Techcoderadio

Firmware updater exe : DetectItEasy  De4dot: VS Code ILSpy decompiled cleaned code  dotPeek created VS solution   Firmware ROM binary file inside VS solution, DetectItEasy: CPU is probably R8C. Some Ghidra R8 processor modules exists: https://github.com/silverchris/m16c  

Some radio scanner firmwares contains lots of debugging strings and code, e.g. debug19 debug20 debug21 . C . sjis MOT TST test_control_ch  and some are based on NORTi RTOS. Some receiver model firmwares are probably encrypted but e.g. binwalk can show something        Some devs have multiple firmwares, e.g. one for the DSP and one for the display. Ghidra TMS320c28x   Ghidra Fujitsu MB91F    

I am interested in finding unknown remote commands and test modes. Ghidra and a bit of Python code.

run BearMock to get decoded Motorola S-record format file https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html CPU is probably M16C/60N Ghidra:

run BearMock to get decoded Motorola S-record format file https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html CPU is probably M16C/60N Ghidra:  

run BearMock to get decoded Motorola S-record format file https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html CPU is probably M16C/60N Ghidra:    

run BearMock to get decoded Motorola S-record format file https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html CPU is probably M16C/60N Ghidra:    

Unzip BCi96DVUP_V1_03.zip extract BCi96DVUP_V1_03.cab (unzip) run admin regsvr32 comctl32.ocx run BCi96DVUP_V1_03.exe  run BearMock to get decoded Motorola S-record format file https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html BCi96DVUP is VB6 (Detect It Easy) Code inside .exe CPU is M16C/60   Ghidra can disassemble M16C/62N    

Python, Wireshark, ActiveGPS.exe, Ghidra My ActiveGPS device, purchased maybe 15 years ago (no more produced)  Hardware used: https://techcoderadio.blogspot.com/2025/04/some-activegps-pymocking.html Enhanced version of the PyMock for the ActiveGPS (due to hw setup many retries required when running with sleep or flush .... maybe com0com would work better?). B = b'0303 ... firmware version, 3.6 is the latest version import serial import time A = b'00' B = b'03036F72AD18F8BF4B07DA01120B3215AF00' C = b'00000' D = b'00' E = b'00' J = [      b'18F8BF4B07DA01120B3215AFFFFFFFFF',      b'409CA961000050124EF175426C73AE41',      b'14060D0907DB5B58421D474A4A00FFFF',      b'FFFFFFF133FB33FB33FA33FA33FA33FA',      b'33FA33FA33FA33FA33FA33FA33FA33FA',      b'33FA33FFFFFFFFFFFFFFFFFFFFFFFFFF',      b'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF',      b'FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF0000'...

BF-5RMini_CPS.exe dotPeek Visual Studio Ghidra Innoextract (Linux) DetectItEasy Installer extraction with Innoextract  DetectItEasy shows that CPS software is obfuscated with modified EP + CLR constructor Ghidra dotPeek to VS solution BF-5RMini_CPS.sln - mostly readable code    

D878UVII_V4.00_20250725.CDD Renamed it to D878UVII_V4.00_20250725.BIN. Visual Studio 2022 can show its content as ASCII and HEX.  Detect It Easy.   D878UVII.exe is VB6. For inspecting with Ghidra: copy DAO350.dll and msvbvm60.dll to the dir where D878UVII.exe is located.    

  https://techcoderadio.blogspot.com/2025/04/tidradio-td-h3-firmware.html    H3_250317.BIN