Portables

Which?| GP300 | GP900 | MT2100 | Programmer or RIB| Software

Please, let me know how you got to this site and/or link this site to yours to let everybody share in this information!  

Which portables are we talking about?

In my collection of government-portables, I have a few Motorola models that are worth discussing and looking at.

It is about the GP300, the GP900 and the MT2100 of Motorola. All these three portables have specific options that might be interesting for HAMs and others.

I consider words like 5TVO, DTMF and CTCSS as known. If you do not know what these words mean, look at the technical page for more info.

A tip first…

When you want your portable to look really new again, because tha plasic or metal housing is a bit dull, you can try something that works really great.

I bought a can of Kockpit-spray at the local gas-station. This is a greasy spray that lets you dashboard shine again. If you put a bit of it on a sponge you can apply it on the plastic of your portable.

Remember: always try such things on a spot you cannot see. Then you can check wether it doesn't ruin your plastic. If it does, only the little spot is damaged.

After applying, you can wait for a day or so and then "dry" it with a clean dry cloth to remove what is left.

GP300

Overview

The GP300 is a simple, yet very good portable for the amateur. It has a few options (depending on the model) that are interesting:

CTCSS
Scan
5 Watts of power
Adjustable squelch
Adjustable mike-gain
16 channels (with scanning feature activated only 15)
Lots more…
5TVO (depending on model)

Modification

This is what it is all about: modifying the motherfucker. Usually it has only 8 channels, however there is a way to get it up to 16… Here is what you need:

RLN4008 RIB box or a home made one (see: RIB)
sharp knife
Software

8 -> 16 channels

Okay, let's asume that you are a retard and you have only 3 fingers; even then you are able to do this mod…

- remove channel knob
- remove the little plastic dot under the button (it stops the switch) with your knife
- replace the knob

Tough hey? Now, let's take a short brake (well deserved, as I may say) to evaluate the heavy mod…

Now it is time for the software. Didn't find it? Look at the software-section for tips on finding it.
If you want to know how to program it, you should look at www.mods.dk for my manual. Under this text I copied a section from Batlabs about how to modify the software to let your radio run 16 channels in the 2m band.

Connecting the RIB

The RIB has to be connected tot the portable underneath the battery. So,, remove it and look…

There are two springs: the left one (with the bottom of the portable facing towards you) is for the 7,4 V, the right one is ground. Between them, right next to the + spring, there is a little solder-spot. This is where the RIB hat to be connected to.

You can connect the RIB with little metal clamps, so that you don't have to solder it on every time. To make a connection on the signal spot, you simply bend a piece of wire in a U-form (5mm) and solder this on the solder-spot. Now you can clamp the RIB on this hook everytime.

In the next section I printed a piece of info from www.batlabs.com :

General Information

The model breakdown table for the GP300 series of radios (and a general guide for lots of others): 

Type
of
Unit
 
TX Power
 
Freq.
 
Model
Series
 
Channel
Spacing
 
Channel
Signalling
 
Channel
Capacity
 
Frequency
Sub-band
 
Version
 
Unique
Model
Variation
 
P
 
3
1-3W VHF
 
3
VHF
(136-368MHz)
 
YPC
GP300
 
0
12.5 kHz
 
0
PL/DPL
 
A
2 Channels
 
1
Low Split
136-162 MHZ
403-433 MHz
 
A
 
A

 

 
9
1-5W VHF
1-4W UHF
 
4
UHF
(403-520MHz)
 
MGC
GP350
 
2
20/25 kHz
 
9
Select-5
(5-Tone)
 
D
8 Channels
 
2
High Split
146-174 MHz
438-470 MHz

 

 

 

 

 

 
QLC
P110

 

 

 
C
16 Channels
 
3
"T"-Band
465-495 MHz

 

 

 

 

 

 
YPJ
GP300GS
GP300KM

 

 

 
G
10 Channels (8+2)
 
4

192-208 MHz
490-520 MHz

 

 

 

 

 

 
PFL
People
Finder

 

 

 

 
5
403-470 MHz
403-433 MHz TX
438-470 MHz RX

 

 

 

 

 

 
PFP
People
Finder

 

 

 

 
6
403-470 MHz
438-470 MHz TX
403-433 MHz RX

 

 

 

 

 

 

 

 

 

 
8

336-368 MHz

 

 

The P in the Type field stands for Portable, the A in the unique model package means the radio was included in a package with Battery, Antenna, etc. The "8+2" model is a unique model that has 8 normal channels and 2 scan list channels (the scan list channels can be programmed normally as well but on the escutcheon they are labeled as scan).

You will find there are a number of the newer series of radios with model number based on this system. Therefore, you can use this as a guideline when trying to figure out what a radio does.

The HKN9755A is the stand-alone cloning box that can be used with the GP300/P110. It is a microprocessor based device that will read a target radio and dump the codeplug to a target radio.

If you want to make up your own remote accessory for these radios you will want to look at the service cable schematic as well as this schematic of a GP300 speaker microphone.

You can find the programming cable for the GP300/P110/GP280/GP88 here.

If you want to see the programming cable for the GP350, look here.

In order to use your GP300 accessories with your GP350, you will want to order the HLN9482A GP300/350 accessory adapter.

If you want to build a nice little programmer for the GP300 radios, one that does not require a RIB, check out this link.

This is the service cable for the GP300 series radios. It is used for tuning the radio with RSS.

FYI, there is a program out there that "fell" out of a Motorola LAB that allows you to read and edit the GP300 codeplug directly. We do not know where it is, just that it does exist. It is generally called GP Utility or GP Tools or something like that. It looks similar to RSS but its only function is bit banging.

You need this codeplug editor if you are going to increase the number of channels in a Select-5, Select-V, 5-Tone, GP300. Refer to this page for more information on the procedure.

The GP88 is basically a GP300 in a slightly different case (like a P110 is). If you TK one you should be able to make it a GP300 with all the GP300 features.

Are you curious about what is inside your GP300 battery pack?

If you have one of the GP300 5-tone models with a display, it shows an error something like 053, and it doesn't want to accept a codeplug, you can try turning on the radio with all the side buttons pressed including PTT. This will put the the unit radio into test mode and it will accept the codeplug, if it´s the right model.

Fuse Location

Yes these radios have a fuse. To access it, first pull off the top knobs. Turn the radio so that you are looking at the battery connection side. At the bottom of the metal chassis, gently insert a flat-blade screwdriver between it and the housing, and pry up.

After you have the chassis out of the housing, carefully remove the speaker/microphone header plug. Note that there are four retainer clips holding the chassis together. With your screwdriver, gently pry off the clips. Hold your finger down on them as you do this so you don't shoot them across the room.

Once you've done this, you should have the main circuit board, the metal chassis and a large shield apart. On the metal chassis, on the opposite side of the battery contacts, you will see a small circuit board. On this board is the fuse, it's usually a square white fuse. Sometimes it's round. The Motorola part number is 6580561D02, four amps.

If you are not a technician and are not experienced at disassembling radios, you must exercise caution, people have been known to wreck the housing, RF board or both just trying to get it apart, believe me it's easy to do if not careful.

Also, it is VERY rare that this fuse blows, so chances are that there is something else wrong with the radio if it will not power up.

Low Audio With GP300

If you have a radio that has low or distorted audio output, there is a good chance that you need to check and probably replace one of the small little SMC components right next to the volume control.

The Hoffis Pages

You will want to check out the pages below for some very important hacking information on the GP300. Some of the codeplug structure, disabling the encryption, cloning, etc., it can all be found in these two pages.

Check out page 1.

Check out page 2.

220MHz Radios

More and more 220MHz capable GP series radios are starting to show up on the market.

Generally these are GP280's, however, GP300's are around as well.

The GP280's usually need GP280 RSS, while the GP300's can usually be programmed with regular GP300 RSS.

The standard bandsplits that may be found are 216-223MHz, 222-223MHz, and 205-225MHz. All of them use the same RF section, hence, all of them are capable of 205-225MHz, and possibly a little more.

In order to program out of band frequencies into the first two bandsplits (to facillitate use in the Ham Band), follow any of the out of band instructions listed above. The software is set up all the same way and the existing modifications will work.

Out of Band Information

To program frequencies outside of the rated bandsplit in the GP300/P110/GP350 is very simple, follow the listed steps:

Out of Band Information, Alternate Method

In the GP300.MDF file make a Checksum-16 of the whole file (the F12 option in Hex Workshop), in our case we ended up with 0xF2D3 (RSS V 05.00), write this down, you might need it later.

Look starting at about offset 0x402, you should see something like:

00000402 02 00 94 11 5C 12 94 11 5C 12 94 11 5C 12 05 00 50 05 ....\...\...\...P.

05 00 = Bandsplit identifier (Note: it is at the end of the frequency assignments)

94 11 = 4500 in decimal, ie 450.0000 MHz

5C 12 = 4700 in decimal, ie 470.0000 MHz

Note there are 3 occurances of the strings 94 11 and 5C 12, the first set is the limits displayed in the Radio Wide menu (F4-F2). The second set are the TX limits for the radio. The third set are the RX limits for the radio (note that if the TX and RX limits are not set the same the RX limits are screwed up).

To figure out what hex to enter for your bandsplits you can either use the Base Convertor (in Hex Workshop), or use a calculator with a HEX --> DECIMAL conversion function. If you are using a calculator enter your limit (ie 1440 for 144.000 MHz) and convert it to hex, you should get 0x05A0. When you enter the data into the .mdf file you have to reverse the bits such that you would actually enter 0xA005 in the field you are changing.

Some of the RSS packages (We don't have codeplugs for everything, so We can't check them all) check the checksum of the .mdf file when you try and load a codeplug and return an error if the checksum of the .mdf file doesn't match the one stored in the program. If you don't get an error when you run the RSS with the new .mdf and try and load a codeplug then you don't have to worry about the next step.

If you get a corrupt .mdf file error then you will have to go back and correct the checksum in youredited .mdf file. Load the file back in your hex editor and make a Checksum-16 of the file. If you compare the new checksum with the original one for the file they probably will be different.

The only way we have to correct the checksum of the file at this time is to keep editing bits and making Checksum-16 calculations until the edited file's checksum and the original match. You can either edit the Copyright statement or some of the model descriptions in the file. Just take one or a few of these insignificant bytes (some experimentation may be required depending on by how much the cheksum is out) and add or subtract a few bits of the numbers make a Checksum-16 of the file. You should notice the checksum has changed by the number of bits you added or subtracted. Keep going until the checksum's match.

Once the checksum's of the files match you should be able to run the RSS, load the codeplug, and enter the frequencies within your new bandsplits with ease.

Out of Band Information, Alternate Method 2

First, make a backup copy of the GP300.MDF file.

The, using your Hex Editor, perform the following:

That's it. Now, when you run the RSS and read the radio via the RIB, the program thinks you have the 465-495 model and you can input the frequencies in this range with out any limitation, and still have the extra out of band with the shift key. BUT, remember, you haven't changed the RF section in the radio, so you will only be able to get the radio to work up to +/-10MHz outside of its original split, if you are lucky.

You don't have to worry about the checksum of the .mdf file because you only moved hex bytes within the same file, not adding or subtracting anything. The RSS shouldn't crash.

Expand the radio to 16 channels

There are several ways you can add channels to a 2 or 8 channel GP300/P110 radio. The easiest is to use a program called TK (Took Kit). This programs plugs into the normal cables and RIB and does all the work for you. TK won't work with the GP350 so don't try it. The hex method may work but has not been tested.

NOTE: I do not have any sources for TK, so don't bother asking, you're on your own.

Expand the radio to 16 channels, Alternate Method

A much slower but just as effective way of doing it is to use Hex Workshop to edit the saved file. The saved file from the GP300/P110 uses some form of encryption that changes the look of the file each time it is saved in RSS. This can sometimes make the below process long and boring.

First, make a backup of the codeplug file you want to edit (copy it to a .bak or something). In the event you loose track of which bit you are editing and get a Error 58, its easy to start over again.

Next, load your codeplug file into your hex editor. You want to edit the byte right after the end of the serial number. Make a note of it's original value and increment it or decrement it by one and save the file.

Exit the hex editor and start up the GP300 RSS. Try loading the file you just edited, you will either get an Error 21 (Radio not supported) or the codeplug will load okay (once in a while you may get an Error 58, but this isn't very common).

Note the model number that the codeplug has loaded as, and compare it to the original model number of the radio. If the nineth character of the model number is a "C" (ie. P93YPC20C1__) you have a 16 channel codeplug. Also, make sure that the rest of the model number is the same, otherwise you may have made a 16 channel codeplug on some other band!

If the RSS won't load the codeplug, go back to the hex editor and change the bit again, save the file in the hex editor and try loading it again. Keep repeating this until a) you get tired and give up, b) you are successfull, or c) you edit that byte all 255 times. If you have come to point c), edit the byte to something you know that works, load it in RSS and re-save it in RSS. This will re-encrypt the file and you can continue editing.

If you want to do this faster, you should check out the Hoffis pages (above) and disable the encryption for the codeplug. Heck, if you can manage to do that, you should be able to make the 16 channel modification easily then. :)

Tips:

Note: Sometime in 1994 Motorola changed the 2 channel radios such that if you were to hack the radio into an 8 channel model, you still get 2 channels. The change was the microprocessor to a new unit that only recognizes the common and 1 line of the channel selector. The channel switch is the same regardless of which radio you have. Only by changing the CPU can you then change the number of channels to more than 2. To tell if you can convert your radio, pop the knob off and turn the selector. If the 2 channels programmed in the radio come up in the order 1,2,2,2,2,2... it will work. If they come up 1,2,1,2,1,2,1,2... forget it, you'd probably have to change the microprocessor to get it to work.

Expand the radio to 16 channels, Alternate Method 2

Depending on which firmware is in your radio, this may or may not work (see Note above).

Open the GP300.MDF in your Hex editor and make a Checksum-16 of the whole file. You will need this later, so write it down. For RSS version 5.00 I got a checksum of 0xF2D3.

Search for your model number in the file, you probably will come accross more than one entry so you can either change them all or change them one by one until it works.

Once you find your model entry you should see something like this:

0000086C 50 39 34 59 50 43 32 30 43 33 5F 5F 06 1F 10 04 27 40 14 20 19 50 P94YPC20C3__....'@..P

If you look at this model entry, the third byte after the model number (offset 0x87A) is a 10. This is the hex representation for the number of channels in the radio, in this case 16ch. Most of the time you will see a 0x02 or 0x08 in this position for 2 or 8 channel radios respectively. Try changing the field to 0x10 to make a 16 channel radio and see what happens. Also note the 06 at offset 0x878, this is the bandsplit for this model number and corresponds with the bandsplit entry in the table at the top of the .mdf file.

The .mdf file for these radios is checksum protected and every time the RSS loads it calculates the checksum for the file and compares it to an internal reference to see if it matches. If the checksums do not match you will get an error message.

The only way we have to correct the checksum of the file at this time is to keep editing bits and making Checksum-16 calculations until the edited file's checksum and the original match. You can either edit the Copyright statement or some of the model descriptions in the file. Just take one or a few of these insignificant bytes (some experimentation may be required depending on by how much the cheksum is out) and add or subtract a few bits of the numbers make a Checksum-16 of the file. You should notice the checksum has changed by the number of bits you added or subtracted. Keep going until the checksum's match.

To find out if you picked the correct model number to edit, save the .mdf file and load your radio's codeplug into the RSS. Try adding channels with the Mode Utility and see what happens.

Some other RSS modification tips for the GP300

GP300 RSS ver.R07.00.00 31-Oct-94.

If you would like to program any GP300 radio with the codeplug information previously got from another GP300 (serial number, model, freq. range etc. doesn't matter), do the following:

In the file gp_2.ovl. look for signature C6 46 FC 00 9A E3 08 at offset 10949 (2AC5h) and modify three bytes from ** into 90h:

Old string = C6-46-FC-00-9A-E3-08-XX-XX-**-**-**

New one = C6-46-FC-00-9A-E3-08-XX-XX-90-90-90

XX means the value doesn't matter, leave old values (these bytes contain segment address and may vary).

Run gp300.exe and load archive file with the codeplug info previously saved on disc.

Press (F8) and program any target GP300. Model number, serial and features will be copied into it.

If you want to disable frequency checking for entering out of band frequencies in RSS, try doing the following modifications:

Search for 77 10 around location 3E80 and replace with 90 90
Search for 77 03 around location 3E8D and replace with 90 90

One disables frequency checking on tx, the other on rx. Note that the locations will vary depending on the version of RSS.

Out of band for 5-tone radios

This seems to work on 5-tone version 2 RSS.

Program your out of band frequency into either the TX or RX field, then use [shift]-F2 to leave the field. This only seems to work for +/-2MHz or so.

Another thing to try is using the shift key to enter the frequencies into the field remembering to release it for the decimal point, ie. 146.9400 would be !$^.($)) just make just you are using a standard English keyboard layout.

If this doesn't work, then try the method below.

You will have to make modifications to the gp300-5t.gdt file.

This modification makes the following changes:

To make the changes, open the gp300-5t.gdt file in a Hex editor.

Use "EDIT" and "REPLACE" and search for 433000000 (400ECF19h). You should probably find an entry at addresses 0064h and 006Ch, replace with 520000000 (0092FEIEh) (TX and RX HI freq Range for 403-433).

Use "EDIT" and "REPLACE" and search for 470000000 (80A1031Ch). You should probably find an entry at addresses 0094h and 009Ch, replace with 520000000 (0092FEIEh) (TX and RX HI freq Range for 438-470).

Use "EDIT" and "REPLACE" and search for 438000000 (80591B1Ah). You should probably find an entry at addresses 0090h and 0098h, replace with 4030000000 (C04A0518h) (TX and RX LOW freq Range for 438-470).

Use "EDIT" and "REPLACE" and search for 436000000 (00D5FC19h). You should probably find an entry at addresses 0610h, replace with 5200000000 (0092FE1Eh).

Use "EDIT" and "REPLACE" and search for 475000000 (C0EC4F1Ch). You should probably find an entry at addresses 06D0h, replace with 5200000000 (0092FE1Eh).

Use "EDIT" and "REPLACE" and search for 434000000 (8050DE19h). You should probably find an entry at addresses 0678h, replace with 4030000000 (C04A0518h).

This should be all that is required. For a VHF version, the process is similar.

All you have to do is convert the edge of the bandsplit you are looking for from decimal to hex using Hex Workshop'd Base Converter (make sure the byte order is "Intel") and search in the file for it. Remember to put all the trailing zeros in when you do the decimal to hex conversion.

Disable Codeplug Check for 5-tone radios

If you have managed to get a mangled codeplug crammed into your GP300 5-tone radio and would like to get your old codeplug back in, you've probably found that the RSS will not let you. When it checks the radio prior to programming, it gives you an error (because it doesn't think you have the proper radio connected).

In order for you to be able to program your backup original codeplug back into the radio, you must disable the check. This can be done as follows:

 

Quite a lot…

GP900

(not exactly the same)

The GP900 has a few features that are interesting: 5TVO, scan, Hi/Lo power etc.

The only thing that is to be said about it, is that there is another version of the GP900, the CENELEC version. This version only produces 5 Watts and is explosion-safe. That means that it has less power than onthers and current-protected batteries.

Do not attempt to charge these batteries in another charger than supplied. It will certainly be damage the battery! CENELEC batteries have a current-protection inside to prevent sparks. Also, using this battery on a normal GP900 will appear that it has less capacity.
Using a normal GP900 battery on a CENELEC portable, will only activate the RX-section because the TX section is powered by a special section in the battery.

GP900 batteries can be exchanged by batteries from a MT2100 or so…

This is how to make your programming calbe:


Stolen.. ofcourse


MT2100

Cooler than the GP900!

These portables differ from the GP900 because of a higher number of channels and a… top display! You can give a name to every channel!

It is possible that your codeplug (the software that goes into the radio) is too large. Then, you have to make less channels.

How to program this portable is a bit difficult to say. I am working on a manual for this, but the dutch version isn't even fixed yet, so…
Programming requires a RIB and a cable:

Good luck…

The programmer or RIB (Radio Interface Box)

When we want to program a radio from Motorola (or others…) we need to convert the TTL levels of the portable to an RS232 level of the computer. That is what this RIB does.

The RIB for the GP300 is quite simple. For the larger ones, you need the difficult to build RIB. Look at www.batlabs.com for the schematic. This is for the GP300:

picture…

Components

Print
That leaves lots of work for you…!

The software

Yep, how do we get the software? It is not on my site (not allowed) and it is hard to find. I have a lot of software, but how to get it to you…

Contact me. You can get the software, but… only when you have something for me that is interesting…

Do not send me a mail when you don't have anything to offer. It took me a lot of time and energy to find the shit!

Mail me at [email protected] and we'll find a solution.

Or look at:

http://hamradio.online.ru/sch_eng.html for a bit of software.

But Thijs, what's next?

Euh… nothing. Get back to work!

Good luck and, if it works, have fun!

73,

Thijs

HOME