Skip to content
Python tools and patched firmware for the TYT-MD380
C R Python JavaScript Assembly Makefile Other
Branch: master
Clone or download
Type Name Latest commit message Commit time
Failed to load latest commit information.
annotations Use ${MAKE} for sub-makes rather than make. (#766) May 28, 2017
applet To avoid "ID unknown" message when userdb is over 7 Meg. (#896) Jan 27, 2019
chirp PEP8 and Python3 enhancements Jan 15, 2017
codeplugs Virgin codeplug from MD-380 GPS (#667) Feb 4, 2017
contrib Added ability to set side buttons to our own functions Jan 10, 2017
cores Core dumps, which are handy for populated the SRAM region when revers… Aug 27, 2016
db db: cleanup Jun 20, 2018
docs Update Mac OS X instructions Mar 23, 2019
emulator Added support for stdin, fixed small newline thing (#676) Feb 3, 2017
firmware D14.07 firmware download. Apr 13, 2019
hooks Fixes offset in the unused C version of the BL hooker. Sep 18, 2017
leaflet renamed doc into leaflet Oct 20, 2016
locales Fixed the locales Makefile, which was broken by a bad pull request fo… Feb 6, 2018
md380org fix title entries for subsubmenu on md380org Jun 21, 2018
patches Merge latest changes from travis repo Dec 1, 2017
playground MD380 firmware plugin for Binary Ninja. Jul 11, 2017
symbols Symbols now properly extracted for D14.07. Apr 13, 2019
.gitignore Makefile fixes and improvements. (#737) May 6, 2017
.travis.yml Disabling OS X from Travis CI. Jul 1, 2017
99-md380.rules USB access rules for the MD380. Need to add CS7xx devices when I get … Dec 9, 2015 started CPS issues list Nov 15, 2016 PEP8 and Python3 enhancements Jan 15, 2017 Typo. Dec 11, 2016
Makefile Makefile target to set the time. May 21, 2018 clarify python-requests requirment Mar 16, 2018 Use correct .org url May 31, 2019 PEP8 and Python3 enhancements Jan 15, 2017
appveyor.yml Added ability to set side buttons to our own functions Jan 10, 2017 refactoring makefiles Oct 7, 2016
curl.mak Improved resiliency of curl invocations May 14, 2017
default.nix default.nix: flashdb requires wget (#886) Sep 15, 2018
delete_object_files_and_listings.bat Merge remote-tracking branch 'refs/remotes/travisgoodspeed/master' Sep 4, 2017 Cut GPL references for the scripts forked from Ubertooth. Feb 6, 2018
md380-codeplug Added ability to set side buttons to our own functions Jan 10, 2017
md380-dfu PEP8 and Python3 enhancements Jan 15, 2017
md380-fw PEP8 and Python3 enhancements Jan 15, 2017
md380-gfx PEP8 and Python3 enhancements Jan 15, 2017
md380-tool PEP8 and Python3 enhancements Jan 15, 2017 Added ability to set side buttons to our own functions Jan 10, 2017 Stop md380-dfu uploading .rdt codeplug as raw Sep 6, 2018 Modified md380_fw to include KG5RKI's MD2017 work Jul 16, 2017 Windows fix for md380_gfx from Wolfgang. Close #710. Mar 5, 2017 Catch PipeError and print a friendly debug message Jun 14, 2019
md380remote.pyw Merge remote-tracking branch 'refs/remotes/travisgoodspeed/master' Sep 4, 2017
requirements.txt PEP8 and Python3 enhancements Jan 15, 2017
stm32-dfu Cut GPL references for the scripts forked from Ubertooth. Feb 6, 2018 Merge remote-tracking branch 'refs/remotes/travisgoodspeed/master' Jun 10, 2017

MD380 USB Tools

by Travis Goodspeed, KK4VCZ

More documentation


To support users by using the md380tools or the resulting patched firmware a Google Group is public opened and reachable via!forum/md380tools. No extra registration should be necessary. You could also feed it via e-mail at So feel free to put in your questions into it!

A few of us are also on the #md380 IRC channel on Freenode.

A helpful site is available at

There are also some related groups you may find interesting:


This repository contains tools for working with codeplugs and firmware of the Tytera MD380, which is also sold under a variety of different brand names. The codeplug format is sufficiently similar to the radios from Connect Systems (CS700, etc) that these tools might someday be made compatible.

Client Tools:

  • md380-dfu reads and writes MD380 codeplugs and firmware.
  • md380-tool communicates with the patched firmware. (Fancy stuff!)

Development Tools:

  • stm32-dfu modifies firmware for jailbroken devices. (No longer required.)
  • md380-fw wraps and unwraps devices firmware.
  • md380-gfx modifies firmware graphics.

Build Status

Build Status

Supported Hardware

The patched firmware is known to work on the following devices:

  • The "D"-Version (NoGPS) for radios without GPS

    • Tytera/TYT MD380
    • Tytera/TYT MD390
    • Retevis RT3
  • The "S"-Version (GPS) for radios with GPS

    • Tytera/TYT MD380
    • Tytera/TYT MD390
    • Retevis RT8

Both types of vocoder (old and new vocoder radios) are supported.

The DMR MARC user's database required a 16 MByte SPI Flash memory chip. In some VHF Radios is only an 1 MByte SPI Flash installed.

Known models

Name vocoder GPS exp FW original FW
MD-380 old N D02,D13 D02,D03
MD-380 new N D02,D13 D02,D13
MD-380G new Y D02,S13 S13
MD-390 new N D02,D13 D13
MD-390G new Y D02,S13 S13
  • RT3 = MD-380 (old)
  • RT8 = MD-390G


This software is licensed in exchange for two liters of India Pale Ale, to be delivered at a neighborly bar, preferably one without televisions.

Tytera's firmware is of unknown license and is not included in this repository. We use a heap-less printf library under the BSD license.


  • The MD380 uses a custom variant of DFU that isn't quite compatible with the spec. Their code seems to be forked from an STMicro example for the STM32 chip.

  • Universal Serial Bus Device Class Specification for Device Firmware Upgrade, version 1.1:


This project should work across Linux, Mac OS, and Windows, but has not been tested on all platforms. A separate client, MD380Tool, is under development for Android.

Preparation of build environment

Additional steps for linux based installations

git clone
cd md380tools
sudo cp 99-md380.rules /etc/udev/rules.d/ 

(The 99-md380.rules file is copied to /etc/udev/rules.d/ in order to allow users to access the radio over USB without having to use sudo or root permissions.)

Flash updated firmware for linux based installations

Turn on radio in DFU mode to begin firmware update with USB cable:

  • insert cable into USB.
  • connect cable to MD380.
  • power-on MD380 by turning volume knob, while holding PTT button and button above PTT.

For non-GPS-models do:

git pull
make flash

For GPS-models do:

git pull
make flash_S13

Flash updated users database for linux based installations

Turn radio normally on to begin database loading with USB cable

For European users:

make updatedb_eur flashdb

Note: for European users it is probably illegal to use the other method for updating, due to privacy laws. (This is no legal advice, please consult your lawyer to be sure.)

For the rest of the world:

make updatedb flashdb

(The users.csv file located in the db directory must be refreshed this way, with make updatedb, otherwise it will continue using any already-existing users.csv file when running make flashdb.)

Convenient Usage:

Anything with md380-tool requires a recent version of our patched firmware. You can check your version in Menu/Utilities/Radio Info/Version. If it's a recent date you're good; if it's a number, you need to upgrade.

To dump the recent dmesg log:

md380-tool dmesg

Firmware Compilation

This archive does not ship with firmware. Instead it grabs firmware from the Internet, decrypts it, and applies patches to that revision.

You can reproduce the patched firmware with make clean dist after installing an arm-none-eabi cross compiler toolchain. The firmware and a Windows flashing tool will then appear in md380tools-yyyy-mm-dd. Alternately, you can flash them from Linux with make clean flash, after starting the recovery bootloader by holding PTT and the button above it during a radio reboot.

Windows Firmware Installation

You can install any of these patched firmware files into your MD380 by using the respective .bin file with the Tytera Windows firmware upgrade tool, upgrade.exe, available inside their firmware upgrade downloads. Here are the steps:

  • Turn off your MD380 using the volume knob.
  • Attach the Tytera USB cable to the SP and MIC ports of your MD380.
  • Attach the Tytera USB cable to your host computer.
  • Hold down the PTT and the button above the PTT button (not the button with the "M" on it).
  • Turn on your MD380 using the volume knob.
  • Release the buttons on the radio.
  • The status LED should be on and alternating between red and green, indicating you're in flash upgrade mode.
  • Start the Tytera Upgrade.exe program.
  • Click "Open Update File" and choose one of the .bin files produced from the process above.
  • Click "Download Update File" and wait for the flash update process to finish. It takes less than a minute.
  • Turn off your MD380 using the volume knob.
  • Disconnect the USB cable from your MD380 and host computer.
  • Turn the MD380 back on, and you should see the "PoC||GTFO" welcome screen. You're running patched firmware!

Chirp Driver:

Also included is a partial driver for the MD380 in Chirp. This driver doesn't yet support the essential DMR features, but it does handle analog channels and banks well enough to load analog repeaters into your radio.

This driver can't yet communicate with the radio, so use md380-dfu read foo.img to read an image out of the radio, then open it in Chirp after installing chirp/ as a driver. Once you've made your changes, you can load the image back in by running md380-dfu write foo.img.

More Info

Some articles:

  • Jailbreaking the MD380, PoC||GTFO 10:8 (pocorgtfo10.pdf page 76.) by Travis Goodspeed
  • Running AMBE Firmware in Linux, PcC||GTFO 13:5 (pocorgtfo13.pdf page 38.) by Travis Goodspeed

Pat Hickey has some notes and tools up in his own repository,


Temponary not avaible, see

Images extracted from the firmware have comments at the beginning of the file, telling md380-gfx where they came from. Comments begin with a '#', and end with a new line.

Image editors like GIMP will discard the original comments, but you can replace them by opening the file in a text editor and copy-pasting the comment lines from the original extracted file to your custom image.

Boot logo

There are several boot logos provided that you can choose from by editing patches/2.032/Makefile, and commenting/uncommenting as you see fit.

The original boot logo is 160x40 pixels, and only 2 colors. This means an image that has the same properties can be written into the firmware as a direct replacement, as seen in the Makefile.

An image with more than two colors requires the "relocate" argument to md380-gfx. There are examples of this in the Makefile as well.

You can’t perform that action at this time.