The devices of the MOTOTRBO series are devices that are suitable for analog radio and digital radio.Some of the devices listed here are no longer manufactured. Depending on the model, they have various options, some of which can also be expanded later. The devices are reliable and of good quality. The only problem is that devices of the 2nd generation have a customer-specific OMAP Secure CPU installed and a device that has been shot down cannot be restored! The devices are classified as follows:
First Generation MOTOTRBO Devices:DP2400,DP3600,DM3400,DM3600,MTR3000 Second Generation MOTOTRBO Devices:DP1400,DP2400,DP2600,DP3441,DP3461,DP4400(1),SL1600,SL4000,DM1400,DM1600,DM2600,DM440 0, DM4600,MTR3000,SLR1000,SLR5500,SLR5700,SLR8000
The devices of the second generation are divided into the following groups: MOTOTRBO Light :DP1400,SL1600,DM1400,DM1600 MOTOTRBO :DP2400,DP2600,DP3441,DP3461,DP4400(1),SL40 00.DM2600 ,DM4400,DM4600 Repeater :SLR1000,SLR5500,SLR5700,SLR8000
The MOTOTRBO CPS is required to program the devices. The current version is CPS 2.0, but I recommend using CPS 16. Both CPS versions can also be installed in parallel! CPS 2.0 starts very slowly and takes up a lot of space on the hard disk. Modified devices can also not be processed with CPS 2.0. The MOTOTRBO tuner is required to align the devices. The tuner is currently 19.0.
Caution: Always read and save the tuning data first! With devices that are processed in Flashzap mode, the tuning data is always overwritten and must be reprogrammed! Firmware downgrade for devices that can no longer be read/programmed with CPS 16 because a newer firmware has been installed, or in the device: The MOTOTRBO Depottool 14 and the appropriate firmware are required for this! For portable and mobile TRBO Light devices, it is firmware version R01.01.300000 For all other TRBO devices/repeaters of the 2nd generation, it is firmware version R02.09.x 1.) Read out and save tuning data with the tuner! 2.) Switch on the device and bring it into Flashzap mode. The devices canbe switched to Flashzap modesoftware (Motozap) 3.) Start the depot tool, select the Tanapa that matches the device and flash the device. 4.) After flashing, reprogram the tuning data. Reset device password: The device password can be reset. In order to be able to reset the password, the firmware suitable for the CPS and the device must be installed! To reset the password, the menu item "Restore radio" must then be clicked in the CPS. To read password-protected code plugs, the following must be modified in cpservices.dll: With CPS 16 Build 828 EMEA, address 8291 (Dec.) 06 must be changed to 17. For the CPS 16 Build 828 NA, address 8300 (Dec.) 06 must be changed to 17.
For the CPS 16 Build 828 LA, address 8283 (Dec.) 06 must be changed to 17. For the CPS 16 Build 828 AS, address 8292 (Dec.) 06 must be changed to 17. After opening/reading the code plug, any value must be entered in the password field in order to display the code plug. Enable non-approved features in MOTOTRBO Light devices: It is possible with a patched CPS 16 to enable non-approved features, such as Capacity Plus, 5 tone ring, advanced encryption and AES, even on entry-level devices. This patch must be copied into the CPS 16 directory.
How are the features activated and where are they stored?: 1.) The features can either be activated by an EID obtained from Motorola, or as described in point 2.). All features are saved in the userdata.sdf file and can therefore also be used offline later. With CPS 2.0, the file is located under C:\ProgramData\Motorola\MOTOTRBO CPS 2.0 The file is located with CPS 16 under C:\ProgramData\Motorola\MOTOTRBO CPS
2.) But if you prefer it anonymously and free of charge, you can simply tinker a userdata.sdf with CPS 2.0. You can then use it for CPS 16. You just have to copy it over. With CPS 2.0, you can use known or guessed serial numbers under the "Licenses/Restore device licenses" menu item, create a userdata.sdf with various features. Only the EM features can be used for EU devices! In order for the features to be activated, the serial number of the device must first be changed to the serial number that matches the desired features. This can be done with the MOTOTRBO Depottool 14. To activate the features, the following menu item must be called up: Activate licenses/device licenses for CPS 2.0 Activate function/device functions for CPS 16 After activating the features, you can reset the serial number to the original serial number.
Flashzap mode SLR5500,SLR5700,SLR8000: The repeater can only be set to Flashzap mode with a jumper plug. For this purpose, a bridge is placed between pin 4 and pin 9 and between pin 18 and pin 24 in the 25-pin Sub-D connector. The connector is then plugged into the Aux port and the device is switched on.
Note: With some repeater types (SLR1000), it is not yet possible to get into Flashzap mode, or to change the serial number!
Device recovery at the hardware level: It is also possible to restore a broken device at the hardware level. It is possible via the depot UART port in the device. In order to activate the depot UART, some test points must first be set to low or High levels are set. The 1.8V connection from the interface can be used for the high level. Use the ground for the low level. The easiest way is to connect the colored points with each other.
At the moment I still don't have the right software for this. A solution is being sought/worked on! The Flashzap II client could be the solution for this, since it is probably also RS232 capable like its predecessor. But I haven't been able to get Flashzap II yet. An upstart kernel may also work to boot the device via the depot UART port.
Device hardware/software: The MOTOTRBO devices of the 1st generation are based on the Texas Instruments OMAP1710 CPU. The MOTOTRBO devices of the 2nd generation are based on the Texas Instruments OMAP L138, OMAP L132 secure CPU and a Wind River Linux . It should therefore be possible for someone with programming and Linux skills to create an upstart kernel.
More info and tools on device recovery are always welcome.
