Hantek DSO-220

Hantek-branded DSO-220 (firmware 5.x)

Voltcraft-branded DSO-220 (firmware 3.x?)

The Hantek DSO-220 is a USB-based, 2-channel oscilloscope with an analog bandwidth of 20MHz and 60MS/s sampling rate. It was sold under the Hantek and Voltcraft brands and possibly others: Hantek says on their website that "DSO-220 USB ... is mainly exported to America, Europe and many other developed countries through ODM pattern."

There were two versions of the hardware produced, requiring different firmware versions but re-enumerating to the same USB PID. I suspect, but cannot confirm, that a unit's hardware revision is indicated by the style of its case:

Units with a boxy case, as with the Voltcraft unit shown on this page and the "HUITONG" branded unit pictured on Hantek's product page, seem to initially enumerate as 0547:1004 and require firmware in the v3.x series.
Units with a contoured case, as with the one shown in the photographs below and in the mikrocontroller.net teardown, seem to initially enumerate as 0547:1005 and require firmware in the v5.x series. This is the same style of case used by Hantek DSO-2xxx/52xx.

Nearly all information on this page is taken from the unit photographed below, which takes 5.x firmware. (I can load 3.x firmware onto it and it re-enumerates properly, but the LED doesn't even blink like it's supposed to.) The 3.x and 5.x firmwares have significant code differences, judging by a cursory disassembly of them, so it's possible that the innards of 3.x units are quite different as well. Firmware can be extracted from drivers in the same way as for other Hantek scopes (see Hantek DSO-2xxx/52xx).

The DSO-220 may be closely related to the Hantek DSO-2100. Hantek's website has a single product page for both, and the DSO-2100's firmware is quite similar to the 5.x firmware for the DSO-220, with only a few differing pieces of control flow.

See Hantek DSO-220/Info for more details (such as lsusb -vvv output) about both hardware revisions. Notably, after firmware load and re-enumeration, the PIDs and USB descriptors are identical, indicating that both firmwares speak the same protocol.

Hardware

The PCB does not look professionally assembled; both my unit and the unit in the mikrocontroller.net teardown linked below appear to have most components, including SMD ones, hand-soldered. There are clear reworks present, with SMD resistors bridging between through-hole pads on the underside of the board.

Main chip: Xilinx XC95144XL CPLD (JTAG IDCODE 0x59608093) (datasheet)
USB: Cypress EZ-USB AN2131QC (datasheet)
I2C EEPROM: Unknown (marking masked on all photos I've seen)
SRAM (64KB): 2x ISSI IS62LV256L-15T 32K x 8 Low Voltage CMOS Static RAM (datasheet)
ADC: Texas Instruments ADC1175-50 8-Bit, 50 MSPS, 125mW A/D Converter (datasheet)
Analog mux: 74HC4052 Dual 4-channel analog multiplexer/demultiplexer (datasheet)
Crystal: 60MHz
Relay: 4x Forward Relays PS-5 (two per input stage) (datasheet)

There is an unpopulated JTAG header for the CPLD labeled J8. Its pinout is as follows:

+3.3V (pin 1 has a square pad)
TCK
TDI
TDO
TMS
GND

From continuity testing of the board, I have determined the following:

The blue LED (active high) is connected to PC2 of the AN21.
The two outputs (1Z and 2Z) of the 74HC4052 are, unsurprisingly, connected to the inputs (Vin) of each ADC.
Six of the address lines, A[0:4] and A[15], and all of the data lines of the AN21 are connected to the CPLD. A[15] is almost certainly connected to some sort of chip enable on the CPLD, which means that it exposes 32 bytes of registers to the AN21, mapped from 0x8000-0x801f. Disassembly of the Hantek 5.0.0.1 firmware seems to confirm this: the function starting at 0x46 is the interesting one.