Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)

User avatar
BD4VOW
Posts: 67
Joined: Sat Feb 18, 2023 3:38 am
Location: Suzhou,China

Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)

Post by BD4VOW » Wed Mar 01, 2023 7:14 am

Based on https://github.com/v0l/radio_tool project, and the decompiled code from the latest OpenGD77CPS, the latest 20230227 beta version OpenMDUV380(openGD77) firmware successfully flashed into Baofeng DM-1701.

youtu.be/nXfHvqsBTZ8
Most functions except the keypad seem to work correctly. I also have Baofeng DM-1802, the PCB is exactly the same except the navigation key uses vertical pads instead of horizontal pads which should be their compatibility design.
Last edited by BD4VOW on Wed Mar 01, 2023 7:22 am, edited 1 time in total.

User avatar
BD4VOW
Posts: 67
Joined: Sat Feb 18, 2023 3:38 am
Location: Suzhou,China

Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)

Post by BD4VOW » Wed Mar 01, 2023 7:20 am

I am also trying to reverse engineering the factory firmware.
Hope I can help you guys porting to these radios.
btw, I am also working on porting openRTX to them.

VK3KYY
Posts: 7473
Joined: Sat Nov 16, 2019 3:25 am
Location: Melbourne, Australia

Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)

Post by VK3KYY » Wed Mar 01, 2023 10:32 am

OK. That's good.

I know OpenRTX has some data on DM1702/DMX

I don't know anything about the Baofeng DM-1701/DM-1802

What MCU is in this radio, is it STM32 or MK22 ?

Edit.

I guess it must be STM32 if its running the OpenMDUV380 version

So it must be a clone of the RT3S/UV380 ??

CPS. Just uses normal STMDFU upload, except it decrypts the official firmware (donor) and merges it to obtain the AMBE codec, and then re-encrypt so that the data is accepted by the bootloader

Tomorrow I will look at RadioTool to see if the uploiad process to this radio is the same as the UV380. Perhaps only the encryption is different

VK3KYY
Posts: 7473
Joined: Sat Nov 16, 2019 3:25 am
Location: Melbourne, Australia

Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)

Post by VK3KYY » Wed Mar 01, 2023 11:19 am

I looked at radio tool

Possibly just the encryption table is different

https://github.com/v0l/radio_tool/blob/ ... dm1701.hpp

Did you recompile the CPS with this new encryption table

I could easily add 1701 encryption table to the CPS

RadioTool uses the TYT upload protocol for the 1701, because it is simply STM DFUSe protocol with one extra command to allow writing to the ROM in the MCU

User avatar
BD4VOW
Posts: 67
Joined: Sat Feb 18, 2023 3:38 am
Location: Suzhou,China

Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)

Post by BD4VOW » Wed Mar 01, 2023 2:43 pm

These radios are not said to be cloned by anyone. I guess they basically come from the same standard reference design of ANNODA or some other Shenzhen solution companies, and the firmware design is also the same.

TYT and Baofeng or some other similar radio companies located in Quanzhou, Fujian Province are manufacturing companies, and their PCB designs for different models should be entrusted to those companies in Shenzhen to carry out a small amount of customized designs based on standard solutions. They are very good at designing and producing different appearances. Of course, they are best at producing PCBs, assembling, and packaging. The appearance/packaging/instructions they design usually leave an area for changing the brand label according to different customer requirements.

Retevis or AILUNCE are backed by the same trading company, and their products are basically produced by the above factories in Quanzhou, Fujian, yes, the labels changed.

This is why these radios are so similar and used almost like the same.

User avatar
BD4VOW
Posts: 67
Joined: Sat Feb 18, 2023 3:38 am
Location: Suzhou,China

Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)

Post by BD4VOW » Wed Mar 01, 2023 3:03 pm

VK3KYY wrote:
Wed Mar 01, 2023 11:19 am
I looked at radio tool

Possibly just the encryption table is different

https://github.com/v0l/radio_tool/blob/ ... dm1701.hpp
YES, just the encryption table is different!
VK3KYY wrote:
Wed Mar 01, 2023 11:19 am
Did you recompile the CPS with this new encryption table
No, I did not do too much work, I just extract STM_DFU_FwUpdate.cs and FirmwareLoaderUI_STM32 form, and made a small modification: call File.WriteAllBytes() to write all merged bytes to a binary file before MDUV380_ENCODE. then write the merged unencrypted binary file into the radio using radio_tool.
VK3KYY wrote:
Wed Mar 01, 2023 11:19 am
I could easily add 1701 encryption table to the CPS

RadioTool uses the TYT upload protocol for the 1701, because it is simply STM DFUSe protocol with one extra command to allow writing to the ROM in the MCU
That's good news.

User avatar
BD4VOW
Posts: 67
Joined: Sat Feb 18, 2023 3:38 am
Location: Suzhou,China

Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)

Post by BD4VOW » Wed Mar 01, 2023 3:06 pm

Here are the detail photos for your information.
Image
Image
Image
Image
Image
Image
Image
Last edited by BD4VOW on Fri Mar 03, 2023 6:16 am, edited 1 time in total.

VK3KYY
Posts: 7473
Joined: Sat Nov 16, 2019 3:25 am
Location: Melbourne, Australia

Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)

Post by VK3KYY » Wed Mar 01, 2023 8:36 pm

I will make a special version on the CPS today with support for this radio, by adding the encryption table, but there may be some other small differences in the loading commands

Re: Clone of UV380 etc

Thank you for the information

I know Baofeng and TYT are in the same city and that TYT radios are also sold using the Retevis brand name, Radioddity also rebrand some TYT radios

And the the official firmware for all these radios, including Baofang and TYT, is all written by a separate company.
The bootloader in the Baofeng and TYT radios is almost identical, so it also is probably written by the same company who write the main application firmware


BTW

Do you have access to the build tool chain for the C7000 MCU which is used in many new radios. I think the CPU core in this chip is the Chinese CSky design, but there are many versions of this core.
GCC now supports some CSky processors, but possibly does not support the processor core used in the C7000

I also tried to use Ghidra to analyse the GD-73 firmware, which uses the C7000, but selecting CSky as the processor did not produce valid decompilation

VK3KYY
Posts: 7473
Joined: Sat Nov 16, 2019 3:25 am
Location: Melbourne, Australia

Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)

Post by VK3KYY » Wed Mar 01, 2023 10:46 pm


VK3KYY
Posts: 7473
Joined: Sat Nov 16, 2019 3:25 am
Location: Melbourne, Australia

Re: Baofeng DM-1701/Baofeng DM-1802/Retevis RT-84 running latest OpenMDUV380(openGD77)

Post by VK3KYY » Wed Mar 01, 2023 10:49 pm

BTW.

See https://www.youtube.com/watch?v=ScoVslqV5eY video I made a long time ago, buy it shows the UV380 PCB

Design of PCB is a lot different

I'm surprised that the baofeng radio works at all.

The PCB looks similar to the TYT MD-760 aka Radioddity GD-77, or the old Baofeng DM-1801, but I think the DM-1801 CPU is on the other side of the PCB, whereas this looks almost identical to the TYT MD-760

OpenRTx has some details of baofeng "md1702"

https://github.com/OpenRTX/OpenRTX/tree/md1702

But I think the model number is incorrect becuase MDxxxx is TYT DMxxxx is Baofeng code

Also RadioTool does not support a Baofeng 1702, so perhaps the data in OpenRTX is 1701/1802 ??

I compared the hw_config.h files in OpenRTx for 1702 and UV380 and they are identical except the 1702 does not have definitions for the rotary control

Does your radio have rotary control , like the UV380


Does the keypad work at all ??

Possibly the pin mapping on the CPU for the keypad is different

Post Reply