Possible IC-R5 unlock?

hackinstack · #1 (**permalink**) 08-03-2009, 11:15 PM

I have been looking through the service manual for the R5 and I think I have found how the bands are locked out by the CPU. Can anyone else confirm a suspicion I have regarding the solder pads in the "band matrix" section...

PM me if you would prefer not to discuss in the open...

gcgrotz · #2 (**permalink**) 08-04-2009, 11:03 AM

Good luck, nothing there to listen to anymore...

MarkWestin · #3 (**permalink**) 08-04-2009, 11:48 AM

I think that if you look in the parts list that you will find that the main CPU has a different part number in the USA (blocked) version. It is possible that different versions could receive somewhat different frequency ranges. I think the 50 - 90 Mhz region is the most probable area. I have more than one unblocked receiver, and can tell you that even here in northern Maine there is no more analog Cell Phone traffic.

Mark

DaveIN · #4 (**permalink**) 08-04-2009, 01:16 PM

It's hard coded into the CPU as Mark mentioned. Cell phone monitoring, it must be the 80's again, I feel younger already.

hackinstack · #5 (**permalink**) 08-04-2009, 06:11 PM

Yeah, I know the analog is dead.... just humor me...

It looks like, to me, the Mitsubishi CPU loads from a serial EEPROM using i2c and utilizes the solder pads in what is referred to as a "band matrix" in the service manual - which i'm assuming is being used as a lookup table of sorts for what bands to allow access to. Assuming this is correct, then the "hard coding" is not actually in the CPU it is based off the logic pins of the CPU, which is different.

Otherwise, I'm guessing they have the processor pre-loaded at the factory as MarkWestin mentions? why then would it not be possible to pull out the firmware to a file, edit and reload? (assuming there are read-protect bits set, but again - looking for confirmation)

I looked at the firmware for a 7800 and it does not appear ICOM uses encryption on their firmware images. I cannot however find a firmware image for an R5. I'm guessing they only factory upgrade if there is an issue. Additionally, it doesn't look like the processor even supports any kind of encryption - so i'm wondering how they would protect the lockout features from overwrite and maintain factory-upgrade ability even if they are "hard coded" as everyone says.

hackinstack · #6 (**permalink**) 08-06-2009, 06:36 PM

Anybody?