GTX Hacking

[bellersley]

I was messing around with Maxtrac lab and was looking at the EEPROM Access feature that let's you view/change the EEPROM directly. Maybe it was boredom but I thought I'd hook up a GTX and see what happens. Well, it gives you access just like a Maxtrac. So, I'm wondering if it would be possible to do any hacks with this, like change the model/serial number.

Anyone play with this before?

[bellersley]

Well, I've found the location of the serial number so far. It starts at 0553 and goes to 055C. Changing it here does change it in the radio and the GTX RSS sees it as such. Now to find the model number!

[kcbooboo]

Cool ! Let us know what other goodies you find.

I can't help but wonder why you'd want to change either of those values?

There is an old gtx lab program floating around but it won't read codeplugs saved by the current version. At least you can blank a board with it, then use the regular program to initialize a radio.

By the way, this topic probably belongs in the 900 MHz forum. You might want to ask a moderator or adminstrator to move it for you.

Bob M.

[wavetar]

He didn't say he wanted to move it into the HAM bands or anything. Just a generic hacking post. And yes, the Maxtrac eeprom access works for GTX & any other 'maxtrac RSS based' units, like GM300/SM series stuff.

Todd

[bellersley]

There's no specific reason you'd want to do any of it, I was just messin around

I also tried blanking the GTX and reinitializing it with a Privacy Plus codeplug but it just sits there with E06. Looks like the only way to make this sucker do PP (its an LTR) is swapping the chip.

My next project is to try and see if jamming an LCS codeplug will expand the number of channels as some have postulated. Anyone have a 900 (or 800) LCS codeplug handy?

[wavetar]

I also tried blanking the GTX and reinitializing it with a Privacy Plus codeplug but it just sits there with E06. Looks like the only way to make this sucker do PP (its an LTR) is swapping the chip.

Yes, you have just found out that the codeplug can only do so much. The firmware rules all, and it is different between LTR & PP models. Thus the E06 error.

My next project is to try and see if jamming an LCS codeplug will expand the number of channels as some have postulated. Anyone have a 900 (or 800) LCS codeplug handy?

Yes, that will work just fine, as long as the codeplug is for a standard SmartNet LCS. If you try to use a full SmartZone capable LCS codeplug, you will again get the E06, as the GTX firmware doesn't understand full SmartZone at all.

Todd

[kcbooboo]

Speaking of E06, I looked through my GTX RSS and Service manuals and find no mention of such error codes. Is there another document that shows these? I suppose there are other error codes as well, but I can understand the ones that come from doing something stupid from the front panel (i.e. user errors). Luckily, that error goes away once a codeplug is loaded back into the radio, but the first time I got it, my heart missed several beats.

Bob M.

[wavetar]

Section 4 of the GTX/LCS2000 mobile service manual is titled "Test Mode and Error Codes", and indeed they are in there. Here's a snippit:

Code: Select all

 

The radio will enter Fail Mode upon detecting one of the following errors:

• Application startup self check error
• Codeplug information check error

There are two categories of errors: critical and non-critical. Critical errors will stop radio normal operation.

Table 4-3 Fail Mode
Error number          Failure Description        Display      Critical          Tone Sound
1                          Internal RAM           F 01          Yes              Illegal tone
2                          External RAM           F 02          Yes              Illegal tone
5                          OTP checksum           F 05          Yes              Illegal tone
6                        Codeplug checksum        E 06          Yes              Illegal tone
7                    (1) Codeplug personality     E 06          No               Illegal Tone (when selected
personality has checksum error)
8                        Codeplug tuning error    E 06          Yes              Ilegal tone

(1). For error no. 7, personality (system) change is allowed although the illegal tone is heard. 
For error no. 8 the temporary illegal tone is heard. (See the Quick Start card for instructions on how to change personality.) To exit fail mode, power radio off.

Non-critical errors will be temporarily indicated as described in
the table above.

[kcbooboo]

Well, I'll be !

I never even looked at that chapter, because I've never used the test modes. It's also in chapter 5 of the GTX 900 MHz Portable service manual, same (or similar) table.

You'd think that with three different error conditions, they could have used something besides E6 for all of them. Lots of other digits to choose from. I think I was looking for a list that would have had E0 through E9, but of course they could even use Er or even EE. Any combination of E and something else.

Thanks.

Bob M.

[wavetar]

You'd think that with three different error conditions, they could have used something besides E6 for all of them. Lots of other digits to choose from.

Bob M.

Agreed.