Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Question - Analog APRS support, and/or 878 firmware support #59

Open
doronbc opened this issue Nov 20, 2018 · 342 comments
Open

Question - Analog APRS support, and/or 878 firmware support #59

doronbc opened this issue Nov 20, 2018 · 342 comments

Comments

@doronbc
Copy link

doronbc commented Nov 20, 2018

The D878UV, which appears to be the same hardware can generate an analog APRS message. Is the 868 capable of the same, and/or can the 878 firmware be loaded on the 868 with correct/expected results. Any response is appreciated.

Thanks and 73,
Doron
K1DBC

@bizart
Copy link

bizart commented Nov 20, 2018

Couple of days ago I have successfully uploaded firmware 1.07 from D878UV to 868. It is a not an "easy" update, requires some additional tools like st-link, because of bootloader differences, but I can confirm that all features are working fine. I am working now on icon update, because of two new menu entries (Roaming, APRS).

73,
Boyan
LZ5VH

@NeuerUser
Copy link

That's really interesting. So, the first step would then be to flash a new bootloader, I guess. Iis the programming port easily accessible on the pcb?

@Kreischie
Copy link

Kreischie commented Dec 3, 2018

Hi, i'm very interested to import the firmware from 878 to 868. Any progress in update the logos? Maybe you could specify in how you flashed the firmware from 878 to 868

vy 73
DO7CT

@NeuerUser
Copy link

As he mentioned the ST-Link, he probably flashed a new bootloader via programming pins on the pcb. Afterwards the Anytone probably accepts the 878 firmware via the normal update process.

@Kreischie
Copy link

Okay, i'm an abolutely newbie in this so i think you need an programmer to do this.

@bizart
Copy link

bizart commented Dec 3, 2018

Hi,

Initially I was inspired by http://members.optuszoo.com.au/jason.reilly1/868mods.htm research, although I believe that frequency modification doesn't make much sense.

Used microcontroller in 868 / 878 is from GigaDevice GD32F303, actually it is a Chinese "clone" of STM32F series with 1024Kb flash size, so it can be fully accessed and programmed with standard ST-Link through SDIO interface. I am well familiar with STM devices, so looking at pcb board it was obvious that SDIO port is available right next to microcontroller package, so decided to give it a try. First step was to download full flash content including 868 bootloader, as flash was not read protected, next with few modifications to bootloader area and joining 878 update firmware, I was able to flash and run 878 firmware to 868 radio, which anyway is same hardware except bluetooth extension (extension connector is still present). Few issues to mention, although CPS recognizes radio as 878 and all new features are available, firmware can't be updated through Update Utility, and there are couple of missing icons. As soon as and if, Anytone releases Icon update firmware, those can be uploaded, as they reside in external flash.
Another possibility could be that 878 user, downloads entire firmware, including external flash content with ST-Link.

73

@NeuerUser
Copy link

Hi
Yeah, that was about was I thought you did :) Good work!

Probably the best approach is, indeed, downloading the complete flash from a 878. Then a bundle could be prepared to be flashed to a 868 to convert it into a 878. This bundle then either only consists of bootloader and icon pack, or is a full flash minus calibration area.

Now, how do we get a 878 to you, @bizart ? Either we find a fellow 878 user close to you, or I'll ask if we can all donate some money to you, so you can buy a 878. If we have 20 interested hams, each donating 10 USD, you should be able to get a 878, I guess.

What do you think?

@DL2MF
Copy link

DL2MF commented Dec 4, 2018

@bizart Enclosed the 128MBit Flash from 878. If you need the ZIP password, please send me an email.
(Notice for other users: Flash memory is not flashable FW! Wait for released version.)

@NeuerUser
Copy link

Wow, that was faster than I hoped for. Thanks, Mike. (Did you switch from MD380 to Anytone? Thanks for your great work there. I had a MD380 before I got the Anytone 868. Would be too good to be true, if we could start a similar open source project one day...)

@DL2MF
Copy link

DL2MF commented Dec 4, 2018

I've still some plannings for MD380tools, but also involved a little into GD77 and AT8x8. Might be an interesting future platform.

@bizart
Copy link

bizart commented Dec 5, 2018

@DL2MF Success,
send you an email

@NeuerUser
Copy link

@bizart : What did you need to flash? Was the bootloader section plus the icon section sufficient? Or did you need to flash the entire flash area?
Will you be able to prepare a simple package with some instructions for other hams that want to try it?

@NeuerUser
Copy link

@bizart Do you have any infos for us? We are excited that a conversion is possible.

@bizart
Copy link

bizart commented Dec 10, 2018

hi, couple of units upgraded completely,
waiting for successful upgrade confirmation from one more user

@cveith
Copy link

cveith commented Dec 10, 2018

@bizart
Nice to hear that you got it. I really would like to know what i have to do to setup my 868 with the newer firmware.

Is it possible to downgrade to the default 868 firmware again?
What tools (hardware and Software) do i need to perform the upload?

kind regards

Christian DO1CV

@NeuerUser
Copy link

@cveith : While I hope that @bizart will come up with a small package including a simple tutorial, I can guess currently, how the process will work (as I have flashed some other STM microprocessors).
Hardware: you will need an ST-Link V2 (costs app 3-6 USD). You will need to open the Anytone to get access to the SWIO interface (consisting of four pads, which you need to solder cables or a connector to). You will then connect the ST-Link to the pads and use either STM software (or some open source equivalent) to flash parts of the flash. The flash parts that needs to be flashed, so far only @bizart knows for sure. I guess it is the bootloader and the icon region.

Before you flash you can do a full flash backup, so, yes, you would be able to restore the HT to its original state, using the same process.

After the conversion has been done, you would not need the ST-Link for software updates, as the Anytone would have become a full 878 then.

@cveith
Copy link

cveith commented Dec 12, 2018

Would be nice :) my st-link programmer is on the way.

@ayasystems
Copy link

Hi

I have a STLink and a 868 candidate to be flashed... Could you send to me the 878 downloaded full flahs?

ea4gkq [a_t] radiomad [d_o_t] es

Regards

@NeuerUser
Copy link

@bizart : As you can imagine, we are all waiting in full anticipation. :) Could you tell us, if you will release anything?

Thanks!
Michael

@gymnae
Copy link

gymnae commented Dec 18, 2018

Also very interested in trying this out. A programmer is on its way to me. This is apparently not loved by anytone, as a discussion regarding this option was censored on Facebook - hopefully it can remain here.

@geary
Copy link
Owner

geary commented Dec 18, 2018

This is apparently not loved by anytone, as a discussion regarding this option was censored on Facebook - hopefully it can remain here.

If you're referring to the AnyToneDMR Facebook group, don't blame AnyTone for deleting any comments. The group isn't run by Qixiang Electron Science Technology Co. Ltd (the AnyTone manufacturer), but by someone who sells their radios and has his own particular style of moderation. (I also had comments deleted along with a 12 hour ban, but that is a story for another day...)

Feel free to continue discussing here, I am interested to hear how this experiment goes!

@bizart
Copy link

bizart commented Dec 18, 2018

Hi,
Although I believe it is a marketing failure to sell same hardware as a different product, I would like to admire firmware / hardware developers for their wonderful job creating 868 full featured product. Honestly, I don’t care of aprs features, the only reason to dig into, was because of annoying blue background and in my opinion much better looking dark one. Obviously it is not a rocket science to combine existing bootloader with regular manufacturer updates, for anyone familiar with original st microelectronics hardware and thankfully Jason’s initial research. I am grateful to DL2MF for supplying external flash content which allowed me to fix missing icons and finally build fully working 878 firmware. As stated before it is not an “ease” upgrade, or user friendly and has certain disadvantages. Firmware cannot be updated with “regular” flash utility after upgrade, although you can still revert back to 868 firmware with it. Couple of 868 radios flashed and operating normally, but No Any Guarantee it will work for you. 878 CPS functionality is fine. Current assembly is with latest (known to me) 1.09 revision.

I have prepared short explanation of what is done, waiting for successful upgrade confirmation. Stay tuned.

@gymnae
Copy link

gymnae commented Dec 19, 2018

If you're referring to the AnyToneDMR Facebook group, don't blame AnyTone for deleting any comments. The group isn't run by Qixiang Electron Science Technology Co. Ltd (the AnyTone manufacturer), but by someone who sells their radios and has his own particular style of moderation. (I also had comments deleted along with a 12 hour ban, but that is a story for another day...)

Yes, that group. The owner of the group is a bit special. I was banned there too after pointing out that he was spreading a leaked internal beta and presenting it at his finding.

@NeuerUser
Copy link

NeuerUser commented Dec 20, 2018

Firmware cannot be updated with “regular” flash utility after upgrade, although you can still revert back to 868 firmware with it.

Please help me understand why this is the case.

  • I understand that the hardware is 100% identical, so the difference must be in software only.
  • The software is stored in the 1MB internal MCU flash memory and the 128MB external flash chip.
  • Additionally there is the ROM with the first stage bootloader, which is programmed by STM and should be the same between 868 and 878.
  • Therefore if one is able to extract a copy of the internal and external flash from the 878n and write that to the 868, the 868 effectively becomes a 878 in all respects.

So, what is currently missing then?

Couple of 868 radios flashed and operating normally, but No Any Guarantee it will work for you. 878 CPS functionality is fine. Current assembly is with latest (known to me) 1.09 revision.

I have prepared short explanation of what is done, waiting for successful upgrade confirmation. Stay tuned.

Sounds good! Staying tuned! :)

@doronbc
Copy link
Author

doronbc commented Dec 24, 2018

first off, @bizart thank you very much for taking lead on this, your efforts are very much appreciated by the larger community. for everyone else, thank you for keeping the ball rolling.

@NeuerUser hopefully in time, as things mature and more of us gain more awareness, the radio could possibly take updates as expected through the cps, and possibly a st-link will not be required. this is all dependent though on the community providing development support, and on anytone not taking any legal or developmental actions that would impair the potential feature set of this radio.

i like everyone else am very eagerly awaiting the release of instructions.

@gymnae
Copy link

gymnae commented Dec 30, 2018

My programmer arrived, I'm ready to help try out the package, @bizart

@bizart
Copy link

bizart commented Dec 31, 2018

Hi,

Checkout SWD interface to CPU.

swd_interface_crop

Note that you have to setup st-link utility for "connect under reset" and manually apply reset to mcu after power up. It is tricky sometimes, reset pin is next to crystal and there is no test point on pcb. Pull up resistor is with high value so even touching with tweezers will reset. You need fresh battery connected. I am also connecting usb cable just to notify that cpu resets (usb "disconnect" sound on windows machine). Right after reset, click on "connect target" (st-link utility).

First I would suggest to make a backup of your existing bootloader and rest of firmware, so start with reading entire area 0x08000000 to 0x080FFFFF and save to file.

Please note that you can easily brick your internal flash, so do not proceed without previous step!

Cheers

@doronbc
Copy link
Author

doronbc commented Dec 31, 2018

@bizart thank you very much for the follow up. i believe i have followed the instructions but I still can't seem to connect in st-link utility. can you or anyone else confirm my setup, i am touching pin 25 with a small piece of metal, and get the connection noises in windows, but st link util doesnt connect. i am holding the unit down to make sure the battery is connecting.

correction: reset pin is number 14

14:00:40 : Can not connect to target! If you're trying to connect to an STM32W1xx device, please select Normal or HotPlug mode from Target->Settings menu. If you're trying to connect to a low frequency application , please select a lower SWD Frequency mode from Target->Settings menu.
14:00:42 : No target connected

stm2
stm1
setup2
setup1
st link settings

pins

for anyone wondering, this is pin 25(corrected to 14), its 12 up from the bottom, its just under a pin that has a wavy trace coming out of it
25

from page 12 of http://gd32mcu.21ic.com/en/down/document_id/127/path_type/1

@ei4kn
Copy link

ei4kn commented Dec 31, 2018

The reset pin is actually pin 14 - the chip is the 100 pin package. But it is in the same place as in the picture. I'm waiting on a programmer to give this a go.

@doronbc
Copy link
Author

doronbc commented Dec 31, 2018

The reset pin is actually pin 14 - the chip is the 100 pin package. But it is in the same place as in the picture. I'm waiting on a programmer to give this a go.

thanks, that makes more sense. i just corrected that. i can try it again soon just to eliminate any other issue.

@Archcantor
Copy link

Archcantor commented Feb 28, 2019

Hi Paulo. It is possible to replace the MCU but it requires special equipment and experience. You need a solder re-work station and there is always the possibility of damaging the board. In my opinion, unless you work at a place that does this kind of thing then replacing the MCU is not an option. I am an adventuresome person who takes risks. I have a lot of electronics experience. I would personally not try to do this myself. The other thing I am not sure about is if the MCU pin-out is the same between the two versions and if the older v1 board is compatible with the new MCU. I believe the older v1 board also has a smaller memory capacity.

@CT1HDC
Copy link

CT1HDC commented Mar 1, 2019 via email

@S56VDK
Copy link

S56VDK commented Mar 3, 2019

Hello! Does anybody has btech-6x2 Hex? And can at868 be comverted to btech 6x2?

@prokrypt
Copy link

prokrypt commented Mar 3, 2019

Mine has strings slightly modified, but it's good enough to get the radio to accept firmware over USB...
6X2MCU_custom.hex.zip

@S56VDK
Copy link

S56VDK commented Mar 4, 2019

Thank you prokrypt!

@IK8JHL
Copy link

IK8JHL commented Mar 18, 2019

@prokrypt Please can you giveme only boot of 6X2MCU ?

@prokrypt
Copy link

@IK8JHL I'm sorry, I don't know how :(

@kc2koj
Copy link

kc2koj commented May 3, 2019

Can a btech-6x2 be converted and does anyone have a complete backup copy of a btech-6x2 to return back to stock..thanks in advance

@kc2koj
Copy link

kc2koj commented May 4, 2019

What setting do I have to have to make a complete backup of the btech dmr-6x2 with programmer.i have seen conflicting info..and will a Backup restore 100% to a stock state...To update to a 878 firmware is this the only file we need now..
UB1AAM commented 4 months ago • edited 4 months ago
Who needs.... 878MCU.hex
https://mega.nz/#!HFAQCIYa!-AyYM1KOVm6eDTbF3AwEVXLh1WtS2Alj7NuXcVCpxug

does this give us an option for bluetooth module to be used
Also I have seen info on reflashing your serial # and manufacturing date is this necessary
Thanks in advance for the info and help

@Archcantor
Copy link

Archcantor commented May 4, 2019

I don't know if the 878 was supposed to support BT when it was released. If it did, then loading the hex file will make your radio become an 878 with BT support. If the 878 did not support BT then just flash the latest firmware. I saw in the changelog for v 1.12 that they were fixing some BT issues.

Flashing the serial and date is not required. If you don't then all that will happen is your radio info will not be correct on the screen in the CPS.

Sorry, I don;t have a Btech 6x2 to get you a backup flash. I think there is a 6x2 hex file somewhere to convert the 878 to a 6x2. I would think that could be used to restore a 6x2. I believe the 878 and the 6x2 are the same hardware made by the same company. The only difference is the firmware. The 878 has roaming which the 6x2 does not have. The 6x2 has a simplex repeater which the 878 does not have. Otherwise they are pretty close in features.

@kc2koj
Copy link

kc2koj commented May 4, 2019 via email

@Archcantor
Copy link

It's been awhile since I did mine and I never verified that my flash backup was valid. This is what I did:

In ST Link set the Address to 0x08000000 and the Size to 0xFF800. Set the default speed to 4.0 MHz and Normal Mode. Select connect to target either from the upwards facing plug icon or from target menu and then connect. This will save the current flash to a file.

@kc2koj
Copy link

kc2koj commented May 14, 2019

Has anyone used the ( record USB mode ) in the hidden menu... top button with pf1 + power

@S56VDK
Copy link

S56VDK commented May 15, 2019

I upload 1.12 firmware to converted radio and GPS test issue apears. Even after very long time,more than 30min nothing change.

With oldest fw 1.11, works without problem

I would also like to try reflash it with 1.12 fw hex if anyone have to offer it?

@Archcantor
Copy link

Archcantor commented May 28, 2019 via email

@cdoc83
Copy link

cdoc83 commented Dec 15, 2020

Perhaps this issue is too old now... but I thought I'd give it a try anyway. I got a little too excited and forgot the step to make a note of the serial number and manufacturing date. Is that data contained in the backed up hex file? Is there a way to recover it?

@vk7zja
Copy link

vk7zja commented Dec 16, 2020 via email

@jyams73
Copy link

jyams73 commented Feb 28, 2021

2/20/21: I just purchased the 868 from Anytone. Can someone tell me if this procedure / mod is still worth doing? Will this provide the roaming feature and digital & analog APRES functionality to the 868 modded to an 878. Also wondering if this mod will provide the 200,000 contact storage versus the 868’s stated 150,000? Have all the tools to do this but only if these 878 features can be “unlocked”. Many thanks.

@Archcantor
Copy link

As long as you confirm the MCU chip on your board is the GD32F303VGT6 it will take the 878MCU.hex
That will transform your 868 into an 878. Then just flash the latest firmware and use the latest CPS. Other than the color of the top button the radio will look, feel, work and act like the 878. The mod will not add hardware features like GPS or Bluetooth but it does support them if they are on your board. I added Bluetooth to mine later and it works fine.

@jyams73
Copy link

jyams73 commented Feb 28, 2021

Thank you kind sir. I will no doubt check the chip soon and do this mod if my 868 qualifies.

@doronbc
Copy link
Author

doronbc commented Mar 3, 2021

If anyone has the time or knowledge, we might be able to convert this to a software only solution, removing the need to open the radio or to buy an ST-LINK programmer.

I believe it would require an st-link or v2, ability to setup an openocd connection to the radio, and dump the encrypted firmware using the firmware extractor. Find the AES S-box values in the dumped firmware using Ghidra to dissemble the AES key. Then use the sboot_stm32 tool to remove the encryption. The end result would the ability for any D868UV owner to flash the D878UV firmware on it, hopefully with an option to revert back to original FW, either using the official AnyTone software or another cross platform solution, while using the radios data usb, removing the need to open the radio and use the st-link programmer, again with a large disclaimer user takes all responsibility.

https://www.eevblog.com/forum/microcontrollers/dumping-stm32-protected-firmware/
https://github.com/doegox/stm32f1-firmware-extractor
https://github.com/NationalSecurityAgency/ghidra/
https://github.com/dmitrystu/sboot_stm32
https://hackaday.com/2020/03/24/breaking-into-a-secure-facility-stm32-flash/

If someone can provide the initial dump from the doegox firmware extractor, that would allow for more eyes on this and to check into the AES S-box values and further steps.

@cveith
Copy link

cveith commented Mar 10, 2021

As long as you confirm the MCU chip on your board is the GD32F303VGT6 it will take the 878MCU.hex
That will transform your 868 into an 878. Then just flash the latest firmware and use the latest CPS. Other than the color of the top button the radio will look, feel, work and act like the 878. The mod will not add hardware features like GPS or Bluetooth but it does support them if they are on your board. I added Bluetooth to mine later and it works fine.

Yes it will not add the hardware Features like Bluetooth. But Bluetooth can be added when you have the chance of getting the hardware.

I've modded my 868 two years ago with the firmware hack and last year i've put a bluetooth pcb in. What should i say? It's working with my jabra headset like a charm :)

@jyams73
Copy link

jyams73 commented Mar 11, 2021

Did my upgrade tonight. The biggest obstacle I had to overcome was connecting to the ST-Link V2. I finally put together a combination of steps that worked. 1. Plug in St-link to usb port without wires attached and check that it shows in Device Manager.
2. If it does, then unplug and hook up clk, data, and grd leads from radio. 3. open up the ST-Link Utility. DO NOT CHECK SETTINGS OR CONNECT! 4. plug in st-link adapter with wires attached properly and listen for device manager to beep signaling that the adapter has registered as a usb connection. 5. put 868 in programming mode with appropriate buttons while turning on radio to achieve blinking red programming led. 6. Follow instructions above using the st-link utility to read from the radio and save that file. 7. Assuming that worked, follow same instructions for flashing the 878 hex file (see links above). 8. The radio should program and reboot. 9. Using designated buttons, do a reset on the radio. 10. connect programming cable and follow normal Anytone instructions for upgrading firmware / CPS. 11. Read settings from radio. 12. If you check the radio screen (laying face down because it is still disassembled) you might see that the menu system is in Chinese (mine was and others have said same). All you have to do is to make a few random changes in the code plug and write to the radio. The menu will now be in English!!!
I hope this helps others. As I said, the most frustrating thing was trying to keep the St-link Utility application connected with the device. By not fooling with the target/settings or target/connect, i was able to read and write to the radio. In my case, it seemed that opening the settings or connect dialog boxes caused a loss of connection. I just took a chance and rolled with it and it stayed connected.
Also, in the code plug the "local settings" page is jibberish. I saw a way to flash the correct information such as serial #, etc somewhere but can't put my hands on it. However, my warranty is history now anyway. I did record the original serial and manufacturing date before I did anything.
One more issue I just remembered, after flashing 878 hex file to upgrade to 878, when the radio rebooted, it would not connect to usb in device manager. I simply went to device manager and clicked on the problem line (which was the radio) and did a automatic driver update. I unplugged the radio and turned it off, then plugged the cable back in, turned on the radio, and the usb com port then came up correctly.
Thanks.

@Archcantor
Copy link

Archcantor commented Mar 11, 2021

Change Serial Number and Mode.pdf

QXCodePro_Update_dpinst_Setup_1.02.zip

AT878testmodes.zip

Using a HEX editor you can edit the contents of the CCD file. One of the files enables test mode. The other clears it. You can put your radio info into both and flash the one you want at will.

@j-robles
Copy link

j-robles commented Jun 10, 2023

Do you mind sharing which PCB you purchased?

As long as you confirm the MCU chip on your board is the GD32F303VGT6 it will take the 878MCU.hex
That will transform your 868 into an 878. Then just flash the latest firmware and use the latest CPS. Other than the color of the top button the radio will look, feel, work and act like the 878. The mod will not add hardware features like GPS or Bluetooth but it does support them if they are on your board. I added Bluetooth to mine later and it works fine.

Yes it will not add the hardware Features like Bluetooth. But Bluetooth can be added when you have the chance of getting the hardware.

I've modded my 868 two years ago with the firmware hack and last year i've put a bluetooth pcb in. What should i say? It's working with my jabra headset like a charm :)

@Archcantor
Copy link

I purchased the bluetooth PCB that was sold by Connect Systems back around 2021. It was sold by other dealers too but I have not seen it available anywhere these days. Because the 878 is a mature product I doubt that we will see the add-on bluetooth board for sale again.

@S56VDK
Copy link

S56VDK commented Aug 16, 2023

Hi does anybody have Btech 6x2 PRO MCU.hex?

@emm312
Copy link

emm312 commented Apr 5, 2024

Hi all,
I bought an 878 thats in Chinese, and read I'd need to change the bootloader to get it to be in english. Would I need to flash a ROM or just the 878 firmware linked here?

@emm312
Copy link

emm312 commented Apr 11, 2024

Does anyone have a full dump including the language packs?

@prokrypt
Copy link

prokrypt commented Apr 14, 2024

Back when I was young and stupid I had started to create a firmware string editor for the dmr6x2. Then I realized I was in way over my head and gave up on it. I don't have the source anymore and the firmware file it reads off of already has some edits (by young me), but perhaps it can be entertaining for some:
https://edited.us/dmr6x2hax/

I also failed to finish my font-character locating stuff:
https://edited.us/dmr6x2hax/derp.php
All 3 pages are generated live, but only the second part of the first page has any dynamic stuff displayed...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests