MT2000 aftermarket encryption ID CHP
Moderator: Queue Moderator
-
- Batboard $upporter
- Posts: 2884
- Joined: Mon Sep 03, 2001 4:00 pm
MT2000 aftermarket encryption ID CHP
This look familiar to anyone ? Came out of a ex CHP capitol detail MT2000. Was attached to radio via soldered in flex assembly that plugs into module.
Transcript/Midian doesn't think it's one of theirs. Looks like it's 1996 vintage.
http://www.hostpic.org/images/1611180231260103.jpg
http://www.hostpic.org/images/1611180244010109.jpg
Transcript/Midian doesn't think it's one of theirs. Looks like it's 1996 vintage.
http://www.hostpic.org/images/1611180231260103.jpg
http://www.hostpic.org/images/1611180244010109.jpg
-
- Batboard $upporter
- Posts: 2884
- Joined: Mon Sep 03, 2001 4:00 pm
Re: MT2000 aftermarket encryption ID CHP
Transmitted carrier has a continuous lively white noise sound and modulation sounds similar to inversion but not as simple, more jumbled.
Recovered audio thru like radios is quite good and white noise is stripped. There's about a 1 sec. delay on keyup on passing audio not happening when operating in clear.
Rolling code or dual inversion sound like this ?
Recovered audio thru like radios is quite good and white noise is stripped. There's about a 1 sec. delay on keyup on passing audio not happening when operating in clear.
Rolling code or dual inversion sound like this ?
-
- Batboard $upporter
- Posts: 2884
- Joined: Mon Sep 03, 2001 4:00 pm
- jackhackett
- Posts: 1513
- Joined: Tue Jun 10, 2003 8:52 am
Re: MT2000 aftermarket encryption ID CHP
I believe that Atmel EEPROM dates it to around 2007/8.
-
- Batboard $upporter
- Posts: 2884
- Joined: Mon Sep 03, 2001 4:00 pm
Re: MT2000 aftermarket encryption ID CHP
Thanks Jack.
Anyone recognize the manufacturer of these or know what CHP SWAT, Capitol Security detail was using before upgrade ? (these are from there)
Anyone recognize the manufacturer of these or know what CHP SWAT, Capitol Security detail was using before upgrade ? (these are from there)
-
- Batboard $upporter
- Posts: 2884
- Joined: Mon Sep 03, 2001 4:00 pm
Re: MT2000 aftermarket encryption ID CHP
Under the 634-M sticker reveals it's a Motorola IC MC68HC705C8A Nothing difinitive in the datasheet for the IC.
- w7com
- Posts: 434
- Joined: Tue Apr 22, 2003 11:20 pm
- What radios do you own?: MCS2000, HT1000, Pageboy II
Re: MT2000 aftermarket encryption ID CHP
I agree that it looks like the board design came from the 37th week of 1996. You said you pulled the sticker from the big chip and it's a 6805 (one of may favs from back in the day.)
Any idea what all those 8 pin chips are? There sure are a lot of them.
Okay, I really have to get this on the scope this weekend. (note, I bought a pair from RadioSouth, very clean cases. Very interesting radios.)
I've never seen amber lamp on the top led before but these do show it blinking when RXing secure comms. I did not know it could do that!
Any idea what all those 8 pin chips are? There sure are a lot of them.
Okay, I really have to get this on the scope this weekend. (note, I bought a pair from RadioSouth, very clean cases. Very interesting radios.)
I've never seen amber lamp on the top led before but these do show it blinking when RXing secure comms. I did not know it could do that!
-Joe@nethead.com, Tulalip, WA
I have a private email server in my basement.
I have a private email server in my basement.
- w7com
- Posts: 434
- Joined: Tue Apr 22, 2003 11:20 pm
- What radios do you own?: MCS2000, HT1000, Pageboy II
Re: MT2000 aftermarket encryption ID CHP
The top two position switch selects secure or not, RadioSouth says that programming these you have to leave those positions at none. (I just got a pair tonight and haven't looked at the code, just played with them for a bit.) It seems that the top selector is only for xmit, the radio will rx secure in either position, I had to haul out another radio to listen to the encrypted signal. The top led will stay green when in secure mode (slashed O) and then give an amber flash when there is activity on the frequency (green + red LED.)
Here's a sample of the undecoded audio: http://thisoldhost.com/MT2000-Secure.m4a That's iPhone audio using a UV-R5 to listen, VLC will play it.
Here's a sample of the undecoded audio: http://thisoldhost.com/MT2000-Secure.m4a That's iPhone audio using a UV-R5 to listen, VLC will play it.
-Joe@nethead.com, Tulalip, WA
I have a private email server in my basement.
I have a private email server in my basement.
-
- Batboard $upporter
- Posts: 2884
- Joined: Mon Sep 03, 2001 4:00 pm
Re: MT2000 aftermarket encryption ID CHP
Under magnification there are (12) 5W0176
(3) H4053 716
(1) 72AF2951ACMA
(1) 34181XAPH
(3) H4053 716
(1) 72AF2951ACMA
(1) 34181XAPH
-
- Batboard $upporter
- Posts: 2884
- Joined: Mon Sep 03, 2001 4:00 pm
Re: MT2000 aftermarket encryption ID CHP
The 4053's are multiplexers by Unisonic, so far nothing proprietary to identify these boards.
- w7com
- Posts: 434
- Joined: Tue Apr 22, 2003 11:20 pm
- What radios do you own?: MCS2000, HT1000, Pageboy II
Re: MT2000 aftermarket encryption ID CHP
Yeah the best I can find on the last one, 34181, is it may be a resistor pack at 180 ohms.
This guy, http://www.wb6nvh.com/ seems to have a lot on CHP radios, maybe we should ping him.
This guy, http://www.wb6nvh.com/ seems to have a lot on CHP radios, maybe we should ping him.
-Joe@nethead.com, Tulalip, WA
I have a private email server in my basement.
I have a private email server in my basement.
-
- Batboard $upporter
- Posts: 2884
- Joined: Mon Sep 03, 2001 4:00 pm
Re: MT2000 aftermarket encryption ID CHP
And installed in the radio. Nothing usable on the flex just marked 072-0012-01
http://www.hostpic.org/images/1611240857310111.jpg
http://www.hostpic.org/images/1611240857310111.jpg
- w7com
- Posts: 434
- Joined: Tue Apr 22, 2003 11:20 pm
- What radios do you own?: MCS2000, HT1000, Pageboy II
Re: MT2000 aftermarket encryption ID CHP
More pics of the guts: http://thisoldhost.com/MT2000Secure/
They actually made their own flex board for it. Very nice work for an add-on. Still no clue on who made it. RadioSouth reports it's a MC68HC705C8A running it. I hope they didn't use the Secure PROM option, but since it's a security board I'm guessing they did. http://cache.freescale.com/files/microc ... 705C8A.pdf (see section 9.4.3) Reading a copyright in the ROM would have been nice.
So, how are these things programmed with a key, or is there one?
Dang, I haven't dug into a 6805 since Carter was President!
They actually made their own flex board for it. Very nice work for an add-on. Still no clue on who made it. RadioSouth reports it's a MC68HC705C8A running it. I hope they didn't use the Secure PROM option, but since it's a security board I'm guessing they did. http://cache.freescale.com/files/microc ... 705C8A.pdf (see section 9.4.3) Reading a copyright in the ROM would have been nice.
So, how are these things programmed with a key, or is there one?
Dang, I haven't dug into a 6805 since Carter was President!
-Joe@nethead.com, Tulalip, WA
I have a private email server in my basement.
I have a private email server in my basement.
- jackhackett
- Posts: 1513
- Joined: Tue Jun 10, 2003 8:52 am
Re: MT2000 aftermarket encryption ID CHP
I might have been wrong about that EEPROM chip, date code could also be '97. Data sheets I found had revision histories starting in 2007, but I couldn't find anything definite on when those chips were first produced. Date code format on those is YWW, last digit of year, and two digit week code, so 733 would be the 33rd week of either 1997 or 2007 (and next year they'll use it for 2017). Not a very good system.. basically assuming a less than 10 year service life...
Also those 5W01 chips are dual opamps. Toshiba TA75W01FU.
Also those 5W01 chips are dual opamps. Toshiba TA75W01FU.