OpenGD77

OpenGD77 got me excited over my supposedly basic GD77, so over the weekend, I ordered a handful of radios from Radioddity.com -- GD77 with extra battery for $69, and several GD73 + hotspot for $109. I might resell some of these to local hams who don't have DMR yet (and convince them to turn to the dark side). You guys might want to check it out.

You can use the 15 percent off code 2019BF for an additional discount on top of the bundle prices. The site also gave me a personal code "FRIEND-R26NB5W" although it's just for $10 off, and I'm not sure how many times it will work.

I think the GD73 plus hotspot is a great deal since you basically get the hotspot or the radio free for that price. Too bad there's no custom firmware for the GD73 yet, but who knows, in future our experts might come up with one, too.

Angelo

I have a GD-73, but there will be no chance of any custom firmware, because the radio does not have a separate CPU.

It uses an updated version of the C6000 DMR DSP chip called a C7000 which contains an unknown type of CPU core inside it.

The GD-77 firmware binary does not appear to be encrypted but I tried putting the binary file though several dissassembler programs and nothing seemed to decompile it to assembler.

The company who make the HR-C6000 and HR-C7000 etc are highly secretive and do not release data sheets for their products.

I found a DMR radio service manual that uses the HR-C7000 chip. There are block diagrams and schematics. Let me know if this helps. I would love to see talker Alias added to this radio.

http://www.connectsystems.com/products/ ... anua01.pdf

Well, this is certainly interesting:
The processor running the firmware would seem to be a "CK803" "C-Sky" processor, which appears to have a GNU compiler:

http://www.rowleydownload.co.uk/arm/doc ... tions.html

https://www.phoronix.com/scan.php?page= ... SKY-Patches

There is a full schematic with C7000 pinout also.

The CPU is interesting.

Someone thought it was a PIC32, but Ghidra could not decode the firmware as that MCU

I think that seeing the internal structure of the chip confirms our suspicions that the firmware for many, if not all, Chinese radios is written under contract by the HRC chip manufacturer. It is unlikely that a chip that complex, with internal peripherals and DMR baseband could be programmed from scratch without a deep knowledge of the design or extremely good documentation (which doesn’t seem to exist).

That would explain why the response to bugs and upgrades in new products is often disappointing and in older products is virtually non existent. Companies like TYT probably have to pay for them.

One other thing that strikes me about that block diagram is that potentially this chip only has 32k of RAM, which is very low for the class of processor that is normally used in these radios.

The NXP MK22 in the GD-77 has 128k and I think the STM32F4 in the MD-380 has a similar amount of RAM.

I think the features in the OpenGD77 currently take around 75k of RAM, so it would be impossible to implement the full functionality in any radio that had that chip, even if all the complex technical hurdles of reverse engineering the peripherals was possible.


I agree with Colin.

The firmware for all radios which uses the HR-Cxxxx DMR chips, is almost certainly written by the chip manufacturer, not by TYT or Baofeng.

VK3KYY wrote: ↑

Sun Apr 12, 2020 10:36 am

One other thing that strikes me about that block diagram is that potentially this chip only has 32k of RAM, which is very low for the class of processor that is normally used in these radios.

The NXP MK22 in the GD-77 has 128k and I think the STM32F4 in the MD-380 has a similar amount of RAM.

I think the features in the OpenGD77 currently take around 75k of RAM, so it would be impossible to implement the full functionality in any radio that had that chip, even if all the complex technical hurdles of reverse engineering the peripherals was possible.


I agree with Colin.

The firmware for all radios which uses the HR-Cxxxx DMR chips, is almost certainly written by the chip manufacturer, not by TYT or Baofeng.

The HR-C7000 seems like a whole new generation of this series. This time we have a Software application manual, which is more detailed.

maozhenyu wrote: ↑

Thu May 07, 2020 10:30 am

VK3KYY wrote: ↑

Sun Apr 12, 2020 10:36 am

One other thing that strikes me about that block diagram is that potentially this chip only has 32k of RAM, which is very low for the class of processor that is normally used in these radios.

The NXP MK22 in the GD-77 has 128k and I think the STM32F4 in the MD-380 has a similar amount of RAM.

I think the features in the OpenGD77 currently take around 75k of RAM, so it would be impossible to implement the full functionality in any radio that had that chip, even if all the complex technical hurdles of reverse engineering the peripherals was possible.


I agree with Colin.

The firmware for all radios which uses the HR-Cxxxx DMR chips, is almost certainly written by the chip manufacturer, not by TYT or Baofeng.

The HR-C7000 seems like a whole new generation of this series. This time we have a Software application manual, which is more detailed.

I think you will have difficulty writing firmware for this device even with the manual, as it doesn't use a normal CPU core.

You would need to find the compiler toolchain for this Chinese CPU device, and you will also need to write the SDK / API to control its hardware, which will take a considerable amount of time. Probably thousands of hours.

VK3KYY wrote: ↑

Thu May 07, 2020 10:49 am

maozhenyu wrote: ↑

Thu May 07, 2020 10:30 am

VK3KYY wrote: ↑

Sun Apr 12, 2020 10:36 am

One other thing that strikes me about that block diagram is that potentially this chip only has 32k of RAM, which is very low for the class of processor that is normally used in these radios.

The NXP MK22 in the GD-77 has 128k and I think the STM32F4 in the MD-380 has a similar amount of RAM.

I think the features in the OpenGD77 currently take around 75k of RAM, so it would be impossible to implement the full functionality in any radio that had that chip, even if all the complex technical hurdles of reverse engineering the peripherals was possible.


I agree with Colin.

The firmware for all radios which uses the HR-Cxxxx DMR chips, is almost certainly written by the chip manufacturer, not by TYT or Baofeng.

The HR-C7000 seems like a whole new generation of this series. This time we have a Software application manual, which is more detailed.

I think you will have difficulty writing firmware for this device even with the manual, as it doesn't use a normal CPU core.

You would need to find the compiler toolchain for this Chinese CPU device, and you will also need to write the SDK / API to control its hardware, which will take a considerable amount of time. Probably thousands of hours.

I am not sure, does that mean we have to upload the program to CK803s and operate the whole radio?

I got here is the building tools for CK803s http://www.tinios.com/download/demo/C-S ... DK_GCC.zip and this is the user manual https://download.csdn.net/download/chuanlbs/10815528 (CK802/CK803/CK803S/CK803ER1/CK803F/CK803EFR1 use the same building tool kits called CDK.

PS2. CK803s has a RAM of 288KB and I think the program itself is located in the flash