Giter VIP home page Giter VIP logo

quansheng_uv-k5_firmware's Introduction

TOC

At the beginning I was planning to put here only official firmwares found somewhere in update files and internet but now, with help from people involved in process of reverse enginnering of uvk5 you can find here some knowledge and findings regarding our very wallet friendly yet so capable radio. Here is table of contents of this repository.

Build your own firmware - /uvmod_kitchen

You can select what you want to include in your modded firmware. If you want unlock all frequencies but also have custom frequency steps? This is section for you. Thanks to this tool you can mix and match different mods to be included in final firmware. All mods are basing on firmware version k5_2.01.26.

Build your own firmware - /uvmod_kitchen_31

Same as above but all mods are basing on firmware version k5_2.01.31.

Documents - /docs

Some (incomplete) documents with info about CPU I/O pins, memory mappings, firmware format etc.

Font and graphics - /font_and_graphics

Simple python script which extracts from firmware all bitmaps used in radio's user interface. It works as substitute of documentation.

Datasheets and drawings - /hardware

Here are all the efforts of searching internet for datasheets but also drawings of reverse engineered schematics and high resolution photos of PCB.

OpenOCD configs - /openocd

Tools necessary to unbrick your radio or dump flash memory.

Utility scripts - /python-utils

Python library and sample scripts which leverage official communication protocol. You can dump EEPROM and reboot your radio or decode firmware.

Quansheng UV-K5 Firmware collection - /firmware

Only stock firmwares, no mods, no alterations. If you want modified firmware ready to flash please check out Andrej's repo

Firmware_Version Programming software Firmware-Updater
k5_2.01.17
k5_2.01.19 1.1.11
k5_2.01.23 V1.0.38 2023-02-11 07:49:36 1.1.11
k5_2.01.25 Not released, dumped from device n/a
k5_2.01.26 V1.0.38 1.1.12
k5_2.01.27 Not released, dumped from device by @CloverGit n/a
k5_2.01.27 Released on Radtel Site 1.1.12
k5_2.01.31 Official fw, released 2023-09-02 (UV-K5) 1.1.12
k5_2.01.32 Released on Radtel Site 1.1.12
k5_2.01.33 Official fw, released 2024-03-05 (UV-K5) 1.1.12
k6_3.00.10 Not released, dumped from device (UV-K6) n/a
k6_3.00.15 Official fw, released 2023-09-02 (UV-K6) 1.1.12
k6_3.00.17 Official fw, released 2024-03-05 (UV-K6) 1.1.12
k5_4.00.01 Not released, dumped from device (UV-5R PLUS) n/a
k5_4.00.06 Released on Radtel Site 1.1.12
k5_4.00.07 From @Andy-GM (see #117) (UV-5R PLUS) n/a

All files from table are already encoded and can be directly flashed using firmware updater V1.1.12.

Links

Thanks for all contributors

quansheng_uv-k5_firmware's People

Contributors

2ftg avatar amnemonic avatar clovergit avatar de8msh avatar egzumer avatar guilhem avatar kdmcmullan avatar ludwich66 avatar mcules avatar re3con avatar schumar avatar siklosi avatar stache3000 avatar szetya avatar tunas1337 avatar whosmatt avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

quansheng_uv-k5_firmware's Issues

error_msg @ mod_ota_qrg.py

when I try to change the aircopy frequency via mod_ota_qrg.py in build.bat i get this error message:

C:\Firmware_kitchen>python mod_ota_qrg.py temp\fw.dec.bin
File "C:\Firmware_kitchen\mod_ota_qrg.py", line 91
<title>Quansheng_UV-K5_Firmware/uvmod_kitchen/mod_ota_qrg.py at main · amnemonic/Quansheng_UV-K5_Firmware · GitHub</title>
^
SyntaxError: invalid character '·' (U+00B7)

error

Separate wide narrow settins for receiver/transmitter.

It would be great to have separate settings for wide/narrow in receiver and transmitter. Interesting if this can be done as as software mod? The practice on amateur radio is to get highest possible effectiveness and this is done by modulating as much as possible - so much to fill the receivers filter. To achieve this the receiver has to be set to narrow and the transmitter to wide.

This is in contrary to adjacent channel emission suppression. But on amateur bands channels with 12,5k spacing are practically not in use at least on simplex channels. So effectiveness is preferred. Just 25k spacing is to be watched.

FM bands for hearing assistance

My goal is to be able to use the UV-K5 for events that broadcast audio for hearing assistance in the range of 72-76MHz.

I have very little experience with radios. I thought I could do this out of the box, but this past weekend, I punched in the right frequency (72.9). But I heard nothing. I had to hit the monitor button to hear anything at all, but I got a lot of static and only barely heard what's going on amid the static. It basically wasn't usable.

I thought maybe I could use the "FM Radio" setting, but that doesn't go below 76MHz.

I think the difference is the bandwidth? I think normally it's using a bandwidth of 25kHz, but commercial FM radio uses 200kHz? But I'm pretty uneducated here, so I don't know.

So I think what I'd need is a way to extend the range of the FM Radio down to 72MHz. Is there a way to do that? I don't see that in any of the files right now.

Here's a link to the manual for a transmitter for this purpose: https://williamsav.com/wp-content/uploads/2020/04/ppa_375_manual_en.pdf

More DTMF [request not issue]

A kitchen request: DTMF tones for the numeric keypad 0-9 and #* instead of the annoying beeps!

Activated by menu/key beep on/off - is it possible Adam?

Love UV Mod Kitchen keep up the great work!

Mark

downgrade firmware?

I have UV-5R PLUS with k5_4.00.01 version firmware.
I can't flash any modded firmware - I am getting kind of version control message:


Warning

The file version is not match!

OK

I am using Portable Radio Update tools v.1.1.12

Are there any options to downgrade or how coul I get modded firmware on newer radios?

Fake AM modulation

Hello!
I compare this radio with real AM modulation TRX (FT817). My conclusion: AM switch does not change anything in TX and RX demodulated sound. I am not seeing AM modulation option in the BK48196 datasheet. Did you test this feature?

Access to channel skip by button.

It would be great to have a quick access to channel skip setting when in scanning mode. Without going through a menu and changing the setting for specific channel. It is a common function in dedicated scanner radios. When scannig stops on channel stops on a channel you do not want to listen to actually because of noise on the specific frequency or uninteresting conversation you cen quickly sen this channel to be skipped in further scanning, typically but not necessary by one touch.
Is it possible to add this function to Quansheng?

Multiple Language Telegram Channels

I have added the following request to my mirror page. Greetings from Munich Ludwich

I would like to ask the two Spanish Telegram Channels to merge.
It makes little sense to distribute a few OM to two "equal" channels.
Just open a third channel and direct all users there ;-)
Here is my offer until we find a solution together!
Telegram Channel - ES *
Telegram Channel - ES #

[BUG] uvmod_kitchen is not work for k5_v3.00.10_flashable.bin

run python log:

Running mod_more_freq_steps.py mod...
Running mod_enable_tx_50to850.py mod...
ERROR: Cant find function
Saved encoded firmware to k5_v3.00.10_MODDED.bin

The mod.bin does not support freq from 18-1300Mhz, nor does it support full-band transmission from 50-850Mhz. Functionally it is the same as the original firmware.

Can‘t get a output file from uvmod_kitchen

Hello, I am BH4GCN, an HAM from China. And I am trying to customize a version of UV-K5 firmware by using uvmod_kitchen.
I installed python and modified build.bat , and then ran it in the cmd window. The output seems to have no error, but there is no output of the modified firmware in the temp folder, and the folder is empty.And I also tried to run build.bat directly in cmd without modifying it , and there is also no output in the temp folder.
So I'm wondering if I'm doing something wrong. I hope that any HAMs who knows how to do it can leave a message and tell me. Thank you very much.

The following is the code output in the cmd window

image

Errors during font creation

Hi!
I redrew the font and used the encoder. After flashing the radio, the font shows up with stripes.
I made different pictures for the encoder - with and without color labels. The result is the same.
Large numbers were converted normally.

image

mod_custom_alphabet.py.txt

Alphabet_Stock_Font

TX output low on 70 cm after mods

I've noticed that my TX maximum output is only 2.4 watts on 446 Mhz after mods. Prior to mods it's 4.6watts. I don't know how to enable the mods while retaining the higher TX output.

Font and graphics address for V3 firmware

The V3 firmware add support for Chinese, so the Font and graphics address is changed.

Here are the font & graphic address. (Tested with k5_V3.00.10_encrypted_18to1300MHz.bin)

Addr Length Section Note
0x0000CED0 434 Misc symbols 62 Characters, 7 bytes Each.
0x0000D082 286 Big digits 11 Characters, 26 bytes Each
0x0000D1A0 77 Small digits 11 Characters, 7 bytes Each
0x0000D1ED 1316 Full alphabet 94 characters, 14 bytes each
0x0000D711 3718 Chinese characters 143 characters, 26 bytes each

Updated extract script
https://gist.github.com/tywtyw2002/fc90f8f8305120c42973d30868ed227e

Use hidden menu (switch on with PTT+Sidekey1 pushed) to enable/disable patches

switching the radio on with PTT and Sidekey 1 pushed appears in custom firmware redunant entries. There functions are bypassed with custom firmware. That's 350TX on/off, 200TX on/off, 500TX and 350Enh. TX on/off, F-Lock too?
Giving this another purpose. Changing it to Display Invert on/off, TX Airband on/off, TX on/off, Mic Gain +16 on/off etc... allows the user more controll.
Enter to VOL in menu (voltage) makes no changes, should/could adjust the real battery Voltage?

Add Overview Table

Can you add a table to the page from which you can see the different software versions? So far I have (unfortunately) not been able to tell any difference between the 23 and the 26 version. The possibility of documenting these FW changes is essential for the CHIRP implementation anyway.

A "ManualWiki" (multilingual) that shows the current status of the device would also be useful.

Why not do a fusion with https://github.com/sq5bpf/uvk5-reverse-engineering. A large team also distributes more power ;-).

Best greetings
Ludwich

Datum Firmware-Updater Firmware_Version Programmingsoftware
    k5_2.01.17  
2023/<05 1.1.11 k5_2.01.19  
2023/05 1.1.11 k5_2.01.23 V1.0.38 2023-02-11 07:49:36
2023/05/09 1.1.12 k5_2.01.26 V1.0.38
       
       
       

Tx range limited using uvmod kitchen. 18 to 1300 not possible

I was using uvmod kitchen. My intention was to leave with with full tx range but it appeared impossible. The transmitter does not work below 50 and above 600 MHz. Is there a way to to set it to at least 18 to 1300?
I tried to start with modded firmware ( 18to 1300) without enabling any tx modes and it works for some mods like mic gain and noaa freq replacing. But than the frequency ranges setting mode does not work as it checks original input ranges and reports error. What is this check done for?

mod_more_freq_steps is flawed

https://github.com/amnemonic/Quansheng_UV-K5_Firmware/blob/0804a92ee9951a31a48e0f9e977b4cc36d87c038/uvmod_kitchen/mod_more_freq_steps.py#L35C1-L38C28

Due to (presumably) compiler optimization, the constants for the array sizes are also used multiple other times in the firmware and cause unintentional changes.
So far I noticed that other menu item array sizes also increased, such as backlight duration (ABR) as well as F-LOCK. Going out of bounds with one of the lower menu items that have text options instead of just a number can freeze the firmware.

A potential solution might be adding new constants similar to how the new array was added and changing the references to those.

some python scripts test work on linux. how 2 flash use py?

get_version, adc_read, batt_calibrator, reboot_radio, configmem_dump, configmem_read, configmem_write are tested and work good

configmem_dump wired, may be it's that I mess the meaning of that file. I mistake it used for dump firmware.

ps: can I use a python script to flash firmware? I tried use dnSPY to find out the address, lengeth, baudrate but failed cz I am not good at dnSPY. Good news your code shows the baudrate is 38400. piotr022/UV_K5_playground has a mem-map show start at 0x10C0(or Ox1000). But your docs shows flash start at 0x0F000 and end at 0x0FFFF

detail:

# K5 without battery, only with typeC
$ python version.py 
>> abcd0800026910e6b1dd58242bdfdcba
<< abcd2800036930e645a452720f05e46e2135e980f28d14e62e910d400faee76fa12d81b70b3131a05b02b861decadcba
CMD: 0x0515
LEN: 0x0024
VER: k5_2.01.26

$ python adc_read.py /dev/ttyUSB0
8.2828 V (RAW=2147)  | Charging (RAW=0)
8.2713 V (RAW=2144)  | Charging (RAW=0)
8.2751 V (RAW=2145)  | Charging (RAW=0)
8.2828 V (RAW=2147)  | Charging (RAW=0)
8.2790 V (RAW=2146)  | Charging (RAW=0)
8.2790 V (RAW=2146)  | Charging (RAW=0)
8.2713 V (RAW=2144)  | Charging (RAW=0)

$ python batt_calibrator.py /dev/ttyU
SB0 read val0
Level 0: [1299] 5.01 V // Empty battery blinking
Level 1: [1793] 6.92 V // 1 battery bar if above this value
Level 2: [1893] 7.30 V // 2 battery bars if above this value
Level 3: [1970] 7.60 V // 3 battery bars if above this value, also value used to calculate adc to volt
Level 4: [2048] 7.90 V // 4 battery bars if above this value
Level 5: [2300] 8.87 V // overwritten by radio to 2300 anyway

Actual = 8.24 V

$ python reboot_radio.py /dev/ttyUSB0

$ python configmem_dump.py /dev/ttyUS
B0 test.bin
Reading 0000...
Reading 0080...
Reading 0100...
Reading 0180...
Reading 0200...
Reading 0280...
Reading 0300...
Reading 0380...
Reading 0400...
Reading 0480...
Reading 0500...
Reading 0580...
Reading 0600...
Reading 0680...
Reading 0700...
Reading 0780...
Reading 0800...
Reading 0880...
Reading 0900...
Reading 0980...
Reading 0A00...
Reading 0A80...
Reading 0B00...
Reading 0B80...
Reading 0C00...
Reading 0C80...
Reading 0D00...
Reading 0D80...
Reading 0E00...
Reading 0E80...
Reading 0F00...
Reading 0F80...
Reading 1000...
Reading 1080...
Reading 1100...
Reading 1180...
Reading 1200...
Reading 1280...
Reading 1300...
Reading 1380...
Reading 1400...
Reading 1480...
Reading 1500...
Reading 1580...
Reading 1600...
Reading 1680...
Reading 1700...
Reading 1780...
Reading 1800...
Reading 1880...
Reading 1900...
Reading 1980...
Reading 1A00...
Reading 1A80...
Reading 1B00...
Reading 1B80...
Reading 1C00...
Reading 1C80...
Reading 1D00...
Reading 1D80...
Reading 1E00...
Reading 1E80...
Reading 1F00...
Reading 1F80...
$ md5sum test.bin 
a03555fdba7a517121f8c7132d98d6d7  test.bin
$ ls -agh test.bin 
-rw-r--r-- 1 mifen 8.0K  8月10日 11:07 test.bin

# repo download
$ md5sum ../firmware/k5_v2.01.26_publish.bin 
f7648e381d9707a43d4c2185dddf1613  ../firmware/k5_v2.01.26_publish.bin

# official download
$ md5sum k5固件v2.01.26_publish.bin 
f7648e381d9707a43d4c2185dddf1613  k5固件v2.01.26_publish.bin

$ python configmem_read.py /dev/ttyUSB0 0x0F40 8
03000000000101ff

$ python configmem_write.py /dev/ttyUSB0 0x0F40 00010001010101ff
PAYLOAD= 00010001010101ff

uvmod_kitchen update ?

Hi Adam @amnemonic, let me start with a huge thank you for the effort you are putting into this great development of a surprisingly capable radio (for the price). I understand that this is team work with other brillant people, kudos to everybody involved !

I'm trying to coock my first firmware mod with the files from the "uvmod_kitchen" repository. However looks like the file "mod_enable_tx_50to850.py" is a previous version with "limited" band.

Would it be possible to update the repo with the latest file (18 to 1300 mhz) ?

Thanks
73' IU4MJW

Tried to dump the latest firmware but it failed

I recently purchased a UV-K5 and noticed that it is running firmware version k5_2.01.27 (not released on qsfj.com). I'm sure it's the latest firmware because I purchased the device from a retail store where just a few kilometers from Quansheng company. Using openocd and uvk5.cfg configuration file I can connect to my device normally, Connecting to the debugger only enters the HardFault state, even use reset run, but when I dump the firmware using the dump_image flash.bin 0x0 0x10000 command I find that the saved file is filled with 0x00. I suspect it's because the chip has read protection turned on, but I can't be sure of that.
image

[Feature Request] Modify DTMF Key frequencies

Feature Request: modify DTMF Key frequencies

Description:
I would like to request the implementation of a new mod that allows the modification of the DTMF key frequencies, ensuring that these frequencies are changed even when the PTT-ID is activated.

Thank you for considering my request. I look forward to the potential implementation of this valuable enhancement.

Unlimited time for the close field monitoring/frequency meter function.

There is a function F+4 that brings the radio in strong signal (tested it in few meter distance for now) wide band search mod. If a transmission is received it displays the frequency and ctcss/dcs. A nice feature when observing somebody near transmitting with his radio. But it has to be quickly activated when seeing/supposing a transmission. It is because the function stops after few seconds.
A mode would be great to make the function stay active until it receives/catches something or is deactivated by the user. And after received the data should stay in the display until cancelled, not dissapper after seconds like with factory firmware.

Customize TX DISABLE

Is it possible to customize TX disable on any frequency ranges?
Currently, mod_enable_tx_50to850 unlocks all bands.

18MHz TX

Fasntastic work sir, any way to change to allow TX down to 18MHz as per other firmware mods?

[Feature Request] Include custom WAV file in firmware build for modifiable roger beep

Feature Request: include custom WAV file in firmware build for modifiable roger beep

Description:
I would like to propose an enhancement to the firmware that streamlines the process of adding a customized roger beep sound to the radio. Currently, the roger beep is fixed, but adding the ability to include a custom WAV file for that during the build process would simplify the customization process and provide more flexibility.

Proposed Solution:
Develop a comprehensive mod that includes the option to import a custom WAV file for the roger beep sound. During the firmware build process, the mod should automatically integrate the WAV file into the final firmware.

Benefits:

  • Streamlined customization: Users can easily include a personalized roger beep sound without dealing with complex configurations.
  • Unified solution: Instead of relying on separate mods for Python scripts and audio files, this feature would provide an all-in-one solution.
  • Increased accessibility: Users with varying levels of technical expertise can take advantage of the customization feature.

Example Use Case:
A user who wants to create a personalized radio firmware can now simply select the desired Python mods and include a custom WAV file for the roger beep sound, all in one streamlined process.

I am excited about this proposed feature as it would significantly enhance the customization capabilities of the firmware. I am open to assisting in the development and testing of this feature if needed. Thank you for considering this enhancement.

Replacing or Removing Voice Audio Files [Feature Request]

I noticed that if you try to add an app to the radio in addition to a custom bootscreen, the firmware can easily end up over-sized for the memory on the radio. This got me thinking about the possibility of removing the built-in audio clips for the radio's menu "Voice" functionality to save space in the firmware.

Would it be possible to replace these clips with an empty bit of audio then update all of the pointers to the empty file? Or identify where these clips are and replace them with custom audio files, less than or equal to them in size? I doubt this would be a simple hex edit hack and would require a complete restructure of the memory, but it could allow for multiple apps running in the firmware, right?

Errors with 2.01.27

When trying to compile firmware 2.01.27, most mods give Errors in the logs

*on 2.01.26 k5(8) and some k5 - PMR at high power has 1-2 watts. On the new firmware - 2.01.27 it is fixed

How the reverse engineering is done?

After reading some script in the repo. I understand how the firmware is pack/unpack and how it is modified. But I'm really curious about, how it is found?
For example, how do you know the raw binary is xor by a special sequence? And how do you know the sequence?
In the script https://github.com/amnemonic/Quansheng_UV-K5_Firmware/blob/main/uvmod_kitchen/mod_enable_tx_50to850_except_airband.py, how did you guys know that at the offset 0x1804 is the code that limit the tx freq value so that you can replace the asm code with a custom shell code? Is that really all done through reading the disassemble code?

Receive on NOAA Frequ. Tabel requires a 1050 Hz Tone to demute

To receive and open squelch on NOAA Frequency or replaced PMR or other freq. require a 1050 Hz Tone to open Squelch. You can use any online tone generator and transmit a 1050 Hz Tone for testing.

a) Is it possible to remove this requirement sending a 1050Hz tone?
b) implement a 1050 Tone by push PTT and a combination of buttons (maybe use and change one DTMF Tone e.g. DTMF tone on button M or exit,...)
c) replace roger beep first tone with 1050Hz //Tunas1337 #61 mod_roger_mototrbo_like.py editing Ton1 or 2 doesn't work to change Hz values.
d) when two K5 on NOAA add 1050Hz at the beginning of a transmission or at the end of TX

I found this from NOAA receiver specs in relation:
"The 1050 Hz tone will also demute the receiver, activate a flashing LED and cause the NWS audio"
Tonegenerator: e.g.Onlinetongenerator.c o m

The length of the new firmware is too large.

I modified built.bat,only retain rssi_ sbar.py and bootscreen.py. New firmware upload. The software prompts that the length is too large. Can't these two modifications be compiled simultaneously? Thanks !

QQ图片20230722141101

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.