MT2000 aftermarket encryption ID CHP

The General forum is where users can discuss any topic regarding Motorola communications equipment - hardware, software, etc. There are also several focused forums on this board, so please take the time to ensure that your questions doesn't fall into one of those categories before posting here!

Moderator: Queue Moderator

Post Reply
RadioSouth
Batboard $upporter
Posts: 2884
Joined: Mon Sep 03, 2001 4:00 pm

MT2000 aftermarket encryption ID CHP

Post by RadioSouth »

This look familiar to anyone ? Came out of a ex CHP capitol detail MT2000. Was attached to radio via soldered in flex assembly that plugs into module.
Transcript/Midian doesn't think it's one of theirs. Looks like it's 1996 vintage.
http://www.hostpic.org/images/1611180231260103.jpg
http://www.hostpic.org/images/1611180244010109.jpg
RadioSouth
Batboard $upporter
Posts: 2884
Joined: Mon Sep 03, 2001 4:00 pm

Re: MT2000 aftermarket encryption ID CHP

Post by RadioSouth »

Transmitted carrier has a continuous lively white noise sound and modulation sounds similar to inversion but not as simple, more jumbled.
Recovered audio thru like radios is quite good and white noise is stripped. There's about a 1 sec. delay on keyup on passing audio not happening when operating in clear.
Rolling code or dual inversion sound like this ?
RadioSouth
Batboard $upporter
Posts: 2884
Joined: Mon Sep 03, 2001 4:00 pm

Re: MT2000 aftermarket encryption ID CHP

Post by RadioSouth »

bump
User avatar
jackhackett
Posts: 1513
Joined: Tue Jun 10, 2003 8:52 am

Re: MT2000 aftermarket encryption ID CHP

Post by jackhackett »

I believe that Atmel EEPROM dates it to around 2007/8.
RadioSouth
Batboard $upporter
Posts: 2884
Joined: Mon Sep 03, 2001 4:00 pm

Re: MT2000 aftermarket encryption ID CHP

Post by RadioSouth »

Thanks Jack.
Anyone recognize the manufacturer of these or know what CHP SWAT, Capitol Security detail was using before upgrade ? (these are from there)
RadioSouth
Batboard $upporter
Posts: 2884
Joined: Mon Sep 03, 2001 4:00 pm

Re: MT2000 aftermarket encryption ID CHP

Post by RadioSouth »

Under the 634-M sticker reveals it's a Motorola IC MC68HC705C8A Nothing difinitive in the datasheet for the IC.
User avatar
w7com
Posts: 434
Joined: Tue Apr 22, 2003 11:20 pm
What radios do you own?: MCS2000, HT1000, Pageboy II

Re: MT2000 aftermarket encryption ID CHP

Post by w7com »

I agree that it looks like the board design came from the 37th week of 1996. You said you pulled the sticker from the big chip and it's a 6805 (one of may favs from back in the day.)

Any idea what all those 8 pin chips are? There sure are a lot of them.

Okay, I really have to get this on the scope this weekend. (note, I bought a pair from RadioSouth, very clean cases. Very interesting radios.)

I've never seen amber lamp on the top led before but these do show it blinking when RXing secure comms. I did not know it could do that!
-Joe@nethead.com, Tulalip, WA
I have a private email server in my basement.
User avatar
w7com
Posts: 434
Joined: Tue Apr 22, 2003 11:20 pm
What radios do you own?: MCS2000, HT1000, Pageboy II

Re: MT2000 aftermarket encryption ID CHP

Post by w7com »

The top two position switch selects secure or not, RadioSouth says that programming these you have to leave those positions at none. (I just got a pair tonight and haven't looked at the code, just played with them for a bit.) It seems that the top selector is only for xmit, the radio will rx secure in either position, I had to haul out another radio to listen to the encrypted signal. The top led will stay green when in secure mode (slashed O) and then give an amber flash when there is activity on the frequency (green + red LED.)

Here's a sample of the undecoded audio: http://thisoldhost.com/MT2000-Secure.m4a That's iPhone audio using a UV-R5 to listen, VLC will play it.
-Joe@nethead.com, Tulalip, WA
I have a private email server in my basement.
RadioSouth
Batboard $upporter
Posts: 2884
Joined: Mon Sep 03, 2001 4:00 pm

Re: MT2000 aftermarket encryption ID CHP

Post by RadioSouth »

Under magnification there are (12) 5W0176
(3) H4053 716
(1) 72AF2951ACMA
(1) 34181XAPH
RadioSouth
Batboard $upporter
Posts: 2884
Joined: Mon Sep 03, 2001 4:00 pm

Re: MT2000 aftermarket encryption ID CHP

Post by RadioSouth »

The 4053's are multiplexers by Unisonic, so far nothing proprietary to identify these boards.
User avatar
w7com
Posts: 434
Joined: Tue Apr 22, 2003 11:20 pm
What radios do you own?: MCS2000, HT1000, Pageboy II

Re: MT2000 aftermarket encryption ID CHP

Post by w7com »

Yeah the best I can find on the last one, 34181, is it may be a resistor pack at 180 ohms.

This guy, http://www.wb6nvh.com/ seems to have a lot on CHP radios, maybe we should ping him.
-Joe@nethead.com, Tulalip, WA
I have a private email server in my basement.
RadioSouth
Batboard $upporter
Posts: 2884
Joined: Mon Sep 03, 2001 4:00 pm

Re: MT2000 aftermarket encryption ID CHP

Post by RadioSouth »

And installed in the radio. Nothing usable on the flex just marked 072-0012-01

http://www.hostpic.org/images/1611240857310111.jpg
User avatar
w7com
Posts: 434
Joined: Tue Apr 22, 2003 11:20 pm
What radios do you own?: MCS2000, HT1000, Pageboy II

Re: MT2000 aftermarket encryption ID CHP

Post by w7com »

More pics of the guts: http://thisoldhost.com/MT2000Secure/

They actually made their own flex board for it. Very nice work for an add-on. Still no clue on who made it. RadioSouth reports it's a MC68HC705C8A running it. I hope they didn't use the Secure PROM option, but since it's a security board I'm guessing they did. http://cache.freescale.com/files/microc ... 705C8A.pdf (see section 9.4.3) Reading a copyright in the ROM would have been nice.

So, how are these things programmed with a key, or is there one?

Dang, I haven't dug into a 6805 since Carter was President!
-Joe@nethead.com, Tulalip, WA
I have a private email server in my basement.
User avatar
jackhackett
Posts: 1513
Joined: Tue Jun 10, 2003 8:52 am

Re: MT2000 aftermarket encryption ID CHP

Post by jackhackett »

I might have been wrong about that EEPROM chip, date code could also be '97. Data sheets I found had revision histories starting in 2007, but I couldn't find anything definite on when those chips were first produced. Date code format on those is YWW, last digit of year, and two digit week code, so 733 would be the 33rd week of either 1997 or 2007 (and next year they'll use it for 2017). Not a very good system.. basically assuming a less than 10 year service life...

Also those 5W01 chips are dual opamps. Toshiba TA75W01FU.
Post Reply

Return to “General Motorola Solutions & Legacy Radio Discussion”