Batboard

I don't recall this being posted, so forgive me if it's old news.

Some experimentation today with a factory blank GM300 board & bit banging has yielded some success.

Using the bit banging tool of your choice, enter the following into the EEPROM:
The top line is the memory address locations, the bottom number is the value to enter. Write this into the EEPROM. The GM300 RSS will now think the board is a factory blank and allow the initialization procedure.

Actually, most of this is already on the BatLabs site, but not in the straight-forward way you displayed it. See

http://www.batlabs.com/gm300.html

near the bottom where it discusses blanking or recovering a logic board.

If these first 16 bytes are all that's in the codeplug memory on a factory-fresh board, then indeed, setting any other board to have the same values would theoretically "blank" it. Mainly, you've replaced the serial number with spaces, and I'd bet that's what the software looks at to allow you to initialize it in the first place.

Just out of curiosity, were all the other bytes after 60F hex FF?

Bob M.

Correct, but <4F> is true for Radius GM300 series only. The values
for M10 and M120 radios need to be found

kcbooboo wrote:Actually, most of this is already on the BatLabs site, but not in the straight-forward way you displayed it. See

http://www.batlabs.com/gm300.html

near the bottom where it discusses blanking or recovering a logic board.

If these first 16 bytes are all that's in the codeplug memory on a factory-fresh board, then indeed, setting any other board to have the same values would theoretically "blank" it. Mainly, you've replaced the serial number with spaces, and I'd bet that's what the software looks at to allow you to initialize it in the first place.

Just out of curiosity, were all the other bytes after 60F hex FF?

Bob M.

I knew of the Batlabs info, but it didn't allow the GM300 RSS to do a true initialization...I had found that occassionally, the method they outlined would give some sort of codeplug error that I couldn't clear unless I turned the thing into a Maxtrac. You also required a codeplug for that method...with the initialization procedure you don't.

The software does indeed look for the spaces, but it also seems to require the "1B" and "4F" under 60C and 60F respectively. Some sort of checksum I'm sure, which I haven't bothered to figure out as of yet.

The bytes after 60F were indeed FF for as far as I cared to look (4 or 5 screens worth).

AlexR wrote:Correct, but <4F> is true for Radius GM300 series only. The values
for M10 and M120 radios need to be found

I have some M120 radios which I'll experiment with as soon as I get the chance.

Todd

Well, that wasn't too hard at all. Here's what I found to work for the M120:
Basically, I left "60C" at it's original value of 20h, as the GM300 value of 1Bh also remained unchanged when blanked. I filled in the "20" & "FF" values the same as the GM300, and for the "60F" location I basically noted the GM300 value increased from "19h" to "4Fh" when blanked...a difference of "36h". I added "36h" to the M120 original value of "1Eh", and came up with "54h".

The GM300 RSS then recognized the M120 board as being blank & allowed the initialization procedure.

I don't have an M10 to test with, but it'll probably follow the format above.

Todd

Any chance of getting the next few bytes after 60F, for both examples, as they might have the checksum value.

Bob M.

wavetar wrote:I don't recall this being posted, so forgive me if it's old news.

Some experimentation today with a factory blank GM300 board & bit banging has yielded some success.

Using the bit banging tool of your choice, enter the following into the EEPROM:

Code: Select all

600  601  602  603  604  605  606  607  608  609  60A  60B  60C  60D  60E  60F             20   20   20   20   20   20   20   20   20   20   FF   FF   1B   FF   FF   4F

The top line is the memory address locations, the bottom number is the value to enter. Write this into the EEPROM. The GM300 RSS will now think the board is a factory blank and allow the initialization procedure.

Excellent, so I'll be able to take a 8ch limited radio and make it a 16ch full signalling?

kcbooboo wrote:Any chance of getting the next few bytes after 60F, for both examples, as they might have the checksum value.

Bob M.

Not sure what you mean...in a blank board all the values are FFh after 60F, and if there's a checksum after 60F in a non-blank board, it doesn't seem to matter to the software as it'll recognize it as a blank board if you input the "blank" string above.

Todd

sglass wrote:

wavetar wrote:I don't recall this being posted, so forgive me if it's old news.

Some experimentation today with a factory blank GM300 board & bit banging has yielded some success.

Using the bit banging tool of your choice, enter the following into the EEPROM:

Code: Select all

600  601  602  603  604  605  606  607  608  609  60A  60B  60C  60D  60E  60F             20   20   20   20   20   20   20   20   20   20   FF   FF   1B   FF   FF   4F

The top line is the memory address locations, the bottom number is the value to enter. Write this into the EEPROM. The GM300 RSS will now think the board is a factory blank and allow the initialization procedure.

Excellent, so I'll be able to take a 8ch limited radio and make it a 16ch full signalling?

NO! The logic boards are entirely different, one being a limited 'masked' board, the other a full signalling capable board w/external firmware eeprom. This procedure mainly just lets you do an initialization without requiring a codeplug, and helps to avoid possible codeplug corruptions from the other method.

Todd

I hate it when a plan DOESN'T come together!

I saved a GM300 radio's code plug (16ch UHF 40w) so I could restore things if they didn't work. I then entered the data into B600-B60F as described above. Because the checksum at B611 was incorrect, the radio gave a short beep followed by a long boooooop after it reset itself. I can live with that and apparently so could the radio and the software.

I selected Service -> Board Replacement -> Logic board and was presented with the screen that showed Radius GM300 for the product line and Radius GM300 for the model series. I could not change these (unlike the MaxTrac software which does let you make the choice) but that wasn't a big issue.

I could choose the frequency range, and I selected 449-470, which was correct for this radio.

When I got to the Model Number field, all I got was a blank (white) area. I could not get anything else to display using any of the arrow keys. Normally (in a MaxTrac) you can select from multiple model numbers, depending on power, # of modes, signaling, etc, but with the GM300 I got nothing useful here. I tried both version 1.0 and version 5.0 programs; same thing. I also tried the 438-474 MHz freq range; same thing: no model numbers were displayed so I couldn't choose one.

I could enter a panel number and serial number but I never committed the data to the radio.

Am I missing something here? While I was certainly able to write the original/saved code plug back to the radio (once it had the blank serial number), I could not actually go through the board initialization screen to choose the feature set I wanted. Suggestions?

Bob M.