Read a Password-Protected Mototrbo DP4400

[AxelBelucci]

Hello

Can someone help me? I recently bought two DP4400 UHF MDH56RDC9JA1AN radios on Ebay.
The two are password protected and no one knows when and which password was programmed.

1. Radio: R02.40.00
2. Radio: R02.40.02

I am using the following CPS 15.0 build 752

I have already tried the program Wireshark, but it does not show me the password.

Or is there already a code plug with the same model number?

Can someone help me or can I throw them away because the sellers will not take them back?


Thank you

 

[UPMan]

From Codeplug password recovery

You can get rid of password protection. You just clone an existing codeplug, of the same model, over the passworded radio one. Make sure you tick the 'clone radio identity' box under preferences.

What you can't do, is bypass the password to see what the original codeplug was. (Which is quite interesting sometimes, to see how other engineers have programmed features in certain ways).

EDIT: I should have kept on reading:

If you don't need the programming, there is now an easier way to get rid of the password - simply go to device 'recover' in the cps. this will default your device to factory standard settings.

OR, if you need the information from the codeplug (or you are trying to add handsets to a dealer who has gone bust's system ....)

Use wireshark.

Start the cps, and start wireshark.

select the port the radio is connected to, and start wireshark recording / sniffing

read the radio, until it gets to the password input box.

go to wireshark and stop the recording

sift through the large data packet. it should be one of the last few sniffed if you stopped wireshark shortly after the password box came up

You are looking for a word or numbers with full stops in between - so a password of 'password' would be displayed in wireshark as p.a.s.s.w.o.r.d

its usually just before the radio name, so if you are reading a display radio, then its very easy, just look at the display when you turn it on, and look for that in the wireshark dump.

This was my first time doing this, and with a bit of paper and ten mins, password was found, and saved a lot of ball ache trying to re program some radios and a repeater etc.

 

[AxelBelucci]

Codeplug password recovery

Hello,

I had already tried this with the program Wireshark, but that does not work. I had tried for safety's sake with my radio DP3400 and that worked.

For the two DP4400, the line "e8" is always missing where the password is.I also tried the recovery function, but there I always get an error.
Concerning the same code plug I could not try it, because I do not have one. Can you tell me where I can find a code plug with the same model?

Thank you

 

[Firebuff880]

Unless you are in Europe, the Middle East or Africa they are dumpster food.

You have been taken.

 

[AxelBelucci]

Hello,

Would not it be possible to change the model number in an existing codeplug?


Thank you

 

[mikewazowski]

When it became known that the codeplug password was being sent in the clear and could be snooped with WireShark, Motorola closed that hole.

You cannot change the model number with CPS.

 

[TampaTyron]

To successfully perform the recovery, you will need to install the same or newer version of matching firmware into your computer that has the CPS installed. WE use this method to clear TRBO radios all of the time. TT