Archive for the 'Hacks' Category

CE115 Hacks for Vertex VX-4500 VX-4600 VX-450

Thursday, September 20th, 2012

Cross-posted from my notes pages…

Vertex CE115 Hack Notes

CE115.exe is located in C:\Vertex Standard\CE115\ and is used for the Vertex 4500/4600 mobiles and 450 portables. It has a number of “manufacturer” or “engineering” modes that allow access to fields in the programming software that are not normally accessible, which will allow changing of band limits (to allow out-of-band frequencies, such as amateur) and numerous other features and tweaks. Because of the nature of these fields, they can cause damage to your radio and serious degradation of performance. Do not use any of these engineering modes if you do not know what you’re getting into!

Command Line Switches:

/kaiha or –kaiha: This is manufacturer mode, and when successfully entered, will show a (M) after the program name in the title bar of the window. The password for this mode is “Kaihatsusha Senyou” (case-sensitive, no quotes, with the space).

/eng or –eng: This is engineering mode, password is “pasuwa-do”. Has less functionality available, but still allows changing the frequency bandsplit.

/siriaru or –siriaru: I’m not sure what the name of this mode is, but it displays an (SP) in the title bar of the program window. It seems to block out most (if not all) of the options in the Common > Hardware menu, and there doesn’t seem to be any features that are added… Password is “kanri bango”.

/ship or –ship: Again, not really sure of the name of this mode, other than “SHIP” mode (as shown in the titlebar. It must have some use in the factory… The password is “koujyou”.


Max Kelley KC2SPY

Vertex Standard CE39 Manufacturer Mode

Sunday, March 11th, 2012

Hi all… I have two Vertex Standard VX-900 VHF portable radios which I’ve been having issues with, because they always TX DPL’s in inverted polarity, rather than normal polarity. I did some looking around and realized that the standard file in CE39 for Windows has the option “DCS TX Data” in the “Common > Hardware” menu set to “Inverted”. However, there is no way to change this! The option is generally greyed out, along with others!

I had recently learned of the “Dealer” mode for some Vertex Standard software, where you right click on the shortcut to the programming software, and add a “-d” at the end of the target line. So, for example, “C:\Program Files (x86)\Vertex Standard\CE39Win.exe” -d would give you “dealer mode”, which appears to not exist for CE39, but does for CE60 for the VXR9000 and I imagine some others as well.

Anyhow, I was looking for a way to get into those greyed-out dropdown menus in the VX900 software, which would allow you to change squelch hysteresis, squelch attack time, squelch release time, etc. What I ended up doing was running CE39Win.exe with every single switch possible (-a,-b,-c,-d…) until the menu items became ungreyed. Well, they never came ungreyed, but with the switch “-m”, a password dialog popped up. I tried “password” and the program started up, but the boxes were still greyed out. So, it turns out, “password” was not the password. So, after a little bit of resourceful hacking, I was able to find the password, which is “ansho-bango” (no quotes).

So, in short, change the target of your program shortcut to append a “-m” at the end of the target line, save the shortcut, run the program, and type in “ansho-bango”, and ansho-bango, you’re ready to go!

Icom IC-F1721/1821/2721/2821 Serial Snooping

Thursday, March 1st, 2012

This is not really a complete post, but rather a quick snippet about snooping the serial data from Icom IC-F1721/1821/2721/2821 P25/analog mobile radios. There are a number of serial buses within the radio: one on the DB25 connector for accessories such as GPS, an internal NMEA GPS serial bus, a CLONE IN/OUT serial bus for radio programming, and the FMDA/MFDA bus which goes between the main microprocessor on the main board and the microprocessor on the control head. This snippet of info has to do with the final option, the FMDA/MFDA bus for control head communication. It operates at 5v TTL levels, at a baud rate close to 57600 (as best I could tell… It may not be an even baud rate.) I was impressed with how fast this bus was running, compared to the 9600 baud rate of Motorola’s internal SB9600 serial bus. Unfortunately, the only place to tap into this bus is inside the radio. I found that the data I was receiving from the bus was not error-free, either (probably due to lack of a buffer on the line, or incorrect baud rate), but I could clearly make out some of the channel names being printed on the display, and I could see what I thought were button codes. I believe FMDA stands for the TX from the control head to Main board, and MFDA stands for TX from Main unit to control head,  but I cannot be sure; One would have to check the service manual. The connection points I tapped into were very close to the ribbon cable connector on the main board for the control head ribbon cable:

The white wire is soldered to a plated-through hole which has either FMDA or MFDA on it (I can’t remember which I had at the time…). The other line (either FMDA or MFDA) is on the plated-through hole just below and left of the one that I have the white wire soldered to in the picture. In theory, you could inject your own “packets” into the serial bus to the radio or control head and control what channel the radio is on, emulate button presses, write to the display, etc.  (even PTT) via serial commands.

Motorola MCS2000 MIII No Power Up

Thursday, March 1st, 2012

OK, here’s another fix/modification… I received an MCS2000 with the FL 01/90 error code, which was extremely common in early production runs of this radio. This error disappeared when I removed the radio PCB from the actual body of the radio deck. So, I went to reinstall the PCB in the radio, installing a single screw at a time and powering up after each screw was added. When I added one of the metal clips that pressed some voltage regulators and the audio amplifier IC against the heatsink, the radio gave the fail code. After some research, it turns out that one of the regulators (the 5v regulator) can come unsoldered from the board due to the pressure of the metal clip pressing it down onto the heatsink. Motorola’s fix, rumor has it, is to shorten the metal tang of the heatsink clip to keep the clip from pressing down so hard on the regulator. I simply reflowed the regulator and added more solder, crossed my fingers, and hoped it would work for another while. Buttoned back up, the radio works like a charm!

Then, I decided to construct a programming cable for the radio using the schematics from BatLabs, and in the process I shorted the SW B+ line on the mic jack (pin 1) to ground, causing the display to go out on the control head, and all that was left on were the LEDs backlighting the keys. I removed power from the radio, let it sit a minute, and tried again, but to no avail. The radio would not power up!

Turns out, I burned some traces from the SW B+ pin on the 18-pin connector that goes from the radio deck to the control head, so the control head was not getting SW B+. This can be verified by checking both sides of a blue 10ohm resistor close to the mic jack, on the back (component) side of the control head board. It should show somewhere around 13v, or SW B+. In my case, it was showing only 2-3v, for some reason… So, I jumpered from pin 17 on the control head connector to the bottom side of that resistor, as such:

I also jumpered from the bottom side of the one capacitor shown to the transistor which is a part of the OPT SEL/SW B+ sensing circuit. Depending on the current drawn through the SW B+ pin on the mic connector, the radio decides whether SB9600 serial lines get sent to the mic jack, or if standard microphone/audio signals get sent to the mic jack. If current is zilch, it assumes that it is a microphone. If current is > 2 mA (I believe that’s the figure…) it decides that the attached device is a “SB9600 SMART” device, and sends the SB9600 to the mic connector. This is why a programming cable for the MCS has a 1k resistor from SW B+ (pin 1) to GND (causes 13mA of current to flow from SW B+, switching MCS into SB9600 Accessory mode). I found that I had no continuity between pin 1 of the mic jack and the 470ohm pullup resistor (possibly R0729) which supplies the SW B+ to the mic jack.

Like I said, the board layout is actually from a GM900 service manual (all I could find) but is *very* similar to the MCS2000’s layout. Hope this helps somebody down the road! The radio is now working like a charm once again.

Icom IC-F5061/F6061 External Footswitch Modifications

Thursday, March 1st, 2012

So, I had to interface an external footswitch to an Icom IC-F6061 being used as a control station (dispatch position) for a customer, and found that the PTT input on the DB25 of the radio does not use the audio from the front panel mic jack. It uses the audio from the external modulation input on the DB25 connector. While this is well and good in some applications, in this instance, it’s just a pain. So, I wrote up a little modification to accommodate a desk microphone plugged into the front mic jack which can be PTT’ed by either the microphone PTT button or the external footswitch.

Here is the PDF of the modification: Icom F5061-6061 Footswitch Mods


Long Time Gone

Friday, February 10th, 2012

OK, well it hasn’t been an entire year yet, but… It’s getting there :) Let’s do a little life update.

Currently, I am a student at Monroe Community College in Rochester, NY, studying Engineering Science for two years, to later transfer directly into the Rochester Institute of Technology for Electrical Engineering. First semester went fairly well, and the second is already underway and is proving to be just as enjoyable as the first!

This summer proved to be rather interesting, as I scored a job at a local two-way radio shop, selling surplus equipment on eBay. I am learning the trade super-fast, however, and I’m getting more and more proficient with bench work, and becoming more and more in tune with the current state of the two-way radio industry, what with websites like the BatBoard (discusses Motorola commercial radio equipment) and various mailing lists, such as Icom_LMR, etc. I have also had the chance to hone my soldering skills, and with the help of a hot-air rework station, stereoscope, and a fine-point soldering station, wonders can be accomplished.

For example, a ham friend of mine, Brent KC2QLJ, brought me his Yaesu FT-897D HF/VHF/UHF? radio which had some “issues.” He had bought a new antenna match unit which used balanced line instead of coaxial unbalanced feed to the antenna. Something was awry with it from the factory, however, and it caused massive amounts of RF to return into the shack, which was induced in the coiled microphone cord of the radio, and resulted in a radio that would not PTT from the front mic jack. Nothing else was wrong, except that it wouldn’t transmit from the front mic jack. Regardless of what microphone was tried, the symptom still remained. What ended up being the culprit was a burnt-up 1K resistor located close to the molex connector on the main PCB of the radio, into which a plug from the front panel microphone jack is plugged into. More specifically, it was R1571, a 1kOhm resistor, which had burnt itself up trying to resist the high level of RF coming in through the mic jack. I replaced it with an 0603 size SMT resistor, which was slightly too big, but it worked regardless, and PTT function was restored.

Transmit audio was also found to be missing from the front mic jack, and R1573 (on the flip side of the board) was determined to be the culprit. It was yet another 1kOhm resistor, and it was quickly repaired.

Although there really was a ridiculous amount of RF in his shack to have caused this, Vertex and Yaesu as a whole seem to be very susceptible to RF getting in through microphone cords, control head cables, etc. I don’t think the Vertex engineers get it! (of course, now they were bought out by Motorola, so who knows who the actual Vertex “engineers” are now!)

So, hopefully, this post will set a precedent for posts to come… I really love technical blogs such as, and, and hopefully I can turn this blog into more of a technical resource, filled with the things that I gather in my “travels.”

Till next time… seeYA!

Mother-Moto arrives!

Monday, April 12th, 2010

Ahhhhh, sweet Motorola goodness arrived in the form of a USPS Priority Mail box at my front door last Friday. I purchased, off eBay, a Motorola MT2000 commercial UHF portable for a very decent price! Came with speakermic and charger, etc. This is to replace my Kenwood TK-380 which, sadly, didn’t do the 440 ham band. I found, though, that the MT2000, while being older, has slightly more features, which is good! It’ll do 160 different modes (like channels) out of the box, and in basically unlimited zones, I believe, or groups of channels. I’ve heard, however, there’s a setting that will allow you to increase that number of modes up to 255, which I have yet to do.

Regardless, I got it all programmed up as I like it, and I’m very pleased! 4w on UHF gets places, when I’m used to having only about 1.5w on the old Icom IC-24AT. I’ve got all the area repeaters on UHF that I know programmed in (29 in total), and I’m working on adding commercial stuff for scanning, as well as FRS/GMRS. Overall, I’m very pleased. In order to program this beastie, I’ve got to use the Motorola RSS, which works ONLY in MS-DOS mode on a spare Windows 98 computer I have sitting down. Originally, I thought, “Bah, I’m going to ignore all those people who say, ‘You must use DOS to program these…’ But, anything else just plain DOESN’T WORK, not even an MS-DOS prompt window on Windows 98.

Trust me, I tried it, didn’t get anywhere.

Sooooo, if anybody has any questions about the radio or programming it, I’d be happy to help :) Just leave a comment here, or send me an email.

Of Wet Cellphones…

Wednesday, November 12th, 2008

Well, my dad decided to wash his cellphone, except I think he really didn’t mean to.. well, the upside is that I got to gut the phone in drying it out, and it’s actually working, somewhat.. there’s some leftover rubbing alcohol in the screen which is drying out (I used alcohol to displace the water) but I think the mic might be busted, kinda killing the whole phone aspect of it :)

Enjoy the pictures, tho!

Paperclip CW and Laptop Rescue

Sunday, November 2nd, 2008

Sending CW...

Well, long time since an entry, and I have to attribute the inspiration/motivation to write this one to N2QDK, Mike Wren for giving me the idea to write this entry (ok, he told me to write it..) Anyhow, this weekend was the CW Sweepstakes, a contest on the radio using CW (Morse-code, for those non-radio types). Now, I’m of the newer generation of hams, who didn’t require a morse code test to get their license, but nevertheless, I have been attempting to learn my code. This weekend, Paul Mackanos, K2DB, was operating from his station in the Adirondacks, K2NNY, and he encouraged the members of a local club, the Rochester DX Association (which I am a member of..) to contact him. So, feeling lucky, I decided to try and make a contact with Morse code with him. Without a Morse code key.

At this point, I’m sure you’re thoroughly confused, and it’s ok, you should be. But, ingenious as I am, I decided to make my own, using a paperclip and a 1/4inch mono cable (actually, my sister’s instrument cable.. shhh..). It actually worked alright, and I was able to send a relatively clean rendition of my callsign. Now, receiving.. that was a different ordeal. I am horrible at copying at the speeds that Paul was operating at (or copying at all) so I tried to use CW decoding software on the computer. I was able to decode a few of his exchanges, but a good deal of it was garbled, unfortunately, due to machine error. If I knew the code, I definitely would have been able to copy him, as he had a perfectly fine signal. So, I threw my call out there, hoping for the best. Unfortunately, the poor accuracy of the CW decoding software hindered my means of telling whether he actually heard me or not. Oh well, it was fun!

Toshiba Satellite Laptop BIOS Reset

Now, in other news, I was given an ooold Toshiba laptop by Irv, AF2K, to fix, last weekend. He said, “It starts up with a [BIOS] password prompt, and won’t do anything more.” I figured, ok, I’ll open it up and use the reset jumper. “Well, one of the screws is stripped..,” he says. So, to Google I go, searching for a way to get in: backdoor passwords, special keystrokes, floppy images.. nothing of that sort. Finally, I stumbled upon a website that described a special “dongle” that shorted some pins on the parallel port, bypassing the password and putting you in the BIOS setup. So, off I went, constructing what you see above to the instructions below.

Short pins: (1,5,10) (2,11) (3,17) (4,12) (6,16) (7,13) (8,14) & (9,15)

When I was done, I checked the shorted pins for continuity, plugged it in, crossed my fingers… and voila! I was in the BIOS setup! I cleared the password, and booted up to the strangely beautiful sight of Windows XP. Irv had been telling me, “I doubt you can fix it, I’ve had so many other guys look at it, try and get it to work, but to no avail.” I call him, “When would you like to come pick up your laptop?” Needless to say, he was stunned.

That’s all for now, folks.. come back next time!

HP Pavilion Secrecies!

Tuesday, August 21st, 2007

Well, boy have I got a fun post for you today! Along with the addition of a new category, Hacks! Along with that, I’ve added some pictures of the whole NOC (network operation center, for those of you with a life) here at

Right, well, on to the secrecies. I’ve been really excited to discover that a computer of mine from 1998 (HP Pavilion 8570C) actually has TV-out capabilities. I was cleaning out the case, and discovered a chip near the integrated video chip on the motherboard that read ImpacTV2, and became interested. I googled the name, and it turned out to be a TV encoder chip, which provided TV output capabilities to the video hardware on the motherboard. Nice! Next to it, I later discovered a set of pins labeled TVCON. Once again, I turned to Google for an answer, and I came up with this pinout:
So, I took a remainder of the IDE ribbon cable I used in the CueCat Surgery post (here), cut it to the length of the header, and clipped an RCA jack to the end of the cable. Into the TV it went, turned on the computer, and voila, I see computer on my TV! If I had wanted to, I could have used the S-Video output (Luma and Chroma) but I didn’t have enough cables to be able to sabotage one.

Conclusion: So, if you have an ASUS board with integrated ATI video, check out and see if there’s a TVCON header on the board. This weekend, I was able to snag a slightly newer (2001) HP Pavilion 510x and it had a 2 sets of headers on the board, labeled LCDTV. One was the same type of header as the TVCON header on the other Pavilion, so I will attempt to get video out from this one as well. It seems an odd decision for HP to exclude built-in jacks for this functionality. It would have cost them, at the most, a dollar more to add an RCA and SVideo jack to the back of this computer. The older pavilion even had solder pads for them on a riser card used for the sound connections.

Anyways, have fun with it, and happy hacking!