Travis Goodspeed edited this page Sep 14, 2016 · 7 revisions

Welcome to the md380tools wiki!

For now, it can only be edited by the project's collaborators. Please be patient as we fill in these links to document our project.

Project Status

MD380Tools is a collection of Python scripts and firmware patches the Tytera MD380 and related digital radios. Our firmware runs on both old and new codec hardware, and we will soon support devices with GPS.

Getting Started

You need to either Build from Source or Download Firmware for your radio. MD380 firmware versions can be confusing, so please read the instructions carefully.

Usage and Introduction

See for build instructions to get started on Linux.

Lady Ada has written some introductory documentation for using the project and the MD380 in Windows.


A few of us are on the #md380 IRC channel on Freenode, and a user's mailing list is available through Google Groups.!forum/md380tools

Codeplug Format

The MD380 stores its contacts and channels in an external SPI Flash chip. You might need to know this Codeplug Format if you'd like to add support for changing those settings to a graphical channel editor, such as CHIRP.

Firmware Development

First you should install the right Compiler Toolchain and then learn how the Build Process works. If you are using code which does not require hardware I/O registers, you might try first prototyping it in the MD380 Emulator on Linux.

Before writing new features for the firmware, you might want to read about how the Menu Infrastructure, Startup Code, and USB Stack behave.

Among other nifty features, we support a Promiscuous Mode for receiving traffic from unknown talkgroups, Raw Packet Capture and Raw Audio Capture for recording network traffic, and a Caller ID Database for internally storing and displaying the database of all registered hams in the DMR MARC user's database.

Firmware Reverse Engineering

We've been reverse engineering the MD380 firmware with IDA Pro and Radare2, as well as some homegrown tools that you'll find in the repository. We expect to also use Binary Ninja once those fine folks add support for Thumb to their platform.

The firmware runs on an STM32F405 with 1MB of Flash and 192K of non-contiguous RAM. Radio functions are managed by the C5000 Baseband chip, while the audio codec chip is emulated by a background process on the CPU.

The Memory Map page describes the firmware layout. Firmware Symbols explains how functions are identified within the firmware. Graphics and Fonts have also been reverse engineered and improved.

Hardware Documentation

Our firmware was initially ported to the MD380 Hardware, but we will soon also support the MD390 GPS Hardware. Additional radios from Tytera and Connect Systems might also be supported in the future.

You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.
Press h to open a hovercard with more details.