CT150 Password Protection Blues

[JSpruill]

I have a customer who bought three CT150 radios from a company called Race-Scan Communications, out of Johnson City, TN. All three of these radios are password-protected. Normally not a major issue, since there are a number of easy ways to get around this. Here are my roadblocks so far:

1. Race-Scan Communications has gone out of business. I have no contact information for anyone who might have worked on these radios last to ask them about the password. According to the customer, a lot of people bought used radios from this company's going out of business sale and are likely stuck in similar positions.

2. The Motorola Depot no longer supports this model radio (even though the particular units I have here are only eight years old), meaning they cannot or will not wipe the radio clean if I send it to them.

3. Overwriting the current codeplug with a different one that is not password-protected does not work. The CPS asks for the password before overwriting what's already there.

Does anyone have an idea of what to try next?

[escomm]

Issue has been discussed and resolved here ad nauseum. You will need a hex editor and the search button up at the top of the page.

http://batboard.batlabs.com/search.php? ... mit=Search

[JSpruill]

A little addendum to my original post then:

4. I tried using both WinHex and Hex Workshop, using guidelines found here and here, with no positive results. After a couple hours of searching (ad nauseum, if you will), these seemed to be the most likely topics to check.

[Sikdmax]

Jeff? Diesel Racing JSpruill?

Let me see if I have contact info for RaceScanComm when I get to the shop in the morning. Seems to ring a bell. Worth a shot...

[Sergio MD]

Password disable:
ELP Prof radio CPS R02.03.00-LA by ELACOM,
Offset 1FA1AA (or search 85C0741C68) change 74 to EB .

ELP Prof radio CPS R02.01.03-MD,
Offset 131BF1 (or search 84C9741C) change 74 to EB .

[JSpruill]

Thank you.