This writing is in reference to Out of Band / Downbanding / Modifying the band-split for the PD/MD78X series. If you have any questions, feel free to ask in the comments section. I originally thought this was going to be a piece of cake the first time I did it, and that 5 minutes on a search-engine would hand me a solution on a silver platter.
There’s next-to-zero information floating around on how to successfully do this.
The hack will work on any of the following radios: PD782G, PD782, MD782, MD782G, PD785G, PD785, MD785G, MD785. It will most likely work on some of the other models; however, this author has only confirmed the process on the above listed radios. The region-specific model designators are irrelevant. If you have a copy of the North American models’ (XX782) firmware, when you flash the radio, it will revert the language to English.
This whole thing started out about a year ago when a broke-assed ham buddy wanted to buy a MD782 that was in the wrong band split because he didn’t want to spend $800 on a new model. It took a couple of hours of fiddling around, but I eventually got the process to work. Since then, I’ve helped other hams get their OOB Hytera radios downbanded for use in the amateur 70cm frequencies.
The Hytera DMR product line is full of outstanding, professional radios. They blow everything else, and yes, that includes Mother Batwing, out of the water.
Warning: Friends don’t let friends use Tytera, Baofeng, Raddioddity, Pofung, Retevis, Chierda, VITAI, Juentai, SAMCOM, Zastone, HYDX or any of the the other clone radios.
Brush the Cheeto cheese out of your neckbeard, and put down the shit radio.
Motorola, Hytera, Tait, Simoco. That’s it.
Repeater owners can, and will, go to RAS and kick your ass off.
The PD/MD/RD lineup of radios, are LMR radios operating on the DMR standard. All of the radios are IP-rated, up to submersion. The battery life is phenomenal. The audio is excellent. They’re built like bricks with buttons and knobs.
The only drawback? The price. A PD78X retails for approximately $700-$800 USD. No, a CS-700 or MD-380 won’t do the same thing. No, they’re not, “just as good as…”
The PD/MD/RD series come in two different UHF band splits. These splits are designated U1 and U2, respectively.
U1 = 400-470 MHz.
U2 = 450-520 MHz.
These radios offer Front-Panel Programming, and more features than even some Public Safety agencies are even capable of taking full-advantage of. In short, they’re a steal, even at full-retail.
Often, on a particular auction site, you can find surplus High-band (U2) versions of these radios for a fraction, yes, a fraction, of their original price. And rightly so. Given the high-band split, they’re useless for ham radio…
…or are they?
This modification requires that the user has access to a Hex Editor and the Hytera Customer Programming Software (CPS). As well, the user will need an existing codeplug for a MD/PD78X series radio that is in the correct band-split to perform the modification. (More on this later).
As well, this technique works on radios with firmware D7.00.11.010 and older. I cannot confirm downbanding with newer firmware versions for radios like the PD982, etc.
Once the CPS is installed, the user will need to read the data from the radio, and save the .rcdx file/codeplug from the existing radio. This is merely for the radio’s header information, which we’re going to surgically hack using the Hex editor later.
In the following directory, you will find the configuration information for the various Hytera radio models.
C:\Program Files (x86)\Hytera\Customer Programming Software\config
In this directory is a .zip file called r70.zip. Copy this file and paste it in a safe location. When the downbanding process is complete, you are going to want to put this back in the config directory.
After putting the r70 file in a safe location, create a temporary folder on the desktop. You can call the folder whatever you want, but for this exercise, we’re going to call it, “Hytera Hack.”
Copy the r70.zip file from the original config directory, and put it in the Hytera Hack folder on the desktop. Keep in mind you will still need to have an unaltered version of the original in a safe location somewhere else, because we’re going to start monkeying around, and if you lose the original the CPS will no longer function.
So we have three copies of the r70.zip file so far, right?
One copy in the Hytera Hack folder on the desktop.
One copy in the the original config directory.
One copy in a safe place for backup/retrieval later.
Alright, so the next thing you’re going to need to do, is to unzip the r70.zip file you created in the Hytera Hack folder.
You’ll notice that once unzipped, there’s going to be a file called, “Model.dat”
Once un-zipped, Model.dat is what we’re after
Right click the Model.dat file, and open that bitch with Notepad.
Model.dat – Oh My Goodness! My eyes!!!
When it opens, you’re gonna see a bunch of numbers, and it’s going to blow your mind.
No big D.
It’s just all the radio variants in the DMR-series. Since I was too lazy to determine which model corresponds, exactly, to the radio I wanted to downband, I just changed the splits on all the models. We’re eventually going to replace the r70.zip file with the original, so it doesn’t really require that we get surgical here. We’re going in swinging with a battle-axe.
Br00T f0Rc3 FTMFW!
Scroll down, until you see something like this:
Freq3 is the one we’re interested in.
Go to “Edit” in the Notepad menu. Choose, “Replace.”
Where it says, “Find what:” enter: Freq3=450,527,450,527,18
Where it says, “Replace with:” enter the band split you want to run with. I’ve gotten greedy in the past, and force-fed it to 400-470, and haven’t burned up any VFOs, but a safer bet would be to run with a reasonable downward split. For this example we’re going to bottom out on the 70cm US amateur band.
So, to recap, for the first replacement we’re going to enter: Freq3=420,490,420,490,18
Once that’s in the, “Replace with:” field, go ahead and hit, “Replace All.”
That’s going to replace the band split for those models with our ham band data.
We have to do this step twice, as not all the Freq3 fields are the same.
Go back to “Edit” in the Notepad menu. Choose, “Replace” again.
This time, where it says, “Find what:” enter Freq3=450,520,450,520,18
The second replacement we’re going to use is: Freq3=420,490,420,490,18
Hit, “Replace All” again.
Now save this edited Model.dat file.
What we’ve done is force-fed all the 450 band-split models to have the bottom of their split at 420. This will allow you to input ham frequencies into these radios.
Unfortunately, if you try to write ham radio frequencies to these radios at this point, the CPS will still give an out-of-range error.
So the next step is to go back to the C:\Program Files (x86)\Hytera\Customer Programming Software\config folder
You will want to open up the r70.zip file in there, and delete the Model.dat file that is in there. Do NOT unzip the r70 file here. Just open it. If you need to, use WinRAR.
Don’t unzip. You can just remove the Model.dat and replace with the modified one.
Once you’ve deleted the Model.dat file in the r70.zip file that’s currently in the config directory, you’ll want to go ahead and add the modified Model.dat file from the Hytera Hack folder into the r70.zip file in the config directory. This places that modified band split information into the r70.zip file, and the CPS won’t know you’re up to no-good.
We’re not done yet.
Go ahead and open up the CPS, and read from the radio. Once read, under the “Radio Information” section, you should see the band split (420-490) under “Frequency Range” that we bullshit in earlier.
You can go ahead and laugh evilly now.
Don’t get ahead of yourself just yet. Save the codeplug you’ve downloaded from the radio just now. We’re going to steal the header from it, and surgically place it on top of an existing codeplug/.rcdx file.
For this step you’re going to need a Hex editor. I use Hex-Editor MX, but any HE will work. You’re also going to need an existing codeplug/.rcdx from a 400-470 radio that’s in the real band-split you’re attempting to operate in. Even though we’ve altered the band-split, the radio will still give an out-of-range error when we attempt to write to it.
Open your Hex editor. Then open it again.
You should have two windows with the Hex editor open.
Open the .rcdx file you just read from the radio.
In the other window/Hex editor, open the existing .rcdx file from the 400-470 radio.
In the Hex editor for the .rcdx file we saved earlier, copy the first 390 lines of code. Copy that to the clipboard.
QuickInfo in Hex-Editor MX Shows the Correct Positioning
In the other Hex editor with the 400-470 radio’s .rcdx information, select the first 390 lines of code, and paste the code we copied from the out-of-band radio. Once the 390 lines of code have been pasted over the 390 lines of code from the 400-470 radio, we can save the altered .rcdx as the code plug to be written to the radio. For the sake of this exercise, you can call it “Demon-Possessed Radio.rcdx.”
What we just did, was copy the header from the out-of-band radio, and “possessed” the code plug from the in-band radio.
Once you have your witches’ brew .rcdx file saved, we’re going to upload it to the out-of-band radio.
Open the CPS.
Open the Demon-Possessed Radio.rcdx codeplug.
Go to, “Program,” then choose, “Write to Radio.”
Congratulations. Crack open a beer, and laugh at your diabolical ways.
Before getting too excited, be sure to take the original r70.zip file you tucked away in a safe place, and replace the modified one in the config directory.
It may not be a bad idea to save the modified r70.zip somewhere in the event you find yourself needing it again. At that point, if you need to swap radio souls again, you can just drop the modified r70.zip into the config directory, and remove it as-needed.
Enjoy your no-longer-worthless radio.
This post is H4x0rM4N 4pPr0V3d:
*Note: The only functionality issue I’ve run into with this mod is with the Phase-Locked Loop error (unlocked) in the VFO when entering frequencies in FPP. This makes manual entry of Frequencies difficult; however I am working on a fix for this. This will be updated when I have the time to dive back into this.
There may be a more elegant way to accomplish the band-split alteration, but this is the best I’ve been able to come up with. This method works, with the only issue being the aforementioned Phase-Lock issue. The PLL issue has arisen, regardless of how large, or how small, the band-split is.
I also haven’t dug around enough to determine if the U1/U2 radios are capable of 400-520 transmission/reception natively and the lockout is simply software-controlled. They may ultimately be exactly the same radio, with a software lock denoting the band-split. That would make more sense from a manufacturing standpoint, but I can’t prove it. I have a service manual laying around collecting dust that I should probably look into, but I haven’t.
I can also confirm that fully taking the radio down from 450-520 to 400-470 works, again, with the only issue being the PLL. There haven’t been any issues with cross-contamination on adjacent TS’s, or any other digigremlins popping up. That said, being greedy, and bumping it down that far is more an exercise in, “Yeah, I did it” than one in practicality. The 420-490 band split alteration is sufficient to encompass what’s needed for the US 70cm band. If I was able to pick one up for a good enough price, I might be willing to sacrifice one for the cause of hacking science, and see how wide you could go before shit started melting, sizzling, and throwing out spurious emissions.