Techcoderadio

Firmware updater exe : DetectItEasy  De4dot: VS Code ILSpy decompiled cleaned code  dotPeek created VS solution   Firmware ROM binary file inside VS solution, DetectItEasy: CPU is probably R8C. Some Ghidra R8 processor modules exists: https://github.com/silverchris/m16c  

Some radio scanner firmwares contains lots of debugging strings and code, e.g. debug19 debug20 debug21 . C . sjis MOT TST test_control_ch  and some are based on NORTi RTOS. Some receiver model firmwares are probably encrypted but e.g. binwalk can show something        Some devs have multiple firmwares, e.g. one for the DSP and one for the display. Ghidra TMS320c28x   Ghidra Fujitsu MB91F    

I am interested in finding unknown remote commands and test modes. Ghidra and a bit of Python code.

with srecparser.py https://techcoderadio.blogspot.com/2026/04/motorola-s-record-old-python-code.html     Uniden BR330T BCT15 BCD396T  

run BearMock to get decoded Motorola S-record format file https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html CPU is probably M16C/60N Ghidra:

run BearMock to get decoded Motorola S-record format file https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html CPU is probably M16C/60N Ghidra:  

run BearMock to get decoded Motorola S-record format file https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html CPU is probably M16C/60N Ghidra:    

run BearMock to get decoded Motorola S-record format file https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html CPU is probably M16C/60N Ghidra:    

Unzip BCi96DVUP_V1_03.zip extract BCi96DVUP_V1_03.cab (unzip) run admin regsvr32 comctl32.ocx run BCi96DVUP_V1_03.exe  run BearMock to get decoded Motorola S-record format file https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html BCi96DVUP is VB6 (Detect It Easy) Code inside .exe CPU is M16C/60   Ghidra can disassemble M16C/62N    

https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html   from time import sleep from serial import Serial __MODEL = 'BCT15X' __PORT = 'COM4' __SPEED = 9600 __TIMEOUT = 0  # non-blocking __READ_SLEEP_SECS = 0 __OUT = 'bct15x-decoded.s19' __ACTIONS = {     'æ€\r': 'ERR\r',  # Empty, just reply     '\r': 'UNKNOWN COMMAND\r', #Empty, just reply .... Strange chars coming first ... just reply error XON/XOFF software flow control if __name__ == "__main__":     try:         port = Serial(__PORT, __SPEED, timeout=__TIMEOUT, bytesize=8, parity='N', stopbits=1, xonxoff=True)     except Exception as ex:         print(ex)         exit()  

  https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html Bearmock seems to work better when running in Python 3.14.1 and BC_VUP_V2 with 38400 bps COM speed setting BC125AT scn file decoded with Bearmock: srec_info bc125at-decoded.s19 Format: Motorola S-Record Header: "" Execution Start Address: 00000000 Data:   000000 - 03FFFF BR330T scn file: BC_VUP_V2 showed error: the firmware file is too old for the scanner. After changing the model variable in Bearmock code as UBC3500XLT decoding runs ok. from time import sleep from serial import Serial __MODEL = 'UBC3500XLT' __PORT = 'COM4' __SPEED = 9600 __TIMEOUT = 0  # non-blocking __READ_SLEEP_SECS = 0 __OUT = 'br330t-decoded.s19' .... Firmware data seems to be partly scrambled

Python, Wireshark, ActiveGPS.exe, Ghidra My ActiveGPS device, purchased maybe 15 years ago (no more produced)  Hardware used: https://techcoderadio.blogspot.com/2025/04/some-activegps-pymocking.html Enhanced version of the PyMock for the ActiveGPS (due to hw setup many retries required when running with sleep or flush .... maybe com0com would work better?). B = b'0303 ... firmware version, 3.6 is the latest version import serial import time A = b'00' B = b'03036F72AD18F8BF4B07DA01120B3215AF00' C = b'00000' D = b'00' E = b'00' J = [      b'18F8BF4B07DA01120B3215AFFFFFFFFF',      b'409CA961000050124EF175426C73AE41',      b'14060D0907DB5B58421D474A4A00FFFF',      b'FFFFFFF133FB33FB33FA33FA33FA33FA',      b'33FA33FA33FA33FA33FA33FA33FA33FA',      b'33FA33FFFFFFFFFFFFFFFFFFFFFFFFFF',      b'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF',      b'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000'...

Bearmock https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html BC246T firmware updater is BC_VUP V3 SW used BC_VUP V2 BC_VUP V2 can show msg which says registration key is required -- just click ok. Select speed 38400 or 57600 for most reliable operation and also try with port.flush() Processed firmware file contains many interesting strings

D878UVII_V4.00_20250725.CDD Renamed it to D878UVII_V4.00_20250725.BIN. Visual Studio 2022 can show its content as ASCII and HEX.  Detect It Easy.   D878UVII.exe is VB6. For inspecting with Ghidra: copy DAO350.dll and msvbvm60.dll to the dir where D878UVII.exe is located.