Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)
Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)
Based on https://github.com/v0l/radio_tool project, and the decompiled code from the latest OpenGD77CPS, the latest 20230227 beta version OpenMDUV380(openGD77) firmware successfully flashed into Baofeng DM-1701.
youtu.be/nXfHvqsBTZ8
Most functions except the keypad seem to work correctly. I also have Baofeng DM-1802, the PCB is exactly the same except the navigation key uses vertical pads instead of horizontal pads which should be their compatibility design.
youtu.be/nXfHvqsBTZ8
Most functions except the keypad seem to work correctly. I also have Baofeng DM-1802, the PCB is exactly the same except the navigation key uses vertical pads instead of horizontal pads which should be their compatibility design.
Last edited by BD4VOW on Wed Mar 01, 2023 7:22 am, edited 1 time in total.
Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)
I am also trying to reverse engineering the factory firmware.
Hope I can help you guys porting to these radios.
btw, I am also working on porting openRTX to them.
Hope I can help you guys porting to these radios.
btw, I am also working on porting openRTX to them.
Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)
OK. That's good.
I know OpenRTX has some data on DM1702/DMX
I don't know anything about the Baofeng DM-1701/DM-1802
What MCU is in this radio, is it STM32 or MK22 ?
Edit.
I guess it must be STM32 if its running the OpenMDUV380 version
So it must be a clone of the RT3S/UV380 ??
CPS. Just uses normal STMDFU upload, except it decrypts the official firmware (donor) and merges it to obtain the AMBE codec, and then re-encrypt so that the data is accepted by the bootloader
Tomorrow I will look at RadioTool to see if the uploiad process to this radio is the same as the UV380. Perhaps only the encryption is different
I know OpenRTX has some data on DM1702/DMX
I don't know anything about the Baofeng DM-1701/DM-1802
What MCU is in this radio, is it STM32 or MK22 ?
Edit.
I guess it must be STM32 if its running the OpenMDUV380 version
So it must be a clone of the RT3S/UV380 ??
CPS. Just uses normal STMDFU upload, except it decrypts the official firmware (donor) and merges it to obtain the AMBE codec, and then re-encrypt so that the data is accepted by the bootloader
Tomorrow I will look at RadioTool to see if the uploiad process to this radio is the same as the UV380. Perhaps only the encryption is different
Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)
I looked at radio tool
Possibly just the encryption table is different
https://github.com/v0l/radio_tool/blob/ ... dm1701.hpp
Did you recompile the CPS with this new encryption table
I could easily add 1701 encryption table to the CPS
RadioTool uses the TYT upload protocol for the 1701, because it is simply STM DFUSe protocol with one extra command to allow writing to the ROM in the MCU
Possibly just the encryption table is different
https://github.com/v0l/radio_tool/blob/ ... dm1701.hpp
Did you recompile the CPS with this new encryption table
I could easily add 1701 encryption table to the CPS
RadioTool uses the TYT upload protocol for the 1701, because it is simply STM DFUSe protocol with one extra command to allow writing to the ROM in the MCU
Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)
These radios are not said to be cloned by anyone. I guess they basically come from the same standard reference design of ANNODA or some other Shenzhen solution companies, and the firmware design is also the same.
TYT and Baofeng or some other similar radio companies located in Quanzhou, Fujian Province are manufacturing companies, and their PCB designs for different models should be entrusted to those companies in Shenzhen to carry out a small amount of customized designs based on standard solutions. They are very good at designing and producing different appearances. Of course, they are best at producing PCBs, assembling, and packaging. The appearance/packaging/instructions they design usually leave an area for changing the brand label according to different customer requirements.
Retevis or AILUNCE are backed by the same trading company, and their products are basically produced by the above factories in Quanzhou, Fujian, yes, the labels changed.
This is why these radios are so similar and used almost like the same.
TYT and Baofeng or some other similar radio companies located in Quanzhou, Fujian Province are manufacturing companies, and their PCB designs for different models should be entrusted to those companies in Shenzhen to carry out a small amount of customized designs based on standard solutions. They are very good at designing and producing different appearances. Of course, they are best at producing PCBs, assembling, and packaging. The appearance/packaging/instructions they design usually leave an area for changing the brand label according to different customer requirements.
Retevis or AILUNCE are backed by the same trading company, and their products are basically produced by the above factories in Quanzhou, Fujian, yes, the labels changed.
This is why these radios are so similar and used almost like the same.
Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)
YES, just the encryption table is different!VK3KYY wrote: ↑Wed Mar 01, 2023 11:19 amI looked at radio tool
Possibly just the encryption table is different
https://github.com/v0l/radio_tool/blob/ ... dm1701.hpp
No, I did not do too much work, I just extract STM_DFU_FwUpdate.cs and FirmwareLoaderUI_STM32 form, and made a small modification: call File.WriteAllBytes() to write all merged bytes to a binary file before MDUV380_ENCODE. then write the merged unencrypted binary file into the radio using radio_tool.
That's good news.
Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)
Here are the detail photos for your information.
Last edited by BD4VOW on Fri Mar 03, 2023 6:16 am, edited 1 time in total.
Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)
I will make a special version on the CPS today with support for this radio, by adding the encryption table, but there may be some other small differences in the loading commands
Re: Clone of UV380 etc
Thank you for the information
I know Baofeng and TYT are in the same city and that TYT radios are also sold using the Retevis brand name, Radioddity also rebrand some TYT radios
And the the official firmware for all these radios, including Baofang and TYT, is all written by a separate company.
The bootloader in the Baofeng and TYT radios is almost identical, so it also is probably written by the same company who write the main application firmware
BTW
Do you have access to the build tool chain for the C7000 MCU which is used in many new radios. I think the CPU core in this chip is the Chinese CSky design, but there are many versions of this core.
GCC now supports some CSky processors, but possibly does not support the processor core used in the C7000
I also tried to use Ghidra to analyse the GD-73 firmware, which uses the C7000, but selecting CSky as the processor did not produce valid decompilation
Re: Clone of UV380 etc
Thank you for the information
I know Baofeng and TYT are in the same city and that TYT radios are also sold using the Retevis brand name, Radioddity also rebrand some TYT radios
And the the official firmware for all these radios, including Baofang and TYT, is all written by a separate company.
The bootloader in the Baofeng and TYT radios is almost identical, so it also is probably written by the same company who write the main application firmware
BTW
Do you have access to the build tool chain for the C7000 MCU which is used in many new radios. I think the CPU core in this chip is the Chinese CSky design, but there are many versions of this core.
GCC now supports some CSky processors, but possibly does not support the processor core used in the C7000
I also tried to use Ghidra to analyse the GD-73 firmware, which uses the C7000, but selecting CSky as the processor did not produce valid decompilation
Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)
BTW.
See https://www.youtube.com/watch?v=ScoVslqV5eY video I made a long time ago, buy it shows the UV380 PCB
Design of PCB is a lot different
I'm surprised that the baofeng radio works at all.
The PCB looks similar to the TYT MD-760 aka Radioddity GD-77, or the old Baofeng DM-1801, but I think the DM-1801 CPU is on the other side of the PCB, whereas this looks almost identical to the TYT MD-760
OpenRTx has some details of baofeng "md1702"
https://github.com/OpenRTX/OpenRTX/tree/md1702
But I think the model number is incorrect becuase MDxxxx is TYT DMxxxx is Baofeng code
Also RadioTool does not support a Baofeng 1702, so perhaps the data in OpenRTX is 1701/1802 ??
I compared the hw_config.h files in OpenRTx for 1702 and UV380 and they are identical except the 1702 does not have definitions for the rotary control
Does your radio have rotary control , like the UV380
Does the keypad work at all ??
Possibly the pin mapping on the CPU for the keypad is different
See https://www.youtube.com/watch?v=ScoVslqV5eY video I made a long time ago, buy it shows the UV380 PCB
Design of PCB is a lot different
I'm surprised that the baofeng radio works at all.
The PCB looks similar to the TYT MD-760 aka Radioddity GD-77, or the old Baofeng DM-1801, but I think the DM-1801 CPU is on the other side of the PCB, whereas this looks almost identical to the TYT MD-760
OpenRTx has some details of baofeng "md1702"
https://github.com/OpenRTX/OpenRTX/tree/md1702
But I think the model number is incorrect becuase MDxxxx is TYT DMxxxx is Baofeng code
Also RadioTool does not support a Baofeng 1702, so perhaps the data in OpenRTX is 1701/1802 ??
I compared the hw_config.h files in OpenRTx for 1702 and UV380 and they are identical except the 1702 does not have definitions for the rotary control
Does your radio have rotary control , like the UV380
Does the keypad work at all ??
Possibly the pin mapping on the CPU for the keypad is different