Batboard

The hack listed by HLA in the other thread does not work for me. It allows reading, and show blank password, but when I go to write it it will not write.

it reads and writes for me.

This method does not work for me, either, using 6.09.06. Any help other than "it works for me"??

Even the active memory hack does not appear to produce any usable results.

bchbumn wrote:For R06.08.05 I found it at offset: 02380650
change 741C to EB1C

that should take care of the problem!

Has anyone found the address/offset for R06.10.02 ? I tried the other day for over an hour, and I went form top to bottom of the file changing from to 74 to EB where I saw it. No luck, ether it does not work with this rev or I screwed up along the line and did not get the file saved before I tried to open the test CP.

Thanks,

Jim

Download portmon is very easy

capture and show txt archive from radio

Florencio

Hi

Anyone have the hex value for version RSS Pro R06.09.06, I can't read the cps on this radio it's password protected.

HT1550 CPS 6.09.06 CRACK
well offset 1E9FF8 will read and bypass the password, reading no problem!
writing back to radio it will ask for password even if you change the password
it will state it's the wrong password!
I could not find offset 1E9FF8, but I found 741C in that area
Please help!
thanks


R06.09.06 right?

Pablo n2meg...

Where is super-haxor HLA? "it works for him"

The Pager Geek wrote:Where is super-haxor HLA? "it works for him"

No super haxor here, but my notes for R06.09.06 with reguards to passwords......

Try this:
CPS R06.09.06 @00248699h there should be 74. Change this 74 to EB and save.

This should allow ya to read and write radio, just press enter when the P/W screen comes up.

Hightower wrote:

The Pager Geek wrote:Where is super-haxor HLA? "it works for him"

No super haxor here, but my notes for R06.09.06 with reguards to passwords......

Try this:
CPS R06.09.06 @00248699h there should be 74. Change this 74 to EB and save.

This should allow ya to read and write radio, just press enter when the P/W screen comes up.

Thanks for the response! That worked great !
Thanks again

Pablo n2meg...

Hi, I have the Professional Series GP300/GM300 CPS - version R03.08.03_EN

does anyone know where i need to make the change in hex to remove the password checking?

n7maq wrote:

bchbumn wrote:For R06.08.05 I found it at offset: 02380650
change 741C to EB1C

that should take care of the problem!

Has anyone found the address/offset for R06.10.02 ? I tried the other day for over an hour, and I went form top to bottom of the file changing from to 74 to EB where I saw it. No luck, ether it does not work with this rev or I screwed up along the line and did not get the file saved before I tried to open the test CP.

Thanks,

Jim

I need this also, anyone know the change for R06.10.02?

http://batboard.batlabs.com/viewtopic.p ... 0&p=358991

tpg

The Pager Geek wrote:http://batboard.batlabs.com/viewtopic.p ... 0&p=358991

tpg

thanks Tim, all that searching I did I could not find that, i had already fixed the lock by modding and older version of the CPS and eliminating the password, but this will be helpful

I know I'm dredging up an old thread...

I have a Moto EX600 XLS
CPS 6.10.04

I tried the hex trick, but I don't have another ex600xls codeplug or radio to experiment with.

I tried this trick using my cdm1250 and I can find the password then. However, the lines, etc do not translate to the ex600xls.

Anyone know what offset I would find the password on?

Thanks

CPS R06.10.04 LA LatinoAmerica
offset 00249189
742B to EB2B

eurecomx

I bought a CDM1250 recently and it has a password. I a using R06.09.06 CPS and have tried the below method but can't find the right line 00248699h. I know nothing about hex editing and would love to be able to program this radio. any help would be greatly appreciated!

Hightower wrote:

The Pager Geek wrote:Where is super-haxor HLA? "it works for him"

No super haxor here, but my notes for R06.09.06 with reguards to passwords......

Try this:
CPS R06.09.06 @00248699h there should be 74. Change this 74 to EB and save.

This should allow ya to read and write radio, just press enter when the P/W screen comes up.

Nevermind a friend helped me figure it out!

CPS R06.11.05 AA = US
OFFSET 0024AD79 (h)
742B to EB2B

and to region check off: Flatbush97
http://batboard.batlabs.com/viewtopic.p ... 32#p127632

eulalio

I cant find it.
i'm using R06-11-05
HELP

Does anyone know the address and mod for R06.11.07?

N6LAU wrote:Does anyone know the address and mod for R06.11.07?

Find Hex Values... 5B85C0742B and change to 5B85C0EB2B

this is for many versions

eulalio

Okay, I'll give it a shot. Thanks.

Hello Friends.
I have several codeplug.
I use HexWorkshop v4.23 to edit CPS Password.
How to convert *.cpg to S Record format?

i have changed it, I am using cps ver r06.12.02, and it still asks fo the password, any ideas, i used win hex to change it

You have to use the cps version they say when they give the hack. If you use a different version chances are the item that needs to be changed has moved locations.

Jason

I don't know how, lol, but somehow I was able to find the coding and openned it up. I want to thank all of you the previously posted on here, I wouldnt have been able to do it if I didnt have you guys, thank you all very much!

eurecomx wrote:

N6LAU wrote:Does anyone know the address and mod for R06.11.07?

Find Hex Values... 5B85C0742B and change to 5B85C0EB2B

this is for many versions

eulalio

Tool : Winhex
Edit: ProRadio.exe
In : C:\Program Files\Motorola\Professional Radio CPS R06.12.02
Offset : 24DDC9(h) ... 74 to EB and Save.

Now no need password ... only Enter

eulalio

Any clue for doing this with an XTS5000? I'm using ver 15.0 and I can't find the info in my hex editor. I even used another XTS5000 and enabled it searched and found the password. The problem is it is in a different place every time I search. I will settle for the file from another radio because I don't need the old info anyway. H18QDH9PW7AN Thanks.

eurecomx wrote:

eurecomx wrote:

N6LAU wrote:Does anyone know the address and mod for R06.11.07?

Find Hex Values... 5B85C0742B and change to 5B85C0EB2B

this is for many versions

eulalio

Tool : Winhex
Edit: ProRadio.exe
In : C:\Program Files\Motorola\Professional Radio CPS R06.12.02
Offset : 24DDC9(h) ... 74 to EB and Save.

Now no need password ... only Enter

eulalio

I cannot find this string with Winhex using 6.12.02. Any other advice?

Got it working!!. Thanks for the information.

I am running CPS R06.04.00 and am trying to unlock the CPS password on a used HT1550 (portable version of the cdm) that I recently purchased.

I am looking for the code to edit using Hex Workshop Hex Editor for CPS versions R06.04.00 and R06.12.02 ...

Thank you.

Anyone found the password fix for CPS 6.12.05 yet ?

SD70MAC wrote:Anyone found the password fix for CPS 6.12.05 yet ?

Change 24DD69 from 74 to EB

Thanks Steve !

Hi all am trying to get this to work for 6.09.06, none of the above mentioned Hex values can be found in my .exe file.

Try this:
CPS R06.09.06 @00248699h there should be 74. Change this 74 to EB and save.

This is from an old tread.

There seems to be multiple posts concerning the inability to find the necessary string at started locations. Big issue here is different versions have the values in different locations.

May I suggest users enter the hex value in search in their hex editor, then do the change.
By only looking in the stated offset of the posts above is not a good way of locating the value.

Some posts have given a clear indication that the user isn't familiar with using hex editor, not so much software problems.

Find Hex Values... 5B85C0742B and change to 5B85C0EB2B

this is for many versions

eulalio[/quote]

Happy hexing

This worked great.
Thanks

Hi Group; I have version R06.10.04 and am having problems finding the address to edit. I have done this with older versions but this one is giving me problems. Can anyone help? Thanks, Bill

Read back a few posts, it's already on here

I have a EX600 XLS and CPS 06.09.06, I downloaded HxD Edit. My question is I am trying to access the database and can't because i lost the password and need to by-pass can anyone help

try posting your location and see if anyone is local to you and can help you out

Sorry to bring up really old stuff, but using R06.12.06. Using the new WinHex but only shows a portion of regions and deos not allow editting. Does HexWorkshop work and how do I do it? Just got a PW protected CDM1250 into the shop and 'nobody seems to know' where my flash cable went.

Thanks and appologies for the old post revival.

Sean

cifd64 wrote:Sorry to bring up really old stuff, but using R06.12.06. Using the new WinHex but only shows a portion of regions and deos not allow editting. Does HexWorkshop work and how do I do it? Just got a PW protected CDM1250 into the shop and 'nobody seems to know' where my flash cable went.

Thanks and appologies for the old post revival.

Sean

Get xvi32, it will work fine.

Just an update to the thread. XVI32 has worked swimmingly for this and the Commercial version of the CPS. Just a few tips:

1) XVI32 is free and will let you edit and save
2) Open XVI32 ONLY, not the cps you are trying to bypass
3)When you have XVI32 open, you have to open the actual .exe file, not a desktop shortcut or other shortcut.
4) When searching for the Hex String, search the entire string, not the last four bits
Ex: Search for 5B 65 CO 74 2B, NOT 74 2B, You will find multiple occurrences of this abbreviated string.
5) Be sure to save the editted string and file.
6) Open CPS as usual and try. You will still be prompted to enter a password, but none will be needed. Press Enter.

cifd64 wrote:Just an update to the thread. XVI32 has worked swimmingly for this and the Commercial version of the CPS. Just a few tips:

1) XVI32 is free and will let you edit and save
2) Open XVI32 ONLY, not the cps you are trying to bypass
3)When you have XVI32 open, you have to open the actual .exe file, not a desktop shortcut or other shortcut.
4) When searching for the Hex String, search the entire string, not the last four bits
Ex: Search for 5B 65 CO 74 2B, NOT 74 2B, You will find multiple occurrences of this abbreviated string.
5) Be sure to save the editted string and file.
6) Open CPS as usual and try. You will still be prompted to enter a password, but none will be needed. Press Enter.

Great tips, and I'm glad it worked well for you.

One other suggestion: Before starting, write down the name of the .exe, then go into the program folder and rename the .exe. Anything is OK, but I like to keep the name plus add something like BU so you know it's the original. If things get messed up, you can always dump your hex edited copy and rename the back up back to the original.

Then open up XVI32 and open the renamed .exe. When you are done editing, do a "SAVE AS" (instead of a Save) and name it back to the correct name of the .exe.

You end up with two .exe files in the program folder; the renamed one which actually the Motorola original, and the edited one. Since you've renamed the edited one as the original name, all of your shortcuts should continue to work just fine.

Absolutely. It is especially important to back up the original file if you dont have constant access to MOL like most techs do. Best of luck, now onto XPR cpgs...

Ancient thread, but I came here needing to unlock two I bought off eBay.
To help others that come here, I compiled a master list of each posted version with the address and value to change from->to
I cannot claim each are working, just a compiled list.

Using Professional Radio CPS R06.12.02 OR R06.12.09 I open Hex Workshop. I then open ProRadio.exe in the case of R.06.12.02 I use the search function to look for 0x24DDC9 and it doesn't find anything. What am I missing? What am I doing wrong?