Offering Captures for Alinco DJ-MD5 & Radioddity GD-73A

[Grissess]

Hello!

I recently came into possession of the two title radios at a swap meet; I've been helping with DMR setup (mostly installation and inventory) on commercial allocations at conventions, and thought I might try my hand with them in my amateur practice to get a good feel. Unfortunately, they seem ill-supported, although I'm assured the DJ-MD5 is very similar to some common AnyTone (I don't know the exact one), and the GD-73 is supposedly kin to the well-supported GD-77. I'd love to get them working in this project, and/or any of its informal upstreams!

I'm quite new to DMR, so I don't know where to start or what to look for, but I am a somewhat-experienced UNIX hacker with an itch to scratch, so if someone could point me to tools, I'll get captures :) . It's unfortunate most of the official tools seem to be closed/freeware Windows applications, so I begrudgingly have the capacity to borrow a friend's laptop for that purpose, but I think I can take USB packet captures on that platform... maybe...

Looking forward to helping if possible!

Thanks,
KD2EMC

[allesand]

Some info on the handsets:

The GD-73 was also mentioned in #188 - dev and checklist there!

Re: the DJ-MD5: mentioned in http://anytonetechzone.byethost7.com/878techmods.htm?i=1#MD5similarities

[Grissess]

Thanks for the pointers, @allesand! I searched for both radios herein, but must've missed #188, which has a little information on what to gather. Let's start with the GD-73A's USB configuration:

Bus 002 Device 051: ID 1206:0227 HTMicroChip walkie-talkie-C7000
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass            0 
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x1206 
  idProduct          0x0227 
  bcdDevice            1.00
  iManufacturer           1 HTMicroChip
  iProduct                2 walkie-talkie-C7000
  iSerial                 3 C86000886357FD716A1F2408
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x002e
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           4
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass    255 
      bInterfaceProtocol    255 
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval             255
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval             255
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval             255
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x04  EP 4 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval             255
cannot read device status, Resource temporarily unavailable (11)

Meanwhile, the DJ-MD5 comes in as a standard-looking USB serial:

root@vesta:~# lsusb -vs 2:52

Bus 002 Device 052: ID 28e9:018a GDMicroelectronics GD32 Virtual ComPort in FS Mode
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            2 Communications
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x28e9 GDMicroelectronics
  idProduct          0x018a 
  bcdDevice            1.00
  iManufacturer           1 GD32Microelectronics
  iProduct                2 GD32 Virtual ComPort in FS Mode
  iSerial                 3 000000010000
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0043
    bNumInterfaces          2
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              100mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              0 
      CDC Header:
        bcdCDC               1.10
      CDC Call Management:
        bmCapabilities       0x00
        bDataInterface          1
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Union:
        bMasterInterface        0
        bSlaveInterface         1 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval              10
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0 
      bInterfaceProtocol      0 
      iInterface              0 
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x03  EP 3 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
Device Status:     0x0000
  (Bus Powered)

On my present Debian-base with a typical kernel and udev, that ends up attaching to a ttyACM chardev.

I don't yet have a working CPS of any sort; once I do, I'll get the other captures :) . Someone will have to tell me what a "call-sign DB" is once I get there...

[allesand]

Yes, since the DJ-MD5 is an "AnyTone-derivative" like the BTECH DMR-6X2 ( #260 / #335 ), it sholuld behave in much the same way - alas, the very subtle differences in codeplug format and options are what makes @hmatuschek reverse engeneering work so cumbersome :-|

Oh! There is #201 - I missed that one "Add support for Alinco DJ-MD5(XT)"

(And somewhat related #196 )

Does https://github.com/hmatuschek/anytone-emu help in debugging?

The GD-73 is very different, even the Windows CPS installation was an adventure. But: dev and status in #188 !

[allesand]

(Call-sign DB: the recent Anytone models can load the whole user database from https://radioid.net/ in the flash, so you get information for all 243797 DMR users on the radio screen, for example while listening to TG 91).

[hmatuschek]

For the DJ-MD5, I may not need to have a capture to implement it in the emulator. I'll have a look at it. Concerning the GD-73A, I will certainly need the radio in my hands for tests as I need to implement the communication protocol from scratch.

[hmatuschek]

I can emulate the DJ-MD5 and DJ-MD5X using https://github.com/hmatuschek/anytone-emu. However, unfortunately, the CPS (as usual some crappy VB botsh of an application) does not run under wine. So, reverse engineering the codeplug will require a proper windows machine/VM.

[Grissess]

@hmatuschek I'd lend you the GD-73A if I could; failing that for a moment, do you want me to get USB pcaps of specific operations, potentially after I run a few software installs?

[allesand]

@Grissess : please refer to #188 : the .rdt is a memory dump, so reverse eng is possible with the CPS and hexedit

[cr03]

Full disclosure, I used ChatGPT to help figure out a sensible plan of action for the GD73. I own one.

@hmatuschek Thanks for all your work so far. Big fan.

I hope this isn't overkill but could you glance this procedure and let me know if I missed anything?
Since getting a hold of radios isn't always economical, I hope these instructions might form a basis that others could be introduced to providing more data as required.

I'd also like to make sure I'm not barking up the wrong tree so to speak.

Step 1: Install Wireshark on Windows

1. Go to the Wireshark download page and download the installer for Windows.
2. Run the installer and follow the on-screen prompts to install Wireshark.

Step 2: Install USBPcap

During the Wireshark installation process, you will get an option to install USBPcap. Make sure to check this option. If you have already installed Wireshark without USBPcap, you can download it separately from its official website.

Step 3: Capture USB Traffic

1. Run Wireshark as Administrator:

   • Right-click on the Wireshark shortcut and choose "Run as administrator."

2. Select Capture Interface:

   • After Wireshark opens, you should see a list of interfaces that Wireshark can capture. USB interfaces will usually be listed as USBPcapX where X is a number.

3. Start Capture:

   • Select the appropriate USB interface and click the 'Start' button to begin capturing traffic.

4. Perform Actions:

   • Now perform actions on your radio like reading and writing codeplugs to capture the relevant data.

List of Actions to Perform in the Old CPS Software

A. Read Codeplug
- Start Wireshark capture.
- Read the codeplug from the GD73 using the old CPS software.
- Stop Wireshark capture.
- Save this capture with a name like read_codeplug.pcapng.

B. Write Codeplug
- Start Wireshark capture.
- Write a codeplug back to the GD73.
- Stop Wireshark capture.
- Save this capture as write_codeplug.pcapng.

C. Edit Channels
- Start Wireshark capture.
- Add a new channel.
- Edit an existing channel.
- Delete a channel.
- Stop Wireshark capture.
- Save this capture as edit_channels.pcapng.

D. Manage Contacts
- Start Wireshark capture.
- Add a new contact.
- Edit an existing contact.
- Delete a contact.
- Stop Wireshark capture.
- Save this capture as manage_contacts.pcapng.

E. Manage Zones
- Start Wireshark capture.
- Add a new zone.
- Edit an existing zone.
- Delete a zone.
- Stop Wireshark capture.
- Save this capture as manage_zones.pcapng.

F. Update Firmware
- Start Wireshark capture.
- Perform a firmware update if available.
- Stop Wireshark capture.
- Save this capture as update_firmware.pcapng.

Step 4: Sharing the Capture Files

1. File Transfer:
   • You can share this file with the developer, likely via cloud storage, making sure you remove or anonymize any sensitive information in the capture.

Additional Notes

Remember to identify clearly the capture related to reading the codeplug, writing the codeplug, and any other specific tasks you perform so the developer can easily correlate the actions with the captured data.

[allesand]

Hello @Grissess and @cr03 : dev status for the GD-73 in #188 !

[allesand]

@Grissess and @cr03 : progress in #188 - qdmr is already reading from the radio very well.

@cr03 What kind of prompt did you use to get that response? @hmatuschek explained that the GD-73 actually writes a memory dump as the config file so rev. eng. was quite straightforward this time. Now next time another manufacturer decides to "update" the complete codeplug layout with a firmware update, that output above might come in handy, though :-)

[cr03]

https://chat.openai.com/share/be2fb973-edbf-4352-bc26-de5cd7b6f549

…

On Mon, Oct 9, 2023 at 16:37 allesand ***@***.***> wrote: @Grissess <https://github.com/Grissess> and @cr03 <https://github.com/cr03> : progress in #188 <#188> - qdmr is already reading from the radio very well. @cr03 <https://github.com/cr03> What kind of prompt did you use to get that response? @hmatuschek <https://github.com/hmatuschek> explained that the GD-73 actually writes a memory as the config file so rev. eng. was quite straightforward this time. Now next time another manufacturer decides to "update" the complete codeplug layout with a firmware update, that output above might come in handy, though. — Reply to this email directly, view it on GitHub <#371 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAB3YZDEIZB4VAJXGTUTC4TX6RN7HAVCNFSM6AAAAAA3QPOJ4WVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM3TEMZUGI2DA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[allesand]

@cr03 Impressive. Thanks for the info!

[allesand]

@Grissess @cr03 : @hmatuschek implemented writing to the GD-73 (see #188), please give it a try. Please also report which firmware version your device is running. As mentioned in #188 (comment) firmware version V.1.11 seems not downloadable, in the linked group are some discussions about high BER with V1.06 but not with V1.04 or V1.11, IIRC. Please report over in #188 to keep reports together.

[hmatuschek]

Also, use the devel branch. The gd73 branch was removed, as the implementation was merged. allesand ***@***.***> schrieb am So., 15. Okt. 2023, 08:28:

…

@Grissess <https://github.com/Grissess> @cr03 <https://github.com/cr03> : @hmatuschek <https://github.com/hmatuschek> implemented writing to the GD-73 (see #188 <#188>), please give it a try. Please also report which firmware version your device is running. As mentioned in #188 (comment) <#188 (comment)> firmware version V.1.11 seems not downloadable, in the linked group are some discussions about high BER with V1.06 but not with V1.04 or V1.11, IIRC. — Reply to this email directly, view it on GitHub <#371 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACE6E3KDT3R4SYGRQR7L53X7N7ADANCNFSM6AAAAAA3QPOJ4U> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[allesand]

@hmatuschek "Branch housekeeping": are the "fix-limit-requests-to-repeaterbook", "prepare-0.11.3-release" and "readme-patch-1" still needed? Now, first things first (breakfast :-)), then some GD-73 tests!

[Grissess]

Hello! It's been a while and I admittedly haven't tried building any of your branch tips lately--but I was able to borrow a Windows computer and use the "official" CPS (version 1.13e) for the Alinco DJ-MD5 in particular. The radio is still largely programmed by the previous owner, and should have a fair smattering of edge cases; the procedure was to download the codeplug, save it, and upload the same codeplug. Both captures were done first without the contact list, then with it (which was significantly slower). The upload experienced an issue that required the radio to be reset before the full codeplug was uploaded.

The pcapng files are around 120MB in size uncompressed; I apologize in advance, since it mostly looks like it was just streaming serial data--though I don't know how best to capture that on Windows.

I can give a test build a try later :)

• sample-2024-02-19-download.zip
• sample-2024-02-19-upload.zip
• sample-2024-02-19.zip (the CPS software's save file)

I hope to get to the Radioddity soon :)

[Grissess]

Ah, I got these first and noticed the instructions up there afterward :) . I don't have any captures for contact changes (I highly suspect there's no "delta", it uploads only an entire codeplug), nor for firmware upload (that's on me). I might have this hardware for a little longer, though, and can furnish those when I settle down :)