Page 1 of 1

Spectra 16 channel scan limit HACKED!!!

Posted: Tue Aug 25, 2009 2:26 pm
by linkinpark9812
Yes it has been done! I have figured it out and could not believe how easy it was to do. It is quite easy to do and does NOT involve bit-banging!

I just figured out how to do this a few minutes ago so excuse me if I am to vague on the subject, but here is my tutorial for now. At first, I got a glitch and was able to do this by accident on one zone. Since it happened, I looked into how the RSS handles the Scan number. Read this thread (http://batboard.batlabs.com/viewtopic.php?f=15&t=86921) for more information on how I expected the RSS to work. Turns out I was right! Just a half hour ago, I thought about the memory and how the RSS uses it when running. I remembered a program I used to cheat money in a game, like Sim City, by editing the program memory.

Read on! This is how to do it.

UPDATE: Don't read on, just use this quick guide! 8) https://rapidshare.com/files/3189355479 ... 0Limit.pdf

Ok, first you must do this on a windows PC. The latest Spectra RSS runs on my 1.6GHz PC just fine for editing code plugs. On your DOS machine or whatever, just get the codeplug from the machine you usually edit your codeplug on, and get it on a windows PC to edit.

Then you are going to have to install this program: (http://www.systemsoftlab.com/artmoney731eng.exe) This is the program that edits the memory.

Now start up your RSS. Load your codeplug and go to a scan list (I only tried this with zone scan lists and not scan lists based on channels, but it should be similar).

Notice the amount of channels selected to scan. I am going to assume you are on a scan list that you want to expand, so your scan amount at the top probably says "16 of 16".

Now with the RSS running, open up art money, agree to the terms. Then under "select process", select the SPECTRA program. Then click search. Make sure Exact value is selected, and integer (standard), and address range is ALL.

Now type the value of the modes you have selected to scan for that list. In this example it is all 16, so type in 16 and click search. It will find quite a lot. Now deselect a mode from scanning, to make it "15 of 16". Now go back to art money and click "filter" The point of this is to see what address out of all the searched ones changed from "16" to "15". make sure that Exact Value and Integer (standard) is selected. Now type in the value of the modes selected NOW, in this case "15".

Now it should only find two address. The reason I am having you search is that I am not sure if it is static or not. However, every time I start up the program, Mine are the same address in art money. Mine are 0006A494 and 0006A496. I am wondering what you guys get.

Anyway for me, it didn't matter what one I switched. Now change it to a value of "17". Now go back into RSS and ADD another mode to that Scan list. In this example you should get "18 of 16", which is incorrect. However, if you exit zone scan list and go back into it, it will now read "17 of 16". Select all the modes you want to scan, and as long as you don't go to 16 or below, you will be fine. if you do, just repeat the process.

To do this to other zones, go to that zone scan list and repeat the above, but you probably won't have to search the address again and they should be the same, and now all you have to do in art money is edit the value.

There is one downside. This pretty much eliminates front panel programming of scan list, but ONLY for the zones you exceed this limit on. The radio recognized that you are over. If you go to edit, and try to add another mode, it will say scan list full. If you delete a mode to scan, even if still above 16, the radio will NOT let you add anymore like the RSS can (RSS is easier to trick! :lol: ). So if you want to be full proof so you don't accidentally do this, go to Zone options, and go to the zones that you exceed the 16 scan limit on, and set "Non-priority lists" and priority lists" to "Zone Slaved". This will disable front end programming of the scan list for that zone ONLY. You only need to do this to zones that you are expanding.

Ok, ok I know the above is somewhat a mess, but i typed it real quick. Sorry! I will try and create a better tutorial in a PDF format with pictures or something so people that aren't as experienced with windows and memory editing can do this no problem. However, the above explanation can probably be done by most people.

Comments and Questions are welcome!

VERY important additional information

Posted: Tue Aug 25, 2009 6:15 pm
by linkinpark9812
VERY IMPORTANT ADDITIONAL INFORMATION!!!

I have programmed it without a problem. Here is the deal with front programming. If you have zone slaved for both priority and non priority scanning modes, you cannot edit the scan list at all. You can, however, review the scan list on each zone by holding the SCAN key down on the control head. However when trying to deselect or select a mode or change a priority by pressing "SEL", you get an error tone.

What I found out is to set the priority modes to Op Select, so they can be front programmed. For one of my zones, it scans just about my whole county (47 modes). All are non priority, except SEL MODE (which is the selected mode you have selected on the spectra). That is set to Pri 1. I don't had a Pri 2.

This allows me to select the priority of the SEL MODE to anything I want. This helps because i can set SEL MODE to NON PRI, and scan and not have that "fluttering" sound in the background (because it is checking priority modes), or I can put it in PRI 1 mode so it always checks it as it scans.

This wouldn't be for just SEL mode, but another of the TWO modes that you select as PRI 1 or PRI 2 (however their is no fail safe for other modes like SEL MODE, because you can accidentally deselect it from the list).

You could also leave Op select for the non priority list, you just have to be careful when changing it from non priority to priority. If you deselect it (no pri or non pri light on), and cycle to another mode, you won't be able to get it back into the scan list. This warning also applies to setting Priority lists to Op Select and selecting Pri 1 and Pri 2 on any other mode other than SEL MODE (which has a fail safe because you cannot accidentally deselect SEL MODE).

It is up to you on how you want to do it!


EVEN MORE INFORMATION: Ok, after testing some more, there is some limited front end editing of the scan list. First, you must set the scan list options, and make non-pri scan list to "ZONE SLAVE" (to be safe) and pri scan list to "OP SELECT".
It is a little confusing so bear with me.

Ok, lets say you set non-pri scan list to zone slave and pri scan list to op select. This is what you have to do before uploading to the radio to make this work like you want it to. This also includes SEL MODE as well as any mode in the scan list.

Modes set to non-pri: Can NEVER be changed to Pri 1 or Pri 2 and cannot be deleted from scan list (nuisance delete still works though).

Modes set to pri 1 or pri 2: Can BE changed to Pri 1 or Pri 2 and disabled. However, they can be re-enabled without the radio bitching about the amount of modes. Also you cannot select these modes to be non-pri using the control head. The only exception is if you set SEL MODE to Pri 1 or Pri 2. Then this allows ONLY SEL MODE to be set to Pri 1, Pri 2 AND non-pri. (weird, isn't it?)

Modes NOT selected to scan: Any modes that are in the MODE list for the zone that is not set to scan when uploaded to the radio can be set to Pri 1 or Pri 2 or disabled. What is weird is that this lets you go over the limit as well, without the radio complaining.

So basically this means that if you set a mode as non-pri in the scan list, it cannot be messed with on the control head. But if you set it to Pri 1 or Pri 2 or not selected at all, you can set one mode to Pri 2 and one as Pri 1 (as you normally would) and even disable it, and can still bring it back to the list. It's just you cannot set it to non pri.

Just play around with it. That's what I did!

ALSO: After you program the radio, and editing the scan list above ON THE CONTROL HEAD, such as changing or adding modes to Pri 1 or Pri 2, reading the codeplug may confuse you. I came across two problems.

One is that Pri 1 will show up as Non Pri. Even though when you go to the scan list on the radio, reading the codeplug brings it back as a non-pri. It seems to always get the Pri 2 right though.

Two is that the above problem will happen, but no matter what you do in the scan list, you can only change modes to non-pri and pri 2. You can never select Pri 1. Also the existing Pri 1 will show up as a Non Pri.

To eliminate this problem, only program the modes you want in non pri scan list. Leave the others modes blank, and just edit those to be Pri 2 and Pri 1 using the control head. However, if you want SEL MODE to be changed to Pri 1, Pri 2, and non pri, set it to Pri 1 in the RSS before uploading. Then this allows you to change SEL MODE to Pri 1, Pri 2 and non pri on the control head. Granted that if you read the codeplug, SEL MODE may read as non-pri (due to the above problem). That's ok, because as long as you don't mess with it and leave it as it is, when reuploading the codeplug, it will program it like it was originally read, even though the RSS is putting in the wrong scan type.

WHEW!!

Nice Step by Step Guide Created!!!

Posted: Wed Aug 26, 2009 7:35 pm
by linkinpark9812
Huh, I am surprised that no one is posting! I thought this was like never done before!

Anyways, I just finished creating a guide that is way better than the posts above!

Here is the link:

http://www.sendspace.com/file/fr9mzp

I am not sure how long the file will stay up because they delete the file after so many days of it not being downloaded. I would post it as an attachment here, however, the forum will not let me.

If that link decides not to work, you can go to some of the popular Motorola groups on Yahoo! Groups. I posted this in a few of those groups in the Files section.

Happy (safe) programming! :)

--linkinpark9812

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Wed Aug 26, 2009 9:56 pm
by eurecomx
big job

eulalio

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Thu Aug 27, 2009 5:06 pm
by linkinpark9812
eurecomx wrote:big job

eulalio
Ya, it was sort of a big job. I still couldn't believe it worked. Just that one day, I thought "Hmm, the program has to store that scan number somewhere... hey, what about a memory editor???" lol. Once I got it to work, I did some different uploads to the radio and seeing how the scan lists can and cannot be edited when over this limit.

Writing the guide was a big part, because I wanted to make sure I got everything right before I started uploading it to popular websites.

I hate uploading a codeplug to the radio. The worst ~3-4 minutes of my day. And the Spectras with A9 heads (which I have) take longer because of storing the mode names in the head itself. I hate how you can't reinitialize a spectra. I always pace back and forth waiting for the damn progress bar to hit 100% and restart the radio! lol

And as you see in my guide, there were some things I was not sure about when you upload the options like that for the radio, because I haven't tested those (because I have no need for it to be set up like that) and I don't like having to upload the codeplug over and over again, risking the chances of bricking the radio.

So, has anyone else tried it? I mean I know it works, but just curious on what others did.

Oh, and also if you go 30-40+ modes (like the Syntor), the scanning gets a little slow, but not that bad. One of my scan lists has ~53 modes (my whole county) and it gets through it in 2-3 seconds max. So I would say the Spectra can do AT LEAST 32 modes per second, which is not bad at all for a transceiver (yes, I know scanners are faster lol).

I think the reason they put a 16 channel limit was due to Public Service requirements. obviously, scanning is not the best idea for a police officer. So from what I heard, as long as the scanning time from start to end is less than 1/2 second, then thats fine. So I assume that the spectra can scan about 16 channels in 1/2 second. So do the math and you can see about how long it will take your scan list to make it through. (though this is purely speculation on my part, it could be faster or slower for all I know. Anyone know for sure or have tested how many modes it can do per second?)

Happy (safe) programming and happy scanning over 16 modes!!! :lol:

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Thu Aug 27, 2009 7:52 pm
by deznetwork
Post by linkinpark9812 ยป Wed Aug 26, 2009 8:35 pm
Huh, I am surprised that no one is posting! I thought this was like never done before!
Ha, I was going to say the same thing.

I need to make some time to give this a try.

D

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Fri Aug 28, 2009 3:30 am
by Jim202
Now if we could only get the XTL to do the same thing!!!!

Jim

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Fri Aug 28, 2009 6:31 am
by mancow
...and the ASTRO!

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Fri Aug 28, 2009 12:19 pm
by linkinpark9812
Jim202 wrote:Now if we could only get the XTL to do the same thing!!!!

Jim
Well, if the CPS stores it the same way, this same method may work. I don't know much about the XTL though, but i wouldn't doubt it stores it the same.

Probably the ASTRO too. ASTRO, iirc, has both an RSS and a CPS. So I would think you would have a better chance trying to do this same memory hack with some ASTRO RSS, since it it probably similar to the Spectra one.

More of a downside....

Posted: Sat Sep 05, 2009 8:42 am
by linkinpark9812
Additional Information to be considered:

Ok, so there is another downside to the radio programming but it can be avoided.

If you read the guide, at the end, it talks about the problems that I had with the Pri 1 and Pri 2 not showing up for SEL MODE in the RSS when reading the radio, but when you went on the radio to look at the scan list it was just fine. Also, the guide says it only affected the Pri 1 option, but it seems that if you use Pri 2 on SEL MODE, it can affect both the Pri 1 and Pri 2 options.

First it happened to the zones that I modified. One time it was all of them, and one time it was just one. Recently It happened to one zone that wasn't modified at all. Here is the best way to avoid the problem.

Ok, say if you have an unmodified Spectra. Read the codeplug and save it and you probably won't have the problems. Follow the guide and edit your zones and what not to exceed the scan limit. SAVE the modified codeplug to the computer and upload the codeplug to the radio. Once uploaded, try downloading the codeplug from the radio. Check ALL your zones (or all mode scan lists) and make sure you can select Pri 1, Pri2, and Non-Pri for a mode. You can just check one of the modes. If you have them already set, just look to see if it is labeled correctly. Like I said, it seems SEL MODE gets put as Non-Pri when in Pri 1 or Pri 2 (if the problem arises).

If you do have the errors, then just do all you radio programming on the computer. Don't read the codeplug and save it to the computer, or the problem will get saved with it. The codeplug you modified is in good working order. Though, the problem doesn't cause real problems. it is more of an annoyance. Because it means you can't change the Pri 1 or Pri 2 for SEL MODE (or other modes depending on the problem). This is no big deal if you just want to add some more non-pri modes, but if you want to change the Pri 1 and Pri 2, you will have to press F7 to CLEAR THE SCAN LIST. This will fix the problem instantly, however, it erases the scan list and puts it to "01 of 16 max". This means in order to exceed this zone again, you will have to follow the guide to hack that scan limit. However you may have no choice but to clear the scan list (like I did) if you already did the modifications and saved the problems with it.

Happy (safe) Programming!!! 8)

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Fri Sep 25, 2009 1:22 am
by Ospre
WoW,
Awesome job. 8)
Im not to that level of tinkering yet ...maybe some day

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Tue Jul 03, 2012 7:31 pm
by Bullmoose
Figured I'd bump this.. I just successfully opened up my Spectra to scan the 48 channels I have programmed into it using the information on this here forum. I learned the instructions provided here really don't apply to conventional scanning. It got me to a point where I could see things change, but I couldn't do anything about it. By enabling zones, it worked like a champ! It seemed like the second I changed it from a number more than 16, it let me put what every I wanted in.

I wish I could have found the guide though.. The link to the guide is now dead... Is it posted anywhere else?

In any case, thanks be to be to Mr. linkinpark. Your work was enough to get me going... ...and I don't care what others say, I like my Spectras and see them being used for many many years to come!!!


Thanks Again!

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Wed Jul 04, 2012 4:42 am
by Jim202
Bullmoose wrote:Figured I'd bump this.. I just successfully opened up my Spectra to scan the 48 channels I have programmed into it using the information on this here forum. I learned the instructions provided here really don't apply to conventional scanning. It got me to a point where I could see things change, but I couldn't do anything about it. By enabling zones, it worked like a champ! It seemed like the second I changed it from a number more than 16, it let me put what every I wanted in.

I wish I could have found the guide though.. The link to the guide is now dead... Is it posted anywhere else?

In any case, thanks be to be to Mr. linkinpark. Your work was enough to get me going... ...and I don't care what others say, I like my Spectras and see them being used for many many years to come!!!


Thanks Again!



The Spectra radio is a fine radio for ham use. It is hard to break and easy to fix. You really can't kill it with any software screw ups. Just reload a good codeplug and your back in business. Just make sure you save the original codeplug on a floppy or some where else than in the directory your currently using for the software file storage.

There should be tons of these radios coming available this year. They all have to be pulled from public safety and commercial service due to they can not be narrow banded. I would expect you to be able to obtain these radios for between $10 and $40 each. The higher cost for the 100 watt trunk mount versions. If you know a radio shop, they might even give them away to save paying the trash hauler charge. Motorola doesn't care about these radios as they have no value, they can't be put back into service. So they are not even sending them to the crusher.

Jim

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Sun Sep 09, 2012 8:18 pm
by linkinpark9812
Haven't been on here in almost a year! Glad this is helping people out!

Here is the file, I re uploaded it.

https://rapidshare.com/files/3189355479 ... 0Limit.pdf

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Thu Oct 11, 2012 8:20 pm
by linkinpark9812
I've just been informed that this indeed does NOT work with mode-based scanning. Not 100% sure why, but it seems to only work with zone-based scanning. If anyone expierements further and finds out otherwise, please post about it and let me know. My PDF file says it should work with mode-based scanning, since I assumed it would, but apparently not.

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Sun Jan 25, 2015 5:22 pm
by Max-trac
The link is Dead for the 16ch scan limit Hack. Can someone re-post it please?
Thanks

Re: Spectra 16 channel scan limit HACKED!!!

Posted: Tue Feb 17, 2015 1:18 am
by petrus
Hi Max-trac,

just send a pm.
Best greetings

andreas