Page 1 of 1

MT2000 aftermarket encryption ID CHP

Posted: Thu Nov 17, 2016 1:09 pm
by RadioSouth
This look familiar to anyone ? Came out of a ex CHP capitol detail MT2000. Was attached to radio via soldered in flex assembly that plugs into module.
Transcript/Midian doesn't think it's one of theirs. Looks like it's 1996 vintage.
http://www.hostpic.org/images/1611180231260103.jpg
http://www.hostpic.org/images/1611180244010109.jpg

Re: MT2000 aftermarket encryption ID CHP

Posted: Thu Nov 17, 2016 3:25 pm
by RadioSouth
Transmitted carrier has a continuous lively white noise sound and modulation sounds similar to inversion but not as simple, more jumbled.
Recovered audio thru like radios is quite good and white noise is stripped. There's about a 1 sec. delay on keyup on passing audio not happening when operating in clear.
Rolling code or dual inversion sound like this ?

Re: MT2000 aftermarket encryption ID CHP

Posted: Tue Nov 22, 2016 6:17 am
by RadioSouth
bump

Re: MT2000 aftermarket encryption ID CHP

Posted: Tue Nov 22, 2016 10:13 am
by jackhackett
I believe that Atmel EEPROM dates it to around 2007/8.

Re: MT2000 aftermarket encryption ID CHP

Posted: Wed Nov 23, 2016 7:01 am
by RadioSouth
Thanks Jack.
Anyone recognize the manufacturer of these or know what CHP SWAT, Capitol Security detail was using before upgrade ? (these are from there)

Re: MT2000 aftermarket encryption ID CHP

Posted: Wed Nov 23, 2016 4:46 pm
by RadioSouth
Under the 634-M sticker reveals it's a Motorola IC MC68HC705C8A Nothing difinitive in the datasheet for the IC.

Re: MT2000 aftermarket encryption ID CHP

Posted: Wed Nov 23, 2016 5:58 pm
by w7com
I agree that it looks like the board design came from the 37th week of 1996. You said you pulled the sticker from the big chip and it's a 6805 (one of may favs from back in the day.)

Any idea what all those 8 pin chips are? There sure are a lot of them.

Okay, I really have to get this on the scope this weekend. (note, I bought a pair from RadioSouth, very clean cases. Very interesting radios.)

I've never seen amber lamp on the top led before but these do show it blinking when RXing secure comms. I did not know it could do that!

Re: MT2000 aftermarket encryption ID CHP

Posted: Wed Nov 23, 2016 6:34 pm
by w7com
The top two position switch selects secure or not, RadioSouth says that programming these you have to leave those positions at none. (I just got a pair tonight and haven't looked at the code, just played with them for a bit.) It seems that the top selector is only for xmit, the radio will rx secure in either position, I had to haul out another radio to listen to the encrypted signal. The top led will stay green when in secure mode (slashed O) and then give an amber flash when there is activity on the frequency (green + red LED.)

Here's a sample of the undecoded audio: http://thisoldhost.com/MT2000-Secure.m4a That's iPhone audio using a UV-R5 to listen, VLC will play it.

Re: MT2000 aftermarket encryption ID CHP

Posted: Wed Nov 23, 2016 6:57 pm
by RadioSouth
Under magnification there are (12) 5W0176
(3) H4053 716
(1) 72AF2951ACMA
(1) 34181XAPH

Re: MT2000 aftermarket encryption ID CHP

Posted: Wed Nov 23, 2016 7:12 pm
by RadioSouth
The 4053's are multiplexers by Unisonic, so far nothing proprietary to identify these boards.

Re: MT2000 aftermarket encryption ID CHP

Posted: Wed Nov 23, 2016 7:27 pm
by w7com
Yeah the best I can find on the last one, 34181, is it may be a resistor pack at 180 ohms.

This guy, http://www.wb6nvh.com/ seems to have a lot on CHP radios, maybe we should ping him.

Re: MT2000 aftermarket encryption ID CHP

Posted: Wed Nov 23, 2016 7:36 pm
by RadioSouth
And installed in the radio. Nothing usable on the flex just marked 072-0012-01

http://www.hostpic.org/images/1611240857310111.jpg

Re: MT2000 aftermarket encryption ID CHP

Posted: Wed Nov 23, 2016 8:26 pm
by w7com
More pics of the guts: http://thisoldhost.com/MT2000Secure/

They actually made their own flex board for it. Very nice work for an add-on. Still no clue on who made it. RadioSouth reports it's a MC68HC705C8A running it. I hope they didn't use the Secure PROM option, but since it's a security board I'm guessing they did. http://cache.freescale.com/files/microc ... 705C8A.pdf (see section 9.4.3) Reading a copyright in the ROM would have been nice.

So, how are these things programmed with a key, or is there one?

Dang, I haven't dug into a 6805 since Carter was President!

Re: MT2000 aftermarket encryption ID CHP

Posted: Fri Nov 25, 2016 10:22 am
by jackhackett
I might have been wrong about that EEPROM chip, date code could also be '97. Data sheets I found had revision histories starting in 2007, but I couldn't find anything definite on when those chips were first produced. Date code format on those is YWW, last digit of year, and two digit week code, so 733 would be the 33rd week of either 1997 or 2007 (and next year they'll use it for 2017). Not a very good system.. basically assuming a less than 10 year service life...

Also those 5W01 chips are dual opamps. Toshiba TA75W01FU.