Lior Elazary KK6BWA

...because this life is yours. Some of it was given to you, the rest you make yourself.

  • Increase font size
  • Default font size
  • Decrease font size
Lior Elazary
E-mail Print PDF

Welcome to my website. Here you will find information on the various project I have for robotics, astronomy, sailing, Holiday display and other misalliances items. You can contact me at:

Random Project/Article

  • Hacking the UV3R
    Ham / Baofeng Radios

    Introduction




    While I was searching around for information for the UV5R hacking I have previously done, I came across some schematics for the UV3R. From a first glance it looked like the CPU could be flashed. In fact, in the schematics it looked like they even left the programming pads on the PCB. The UV3R is very similar to the UV5R, except for its lower power and lack of a good LCD and a keypad. Other then that, the two radios have the same RDA1846 chip that is controlled by a CPU.

    If you want to perform this hack yourself and do not want to read on, you can skip to the DIY Instructions page

    The CPU used on the UV3R is the MC81F8616 which is capable of being re-flashed many times. Better still, the manufacture of the the chip Abov has all the documentations, the compilers and the programmers for this chip.

    Chip Documentation (MC81F8616):
    http://www.abov.co.kr/eng/product/info/view.php?dev=mc81f8816
    C Compiler: http://www.abov.co.kr/eng/tool/hms800_cc.php

    This got me very encouraged since it would be much simpler to hack this radio then removing the CPU on the UV5R; I attempted before. I quickly ordered one from amazon, took it apart as soon as it arrived and traced the programming pads (I did not even use, just turn it on to make sure its not DOA).



    After looking at the datasheets and their USB programmer program, I was able to trace the protocol and re flash the chip using an arduino. As expected, they had the security bit set, so I could not read the original firmware. However, I was able to erase the chip and upload new code. Fortunately it was not too difficult to figure out how everything functions thanks for the schematics and my previous experience hacking the uv5r. My biggest problem was getting the LCD to function properly since it was a bit mislabeled in the schematics.

    As a proof of concept I had the radio tuned to 145.525MHz and listens to a signal. When a strong signal is received it played back 3 dtmf tones as can be seen in the video above.

    {youtube}-bYRF7IxtLA{/youtube}

    Here is a video of the first version of my firmware. It is work in progress and still needs more work.
    {youtube}rfNqLhF10Gc{/youtube}


    Anyone is welcome to help and you can start by checking out the code from here:

    https://github.com/lelazary/UV3RMod

    I also started a thread on the UV3R yahoo groups for anyone wanting to pitch in ideas for the firmware (given the limitations of the RDA1846 chip and 16K of memory). I am not going to promise to implement everything, but if its not to difficult, I will try to. However, since this is going to be open source firmware, you could always try to change it yourself (I will always be willing to help).

    Here are my list (if the feature makes it to the repository at
    https://github.com/lelazary/UV3RMod/blob/master/WISHLIST
    then it would probably be implemented):


    Mode 1) Quick interface to program rx freq, tx freq, power and PL code very quickly for repeaters. No offset, you just start with the rx freq and shift it by whichever amount you want. This will allow allow you to turn off the tx, or operate satellites.
    At any point during this mode, you can hold the mem channel and it will ask you which number you want to save this to.

    Mode 2) Memory mode will allow you to go through your saved memory. At any point you can press menu and change more details about the channel.  The details will include power with granular level, DTMF TX/RX, and other functions TBD. This mode will show the channel name and the freq underneath it.

    Mode 4) Satellite Mode: Auto tuning of the frequency with response to the Doppler shift.

    Mode 5) Digital mode. Hopefully I could add some text base digital data for rx and tx. You might need to tx the text using morse code since there is no alpha numeric keypad on the radio. The digital mode will also include a store and repeat message forwarding.

    Mode 6) Computer mode: All the functions of the radio including the RDA1846 registers, TX, and RX will be controlled through the serial port on the radio.

    Mode 7) Fox/Hunt  mode. Can be used to transmit a signal intermittently (like call sign morse code). Or send the RSSI signal into the audio, and with a directional antenna you can go hunting.

    Mode 8) Advance mode: Any RDA 1846 register can be set manually and saved for during startup.

    Mode 9) If the digital mode works, then RF programming of the radio. This will allow anyone to send you repeater information from their memory locations. I will work by selecting a memory channel to rx, and pressing a button. Then on another radio you can send the programming info.






    Programmer Protocol

    The implementation of this protocol along with the arduino code and the ongoing firmware can be cloned from github.


    https://github.com/lelazary/UV3RMod


    Here is the protocol used to get into the chip and program it: A 9V is set on the reset pin (VPP) to enter programing mode.
    Protocol sending over SPI LSB first. After almost every byte, the chip will pulse the data line to indicate ACK.

    Get Chip ID: 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x00 wait 1ms for response should be 0x82

    Program fuse bits

    Get Chip ID   : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x00 wait 1ms for response should be 0x82
    30ms delay
    Set Mode      : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x08 wait 1ms for response should be 0x01
    30ms delay
    set 20FF to 0 : 0x55 0xAA 0x5A 0xA5 0x02 0x00 0x00 0x03 0x05 0x00 wait 1ms for response should be 0x55


    Erase Chip   :
    Get Chip ID   : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x00 wait 1ms for response should be 0x82
    30ms delay
    Erase         : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x03 0x01 wait 1ms for response should be 0x55
    2 sec delay
    set 20FF to 0 : 0x55 0xAA 0x5A 0xA5 0x02 0x00 0x00 0x03 0x05 0x00 wait 1ms for response should be 0x55

    Read Data:
    Get Chip ID    : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x00 wait 1ms for response should be 0x82
    30ms delay30ms delay
    Set Read range: 0x55 0xAA 0x5A 0xA5 0x05 0x00 0x00 0x04 0xC0 0x00 0xC0 0xFF 0x00 <wait for data to go high> read 255 bytes
    30ms delay
    Set Memory Mode: 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x08 wait 1ms for 0x00


    Program Data:
    Get Chip ID                 : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x00 wait 1ms for response should be 0x82
    30ms delay
    Set Memory Mode             : 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x08 wait 1ms for 0x00
    30ms delay
    Set program range and data  : 0x55 0xAA 0x5A 0xA5 0x80 0xC0 0x00 0x00 <128 bytes> wait 1ms for 0x55


    Set Memory Mode: 0x55 0xAA 0x5A 0xA5 0x01 0x00 0x00 0x05 0x08 wait 1ms for 0x00


    DIY instructions for performing this hack


    Disclaimer: This hack is a work in progress. If you perform this hack you might transmit on frequencies outside the allowable amateur bands. For now I am keeping the TX amplifiers off, so the radio will not transmit more then a hundred feet. However, anyone can always go into the code and turn them back on. If you do so, you are responsible to insure that you know what you are doing, and take the necessary precaution when transmitting.  I will not be responsible for any damage cause by the radio or to the radio. Remember, once you erase the original firmware, there is no way of getting it back, so the radio will be a brick until you upload the firmware; but if you got this far, then that is exactly what you want.


    For this hack you will need an arduino,  NPN transistor (I used 2n394), 1K and 10K resistors, and a 9 volt battery. You could just use a 9V battery and a 10K resistor, but you would need to manually connect the VPP to 10K -> 9V and GND. If you want to do any kind of development, then the transistor is your option.
    Connect everything according to the diagram bellow:



    I made a small interface with the transistor and a connector so I can plug and unplug the programmer. When the programmer is plugged in, the radio will not function. You will need to disconnect the GND,VPP and VDD for the radio to boot up normally. A connector would allow you to plug the radio for programming and unplug it for testing.



    Once you have everything connected, check out the code from here:
    https://github.com/lelazary/UV3RMod

    Upload the arduino sketch programmer/chipFlash/chipFlash.ino into the arduino
    Go into the programmer directory, connect the programmer and the +5V power supply that came with the radio and run the python script uv3rFlash.py . If you choose not to build the transistor circuit then start with the vpp connect to GND, switch it to +9V, run the command, and switch it back to GND.

    ./uv3rFlash.py -p /dev/ttyUSB0 -e

    This will erase the chip using the arduino attached to /dev/ttyUSB0. If you are on windows then use COM5 instead of the /dev/ttyUSB0 or whichever com port the arduino is using.

    Then you can run

    ./uv3rFlash.py -p /dev/ttyUSB0 -w ../firmware/uv3r_firmware.hex

    If there are no errors, unplug the programmer, and you should have a brand new firmware on the radio

    Troubleshooting:
    If something is not working correctly, you can go into the arduino serial monitor program and use the raw commands to see what is going own.

    //Protocol
    //   CMD      Param               Description
    //   S                                        Enter ISP mode
    //   C                                        Exit  ISP mode
    //   I                                          Get Chip ID
    //   F             HH                      Flash config register with hex HH
    //   E                                         Erase flash memory
    //   P            AAAA LL DDDD...     Program memory with starting at address AAAA length LL and data DDDDDD (2char hex code)
    //   R           SSSS EEEE           Read memory from address SSSS to EEEE
    //On success return OK
    //On failure return ERR


    For example typing
    SIC <enter>
    will start the ISP mode, get the chip id and then close ISP mode. I looks like the chip id is 82, so that is what I am checking in the code. If you are not getting 00 for the id, then something is probably wrong with the connections (check the +5 and vpp).

    Good Luck