Batboard

Bought a CP150 that is essentially the same radio as the CP200 except 2 Watt versus 4 Watt. When I went to programm the radio a message popped up that asked for a password. It looks like someone entered a password at the last programming. I am trying to get the password from the previous owner. My question is, if I can not get the password is there anyway of deleting it or turning it off. NEVER RAN ACROSS THIS ONE and I hope maybe someone has a solution? Thank you

Instead of reading the radio you could try and Clone a Codeplug without a password into it to see if it will take it; if it does just read the radio after that and make your changes.

what version CPS are you using?

tpg

If nothing else flash the radio with a firmware upgrade. This will take it back to a default codeplug.

Regards,

Allen

Cloning does not work according to some other posts. I would give it a try but I don't have another radio with the same model number.
I get the lastest updates from Motorola and I believe it is version R05.06

35echo wrote:If nothing else flash the radio with a firmware upgrade. This will take it back to a default codeplug.

Regards,

Allen

Admittedly I've only flashed a couple of Commercial Series radios just to get used to the procedure, but I didn't have to reprogram customer specific information back into the radios after flashing them. So it didn't go back to a 'default codeplug' in those cases.

Indeed cloning doesn't work, Motorola closed that loophole. The software reads the target radio first, and will prompt for a password before allowing the write.

The Winhex method is fairly straightforward, especially for the Commercial Series radios. See this thread & check out my post for using Winhex:

http://batboard.batlabs.com/viewtopic.p ... t=password

You don't really need to follow the practice method for Commercial Series, just type in any word for a password to get the error window to come up, then do a search for that word in the Winhex RAM editor...the real password shows up a few lines below the incorrect password.

Todd

BearMan wrote:Cloning does not work according to some other posts. I would give it a try but I don't have another radio with the same model number.
I get the lastest updates from Motorola and I believe it is version R05.06

Got a hex editor?
Open the cps.exe in a hex editor
Go to HEX offset 00112051
You should see 7509, change it to 9090
Save the change, and rerun the program.

Now, read the radio. When the password screen comes up, just press enter.

Now, using the CPS, go and view the password that is stored in the radio's codeplug for future reference.

Good luck, we're all counting on you. And don't call me Shirly.

tpg

We flash between 100 and 200 CP/PR series a week after repair. They always go to default codeplug. You have to write the customer data back. They may have changed it sometime in the past but it is a must with the current version flash R03.01.02 / codeplug 05.02 / CPS R05.06 This one way we get around passwords if the customer can't remember or doesn't know it.

Regards,

Allen

Great! Using Hex Editor method worked and I was able to take out the Password once I got into the CPS. The only difference is that I could not find the exact offset 00112051 but I found one that was really close and then I found the 7509 and changed it to 9090. After using enter when asked for the password I got into the program. Thanks a million

Danny

I've had the same problem with a couple CDM1250's that I have purchased. Unknown password and unable to reset it. I sent one to the depot and they reset it, but it cost me out my "u know what"
I have a new cdm1550 LS that is password protected and can't afford to send it to the depot. So now I'm stuck with a radio that I really want to use.
If anyone out here knows how to use winhex and can do it for me, I would be willing to pay to have it done. I tried but just couldn't get the hang of it and never was able.
Thanks and I hope someone out here sometime will figure out an easy way.

FireTim wrote: Thanks and I hope someone out here sometime will figure out an easy way.

Ok I understand my Winhex method can be tricky, but it really isn't ever going to get simpler than using Hex Workshop to modify your CPS with the exact values at the exact addresses which have been given for several different versions of the Waris CPS in the thread I highlighted in my post above.