September 20th, 2012

Cross-posted from my notes pages…

Vertex CE115 Hack Notes

CE115.exe is located in C:\Vertex Standard\CE115\ and is used for the Vertex 4500/4600 mobiles and 450 portables. It has a number of “manufacturer” or “engineering” modes that allow access to fields in the programming software that are not normally accessible, which will allow changing of band limits (to allow out-of-band frequencies, such as amateur) and numerous other features and tweaks. Because of the nature of these fields, they can cause damage to your radio and serious degradation of performance. Do not use any of these engineering modes if you do not know what you’re getting into!

Command Line Switches:

/kaiha or –kaiha: This is manufacturer mode, and when successfully entered, will show a (M) after the program name in the title bar of the window. The password for this mode is “Kaihatsusha Senyou” (case-sensitive, no quotes, with the space).

/eng or –eng: This is engineering mode, password is “pasuwa-do”. Has less functionality available, but still allows changing the frequency bandsplit.

/siriaru or –siriaru: I’m not sure what the name of this mode is, but it displays an (SP) in the title bar of the program window. It seems to block out most (if not all) of the options in the Common > Hardware menu, and there doesn’t seem to be any features that are added… Password is “kanri bango”.

/ship or –ship: Again, not really sure of the name of this mode, other than “SHIP” mode (as shown in the titlebar. It must have some use in the factory… The password is “koujyou”.


Max Kelley KC2SPY

March 11th, 2012

Hi all… I have two Vertex Standard VX-900 VHF portable radios which I’ve been having issues with, because they always TX DPL’s in inverted polarity, rather than normal polarity. I did some looking around and realized that the standard file in CE39 for Windows has the option “DCS TX Data” in the “Common > Hardware” menu set to “Inverted”. However, there is no way to change this! The option is generally greyed out, along with others!

I had recently learned of the “Dealer” mode for some Vertex Standard software, where you right click on the shortcut to the programming software, and add a “-d” at the end of the target line. So, for example, “C:\Program Files (x86)\Vertex Standard\CE39Win.exe” -d would give you “dealer mode”, which appears to not exist for CE39, but does for CE60 for the VXR9000 and I imagine some others as well.

Anyhow, I was looking for a way to get into those greyed-out dropdown menus in the VX900 software, which would allow you to change squelch hysteresis, squelch attack time, squelch release time, etc. What I ended up doing was running CE39Win.exe with every single switch possible (-a,-b,-c,-d…) until the menu items became ungreyed. Well, they never came ungreyed, but with the switch “-m”, a password dialog popped up. I tried “password” and the program started up, but the boxes were still greyed out. So, it turns out, “password” was not the password. So, after a little bit of resourceful hacking, I was able to find the password, which is “ansho-bango” (no quotes).

So, in short, change the target of your program shortcut to append a “-m” at the end of the target line, save the shortcut, run the program, and type in “ansho-bango”, and ansho-bango, you’re ready to go!

March 1st, 2012

This is not really a complete post, but rather a quick snippet about snooping the serial data from Icom IC-F1721/1821/2721/2821 P25/analog mobile radios. There are a number of serial buses within the radio: one on the DB25 connector for accessories such as GPS, an internal NMEA GPS serial bus, a CLONE IN/OUT serial bus for radio programming, and the FMDA/MFDA bus which goes between the main microprocessor on the main board and the microprocessor on the control head. This snippet of info has to do with the final option, the FMDA/MFDA bus for control head communication. It operates at 5v TTL levels, at a baud rate close to 57600 (as best I could tell… It may not be an even baud rate.) I was impressed with how fast this bus was running, compared to the 9600 baud rate of Motorola’s internal SB9600 serial bus. Unfortunately, the only place to tap into this bus is inside the radio. I found that the data I was receiving from the bus was not error-free, either (probably due to lack of a buffer on the line, or incorrect baud rate), but I could clearly make out some of the channel names being printed on the display, and I could see what I thought were button codes. I believe FMDA stands for the TX from the control head to Main board, and MFDA stands for TX from Main unit to control head,  but I cannot be sure; One would have to check the service manual. The connection points I tapped into were very close to the ribbon cable connector on the main board for the control head ribbon cable:

The white wire is soldered to a plated-through hole which has either FMDA or MFDA on it (I can’t remember which I had at the time…). The other line (either FMDA or MFDA) is on the plated-through hole just below and left of the one that I have the white wire soldered to in the picture. In theory, you could inject your own “packets” into the serial bus to the radio or control head and control what channel the radio is on, emulate button presses, write to the display, etc.  (even PTT) via serial commands.

March 1st, 2012

OK, here’s another fix/modification… I received an MCS2000 with the FL 01/90 error code, which was extremely common in early production runs of this radio. This error disappeared when I removed the radio PCB from the actual body of the radio deck. So, I went to reinstall the PCB in the radio, installing a single screw at a time and powering up after each screw was added. When I added one of the metal clips that pressed some voltage regulators and the audio amplifier IC against the heatsink, the radio gave the fail code. After some research, it turns out that one of the regulators (the 5v regulator) can come unsoldered from the board due to the pressure of the metal clip pressing it down onto the heatsink. Motorola’s fix, rumor has it, is to shorten the metal tang of the heatsink clip to keep the clip from pressing down so hard on the regulator. I simply reflowed the regulator and added more solder, crossed my fingers, and hoped it would work for another while. Buttoned back up, the radio works like a charm!

Then, I decided to construct a programming cable for the radio using the schematics from BatLabs, and in the process I shorted the SW B+ line on the mic jack (pin 1) to ground, causing the display to go out on the control head, and all that was left on were the LEDs backlighting the keys. I removed power from the radio, let it sit a minute, and tried again, but to no avail. The radio would not power up!

Turns out, I burned some traces from the SW B+ pin on the 18-pin connector that goes from the radio deck to the control head, so the control head was not getting SW B+. This can be verified by checking both sides of a blue 10ohm resistor close to the mic jack, on the back (component) side of the control head board. It should show somewhere around 13v, or SW B+. In my case, it was showing only 2-3v, for some reason… So, I jumpered from pin 17 on the control head connector to the bottom side of that resistor, as such:

I also jumpered from the bottom side of the one capacitor shown to the transistor which is a part of the OPT SEL/SW B+ sensing circuit. Depending on the current drawn through the SW B+ pin on the mic connector, the radio decides whether SB9600 serial lines get sent to the mic jack, or if standard microphone/audio signals get sent to the mic jack. If current is zilch, it assumes that it is a microphone. If current is > 2 mA (I believe that’s the figure…) it decides that the attached device is a “SB9600 SMART” device, and sends the SB9600 to the mic connector. This is why a programming cable for the MCS has a 1k resistor from SW B+ (pin 1) to GND (causes 13mA of current to flow from SW B+, switching MCS into SB9600 Accessory mode). I found that I had no continuity between pin 1 of the mic jack and the 470ohm pullup resistor (possibly R0729) which supplies the SW B+ to the mic jack.

Like I said, the board layout is actually from a GM900 service manual (all I could find) but is *very* similar to the MCS2000’s layout. Hope this helps somebody down the road! The radio is now working like a charm once again.

March 1st, 2012

So, I had to interface an external footswitch to an Icom IC-F6061 being used as a control station (dispatch position) for a customer, and found that the PTT input on the DB25 of the radio does not use the audio from the front panel mic jack. It uses the audio from the external modulation input on the DB25 connector. While this is well and good in some applications, in this instance, it’s just a pain. So, I wrote up a little modification to accommodate a desk microphone plugged into the front mic jack which can be PTT’ed by either the microphone PTT button or the external footswitch.

Here is the PDF of the modification: Icom F5061-6061 Footswitch Mods


February 10th, 2012

OK, well it hasn’t been an entire year yet, but… It’s getting there :) Let’s do a little life update.

Currently, I am a student at Monroe Community College in Rochester, NY, studying Engineering Science for two years, to later transfer directly into the Rochester Institute of Technology for Electrical Engineering. First semester went fairly well, and the second is already underway and is proving to be just as enjoyable as the first!

This summer proved to be rather interesting, as I scored a job at a local two-way radio shop, selling surplus equipment on eBay. I am learning the trade super-fast, however, and I’m getting more and more proficient with bench work, and becoming more and more in tune with the current state of the two-way radio industry, what with websites like the BatBoard (discusses Motorola commercial radio equipment) and various mailing lists, such as Icom_LMR, etc. I have also had the chance to hone my soldering skills, and with the help of a hot-air rework station, stereoscope, and a fine-point soldering station, wonders can be accomplished.

For example, a ham friend of mine, Brent KC2QLJ, brought me his Yaesu FT-897D HF/VHF/UHF? radio which had some “issues.” He had bought a new antenna match unit which used balanced line instead of coaxial unbalanced feed to the antenna. Something was awry with it from the factory, however, and it caused massive amounts of RF to return into the shack, which was induced in the coiled microphone cord of the radio, and resulted in a radio that would not PTT from the front mic jack. Nothing else was wrong, except that it wouldn’t transmit from the front mic jack. Regardless of what microphone was tried, the symptom still remained. What ended up being the culprit was a burnt-up 1K resistor located close to the molex connector on the main PCB of the radio, into which a plug from the front panel microphone jack is plugged into. More specifically, it was R1571, a 1kOhm resistor, which had burnt itself up trying to resist the high level of RF coming in through the mic jack. I replaced it with an 0603 size SMT resistor, which was slightly too big, but it worked regardless, and PTT function was restored.

Transmit audio was also found to be missing from the front mic jack, and R1573 (on the flip side of the board) was determined to be the culprit. It was yet another 1kOhm resistor, and it was quickly repaired.

Although there really was a ridiculous amount of RF in his shack to have caused this, Vertex and Yaesu as a whole seem to be very susceptible to RF getting in through microphone cords, control head cables, etc. I don’t think the Vertex engineers get it! (of course, now they were bought out by Motorola, so who knows who the actual Vertex “engineers” are now!)

So, hopefully, this post will set a precedent for posts to come… I really love technical blogs such as, and, and hopefully I can turn this blog into more of a technical resource, filled with the things that I gather in my “travels.”

Till next time… seeYA!

June 14th, 2011

Well, it’s been a great few years doing the tech tip, and I’ve really enjoyed everyone’s support in reviving it from the middle school days. I’ve had lots of fun! It being Webster Thomas’ last day of school, I decided to give a rather appropriate tech tip for the coming summer months. Everyone enjoys sitting out in the sun, perhaps by a pool, with a nice cold beverage in hand. However, after a while, say you don’t want to hold that beverage any longer. You need a cupholder! Give this a try, it should fix your problem!

June 7th, 2011

There are so many places to get music from today that are… of questionable source, legality, and whatnot. Well, I don’t have a solution to that, other than pony up the cash, but here’s perhaps the simplest way to find music that’s hiding deep within the recesses of the Internet. (pronounced MP3) is a website which searches the Internet for the song that you’re looking for, and provides you a download link for it. Just type in the name of the song, and wait for it to appear in the list below the search box. Then, click on it to download it, or even play it on the website to make sure it’s what you want. Again, the legality of this, I’m not entirely sure… that’s up to you to find out! Do with it what you may!

June 2nd, 2011

So, you buy a new computer, which is sweet! Love new computers! And you start it up for the first time, and instantly, the problems begin. Offers of “Free Internet Access”, and “Free Trial of Such-n-such-a-program” pop up. It’s official. Your brand-spanking-new computer has crapware.

Crapware is software that the computer manufacturer installs on your new computer at the factory, generally in the form of “free” trials and such that force you to buy the full version of the program. Normally, you’d have to uninstall all of the “crapware” individually, but the PC DeCrapifier takes care of all of them, automatically! Give it a try!

May 3rd, 2011

This week’s tech tip is about a web service which aims to provide its users with a suite of “powerful creative applications”, right within your browser. So, sort of like the Adobe suite of programs (Photoshop, Illustrator, Premiere, Soundbooth, etc) except that it’s all free, and online. Take a look at Aviary (, and check out their eight online, web-based creative programs: image editor, screen capture, vector editor, effects editor, music creator, audio editor, image markup, and swatch editor. It’s a really neat collection of programs, and I highly suggest playing around with them!