While looking into something else, I stumbled upon the slides from Bruce Perens' presentation, AMBE Exposed This is from a TAPR/DCC talk in the fall of 2014. I'm not sure how I missed it at the time.
There is also a video of the talk which I haven't watched yet, on YouTube.
If you are interested in the problem of the patent encumbered CODECs that are used in DMR/MotoTRBO, APCO P25, D-STAR, and Yaesu System Fusion that keep developers from delivering the capabilities we'd like in our radio software/firmware, give this a read.
The presentation is 57 slides and chock full of background information.I'm going to keep this filed for when questions come up about why we can't do this or that without buying a dongle or using some limited software from anonymous authors.
This comes up over and over. Why doesn't my SDR, scanner, radio do DMR/MotoTRBO, D-Star, P25, etc. Recently this has come up again now that Uniden announced a DMR upgrade (for a fee) to their newest scanners the BCD-436HP and BCD-536HP. These radios already do P25 Phase 1 and 2, but there is a fee for the DMR upgrade to cover both the development costs and of course additional licensing fees to DVSI.
This will probably be of most interest to those that are familiar with and interested in open source.
There are also some good points about innovation usually coming from the upstarts and not the old guard.
Showing posts with label DMR. Show all posts
Showing posts with label DMR. Show all posts
Monday, May 23, 2016
Saturday, February 13, 2016
Read and Backup Tytera MD-380 calibration settings.
On the Tytera MD-380 Yahoo Group, Stan G4EGH, posted that there is a hidden 'Test Mode' in the MD-380 CPS programming software. in this case 'test mode' is used for reading and writing the radio's calibration settings that are usually done at the factory, but might be changed by someone with a DMR-capable service monitor in the field when recalibrating the radio. (This 'test mode' shouldn't be confused with any sort of debug mode.).
The important part about this find is that every radio has calibration settings that are specific to it. Think of it as a tuning/fine-tuning step that is done after manufacturing in order to make sure the radio is performing optimally. This step is necessary because the electronic components all have some tolerance (10%, 5%, 1%) for how close they come to their specified value.
Making a backup of your radio's calibration settings is a good idea. The settings are written into flash memory or EEPROM and could become corrupted or lost. If you don't know what the settings are, and don't have the proper test equipment you might have to send the radio in to be recalibrated.
The procedure to make a backup of your Tytera MD-380's calibration data using Tytera's MD-380 CPS v1.30 programming software is:
Here's are two screen shots from my radio. Unfortunately, I couldn't resize the window to make it all fit:
I've opened an issue in Travis Goodspeed's md380tools github repo to track progress of adding this capability to md380tools.
Hope this helps somebody.
The important part about this find is that every radio has calibration settings that are specific to it. Think of it as a tuning/fine-tuning step that is done after manufacturing in order to make sure the radio is performing optimally. This step is necessary because the electronic components all have some tolerance (10%, 5%, 1%) for how close they come to their specified value.
Making a backup of your radio's calibration settings is a good idea. The settings are written into flash memory or EEPROM and could become corrupted or lost. If you don't know what the settings are, and don't have the proper test equipment you might have to send the radio in to be recalibrated.
The procedure to make a backup of your Tytera MD-380's calibration data using Tytera's MD-380 CPS v1.30 programming software is:
- Close the MD-380 software if you have it open.
- Find the setting.ini file. On a default install, for Windows 7 (64 bit), the file location is C:\Program Files (x86)\MD_380\MD_380\SoftWare_EN\setting.ini
- Edit the settings.ini file with a text editor like Notepad.
- Locate the line testmode=0 in the [setup] section. Change the value to 1. Save the file.
- Start MD-380.exe. Starting it through the normal menu/shortcut is fine.
- Connect the radio with the USB cable and turn it on.
- Hit CTRL-T, to read the data from the radio.
- Click "Save Test Data" which will save a .test file with an 8 KB binary of the calibration data.
- Put the .test file some place safe where you will be able to find it again when you need it.
Here's are two screen shots from my radio. Unfortunately, I couldn't resize the window to make it all fit:
I've opened an issue in Travis Goodspeed's md380tools github repo to track progress of adding this capability to md380tools.
Hope this helps somebody.
Wednesday, January 20, 2016
Reverse Engineering Cheap Chinese Radio Firmware TyTera MD-380 (Shmoocon 2016 via Hackaday)
Cool Stuff:
For those who are interested in the intersection of microcontrollers, hacking, and radio, an interesting deep dive into the firmware of one of the Chinese DMR/mototrbo ($140) radios, the Tytera MD380.
Unlike the cheap analog Chinese radios (Wouxun, Baofeng) which can only be programmed once, this radio supports a firmware upgrade. The bit that is interesting for people who aren't deep into digital electronics is that this hack produced a version of the firmware that turns the MD380 into the first (hardware) DMR scanner. N2NOV has been pointing out the gap, that no scanners cover DMR for a while now.
Note: this exploration/hack is at the experimental stage, so I wouldn't consider this ready/usable/applicable to anyone but those that want to experiment and are willing to risk bricking their radio or worse.
I couldn't resist, so I ordered a Tytera MD-380 this morning. More details to come. So now my To Do list includes, learning about DMR/MotoTRBO, programming NYC area DMR amateur radio repeaters, and finding/joining communities that are covering alternative firmware development for the MD-380.
Out of the box, this radio is supposed to allow field programming (aka front panel programming) of DMR talkgroups.
Travis GoodSpeed's github repo, has a package of command-line Python tools for the MD380. Looks like enough for reading and writing the radio on Linux and Mac OS. Also there is the beginnings of a CHiRP driver for the MD380. It doesn't read/write the radio but can be used for maintaining the analog channels and banks.
Also, hack-a-day, has had some good radio articles lately that aren't that deep into digital electronics for a wider audience.
You might recognize the name Travis Goodspeed from other projects like the GoodFET, an open source JTAG adapter inspired by Dangerous Prototype's Bus Pirate.
Links:
For those who are interested in the intersection of microcontrollers, hacking, and radio, an interesting deep dive into the firmware of one of the Chinese DMR/mototrbo ($140) radios, the Tytera MD380.
Unlike the cheap analog Chinese radios (Wouxun, Baofeng) which can only be programmed once, this radio supports a firmware upgrade. The bit that is interesting for people who aren't deep into digital electronics is that this hack produced a version of the firmware that turns the MD380 into the first (hardware) DMR scanner. N2NOV has been pointing out the gap, that no scanners cover DMR for a while now.
Note: this exploration/hack is at the experimental stage, so I wouldn't consider this ready/usable/applicable to anyone but those that want to experiment and are willing to risk bricking their radio or worse.
I couldn't resist, so I ordered a Tytera MD-380 this morning. More details to come. So now my To Do list includes, learning about DMR/MotoTRBO, programming NYC area DMR amateur radio repeaters, and finding/joining communities that are covering alternative firmware development for the MD-380.
Out of the box, this radio is supposed to allow field programming (aka front panel programming) of DMR talkgroups.
Travis GoodSpeed's github repo, has a package of command-line Python tools for the MD380. Looks like enough for reading and writing the radio on Linux and Mac OS. Also there is the beginnings of a CHiRP driver for the MD380. It doesn't read/write the radio but can be used for maintaining the analog channels and banks.
Also, hack-a-day, has had some good radio articles lately that aren't that deep into digital electronics for a wider audience.
You might recognize the name Travis Goodspeed from other projects like the GoodFET, an open source JTAG adapter inspired by Dangerous Prototype's Bus Pirate.
Links:
- Hack-a-day article: Reverse Engineering Cheap Chinese Radio Firmware from Shmoocon 2016
- Hack-a-day articles in category Radio-Hacks
- PoC || GTFO Newletter with the referenced article,the article is on pages 76-87.
- Amateur Radio Guide to DMR (Digital Mobile Radio) - 28 page PDF introduction by W2XAB
- The DMR-MARC worldwide network - good web site with information about amateur DMR repeaters, and talkgroup listings
- Travis GoodSpeed's github repo
- Travis Goodspeed's blogspot blog, (last update July 2013)
Subscribe to:
Posts (Atom)