Posts

Inspecting firmwares of some receivers and transceivers

Image
Some radio scanner firmwares contains lots of debugging strings and code, e.g. debug19 debug20 debug21 . C . sjis MOT TST test_control_ch  and some are based on NORTi RTOS. Some receiver model firmwares are probably encrypted but e.g. binwalk can show something        Some devs have multiple firmwares, e.g. one for the DSP and one for the display. Ghidra TMS320c28x   Ghidra Fujitsu MB91F    
Post a Comment
Read more

Quick and super simple RDS log mod for the SDRAngel

rdsparser.cpp Append group data to log file in hex format. void RDSParser::parseGroup(unsigned int *group) {     unsigned int group_type = (unsigned int)((group[1] >> 12) & 0xf);     bool ab = (group[1] >> 11 ) & 0x1;      // add this     {         std::ofstream ofs("rdslog.txt", std::ios::app);         if (ofs)         {             ofs << std::hex << std::uppercase;             // print each 16-bit word as zero-padded 4-digit hex when possible             ofs << std::setw(4) << std::setfill('0') << (group[0] & 0xFFFF);             ofs << std::setw(4) << std::setfill('0') << (group[1] & 0xFFFF);             ofs << std::setw(4) << std::setfill('0') ...
Post a Comment
Read more

Inspecting Alinco DX-R8 firmware updater

Image
DX-SR8 Flash Writer Ver01.12.zip Unzip  extract DX-SR8 Flash Writer Ver01.12.msi extract Instal01.cab CPU: R8C R8C/Lx/3AA Microcontroller IC 16-Bit 20MHz 128KB (128K x 8) FLASH 100-LFQFP (14x14) Flash code is embedded as Motorola S-record format in _B... file (many _xxx files without extension in package). It can be extracted and cleaned (rem non-printing chars etc.) e.g. with Python. srec_info:      
Post a Comment
Read more

Inspecting Uniden BC346XT firmware

Image
I am interested in finding unknown remote commands and test modes. Ghidra and a bit of Python code.
Post a Comment
Read more

Reversing some radio control Android apps

Image
I downloaded two Android apps from APKPure.com M-Radio Control MOTOTRBO.xapk and M-Radio Control TETRA.xapk Unzipped xapks and decompiled with Apktool (Linux) and used grep to search in src files, e.g. grep -ri "cpin" . --include="*.java" grep -ri "trunk" . Search finds AT commands etc.  
Post a Comment
Read more

Testing Rayhunter with cheap 4G LTE Wifi UFI modems

Image
DragonOS VirtualBox   Cheap UFI variants of UZ801 work by default in Asian bands. It is possible to set European bands. https://github.com/hkfuertes/msm8916-openwrt/tree/enable_bands#band-configuration-uf02     Rayhunter  
Post a Comment
Read more

Inspecting Alinco DJ-G29T firmware

Image
Alinco DJ-G29T firmware updater softwate  DJ-G29T ver.1.10NEW.msi => unzip, Instal01,cab => unzip File named PO1_A3 ... contains compiled code and data section in Motorola S-record format. Remove lines before and after data section and with some Python scripts clean the data section. import re import argparse import sys def clean_file(path: str) -> None:     try:         with open(path, 'r', encoding='ansi') as f:             text = f.read()     except FileNotFoundError:         print(f"File not found: {path}", file=sys.stderr)         sys.exit(1)     cleaned = re.sub(r'[^S0-9A-F\r\n]+', '', text)     with open(path, 'w', encoding='ansi', newline='') as f:         f.write(cleaned) def main() -> None:     parser = argparse.ArgumentParser(         description='Keep characters S,0-9,A-F'   ...
Post a Comment
Read more