My Motorolafunk Infopage
The original
since 2001
General:
All things listed here are generally known, arose from my own developments or are based on experiences reported to me.
Nothing on this website is based on insider knowledge!
I cannot guarantee that the descriptions will function correctly.
Two-way radios from Motorola are very common these days and many old devices are now being phased out. Therefore, here is some information.
As with many other manufacturers in the electrical sector, the willingness to help and the service is not very good and friendly here either (at least if you want to do something yourself), but I don't want to go into detail about that here.
Those who found this site will have experienced it themselves anyway (why bother looking for another source of information?).
There are already some Motorola radio sites, but these are only in English and often only device types that are not/were sold in Europe are discussed.
In addition, nothing can be found about the programming software and its system requirements.
All devices described here must be programmed with special software (RSS) (cannot be found on my web space).
On my link page you can find links where you can download RSS.
Anyone looking for it on the web will always find the right RSS. It's just a matter of the effort and time invested!
Attention:
The Motorola RSS is subject to the copyrights of Motorola (also the ancient programs)!
That's why I advise you to delete downloaded RSS immediately after use.
After all, this is not supposed to be a call to create pirated copies.
However, buying the software is not worthwhile for infrequent use, since Motorola charges 3-4-digit amounts per program.
In addition, the Labtools and Lab RSS are not officially available. Well, as the saying goes: the customer is always the fool.
For radios from other manufacturers, on the other hand, the RSS is usually cheap to buy or free, and there are not many of the problems described here.
My opinion on this:
It is a big mess to charge so much money for such silly configuration programs.
A PIII 800-1000 is best suited, since you can then also
create Windows XP on a D: partition in addition to the C: partition (DOS, Windows 3.11). The boot manager is automatically installed by Windows XP!
The program for deactivating/activating the PC cache can be downloaded here
and is suitable for PCs up to and including PIII. I have not yet found a solution for faster PCs.
Important:
Always start DOS-RSS under DOS to avoid checksum errors when programming!!!
Many RSS programs have a hidden mode (FTR mode) that can only be activated with the help of a dongle (FTR key).
If the FTR mode is activated, the RSS behaves similarly to a LAB RSS. It can also be activated by software modification.
The instructions for this can be found in the respective device information.
Programming cables and the circuit diagram for the universal interface (RIB) as well as further information can be found at Batlabs .
The programming cable and RIB box are extremely expensive, which is why I recommend replicating or constructing these things yourself.
With a little manual skill, all common cables can be produced without any problems.
If you also want to flash devices such as GM/GP1200 or MT/MC2100, you need a modified RIB (MDRLN4008BSP),
or better you build a RIB that has all the modes at once, such as the universal programming interface.
The modified RIB is also suitable for a firmware update or for flashing devices of
the Ariane series (GM350,GM600,GM950,GM1200E).
Tips for making the special connector:
With many devices, you have to make the connector for the programming cable yourself, which is often not easy without the right idea.
A PVC cable duct cover is ideal for this because it is easy to work with and can be shaped after heating.
From this you saw out a piece of approximate size and edit it with a file.
If you need hooks on the plug for attachment, you can mold them directly after heating the PVC over a candle.
A piece of rubber (old bicycle tube) is then glued to the PVC part and the holes for the contacts are drilled through.
The rubber has the task of giving the contacts the necessary pressure.
If the contact pressure is not sufficient, glue 2 layers of rubber on top of each other.
Soldering nails with a collar or small brass nails with a pan head are suitable as contacts, which can simply be shortened to the desired length.
If a screw is required to fasten the plug, it must have an inch thread!!!
These are also often found in PCs.
Attention: If a device falls into the water (not only applies to radio devices), immediately remove the battery and open the device as quickly as possible and let it dry out! Many devices are not adequately protected against water. However, EX-protected devices should be able to withstand water for a short time. Notes on replacement batteries: Not all batteries are the same, many will have experienced this first-hand. The quality mainly depends on which manufacturer supplied the cells!
Furthermore, I had to realize that NiCd batteries of the same design with an extremely high capacity are defective much earlier than those with a standard capacity (cell short circuits or high self-discharge).
The best cells are made by Sanyo. Varta sucks!
GP cells often have a capacity spread of more than 50% between cells of the same design and the self-discharge is relatively high. The rest of the cell manufacturers are pretty much in the middle.
One should therefore prefer replacement battery suppliers who install cells of high quality and are also relatively cheap.
My tip is therefore: Alexander Batteries.
These batteries make even the original Motorola look old. Highest quality at a lower price.
Incidentally, at Alexander Batteries you can also get rechargeable batteries for a wide variety of electrical devices!
This is not intended to be an advertisement for the manufacturer, but here you get good quality.
Mobile devices:
handheld radios:
HT800 and P210
HTX MX1000,2000,3000,MX3000SP (Systems Saber),Saber GP300 GP3XX (GP320/GP330/GP340/GP360/GP365FuG11b/GP375/GP380/GP344/GP388), GP6XX (GP640,660,680, GP1280), HT750, HT1250,HT1550,GP140,GP240,GP280,GP540,GP580 CP040, CP140,CP160,CP180 GP600,PTX600 GP900 ,HT1100,MT6000,VISAR and special shapes(Fug.11b) MOTOTRBO GP1200 MT2100,MT/MTS200 0 MTS2010/MTS2013 P165,P185 S120,S240
repeaters:
Links and tips:
Device descriptions and tips:
Basics:
For most of the radios listed here, the RIB or alternatively my universal programming interface is required. The appropriate programming cables for all devices can be found
in most cases at Batlabs .
Flash cables and special cables are provided with a link under the respective device type.
Tips for radios of the JEDI series:
The devices of the types VISAR,GM/GP900,GM/GP1200(E),M(C/TS)2100 all belong to the JEDI series.
The unchanged data set (native code plug) can therefore be read out with MTSX-LAB or Astrolab to a greater or lesser extent for these types, saved and edited with a hex editor such as Hexworkshop.
An exception to this are the devices MTS2010 and MTS2013.
With these BOS devices, it is not possible to read and write the native code plug!
This is probably due to the slightly different header of the code plug. The length of the code plug is specified in the header in the first bytes. Danger:
Always use MTSX-LAB or ASTOLAB under DOS (start the computer with the DOS boot disk). Otherwise there may be serious errors in the code plug! When editing, make sure that you calculate the checksum of the native code plug beforehand and ensure that it is the same again after editing. The part of the native code plug where the serial number is entered is suitable for correcting the checksum. The correction must be done in blocks because it consists of two parts. The native code plug consists of two parts. The upper part is the internal code plug and the lower part is the external code plug. The tuning data is stored internally and the device configuration externally. The internal code plug ends roughly where the second serial number begins.
The data that has been changed must have the same values both in the internal and in the external code plug!
Important note:
If a device (1) is overwritten with a native code plug from another device (2) (same type and same frequency band are a prerequisite),
the device (1) is no longer correctly adjusted! then do if you have previously printed out the old tuning parameters and entered them again afterwards, or if the device is able to recalibrate!
Emergency rescue without overwriting with foreign native code plug (does not work with GM/GP1200):
If the device behaves like dead (red, yellow, green flashes the LED, possibly error message in the display) and it can no longer be programmed with the normal RSS, it may be that the model number (possibly also the serial number) in
the Native code plug is no longer correct.
In this case, read out the native code plug with MTSX-LAB or ASTROLAB, save it and open it in a hex editor.
The checksum doesn't matter to you, since it's no longer correct anyway!
Compare the model number and serial number (2 times in the native code plug!) with the device and correct them if there are any discrepancies.
Write the corrected file back to the device with MTSX-LAB or ASTROLAB.
If the device still doesn't work, you can load the old code plug (if you have it) with the normal RSS into the radio. After that it usually works again.
If it still doesn't work, you can write the native code plug of a working device (assuming the same design and frequency band) into the defective device with Astrolab or MTSX-LAB.
Caution: When writing the native code plug, an error message appears, which should not be taken into account!
However, this (repaired) device must then be recalibrated afterwards!
It is also possible here to create and program a default code plug with a lab tool.
For the GM/GP900/Visar and GP900 99 channels, this can be found on the web (caution, tuning parameters will be overwritten).
If changes are desired on a functioning device (e.g. expansion from 2 to 16 channels), the checksum must be the same after the change as before the change!
The serial number ranges are suitable as a correction field for the checksum (both native code plug ranges must then contain the same characters afterwards).
Attention, another hint:
A native code plug can also be read from the normal RSS, but it is then not programmed into the radio in the native format during programming. This only works with MTSX-LAB or ASTROLAB!
It doesn't work the other way around, because a normal code plug is not a native code plug!
Tip:
I generally advise reading out the native code plug (with MTSX-LAB or ASTROLAB) and keeping it safe.
In the event of a checksum error that can no longer be rectified in the normal way, an "emergency rescue" of the device is possible at any time (by writing back with MTSX-LAB or ASTROLAB) without subsequent recalibration.
The native code plug can be read on all devices of the Jedi series with the exception of MTS2010/2013.
GM/GP1200 devices flashed with Stage 4 firmware may also not work.
GM300: The GM300 is a 16-channel device that supports various call types, such as single tone, MDC1200 and 5 tone selective call. As RSS there is only a DOS version that runs safely on all PCs (tested up to Pentium 3-400) in DOS mode. More tips on this device can be found at Batlabs .
)
)
GM350:
The GM350 only handles PL and 1 tone call. Otherwise it is quite similar in behavior to the GM950.
A separate RSS is required (the one from the GM950 and vice versa does not work).
The GM350 belongs to the Ariane series, is mask programmed and therefore cannot be reflashed.
FTR mode:
To get into FTR mode, the RSS must be modified!
The following is to be done:
With the 300MHz version, in Wrss.exe, at address 749378 (Dec.), change the character string M_PROGRAM_DEFAULT to W_PROGRAM_DEFAULT.
In addition, at address 111796 (Dec.), the value 7B must be changed to 7C.
In the RSS R03.01.09, in Wgm350.exe, at address 103734 (Dec.), change the character string M_PROGRAM_DEFAULT to W_PROGRAM_DEFAULT.
In addition, the value 75 must be changed to 74 at address 90527 (Dec.).
The unlocked menu item can then be found under "Service" and allows the following:
Programming a default code plug (needed for emergency rescue or if you want to attach a different front (head)).
Programming the serial number (Never enter a default serial number. Otherwise, you may accidentally overwrite the tuning parameters).
Note: When programming a default code plug, the device must be recalibrated!!!
If possible, always write down or print out the tuning parameters beforehand. They can then be re-entered after programming the default code plug.
If the device is read out and then only the serial number is changed, the tuning parameters are not changed!
It is then not necessary to re-enter or recalibrate.
)
)
)
GM3XX(GM340/GM360/GM380),GM6XX (GM640,GM660,GM1280):
This is the mobile device series (Professional Series), which is available in 3 different versions.
Without display, with display, with display and 10-key keyboard. The 10-key keyboard device does not have a built-in speaker, unless you use it as a device with a separate control panel.
Internally, 255 channels can be programmed on GM3XX devices, but not all of them can be called up on the GM340.
Software information, flashover instructions and other tips under GP3XX .
)
)
CM3XX(CM340/CM360): The CM3XX devices belong to the Commercial Series (Marlin series). The CM340 has 10 and the CM360, 100 selectable channels with text display. Internally, 100 channels are possible with both types. They can also be used with the CM340 via the scan function. Both devices have a 5-tone selective call. The device design is a little simpler and more compact than the Waris series. The input circuit is fixed and cannot be adjusted because there are no capacitance diodes. Due to this, these devices have their maximum sensitivity in the middle of the band range. The devices are programmed with the CM3xx, CPxxx RSS, which runs on all PCs with Win95 and higher.
The latest RSS runs on all PCs with Win 98 and higher. However, the menu navigation here is new and takes some getting used to.
The Professional Series Tuner is also required here for adjustment.
A firmware update is also possible for the CM3xx devices.
Upgrade tools and CM3xx Lab Firmware, which is also used with the Lab Flashgrade Tool, are in circulation.
When programming a default code plug, make sure that only "Phase 3 to Phase 3" is used.
The region code is EMEA when using European RSS.
For these devices, the upgrade tips can be found under GP3xx , as there is almost no difference in the procedure.
Only bootstrap mode is initiated as described below.
Note:
The normal programming cable is also used for flashing! In order to carry out a firmware update, proceed according to the following instructions:
Switch on the device and start the upgrade tool. Click on flash device, wait until the EEPROM has been read and a prompt to close the switch appears.
Now remove the programming cable from the microphone socket, switch off the device, bridge the last two right-hand contacts in the microphone socket with a screwdriver and switch on the device.
The keys light up, the display remains dark!
Now all you have to do is plug in the programming cable again and continue the flashing process.
This is the safest way to proceed! I strongly advise against building flash adapters or similar stuff, as accidental use of Waris devices can damage them!
GM600,MCX600: The GM600,MCX600 is an Ariane series trunked radio. A DOS version (looks very similar to the Windows RSS) and various Windows versions are in circulation as RSS. The RSS can also be used for the GP600, PTX600. In Eastern Europe and Asia, the devices are mostly in circulation as MCX600. The Asian MCX600 requires a special RSS. Conventional operation with a maximum of 4 channels is possible, provided the correct network is programmed. To activate the FTR mode on the GM/GP/MCX/PTX600 RSS, the following must be done: With the RSS R00.02.21, the address 84938 (Dec.), 74 must be changed to 75 in the exe file and the address 39054 (Dec.) W to be changed to M.
With RSS R00.05.05, address 85645 (Dec.),74 must be changed to 75 in the exe file and address 95912 (Dec.)W must be changed to M.
In order to activate the FTR mode with the Asian MCX/PTX600 RSS, the following must be done:
With the RSS B00.01.07, in the Win_deal.exe, at the address 95897 (Dec.), 4D must be changed to 4E and at the address 411598 (Dec.) W to be changed to M.
With RSS D04.00.02, 4D must be changed to 4E at address 106172 (Dec.) and W must be changed to M at address 828146 (Dec.) in Win_rest.exe.
The FTR mode allows changing the serial number and loading a default code plug.
Never enter a default serial number. Otherwise it can happen that you accidentally overwrite the tuning parameters!
When loading a default code plug, always note the tuning parameters beforehand and enter them again afterwards if necessary. A firmware update can also be carried out on the GM600. To do this, the flash cable must be plugged into the accessory connector strip. The modified RIB or Unirib is required. Flashing is only possible if the EEPROM for the external code plug is available on the circuit board! However, the missing EEPROM can be easily retrofitted. Among other things, the type 25320 or 95320 is suitable for flashing with the edited GM950 RSS (FTR mode activated), a suitable default code plug in the device to be programmed and then with the GM950 upgrade tool flash.
When using the Unirib, the flash switch (Jediflash) must be switched.
Flashed display devices do not show the first and last digits correctly after flashing!
If you need all 128 channels, you have to swap the LCD display for one from the GM950.
For those who can manage with 10 channels, an alias number can be placed in the 2nd position in the RSS (it will be displayed correctly).
Before flashing the device, always write down the tuning parameters first.
Set the squelch parameters to 22-26 after flashing.
)
GM900: The GM900 is a conventional 16-channel device with 5-tone call and PL. It has excellent reception characteristics. The RSS runs on PCs up to PII when booting DOS with a floppy disk. It is the same RSS used for the normal GP900 and the European VISAR (EVN4143/EVN4140(LAB Version)). The output power can be programmed between 1-25W and it has a built-in speaker. In order to avoid rattling noises caused by acoustic resonance, the plastic cover must be glued to the metal cover with mirror tape. Software modifications (FTR mode activation) are under GP900(HT1100)/VISA
R and special forms (Fug.11b) can be found.
More under: Tips for radios of the JEDI series.
)
GM950:
The GM950 is a conventional device with 5 tone ringing and PL (the big brother of GM350) and belongs to the Ariane series.
The device is available in 3 different versions (as a 2-channel device, as a 128-channel device with a display and as a 128-channel device with a 10-key keyboard and a large display).
The output power can be programmed between 1-25W.
The device has a built-in speaker (except for the 10 key keyboard version).
The programming software runs on all PCs with Windows 3.1 and higher.
The device makes a good impression, but this is marred by the fact that the input sensitivity is a little worse than with almost all other mobile Motorola devices.
FTR mode:
In order to get into FTR mode, the RSS must be modified!
The following has to be done:
With version R02.00.00 in GM950.exe, at address 976896(Dec.), the character string M_PROGRAM_DEFAULT has to be converted into W_PROGRAM_DEFAULT.
The unlocked menu item can then be found under "Service" and allows the following:
Programming a default code plug (needed for emergency rescue or if you want to attach a different front (head)).
Programming the serial number.
Never enter a default serial number. Otherwise it can happen that you accidentally overwrite the tuning parameters!
With the GM950plus RSS version R05.00.02 at address 1107018 (Dec.) M_PROGRAM_DEFAULT must be converted to W_PROGRAM_DEFAULT.
A notice:
When programming a default code plug, the device must be recalibrated!!!
If possible, always write down or print out the tuning parameters beforehand. They can then be re-entered after programming the default code plug.
If the device is read out beforehand and then only the serial number is changed, the tuning parameters are not changed!
It is then not necessary to re-enter or recalibrate.
A firmware update can also be carried out on the GM950!
To do this, the flash cable must be plugged into the accessory connector strip. The modified RIB or Unirib is required.
Known firmware errors in old software versions:
Operating the radio during an incoming selective call leads to a crash.
Another control panel (head) can only be attached from N2 to N3. N4 devices (keyboard and large display) have different hardware and firmware!
)
)
)
GM1200(E):
The GM1200 is a trunked radio that can also be used as a conventional device.
In the conventional mode you only have 10 channels available. However, a 5-tone call is not possible, only PL.
The devices are available in 3 different versions (without display, with display, and with large alphanumeric display and 10-key keyboard).
A built-in loudspeaker can only be found in the first version, which can also be used here only after the device housing has been glued to the sheet metal cover.
The GM1200 is also available as the GM1200E. This is said to have 128 conventional channels.
The GM1200E does not belong to the JEDI series but to the Ariane series, it is a descendant of the GM950 (N4)!
A firmware update can also be carried out on the GM1200E.
To do this, the flash cable must be plugged into the accessory connector strip. The modified RIB or Unirib is required.
When using the Unirib, the flash switch (Jediflash) must be switched.
Flashing into a GM950 (N4) does not work!
The output power can be programmed between 1-25W.
GM1200 and GM1200E each require their own programming software, which runs on all PCs.
GM/GP1200 RSS runs from Windows 3.1.GM1200E RSS runs from Windows 95!
With Windows 2000, Windows NT and XP it can happen that the RSS GM/GP1200 RSS does not run!
hints:
A service password must be entered to access tuning mode.
The password is: DPS*SERVICE
The GM1200 belongs to the JEDI series. This makes it possible to read the native code plug and change it with a hex editor.
Caution:
Never change the serial or model number on devices with Stage 4 firmware, or load a default code plug (toolproof error)!!! Note: With the old DOS RSS (e.g. GVN6008K), you can create a default code plug (in native format; native code plug) for GM/GP1200 and program it with MTSXLAB or Astrolab. However, this is only necessary if the device no longer wants to be programmed in the conventional way, or if you want to change the serial numbers (serial number and ESN).
The numbers can be found under "Service Aids", ESN and Internal Codeplug.
In order to also be able to enter the ESN, the MPTR0303.obj file must be edited in the GM/GP1200 DOS RSS (R03.03.00) at the following addresses (Dec.): 211413 211517 211621 for these 3 addresses the value
is
91
through
90 to replace.
Programming the device directly with this code plug does not change the numbers!
The code plug must always be saved on the hard disk first and then programmed with MTSX or Astrolab! More on this below in the text.
If you only want to change the serial number, this is now easier to do. Simply enable FTR mode!
Bei der Windows RSS R00.01.10 ,ist in der DPS12dw.exe bei der Adresse 82741 (Dec.) der Wert B1 in B2 umzuändern.
In der W_dealer.de muß bei Adresse 153566 (Dec.) die Buchstabenfolge WFM in MFM geändert werden.
Wird auch der englische Text gewünscht,so ist in der W_dealer.en bei Adresse 171693 (Dec.) auch von WFM in MFM zu ändern.
Achtung:
Wenn mit MTSX- oder Astolab ein neuer Native Codeplug programmiert werden soll,der nicht aus dem zu programmierenden Gerät ausgelesen wurde, so sind vor dem programmieren unbedingt alle Tuningparameter auzudrucken oder zu notieren.
Wird Dieses nicht gemacht,so ist hinterher das Gerät neu abzugleichen!!!
Firmware updates can also be made for these devices, but this requires a modification of the RIB (universal programming interface or modified RIB is required).
The current firmware version is displayed by pressing the key combination 102#8.
However, this is only possible for devices with a display and keyboard.
I have now also succeeded in releasing the FTR mode for the GM1200E RSS.
In order to do this, the exe file in RSS R00.01.05 must be changed at address 89340 (Dec.),74 to 75 and at address 1212204 (Dec.) W to M.
The FTR mode allows the serial number to be changed. It is also possible to load a default code plug.
Before programming a default code plug, always write down the tuning parameters!
If necessary, these can then be entered again afterwards.
Flashback instructions for GM1200
Further information under: Tips for radios of the JEDI series:
MC2100,MCS2000:
The MC/MCS is a device from the Jedi series. Depending on the type, the devices have up to 250 channels that can be programmed.
The 2100 series RSS is required for programming. It runs on all PCs when booting DOS with a floppy disk. The RSS to be used is GVN6011M.
Alternatively, there is also the Wookie Mobius Lab RSS, which runs under Windows (from 3.1).
This RSS has a clearer menu structure and allows the model number and serial number to be changed easily.
The patched version of this runs on all PCs.
These radios also belong to the JEDI series (type Skywalker).
The devices have an open architecture and can be reflashed with the upgrade tool.
It is also possible to flash American MCS2000 Flashports into MC/MCS2100 devices, provided they have the same band ranges and external characteristics (The 2100 Series RSS only supports the 4m, 2m and 70cm band)!
The procedure here is the same as described here: Flashing instructions for devices of the Jedi series with open architecture
In this way, a toolproof error can also be eliminated and the hated SMARTRIB is not necessary for this either. Only the universal programming interface is required.
)
)
)
M110/MC-Micro: The MC-Micro is available in many different variants (control panels) as conventional and trunked radio devices. It does not have a built-in loudspeaker! For these devices you need a special programming cable that is connected to the PC without an RIB. The devices (MC-Micro and M110) are both optically similar. However, both types require their own software, which requires a slow PC (less than or equal to 386-25 without a FIFO interface). The MC-Micro software is difficult for beginners to use due to the strange menu navigation. Also for the MC-Micro in the trunked radio version, we need our own trunked radio RSS. However, this RSS does not allow any conventional channels!
If you want to use an MC-Micro trunked radio for amateur radio, the firmware EPROM must be exchanged for a special Afu firmware. An RSS is then no longer required.
The firmware and further information can be found here .
MC-Micro and M110 must be adjusted after programming the channels! The switching bandwidth is only small, approx. 2-3 MHz. This means that the lowest and the highest frequency may be max. 3MHz apart.
The device must be opened for adjustment. In most cases it is sufficient if the pre-circuits and the RX/TX PLL are adjusted again.
Instead of the normal microphone, the MC-Centro operating station can also be connected to the MC-Micro.
This is also programmed with the MC-Micro RSS.
)
Maxar: The Maxar is an old quartz device that resembles an old CB radio. It is not very common. The device is quite confusing in structure (wiring) and has problems with the frequency stability at low temperatures. This has also only been insufficiently improved in newer versions. The classic Motorola fist microphone is used as a microphone, but its internal structure (dynamic design) differs fundamentally from the newer ones. The switching bandwidth, when using several channels, is only small and amounts to approx. 3MHz.
)
Staccato: The Staccato is an old, somewhat strange radio device. It consists of the controller part of the Storno CQM6000 and the HF part of the MC-Micro. The device was only manufactured in small numbers.
It is programmed with a special interface (GTF-323).
)
)
HT800 and P210: These devices belong to the Genesis series. The devices are very robust and reliable. The keys are large and easy to use even with gloves. The keys have a tactile pressure point. The devices are also available with a keyboard (unwieldy and large). However, the disadvantage is that they do not cover the entire 2m band (146-174MHz) or 70cm band. There are 3 different frequency ranges for the 2m band: 136-151MHz, 146-162MHz and 157-174MHz. In the 70cm band there are even 4 different versions: 403-433MHz, 438-470MHz, 470-500MHz and 488-520MHz. The same software is required for both device types (P210 and HT800).
The only difference between the HT800 and the P210 is the housing. Inside there is no difference!
The old development software runs on all PCs up to Pentium 1.
If an error message occurs during programming, this should be ignored!!!
The newer software versions only run on a PC smaller than or equal to 386-25 without a FIFO interface.
With these versions, the code plug may have to be converted because it has a larger format. This is only necessary if there is still an old (smaller) code plug in the device.
The devices are available as 2, 8 and 16 channel versions. The devices can be expanded to as many channels as the channel selector switch has positions.
To do this, pull off the button and remove the lock in the button with a knife. Now the maximum number of channels needs to be specified in the software (this only works with the old development RSS).
)
HTX: The HTX is mostly an old trunked radio that can actually only be used for exploitation. A current firmware update cannot be carried out and therefore does not support all trunked radio channels that are used today. It cannot be programmed with conventional channels unless it is a trunked radio. The HTX is also available as a conventional radio. However, it was not used in Germany. It has also been referred to as the Storno CP1000/HTX. I can't say yet whether it is possible to flash it to a CP1000/HTX. In any case, the device has a flashrom. The programming cable listed below is not suitable for flashing the application program!
I don't have any information about the flash cable yet.
)
)
)
MX1000,2000,3000,MX3000SP (Systems Saber),Saber:
This series is the European version of the Saber series (Saber I,II,III).
Actually the best handheld radios Motorola has ever made.
The part lies well in the hand, can be worn on the belt without being disturbing (because it is very flat) and has a clear sound.
The buttons are large and easy to use even with gloves.
The PTT button and the monitor button have a tactile pressure point.
The devices are very robust and reliable and 5-tone call (not with the Saber) is possible.
The devices are available in short and long versions. The long version has a cavity where an encryption module or a mandown switch can also be installed. Information on this can be found in the text below.
A short version body cannot be used for the long version, and vice versa.
The length of the devices essentially depends on the battery. The batteries are available in different lengths and widths (different capacities!).
The MX1000 has 10 channels (Saber I has 12 channels). The MX2000 has 100 channels (Saber II has 120 channels), which can also be divided into 10 zones of 10 (12 for Saber) channels, and a display.
The older MX2000 supposedly only have 70 channels.
The MX3000 has 100 channels (Saber III has 120 channels), which can also be divided into 10 zones of 10 channels (12 for the Saber),
and a display and 10-key keypad. For the MX1000/2000/3000 devices, all 3 Executions only one software necessary.
The same goes for Saber I/II/III.
For Dutch devices, as well as for BOS devices (MX3010/MX3013) and MX3000SP with 256 channels (Systems Saber), there is a special RSS!
The software can only run on a PC smaller than or equal to 386-25 without a FIFO interface.
An exception to this is RSS version R02.04.00 (RSS for the normal European MX1000/2000/3000 devices).
This runs on all PCs (started with a DOS boot disk)!
The RSS of the Saber series and vice versa cannot be used for the MX1000/2000/3000 and MX3010/MX3013!
For fixed operation, there is a special mounting bracket where you just have to plug in the device (Convertacom).
The Convertacom is simply operated on 12V and has (not always) a built-in transmitter amplifier and a hand-held microphone with a display.
Conversion from Saber III to MX3010 or MX3013:
MX3010/MX3013 radios are Saber III radios with Core 6D where a special code plug is programmed.
Only the operating label and type plate are different.
Saber III radios with Core 6D can be easily converted into a BOS radio by overwriting them with the MX3010/MX3013 RSS.
Reconversion is only possible if a suitable Saber code plug is programmed into the device with the MX3010/MX3013 RSS.
Band Limit Extension:
Unless one has an RSS where the band limits extend beyond the normal ranges, the RSS must be modified.
This is necessary, for example, for Afu operation. The band limits can be expanded by approx. 5 MHz.
With RSS R02.04.00, the band limits in the range 130234 to 130354 (Dec.) must be changed in mx1r0204.exe.
The values are entered in hex. They can be converted using the Hex Workshop Base Converter.
Examples:
146000000 corresponds to 80C8B308
144000000 corresponds to 00449508
174000000 corresponds to 80075F0A
In the Saber RSS (saber.exe) the procedure is the same, only the area where the band limits are to be found is different!
Just search for the values and edit!
Channel Expansion:
The MX2000/MX3000 can be expanded to 105 channels if the channels have not been zoned.
In order to be able to enter the 105 channels, 64 must be changed to 69 in the mx1r0204.exe at offset 111740 (Dec.).
With the Dutch MX2000/MX3000, where the RSS SB01.00.00 is required, 64 must be changed to 69 in dptr0100.exe, at offset 109216 (Dec.).
Saber I can also theoretically be expanded to a maximum of 16 channels. To do this, change the value 0C to 10 at offset 7910 (Dec.) in RSS R07.01.00, the Saber.exe.
The absolute number of channels depends on the additional options used, since the core memory area is very limited.
In order to prepare the channel switch for 16 channels, the button must be removed and the lock removed.
At the moment I cannot say how many channels can ultimately be programmed if no additional options are used.
The Saber III devices can also be expanded if the channels have not been divided into zones.
For this, in the RSS R07.01.00, in the Saber.exe at offset 130643 and 130681 (Dec.), 78 must be changed to a larger value.
However, it should not be possible to program more than 140 channels if there are no other additional options.
I haven't been able to test the modification yet and the created code plug and the tuning values should be checked before programming.
I noticed that there were strange characters in the code plug for more than 120 channels! An improvement is being worked on.
Slot view for additional modules/mandown switches (plug side):
OOOOOOOOOOOOOO O
O O O OO
In the long version of these devices, one sometimes still finds encryption modules or mandown switches.
These additional modules are located at the bottom of the device, directly above the battery contacts.
If these modules are to be removed because the programming does not work or are simply not needed,
the points marked in red in the device must be connected with a wire jumper!
The best way to do this is to unscrew the shielding plate and solder in the wire jumper from below (attention, then note the mirrored base image).
If there is no mandown switch or encryption module there, a bypass module is plugged in. The bypass module contains the wire jumper described above.
)
GP300: A real classic! The device is compact and handy, the keys (except those of the keypad, if available) have a tactile pressure point. The GP300 is available in 2 different versions (PL version and 5 tone version). The devices are also available with a keyboard and display. Each version requires its own programming software (RSS). The RSS runs on every PC up to PIII. Always start the RSS under the correct DOS! The devices are available in 2.8 and 16 channel versions, with and without display and keyboard. Each device can be converted into a display/keyboard device by changing the housing without further changes being necessary!
Apart from band programming, both versions are easy to carry out!
Tips for this can be found on the Batlabs homepage.
The 5 tone devices are available as ROM version 1 and ROM version 2.
With ROM version 1, using all 16 channels, it may happen that the memory space is not sufficient.
However, this only occurs if several options, such as scanning and selective calling, etc., are to be programmed at the same time.
In this case, you can only make a compromise and omit an option, or use fewer channels. With ROM version 2, the memory space is usually sufficient.
It is possible to turn any device into a 16-channel device (pull off the button and cut off the locking tab), if the firmware allows it.
The newer PL devices (from Bj.94) cannot be brought to more channels than intended.
With the 5 tone devices it is unrestricted, as far as I know.
Detailed instructions for expanding the PL devices can be found on the Batlabs website.
The best way to expand the 5 tone devices is to use the "GPTOOLS" software.
However, the software only runs on a PC that is smaller than or equal to 386-25 and does not
have a FIFO interface.
Here's a guide in English (for 5 tone devices), which I once sent to Batlabs:
Data 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F
Add.
0000 == == == == == == == == == == 00 == 17 00 00 03
0010 01 95 3A 3A 3A 3A 3A 3A 3A 3A 7A 7A 7A 7A 7A 7A
0020 7A 7A 06 06 06 06 06 06 06 06 38 02 2D 1D 1A 18
Example for VHF 25kHz radios:
Add.0000/Data 00-09 serial number(Type in Hex)
Add.0000/Data 0B max.channels to set: 19 for 8 channels max.
02 for 16 channels max.
For editing the serial number,convert your ASCII characters,that you wanted
to set instead the serial number ,into hex.characters and write back to table.
To expand the max.channels from 8 to 16,change Add.0000/Data 0B from 19 to 02.
Edit only the == marked fields!
The example codeplug could be different in some fields from yours,because
this example is a default codeplug,for a 146-174MHZ/25kHz radio.
It will work with all frequency ranges (UHF radios too).
For other radios you must set this:
VHF 12.5kHz: VHF 25kHz:
for 8 channels:0D for 8 channels:19
for 16 channels:07 for 16 channels:02
UHF/low 12.5kHz: UHF/low 25kHz:
for 8 channels:0E for 8 channels:1A
for 16 channels:05 for 16 channels:06
UHF/high 12.5kHz: UHF/high 25kHz:
for 8 channels:0F for 8 channels:1B
for 16 channels:04 for 16 channels:03
The Toolkit software (not developed by Motorola) is used for modifying the GP300 PL devices . This software only runs if you insert a wire jumper (Pin6/Pin10) on the parallel interface. Don't forget to pull the channel selector button off and remove the lock with a knife!
)
)
)
)
)
)
)
)
GP3XX (GP320/GP330/GP340/GP360/GP365FuG11b/GP375/GP380/GP344/GP388),GP6XX (GP640,GP660,GP680,GP1280):
These handheld radios belong to the Professional Series.
There are the following devices: GP320, GP330, GP340, Gp360, GP365FuG11b, GP375, GP380 and the smaller GP344, GP388.
All devices, except GP320, GP330 and GP340, can be programmed with 255 channels.
The GP340 has 16 channels and 255 fictitious channels. Fictitious channels cannot be selected directly.
However, they can be used in scan lists etc. This allows the actual number of channels to be increased to a limited extent.
The device is compact and handy. The buttons have almost no tactile pressure point and, with the exception of the PTT button, are difficult to feel. Operation with gloves is therefore somewhat problematic!
The GP334/GP338 are also very thick with the standard battery.
The software runs on all PCs with Windows 95 or higher.
The software also supports the mobile GM3XX devices and is very extensive in the menu items.
An additional tuning software (Professional Series Tuner) is required to tune the devices.
To configure the BOS GP365 FuG11b, which has been available since the end of 2003, a special RSS is required that only changes the channel assignments on the option board. The device itself is a GP360.
By deactivating the options board in the RSS, it can be used as a normal GP360.
The GP365 FuG11b replaces the GP900 FuG11b, which has been discontinued since July 1st, 2004.
hints:
I also advise you to print out all the tuning parameters and keep them safe.
If the device, for whatever reason, is dead or can no longer be programmed in the conventional way, you can enter the old values (in the tuning software) again by hand after an "emergency rescue".
It can also happen that the device is dead after normal programming. In this case, trying to program again and if nothing works, only the "emergency rescue" will help.
Software errors often occur with this series of devices, since there is usually still old firmware in the device that has errors!
It is recommended to always use the latest software version (RSS).
Old RSS versions are usually no longer usable for devices with newer firmware! You no longer need the RIB for this series of devices! You can also use the so-called RIBless Cable. A firmware update is possible for the GM/GP3XX series. There are 4 different Flashtool types, for conventional handheld radios (ENVN4019), for trunked radio handsets (ENVN4018), for conventional mobile devices (ENVN4026) and for mobile trunked radio devices (ENVN4027). For flashing, the "Bootcontrol" contact must be grounded when prompted by the upgrade software (Flashgrade). Simply solder a switch to the programming plug, you can then save yourself the flash adapter.
I only recommend a firmware update if there are any errors in the old firmware.
When upgrading, there is always the danger that after a PC crash or similar, the device will behave as if it were dead and it can only be brought back to life by an "emergency rescue".
However, if you use the upgrade tool ENVN4019Y (or newer) you don't have to worry much, as this tool allows the firmware to be reloaded in the event of an abort.
My tip:
Before doing a firmware update, always first read out and save the tuning parameters with the tuner program!
The temperature compensation parameters must be read out and written down by hand (but you can also append to the file name)!
If the update fails, you can re-enter or reload the values after the emergency rescue. Note: If you want to load older firmware into the device, or you want to load the device again with the same firmware, proceed as follows: In one of the areas marked red in the example, enter the software version of the firmware that is in the Device is (example in green) on. If the device is to be loaded again with the same firmware, the software status of the upgrade tool itself must be entered here. The software version number can be found in the menu under Help for the upgrade tool. The software status of the radio can be read out under device information. A checksum does not need to be corrected after editing.
The green block is just an example of what the entry should look like.
Warning:
When loading older firmware, you must always ensure that you do not downgrade from phase 3 to phase 1/2.
However, an upgrade from phase 1/2 to phase 3 is possible without any problems!
Phase 1/2 corresponds to firmware R01.xx.xx/R02.xx.xx. Phase 3 corresponds to firmware R03.xx.xx
Example from file "upgradetool.exe"(R02.00.27):
D p¦D t¦ D x¦D |¦D €¦D „¦D ˆ¦D Œ¦D ¦D ”¦D ˜¦D R01.00.04 R01.00.05 R01.00.06 R01.00.07 R01.00.08 R01.00.09 R01 .00.10 R01.00.11 R01.00.12 R01.00.13 R01.00.14 R01.00.17 R01.00.18 R01.00.19 R01.00.20 R01.00.21 R02.00.18 R02.00.20 R02.00.27 0 pln_vhf.0 pln_vhf.mot H25KDC9AN0 pln_uhf.0 pln_uhf.mot H25RDC9AN0 pop_lb1.0 pop_lb1.mot H25BEC9AN3 pop_lb2.0 pop_lb2.mot H25CEC9AN3 pop_vhf.0 pop_vhf.mot H25KDC9AN3 pop_uhf. 0 pop_uhf.mot H25RDC9AN3 pop_uhf2.0 pop_uhf2.mot H25SDC9AN3 pre_lb1.0 pre_lb1.mot H25BEF9AN5 pre_lb2.0 pre_lb2.mot H25CEF9AN5 pre_vhf.0 pre_vhf.mot H25KDF9AN5 pre_uhf.0 pre_uhf.mot H25RDF9AN5 pre_uhf2.0 pre_uhf2.mot H25SDF9AN5 prek_lb1.0 prek_lb1.mot H25BEH9AN6 prek_lb2.0 prek_lb2.mot H25CEH9AN6 prek_vhf .0 prek_vhf.mot H25KDH9AN6 prek_uhf.0 prek_uhf.mot H25RDH9AN6 prek_uhf2.0 prek_uhf2.mot H25SDH9AN6 Motorola Professional GP300 Series FlashGrade FlashGrade - Labtool version, MOTOROLA Internal use only COM%1d ENVN4019E Version: R02.00.27,
If you have changed the file and entered the software version of the upgrade tool yourself, it is now possible to flash a device again and again, even if the device now has the same software version as the upgrade tool!
As can be seen from the entry from "upgradetool.exe" (blue lettering), there is also a LAB version of this.
This can make the "emergency rescue" much easier (without a 2nd functional device and complex construction of RIBless cables).
The LAB version is in circulation, but there are two different versions of it.
However, the 1st version (service tool) usually only runs with the associated dongle (Sentinel from Rainbow Technologies).
In order to bypass the dongle in the service version, the hex. numerical value must be changed from 75 to 74 at address 60014 (Dec.) and from 75 to 74 at address 53851 (Dec.).
The service tool has a smaller range of functions than the lab tool. It is only possible to flash the firmware with this.
However, the range of functions can be expanded by changing the value 84 to 85 at address 59377 (Dec.).
To improve the overview, address 272102 (Dec.) can be changed from 0000 to FFFF.
The 2nd version (Labtool) basically works without a dongle.
With it it is possible to flash the firmware and to program the respective code plug.
A special firmware is required to use the lab tool and the service tool (the normal flash tool does not work!).
The files for the Lab Flash tool are all in S-Record format and have the file extension .0.
I managed to reconstruct this firmware (it is also necessary to convert the code plugs, which is very easy).
The code plugs are the normal files (from the upgrade tool) that are converted into S records (S19).
All S-Rocords must be created with 30 bytes per string!
After the conversion, only the first header in the files has to be deleted afterwards.
Afterwards the file designation is changed (can be taken from the Upgradetool.exe with the text viewer!).
With the firmware file it is much more complex and can only be done if you know the file structure exactly.
This file is also an S-Record file, but it consists of individual blocks with non-continuous addresses.
The biggest problem, however, are the address blocks in the still binary War5t.mot file, which all have to be laboriously removed by hand before the conversion (very time-consuming and error-prone).
With the newer upgrade tools, the firmware and the code plugs are encrypted. However, they can be decrypted with the US CP-FW program and then copied out of the internal RAM with HxD.
However, the latest files can now all be found on the web using the lab tool (EU Waris Lab upgrade kit for GMGP3xx and GMGP6xx).
The current status is R03.10.02.
The Lab upgrade tool is also ideal for flashing GM/GP6xx and GM/GP12xx into conventional radios! Even the GP1280 can be reflashed into a fictional GP380! To reflash, proceed as follows: First you need the LAB upgrade tool with firmware and code plugs. Flash adapters are also needed (you can also install a switch in the RIB) and of course the appropriate cables and a normal RIB. The modified RIB is not required for this, but the Unirib Rev.3 circuit can also be used because it can be used universally (there is also a flash switch for the Waris series that replaces the flash adapter).
Before flashing, the device is first read out with the tuner and the file is saved.
Always read and note the temperature compensation data for each device (can also be attached to the file name).
Now the Lab Upgradetool is started, the GP or GMxx firmware and the code plug are loaded.
For GP devices you use the Lab Firmware ENVN4019S (is no longer the newest).
For GM devices, the Lab Firmware ENVN4026H is used (it is also no longer the latest).
The code plug is to be selected according to band range (only the original band range is possible) and model.
Example: GP640 corresponds to GP340, GP660 corresponds to GP360, GP680 corresponds to GP380, GP1280 does not correspond to a regular GP3xx device, but can be reflashed to GP380special. The same scheme is to be followed for GM6xx.
Once the files have been loaded, the code plug is now programmed into the device.
The following must now be activated:
"Phase 1/2 to Phase 3" if the device has firmware R01.xx.xx/R02.xx.xx in it. Otherwise "Phase 3 to Phase 3".
Only "Write hardware codeplug","Write application codeplug" is ticked off!
After programming, "Codeplug error" appears on display devices. Disregard, does not disturb.
Now the firmware is flashed, the procedure is as follows:
switch off the device, disconnect the battery or power supply, then reconnect the battery or power supply.
Now turn on the flash switch (boot control to ground) and turn on the device. If you have followed this sequence,
After the flash process is complete, switch off the flash switch (boot control open) and remove the battery or briefly interrupt the power supply. After switching on, the device is now a GM/GP3xx.
Now the region code is set to EMEA, the serial number is entered with the tuner and the tuner data is written back.
Then enter the temperature compensation data (they are not set automatically).
If you forget to write them down, simply set the temperature compensation data to 00000000, reload the tuning data set and program it into the device.
Now the device can be programmed with the GM/GP3xx RSS.
To flash the GP1280, you have to create a special code plug for the Lab Flash tool if you don't already have this special code plug.
But it is now in circulation.
In order to be able to program the device afterwards, a new .exe file must be created.
To do this, the GP300.exe file is copied to a new directory and renamed to GP300(GP1280-GP380).exe .
Now use a hex editor to look for H25RDH9AN6 and change this model number to H25RDN9AN8.
For the 2m version, H25KDH9AN6 must be changed to H25KDN9AN8.
Then the file is copied back into the GM/GP3xx directory.
After starting the program with the GP300(GP1280-GP380).exethe device can be programmed without restrictions, except for the function keys.
Should this type ever be officially available, it will also be possible to program the function keys with the current RSS.
If you want to use a keyboard housing or control panel with display and 10-key keyboard on a device that did not have this feature before, you only have to program a suitable code plug with the Lab Flash tool.
An exception to this is the GP320, GP340 as it does not have a channel selector switch or one with only 16 positions.
The region code can be changed with the Labtool, but also with the normal Flashtool (if it has been edited).
This can be done with all radios of the Professional Series.
This also applies to the American models!
The region code for Europe is EMEA.
This is how the Lab menus are enabled with normal upgrade tools :
In order to find the right places that need to be edited with all upgrade tools, proceed as follows:
With Hexworkshop, search for the value 01E1 from the beginning of the file. Then in the direction of the beginning of the file (i.e. directly above),
find the first value 0F84 and change it to 0F85.
Then search for FFFFFFFF0A8000000A80 and change it to 0000FFFF0A8000000A80.
Now all you have to do is search for FFFFFFFF0F8000000F80 and change it to 0000FFFF0F8000000F80.
This method only works with the old GM/GP3xx and GM/GP6xx upgrade tools!
Caution:
Never try to flash a working device with this lab tool unless you have the correct, associated code plugs and firmware files!
Even with the edited, normal upgrade tool, only program Lab code plugs!
The normal upgrade code plugs can, however, be converted into lab code plugs as described above (only works with the old upgrade tools).
Please note! Otherwise the device will no longer be functional afterwards.
Attention:
All devices of the Waris Portable series, which were delivered after January 1st, 2005, have a modified hardware (Lazarus)!
As a result, after programming a new code plug with the Lab Flashtool, there may be a frequency offset in the receiver!
The only remedy is a code plug with a higher Super Tanapa revision.
Revision A is mostly code plugs for the old hardware. Revision B/C/D are for the new hardware.
Note: Newer firmware versions can reduce the service life of the EEPROM. In order to avoid this, enter the value 20 in the RSS under configuration bytes for byte 3! Further information about the affected firmware versions can be found in the readme.txt of the original, current upgrade tools. Known problems with old upgrade tools and the Lab upgrade kits: With newer PCs and operating systems, it can happen that the FL0 Sync error is displayed when flashing.
In this case, it is best to use a PC (up to PIV) with Windows XP.
Sometimes it also helps to deactivate FIFO in the RS232 parameters.
I advise never performing a firmware update with the highest baud rate! It is best to do this with the lowest baud rate and RIB. Always read out the tuning parameters from the device and keep them safe (also read out and note down the temperature compensation data)! If an emergency rescue is necessary, the parameters can then be easily re-entered afterwards without having to make a new adjustment! Code plug password: If the device has been provided with a code plug password, the code plug can simply be overwritten with a default code plug!
In the meantime, however, modified versions are also available where the password can also be read out or deleted.
Professional Series Global Tuner:
The tuner is required to tune American and European Waris devices.
Marlin, Guppy and Piranha devices (CMxxx/CPxxx) are also compared with this.
In addition to the comparison, the serial number can be entered.
This is normally only possible once if none has been entered in the device. If a number is available, no new number can be entered.
In the meantime, however, modified tuner versions are also available where this is possible.
Always read and note the temperature compensation data for each device (can also be attached to the file name).
HT750,HT1250,HT1550 are the American Professional Series devices with MDC. The GP140 is a European MDC device.
They also belong to the Waris series. They have different firmware and require a different RSS than GP320, GP340, GP360 and GP380.
HT750 and HT1250 and GP140 have a smaller FlashROM and therefore cannot be flashed with GP3xx firmware.
With the SMARTZONE (GP540,GP580) and PRIVACY PLUS (GP240,GP280) devices, flashing to GP3xx 5-tone is possible.
The HT1550 has a larger FlashROM and can also be flashed into a GP1280 or pseudo GP380!
The instructions can be found under "umflashen GP1280-GP380".
If you have a HT750, HT1250 or GP140 with a small FlashROM that has a checksum error, you have to use other Lab firmware files/code plugs than the GP340, for example.
The normal Lab Flashgrade can be used to flash the firmware.
However, it is not suitable for programming the Lab Codeplugs!
For this you can use the old ENVN4019A upgrade tool edited into the lab mode. The Lab firmware file and code plug can be read out directly as S-Records by making a firmware update with a working device, not exiting the program and reading out and saving
the primary memory of the PC with ( Winhex RAM Editor). The 2nd S-Records block is the code plug, the 3rd S-Records block is the firmware!
The respective S-Records can then be easily isolated from the file and saved in individual files.
In the meantime, however, there is also a complete kit in circulation (US Waris Lab Upgradekit) that makes the whole thing a little easier.
The current status is R03.09.05.
Caution:
Never try to flash GM/GP3xx and GM/GP6xx to HT750, HT1250 or GP140!
The firmware addressing is different due to the lack of a FLASHROM and the device does not work afterwards.
Flashing back is very difficult due to the different code plug structure. If necessary, flash the ENVN4019S Lab firmware and then try to program an ENVN4019S Lab code plug (hardware code plug only).
If the code plug cannot be programmed, try again!
Code plug error or an LED that flashes red briefly:
If you have a device that displays CP Err or flashes red briefly after attaching the battery and then switching on, you can try the following:
Take a working device and first update the current firmware (if not already happened).
Now you start the firmware tool again and only stop after it is displayed that you should switch on the flash adapter.
You don't do this at first and replace the functional device with the defective one. Only now do you follow the instructions
from the upgrade tool. The upgrade tool then issues a message that you have replaced the device (just ignore it and cancel the upgrade process).
Now detach the device from the programming cable, briefly remove the battery and switch on the device. The code plug error should now be eliminated.
Note:
Only the RIB, the flash adapter and the programming cable are required to flash these devices.
When using the Unirib, switch all switches to the "normal" position and switch on the Waris flash switch when prompted to flash. The flash adapter is then not necessary.
)
)
CP040,CP140,CP160,CP180:
These are Commercial Series handheld radios.
In Germany only the devices of the Guppy series (CP040) are sold as 4 and 16 channel devices.
The devices of the Piranha series (CP140, CP160, CP180) can only be found in Eastern Europe.
As the price and the first impression suggests, they are not among the best that Motorola has ever made.
The maximum volume and sound quality is not very high and the input sensitivity could be a bit better.
The keys have a tactile pressure point, which could be clearer.
The devices have PL/DPL, but they do not have a 5-tone selective call.
The devices are programmed with the CM3xx, CPxxx RSS, which runs on all PCs with Win95 and higher.
The latest RSS runs on all PCs with Win 98 and higher. However, the menu navigation here is new and takes some getting used to.
The Professional Series Tuner is required for synchronization.
A firmware update can also be carried out on this device. The bootstrap mode is activated on these devices
by applying -9 volts (over 1k ohms) to the frontmost contact of the 2.5mm jack plug.
Firmware upgrades/downgrades or any emergency rescues or model changes can be made with the US Waris Lab firmware code plugkit. Notes on this can be found here :
)
GP600,PTX600: The GP600,PTX600 is a trunked radio that looks very similar to the GP300. A DOS version (looks very similar to the Windows RSS) and various Windows versions are in circulation as RSS. The RSS can also be used for the mobile GM600,MCX600. The device CPU is mask-programmed, so it is not possible to flash the devices. Conventional operation with a maximum of 4 channels is possible, provided the correct network is programmed. In Eastern Europe and Asia, the devices are mostly in circulation as PTX600. The Asian PTX600 requires a special RSS. To activate the FTR mode on the GM/GP/MCX/PTX600 RSS, the following must be done:
With RSS R00.02.21, address 84938 (Dec.), 74 must be changed to 75 in the exe file and W must be changed to M at address 39054 (Dec.).
With RSS R00.05.05, address 85645 (Dec.),74 must be changed to 75 in the exe file and address 95912 (Dec.)W must be changed to M.
In order to activate the FTR mode with the Asian MCX/PTX600 RSS, the following must be done:
With the RSS B00.01.07, in the Win_deal.exe, at the address 95897 (Dec.), 4D must be changed to 4E and at the address 411598 (Dec.) W to be changed to M.
With RSS D04.00.02, 4D must be changed to 4E at address 106172 (Dec.) and W must be changed to M at address 828146 (Dec.) in Win_rest.exe.
The FTR mode allows changing the serial number and loading a default code plug.
Never enter a default serial number. Otherwise it can happen that you accidentally overwrite the tuning parameters!
When loading a default code plug, always note the tuning parameters beforehand and enter them again afterwards if necessary.
Programming cable for GP600
)
)
)
)
)
GP900, HT1100, MT6000, VISAR and special forms (GP900 Fug.11b):
The normal GP900 (HT1100) and VISAR is mostly a 16-channel device with a 5-tone call.
Both are available with and without a 10-key keyboard.
The RSS required for this runs on PCs up to PII if DOS is booted from a floppy disk (on PCs from PII-400 it may be necessary to switch off the cache in the bios).
It can be used for standart GM/GP900/HT1100 and the European VISAR.
There is also an American version of the VISAR. A different RSS is required for this.
The Gp900 are robust, reliable devices. The keys could have been a bit more tactile though.
The tactile key pressure point is weak or non-existent on the GP900.
If you have the 2-channel version of the GP900/VISAR, you can easily convert it to a 16-channel version by
changing the model number in the native code plug. A list of model numbers can be found in the RSS under the Help "RSS Info" menu item. See JEDI Series Radio Tips for
how to do this . The RSS type to be used is eg EVN4143 or the LAB RSS EVN4140.
GP900 explosion protection:
The GP900 has also been manufactured as an explosion-proof version.
These devices have a maximum transmission power of 1W and require a special battery (very expensive).
The normal battery also fits on these devices, but then it cannot be used to send.
The Ex battery has a 3rd contact, where a voltage for the transmission output stage is also tapped.
After soldering a bridge into the device, it can also be operated with the normal battery.
EVN4143 is also required as RSS here.
GP900-99 channel version (MT6000):
The GP900 is also available as a 99 channel version with 5 tone call and PL.
In England it is mainly found as MT6000.
A special RSS is required for this type of device. The running conditions are the same as for the standard GM/GP900 RSS.
The RSS type for this is EVN4653A or the LAB RSS EVN4602.
I don't know anything about this type of device yet. Probably you can also flash it into an MT2100.
GP900(FuG11b):
The GP900 is also available as a BOS version (Fug 11b). This device has special firmware that is mask-programmed.
A 5-tone call is not possible with this device, but it has 219 channels and PL is also possible.
A special RSS is required for programming (the one for the GM/GP900/5 Ton Visar or GP900-99 does not work).
The channel frequencies can only be changed in factory mode.
This RSS runs on all PCs with Win 3.1, Win95 and Win 98. Win NT/2000/XP does not always work properly.
A password must be entered to access the factory mode. If this is not known,
the DPS.ini must be deleted and NONfUg* used as the password. The password can then be changed again at any time.
This RSS also has an FTR mode (factory programming). This is normally only released with the right dongle.
In order to release the FTR mode, 74 must be changed to 75 in RSS R01.07.00 in DPS.exe at address 349842 (Dec.).
In FTR mode, the serial number can be changed and a default code plug can be programmed.
Never enter a default serial number. Otherwise it can happen that you unintentionally overwrite the tuning parameters!
Caution:
A saved default code plug can overwrite the tuning parameters! Therefore, make a note of the tuning parameters beforehand.
Instructions and more on this under: Tips for radios of the JEDI series.
VISA:
The Visar is a very small and relatively bulky device. The battery life isn't exactly great either and the batteries are expensive.
For the 5-tone VISAR the GM/GP900 RSS is used!
For the American VISAR version the HT1000 RSS!
It is partially equipped with the same modules (HF module) as the GP900 (but as I said, only partially).
The device is very sensitive to shocks and therefore very often defective.
The problems lie in the tiny connectors and in the very thin processor assembly.
With this module, the SMD components are partially coming loose (especially on devices with a keyboard).
Conductor breaks often occur and these cannot be repaired because it is a multilayer board. In this case, only the entire board can be exchanged.
A fall from the table is often enough to cause a defect!
My tip: if the VISAR isn't offered cheaply, or if you got a VISAR as a gift, keep your hands off it!
RSS Hacktips (FTR mode):
If the RSS is edited according to the following instructions, it is possible to change the serial number of the device.
Warning: before changing the serial number, always read out the code plug from the device!
Always enter a correct serial number. Do not use default values!
Otherwise there is a risk that the device will be programmed with foreign tuning parameters and will no longer function properly!
To do this, the following must be edited in the respective ODB file:
In R06.06.00 (German version) Can be found at address(Dec):00482640 to 00482642 (the red marked position is to be replaced by 000000)
""push....D....}...].................#if..........\].. .................... .Z. .......""
2222707573680000000044001111177D1A10145D070000000000000000000000000000000A2369661000BC84080000000000
5C5D070000000000000000 000BBBBBBBBBBBBBBBB00000000 A85A07 000000000004002222
In addition, enter 6C59 at address 481920(Dec.). Only then does the menu text appear for F8 (change serial number)!
In R06.06.00 (English version)
Located at address(Dec):00482048 to 00482050 (replace the digit marked in red with 000000)
""push....D....}...Z.................#if...........[.. .................... XX. .......""
2222707573680000000044001111177D1A10C45A070000000000000000000000000000000A2369661000D4800800000000000
0C5B07000000000000000 0000BBBBBBBBBBBBBBBB00000000 585807 000000000004002222
In addition, enter 1C57 at address 481324(Dec.). Only then does the menu text appear for F8 (old serial number)!
In the GP900 99 channels RSS R01.00.00 (English version):
Located at Address(Dec):00484997 to 00484998 (replace the digit marked in red with 0000)
""push....D....}..Hf.................T.~..........f.. ........ec..dd...... c. .......""
2222707573680000000044001111837D1A10486607000000000000000000000000000000FC54047E1000B0BB080000000000
90660700000000000000000 0065631000646407000000000000 6307 000000000004002222
At this address (573126 (Dec.)), the character string must be changed from 9180 to 9080 .
In addition , enter 1C61 at address 484052(Dec.). Only then does the menu text appear for F8 (old serial number)!
The menu item can be reached under Main;Change/Create/View/F8 after reading out the code plug.
Here the model number (is not necessary) and serial number can be changed.
A Lab RSS can also be found on the web for these devices (GM/GP900/HT1100/VISAR).
This allows the features listed above without editing.
In addition, with this RSS it is also possible to program a default code plug (caution: tuning parameters are overwritten when programming a default code plug).
)
)
GP1200: The GP1200 is available in 2 versions: without keyboard and top display, with alphanumeric, multi-line display and keyboard. The GP1200 are robust, reliable devices. The keys could have been a bit more tactile though. The tactile key pressure point is only weak on the GP1200. Tips: The device can be switched to conventional operation by pressing the small button above the send button for approx. 5 seconds while the device is switched on. holding down. A service password must be entered to access tuning mode. The password is: DPS*SERVICE The GM1200 belongs to the JEDI series. This makes it possible to read the native code plug and change it with a hex editor.
Caution:
Never change the serial or model number on devices with Stage 4 firmware, or load a default code plug (toolproof error)!!!
Note:
With the old DOS RSS (e.g. GVN6008K) you can
create a default code plug (in native format; native code plug) for GM/GP1200 and program it with the LAB RSS versions.
However, this is only necessary if the device no longer
wants to be programmed in the conventional way, or if you want to change the serial numbers (serial number and ESN).
The numbers can be found under "Service Aids", ESN and Internal Codeplug.
In order to also be able to enter the ESN, the MPTR0303.obj file in the GM/GP1200 DOS RSS (R03.03.00) must be edited at the following addresses (Dec.):
211413
211517
211621
for these 3 addresses, the value 91 must be replaced by 90.
Programming the device directly with this code plug does not change the numbers!
The code plug must always be saved on the hard disk first and then programmed with MTSX or Astrolab! More on this below in the text.
If you only want to change the serial number, this is now easier to do. Simply enable FTR mode!
Never enter a default serial number. Otherwise it can happen that you accidentally overwrite the tuning parameters!
With the Windows RSS R00.01.10, in the DPS12dw.exe at the address 82741 (Dec.) the value B1 has to be changed to B2.
In the W_dealer.de at address 153566 (Dec.) the letter sequence WFM has to be changed to MFM.
If you also want the English text, you should also change WFM to MFM in W_dealer.en at address 171693 (Dec.).
The following instructions were sent to me (but not tested myself):
If you press the PTT 5 times when switching on the GP1200, precisely on the second high tone (when the display lighting goes on), you get into a service mode.
The following are displayed one after the other: "Service", firmware version, model no., serial no. and then nothing more.
Warning: If a new native code plug is to be programmed with MTSX or Astolab that was not read out of the device to be programmed, then before programming, all tuning parameters must be printed out or noted. If this is not done, the device must be recalibrated afterwards!!! Firmware updates can also be made for these devices, but this requires a modification of the RIB (Unirib or modified RIB is required). The current firmware version is displayed by pressing the key combination 120#4. 120#6 shows the trunked radio identifier and 120#8 the ESN. However, this is only possible for devices with a display and keyboard.
Flashback instructions for GP1200
For more information see also under GM1200(E) and tips for radios of the JEDI series.
)
)
MT2100,MT/MTS2000:
The MT/MTS2100 is a device from the Jedi series. Depending on the type, the devices have up to 250 channels that can be programmed.
The 2100 series RSS is required for programming. It runs on PCs up to PII if DOS is booted before a floppy disk.
The RSS to be used is GVN6011M. This is also used by the European MT/MTS2000. The American MT/MTS2000 devices need a different RSS!
Alternatively, there is also the Wookie Mobius Lab RSS, which runs under Windows (from 3.1).
This RSS has a clearer menu structure and allows you to easily change the model number and serial number. The patched version of this runs on all PCs
These radios also belong to the JEDI series (type Skywalker).
The devices have an open architecture and can be reflashed with the upgrade tool.
It is also possible to flash American MT/MTS2000 flash ports into MT/MTS2100 devices, provided they have the same band ranges and external features.
The 2100 Series RSS only supports the 4m, 2m and 70cm bands.
The procedure is the same as described here: Flashing instructions for devices of the Jedi series with open architecture
In this way, a toolproof error can also be eliminated and the hated SMARTRIB is not necessary for this either.
Only the universal programming interface is required.
Note:
Older MT/MTS2000 devices cannot always be flashed because they often do not have a flashrom for the firmware.
MTS2010/MTS2013:
The MTS2010/MTS2013 is the BOS version of the MTS2100/MTS2000.
It also belongs to the JEDI series. The MTS2010 is the 2m BOS version and the MTS2013 is the 4m BOS version. A special version is required for the RSS (SDVN4319D).
The device has a special firmware! It also has an open architecture and can therefore be flashed with new firmware.
However, a modified RIB or Unirib is required for this.
The regular upgrade tool for this is called the Motorola 2100 Series FUG Radio Bypass Utility.
With this device, however, the native code plug cannot be read or written with MTSX-LAB or ASTROLAB!
It is probably due to the first bits in the header, where, among other things, the length of the code plug is defined.
This point differs in structure from other JEDI native code plugs. But I don't know more about it yet.
If you want to flash the devices in MT2100, you also need the 2100 Series Lab Upgrade Tool.
Before you start, always first read out and write down the tuning data with the MTS201x CPS!
With the Lab Upgradetool, the appropriate code plug must first be programmed.
For the MTS2010 it is H01KDH9AN7
For the MTS2013 it is H01FDH9AN7
First put the device into bootstrap mode with B. Then select and program the code plug with I and E.
Then switch the device off and on, boot again with B and flash the firmware with N.
Now the device can be synchronized and programmed with the 2100 Series DOS RSS.
)
P165, P185:
These devices were originally intended as an entry-level class for the Eastern European market.
In the meantime, however, they are also offered in Western Europe.
For programming, the Entry Level Radio P1xx CPS is required.
It's a net. Framework CPS, which is similar to the old MOTOTRBO CPS.
Modifications can therefore still be carried out in the same way!
A special USB cable is required for programming, adjustment and firmware updates.
)
S120,S240:
These devices were sold here in Germany as Freenet devices. They are no longer manufactured.
The difference between the S120 and S240 is that the S120 is designed for battery operation and the S240 is designed for battery operation.
The battery device can also be operated with batteries, but then you have to use one battery less and insert a bridge for it.
The devices are pre-programmed with 3 channels (K1=149.25MHz; K2=149.375MHz; K3=149.05MHz)
These devices were also offered with other frequencies in other European countries.
The devices are equipped with PL, which cannot be switched off on the device!
If the device is switched on with the keys pressed, you get to the programming "menu".
One button then switches between channel selection and PL selection, the other then always switches one on.
The 3 channels are displayed via the multicolored LED (red, yellow, green).
The PL tones are beeped. But only 5 are possible!
Deviations in the programming are possible with other device revisions.
I assume it is possible to change the frequencies and turn off the PL with an RSS.
However, the RSS only seems to exist as a LAB version and has not yet appeared anywhere.
Perhaps the devices are also mask-programmed, which I don't believe, however, since Motorola manufactures all newer devices in an open architecture.
More information on this is welcome, I will then publish it here.
)
R100 (MC-Compact): The R100 repeater, also called MC-Compact, is an older device (an MC-Micro derivative) that can be operated as a repeater and base station. If you want to use it as a base station, a Micro or the MC-Centro operating station can be used. If a selective call is desired, the MC-Centro operator station must always be used, as this includes the ring tone generator and evaluator. The MC-Centro operator station is programmed with the MC-Micro RSS. If the R100 is to be used as a repeater, a duplex filter must be installed. This must then be adjusted to the transmission and reception frequency used.
The R100 can only be programmed with 1 channel, whereby the transmit and receive frequency can of course be set individually.
The R100/MC-Compact is combined with the R100 RSS. programmed with the MC-Micro RSS, which only runs on PCs up to 386-25 under DOS.
In order to enable the master mode (lab mode) for the RSS, the R100.com file must be edited at the following addresses (Dec.):
42737 43257 43336 43688
The value 75 must be replaced by 74 for each of these 4 addresses.
The MC-Micro RSS is also available as a Master (Lab) version. It supports all MC-Micro variants, MC-Centro and MC-Compact.
At the moment there is only a 70cm default code plug available. The band limits can also be changed to the 2m range with the help of a hex editor. I cannot yet confirm whether a 2m device will also work with it.
)
MTR2000:
The MTR2000 is a repeater that is available in different performance classes. It has a modular design and is built into a 19" housing. It
can also be used as a base station.
The device is programmed with the MTR2000 RSS. A RIB is not required, because it has an RS232 interface.Firmware
updates are also possible.The MTR2000 Outlaw Flash software is required for this.The software allows the device firmware to be read out and saved.You should always do this before loading the new firmware.
Note:
The brand names used here are registered trademarks
of Motorola, Intel and Microsoft.
E-mail:
Original text
Vielleicht sind die Geräte aber auch maskenprogrammiert,was ich allerdings nicht glaube,da Motorola alle neueren Geräte in offener Architektur fertigt.
Rate this translation
Your feedback will be used to help improve Google Translate
Original text
Contribute a better translation
.svg){kind=small}