Pro-83 Keypad "secrets"??

[labdog98f]

Has anyone uncovered some key-press secrets other than the 3 + E one to restore the factory programmed freqs?

I tried the 2+4+9 at power on to see the firmware version and it just booted to SEARCH bank 1 with a freq. range of 137-138 entered.

Normally it starts in bank scan mode when powering up.

It over wrote the range that I had in Search Bank 1 (RRs 160.215-160.565).

I have not tried the 2+9 trick to wipe the scanner so I do not know if that one works.

Scott

 

[INDY72]

Auto clear (Func + 2+9 on powerup a 3 keyer this time) works good, I did that as soon as I could get it home so I could manually program what I wanted in it... No new KEY Tricks yet... still too new for too many folks to have gone keypress nuts yet.. no TONE tricks yet iether,.. Have yet to hear of anyone turning this one into a data slicing tool yet .. but I am sure thats not far off.....

 

[labdog98f]

Seek and ye shall find. :lol:

From message 304 on the Pro-83 Yahoo group:

These are documented in the manual:
Hold 2 9 , Power : "CLEAr"s Memory
3 E , Power : "-LoAd-"s "standard" 150 channels

These are not in the manual:
Hold 1 9 , Power : "000 55" Memory?, more below
Hold 4 9 , Power : "-LoAd-"s Channel 1=144.000 2=144.020 ... 200=147.980
Hold 5 9 , Power : "-LoAd-"s Channels 1-22, see below
Hold 7 9 , Power : Same as Hold 1 9?
Hold 8 9 , Power : "CLEAr"
Hold 0 9 , Power : Chain Search Bank 1, 173.000-173.100
Hold . 9 , Power : Chain Search Bank 1, 857.100-857.200

Hold 1 0 , Power : "H --- ---" on display, speaker on, keys beep
Hold 3 0 , Power : F(unction) SRCH Flashing Stalker xxx nnn.nnn, xxx is
selectable with 2/8 (^/v), 800 Lo Air Hi or UHF, nnn.nnn numbers seem to
fluctuate within different limits for each xxx, limits change with
different/no antenna (What is this, a test/tuning mode?)

"000 55" Memory? ./CLR jumps first (address) value to next x00 value
Function then 2/8 (^/v) change the first by 1, maximum value 4C8
"CLEAr"ed values at:
http://teched.net/~jacob/rf/scanner/pro-83/clearedvalues.txt

"-LoAd-"s Channels 1-22, channels 1-22 are loaded, others seem
untouched, bank 1 scan enabled. Frequencies at:
http://teched.net/~jacob/rf/scanner/pro-83/25.005.txt

I have tried other key combos, they seem to do nothing (normal power on)
or duplicate one listed (byproduct of keypad matrix?).

 

[DOPPLERBOB]

power up modes

Here are the ones I found. Some may clear your memory so use at your own risk :shock:
Of course you have to hold the following buttons down then press the power button without releasing any of the buttons until it powers up.


3-L/O-CLR Wx alert mode?
2-9-E Comes up with F4FOH on display
2-9-CLR All segments light until press any key
2-9-SCN Loads test frequencies (not preprogrammed defaults but test ones)
2-9-light Clears all channels to 000.000

2-5-9 shows version? 1.06 then F4FOH

3-9-1-hold Shows 3 digits then 2 digit value next to it (maybe used to set up caLIBRATION factors for radio? Unable to change any of the values.All in Hex mode. If you hit the clr button, it advances by 100

Have Fun
Bob
Milford, Ct.

 

[EricCottrell]

Hello,

They are diagnostic or test modes.

Most recent uniden scanners have them and can clear the memory.

2+9+Hold(Manual) on power-up clears the memory
2+9+Scan on power-up loads test data into channels
2+9+4 on power-up displays the Firmware Version and checksum
2+9+L/O on power-up tests display.
The Pro-83 uses similar keypresses as well.

The 1.06 is the version and F4F0H is the checksum in hex.

"CLEAr"ed values at:
http://teched.net/~jacob/rf/scanner/pro-83/clearedvalues.txt
are interesting and appear to display the contents of the eeprom or channel configuration. The first 16 locatins is a "UNIDEN Corp.2004" string. Location 008 is really a 6F.

Starting at Location 010 are the channel lookouts with each bank taking 3 bytes.
The 3rd byte is 0f because only the lower 4 bits are used for channels 17 through 20 of a bank.
010 ff Lockout for channels 8 to 1 of the bank
011 ff Lockout for channels 16 to 9 of the bank
012 0f Lockout for channels 20 to 17 of the bank

Location 02e starts the delay flags for each bank stored like the lockouts.

Location 0a7 is scan bank enable (LSB). If bank 10 only is selected it is 00. If Bank 1 only is selected this is 01.
Location 0a8 is scan bank enable (MSB). If bank 10 only is selected then this is 02. If bank 1 only is selected then this is 00.

Locations 100 and 101 are the Channel 1 Frequency. Frequencies are stored as two bytes with the lsb in the lower address. The frequency values seem to use the upper bits
as a band indicator and the lower bits as the number of steps from the base.
5770 hex = band 5? and 770 hex is 1909 decimal so 1909 * 0.005 step is 9.52 MHz plus 137.0 MHz base results in 146.520.
Of course Locations 102 and 103 are the Channel 2 frequency, etc.

I would not be suprised if the chain search parameters and the various lockout frequencies are somewhere in there as well.

73 Eric

 

[teched]

http://teched.net/~jacob/rf/scanner/pro-83/clearedvalues.txt
are interesting and appear to display the contents of the eeprom or channel configuration. The first 16 locatins is a "UNIDEN Corp.2004" string. Location 008 is really a 6F.

I found that error while comparing dumps, and corrected it... are there more?

I have also put friendlier dumps up, cleared.hex and hold59.hex, in http://teched.net/~jacob/rf/scanner/pro-83/

Starting at Location 010 are the channel lookouts with each bank taking 3 bytes.
The 3rd byte is 0f because only the lower 4 bits are used for channels 17 through 20 of a bank.

...

It looks like you are on top of the memory layout and formatting. Do you have any details on writing to the memory via the PC/IF?

Jacob

 

[EricCottrell]

Hello,

No success on figuring out how to talk to the radio.

It will take more work to figure stuff out. I just wanted to see if this was possibly a dump of the eeprom. It will be handy if I ever do figure out the upload format and have problems.

73 Eric