Hytera MD782 Password

[W4ADC]

Hello all. I acquired three (3) Hytera MD782 mobiles from an auction. Two of them programmed flawlessly as expected. Unfortunately one of them is "password" protected. Question??? Does anyone know how to bypass this or have a firmware reset procedure. Such a nice and useful radio to be rendered as useless. Thanks for any help or ideas.

 

[dazey77]

I have never had to get around a password. I believe that if you have the cps that corresponds to the radio firmware version you may be able to write initial config to it (but only the right CPS will work). That and firmware updates might do something. I would start by trying to find a CPS that will write intital data to the radio. This issue does come up on here from time to time so worth a search too.

 

[dazey77]

have you seen this? A longer explanation of the above really.

Just a quick guide on Hytera cps password protection - Transmission1

 

[0xFF1E071F]

Hello W4ADC;
Did you solve your problem? If not, i might help you. You did not mention your firmware version. Anyway there is a tool named flashburn for hytera radios. Unfortunately sharing such tools on this forum is forbidden i think. But you can find it online
1. Download and install flashburn
2. Read "user_defined" data. The result should be approximately 15-16Mb(You need programming cable for this)
3. Send that file to me. I am going to brute force and try to find your pass or reset it.

 

[trafficcop608]

Hello W4ADC;
Did you solve your problem? If not, i might help you. You did not mention your firmware version. Anyway there is a tool named flashburn for hytera radios. Unfortunately sharing such tools on this forum is forbidden i think. But you can find it online
1. Download and install flashburn
2. Read "user_defined" data. The result should be approximately 15-16Mb(You need programming cable for this)
3. Send that file to me. I am going to brute force and try to find your pass or reset it.

Got ya, so far I have not been able to locate the tool.

tried to call the seller who’s tag is inside the battery they are out of business.

many help is appreciated

 

[Hyt321]

Hello W4ADC;
Did you solve your problem? If not, i might help you. You did not mention your firmware version. Anyway there is a tool named flashburn for hytera radios. Unfortunately sharing such tools on this forum is forbidden i think. But you can find it online
1. Download and install flashburn
2. Read "user_defined" data. The result should be approximately 15-16Mb(You need programming cable for this)
3. Send that file to me. I am going to brute force and try to find your pass or reset it.

Hello,

I have a PD605 with read and write passwords that have been lost - does this way work for this model?
Thanks

 

[0xFF1E071F]

Hello,

I have a PD605 with read and write passwords that have been lost - does this way work for this model?
Thanks

Yes it also works for your model. Do you know the firmware version?

 

[IK7VXC]

@
0xFF1E071F

I have the same password problem with a PD758G. However I wasn't able to find this flashburn program. Could you give some pointers? Please PM me. Thank you.
Mike

 

[IK7VXC]

Forgot to mention: Firmware version A9.02.01.013

 

[jasej]

Forgot to mention: Firmware version A9.02.01.013

My friend, according to a list I have, you need the Hytera CPS V9.00.09.306 iM version... But, I had the same situation, but I couldn't get access to the CPS V9.00.09.306 iM version, but I got access to newer firmware that I used to install on my PD782, and then use the correct CPS to reset the radio to factory settings...

Upgrade Firmware : A9.02.03.005 Cps used to reset my PD782i : V9.02.04.003 im.NA2

I hope the information is useful to you

Regards

 

[Jae30001]

Did you get this figured out? I've purchased two 782 radios and they are both password locked(when I try to read them through cps). The hytera website is not easy to navigate, pretty much downloaded all the versions, tried each one. I upgraded firmware with batch terminal upgradentool. Still no luck.

Finding flashburn is hopeless

 

[sp7jb]

Witam, mam ten sam problem z Hyterą PD785 V9.02

 

[0xFF1E071F]

Witam, mam ten sam problem z Hyterą PD785 V9.02

dont worry I also going to solve your problem

 

[Jae30001]

Thank you

 

[jasej]

Hi, Jae30001, !

Just look for CPS version CPS V9.00.09.306 iM , so you can reset your Hytera device with firmware A9.02.01.013.

Must work and clean your equipment...

See the attached..

. Greetings

 

[radioopperator]

Local dealer should be able to tell you how to over write the code plug then have no password.

 

[idarlund]

3. Send that file to me. I am going to brute force and try to find your pass or reset it.

How do you bruteforce it? Extract a hash from the file and then johntheripper/hashcat it? If yes; How to extract hash, and what hash type is it?

 

[Jae30001]

How do you bruteforce it? Extract a hash from the file and then johntheripper/hashcat it? If yes; How to extract hash, and what hash type is it?

Those are called proprietary secrets 😁

 

[Forts]

Did you get this figured out? I've purchased two 782 radios and they are both password locked(when I try to read them through cps). The hytera website is not easy to navigate, pretty much downloaded all the versions, tried each one. I upgraded firmware with batch terminal upgradentool. Still no luck.

Finding flashburn is hopeless

Even with flashburn, you aren't going to get too far, dependng on your FW version. After FW 7.5ish (or maybe 8?) the codeplug contents are all encrypted. In older versions the passwork could easily be found in the clear.

 

[Jae30001]

Even with flashburn, you aren't going to get too far, dependng on your FW version. After FW 7.5ish (or maybe 8?) the codeplug contents are all encrypted. In older versions the passwork could easily be found in the clear.

Ahh, your correct, and partially wrong. Your looking at the problem the wrong way.. You don't need to un encrypt it. You just need to "Brute Force" it. Flashburn lets you pull the data from the Hytera. Including the password locked file.

This can take 5 minutes, or hours. But its a simple path forward. Its not a high bit encryption. Its a simple encryption. You could write a program in a dozen languages, to force and retry.

Ofcourse, the most simple way. Is matching the CPS to the firmware, and doing a reset. But some firmware versions are not easy to come by.