Firmware Hex Debug Tool

[merlin]

I know I am not the only one playing with this. I can get into HDT on 3 radios, but damned if I can get any list of commands.
If anyone has a brief list of command and their format they can post it would be a big help.
What I can't figure out is the dump command, the disassemble command and some peripheral commands like read a block of RAM.
Everything I have tried, I guess is an error and just restarts the initial radio dump.
IE: at the * prompt, I send '?' to HDT and get the same response as first turning on HDT with no command list.
Any help here would be hot.

When I can get a programming cable, I want to use this on an XG-75 which is supposed to have more commands and functions.

TYIA
73s

 

[mancow]

What are you referring to? What tool?

 

[rjschilder]

HDT via serial cable. The old non-omap radios are fairly non-descript in HDT. p7300 and up (probably p5300 and up...) have all the commands listed when you send '?'

 

[merlin]

What are you referring to? What tool?

Sorry, if this is beyond you then it is probably useless to you.

 

[merlin]

HDT via serial cable. The old non-omap radios are fairly non-descript in HDT. p7300 and up (probably p5300 and up...) have all the commands listed when you send '?'

Non descript is understatement. What I have is trying to work but not knowing command formats and parameters, I am left hanging a bit.
'?' at the prompt is supposed to list some of the commands, I get '?Unknown cmd'
'dump [xxxx]' seems to work, but the number of addresses varies from one line to a few.
'debug', 'dis', 'd' do the same thing.
'trace' (no doubt a good command) returns '?Bad parms'
'cmd' returns '?PASS' ( a query for password parameter?)
These are old non OMAP radios (M7100, P7100, LPE200) but MaCom put HDT in these for the tech gurus so should do something useful.
With a cold start, 'dis' does try to disassemble code it recognizes as op code but obscured with what looks like dump.
I guess that is what people describe as bugs.
HDT is as basic and simple as possible, but wouldn't exist if it didn't serve a purpose.
TNX

 

[merlin]

A quick Update:
I have resolved a few 'cmd' parameters. Tested on an M7100
Looks like plenty more to go. Hey this is fun playing.
Cheers

 

[rjschilder]

Non descript is understatement. What I have is trying to work but not knowing command formats and parameters, I am left hanging a bit.
'?' at the prompt is supposed to list some of the commands, I get '?Unknown cmd'
'dump [xxxx]' seems to work, but the number of addresses varies from one line to a few.
'debug', 'dis', 'd' do the same thing.
'trace' (no doubt a good command) returns '?Bad parms'
'cmd' returns '?PASS' ( a query for password parameter?)
These are old non OMAP radios (M7100, P7100, LPE200) but MaCom put HDT in these for the tech gurus so should do something useful.
With a cold start, 'dis' does try to disassemble code it recognizes as op code but obscured with what looks like dump.
I guess that is what people describe as bugs.
HDT is as basic and simple as possible, but wouldn't exist if it didn't serve a purpose.
TNX

I ran into something similar a few days ago. Had a p7100 with old firmware, did a ? at HDT and it listed all the commands. Updated it to the latest release and I get the 'Unknown cmd' for everything as well...

 

[merlin]

I ran into something similar a few days ago. Had a p7100 with old firmware, did a ? at HDT and it listed all the commands. Updated it to the latest release and I get the 'Unknown cmd' for everything as well...

Looks like different versions of firmware have different commands.
Different commands for test mode also.

 

[ElroyJetson]

I'd like to know if you have found the commands to read from, dump, save, load, and write to the radio for the purpose of recovering a lost MRU or doing firmware updates. I've got an M7300 in LOST MRU and I want to fix it. I can communicate with it via the back panel RS232 port.

 

[rjschilder]

I'd like to know if you have found the commands to read from, dump, save, load, and write to the radio for the purpose of recovering a lost MRU or doing firmware updates. I've got an M7300 in LOST MRU and I want to fix it. I can communicate with it via the back panel RS232 port.

did you swap the CAN cable / terminator / control head out? Sometimes the pigtail on the back of the m7300 needs replacement also. It's pretty easy to swap out if you have another one handy.

 

[ElroyJetson]

No it's not that. The unit shows LOST MRU though it has a control head on the radio chassis. As I said, the radio is in a CS7000 console.
It's not the can bus connection.

Not wishing to be short about it but I don't need distracting questions and suggestions to do troubleshooting that was done long ago.
This radio suffered data corruption during programming as a consequence of bad grounding between the radio and the programming laptop, which I only found out later was a known issue with some vehicle installations. (The radio was in a vehicle at the time.)

All required troubleshooting has been done. It doesn't need to be gone over again. I need the MDT commands and/or recovery instructions, and that's all.

My question again, with some clarification:

I'd like to know if you have found the commands to read from, dump, save, load, and write to the radio for the purpose of recovering a lost MRU or doing firmware updates. I've got an M7300 in LOST MRU and I want to fix it. It currently has an attached CH721 control head and is in a CS7000 console. I can communicate with it via the back panel RS232 port on the radio chassis.

 

[merlin]

@ Elroy. Not with the 7300, in fact, I haven't been able to get into HDT with this series.
The 7100s, I have had mixed results that have kept me from any writing that can brick the radio.
What I know of the 7300s and lost MRU is a corrupt bootloader.
Given the radio will talk, you could try a full blown recovery. I think you are prudent enough to have backed up all the files you need for this.
You may also need the CH721 file. (or is that a Motorola thing)
I think I can dig up the CS7000 service manual if you think that will help.
Let me see if I have all the MDT commands for the 7300s. That is all a function of test mode so you need to enter test mode for that.
On one of my P7100s, test mode is entered with a "?[cr]" An early version is entered by holding PTT at power up.
My P5400 doesn't behave like that, so need that nefarious programming cable to do anything with it.
73s

 

[rjschilder]

As I said, the radio is in a CS7000 console.

Sorry, I don't see anything about a CS7000 in this thread. otherwise I wouldn't have mentioned that. Perhaps before being short, mention the details.

 

[merlin]

Hi. That shouldn't matter at all. Effectively, this would be the same port you program the radio with.
Mounted in the CS7000, the head I believe is front mounted so Thinking programming is done via the RS232 port on the back of the radio.
Looks like there is also a CH-721 programming cable. CH-721 SERIAL PROGRAMMING CABLE CA-104861
Also a mic connector programming cable. CH-721 MIC CONNECTOR PROGRAMMING CABLE CA-103541-001
Well, still true to form, there are. Most of what I have is install and user over 20 documents for this radio and head.
What I have is all install and user manuals. No detail for programming.
Hmm, Wrong about the RS232 port.

 

[merlin]

While I am here. If there is yet a CAN port on the radio, I read it must be terminated with a plug.

 

[ElroyJetson]

It is.

 

[BMDaug]

@ElroyJetson So first off, it’s really funny to me that you have a couple of threads asking for technical assistance, your status is “I AM NOT YOUR TECH SUPPORT”, but you expect us to be your’s…

Anyway, more details would be fantastic.Did corruption occur during regular personality programming, or during some aspect of burn/boot/flash/enc updating? If you can address the radio via the rear rs232, you could try updating boot/burn/flash/enc, and then, here’s something to try: Open a personality, click on the Voice Annunciation menu, navigate to Voice Annunciation Management. Once the window opens, navigate to the Manage Radio tab near the center of the window. Now click Format Flash Drive in the lower right and see if that succeeds. This will format the memory that is responsible for storing the personality and voice annunciation. Per the manual “This option should only be used in case of data corruption”. In my experience, once this completes, the radio is completely devoid of programming.

-B

@merlin Sorry your thread is being hijacked. Just trying to help…

EDIT: Even if you aren’t using VA, you will still need to select a com port and read the radio from the Manage Radio screen before you can format.

 

[ElroyJetson]

I was attempting to do a personality update. No burn/boot/flash/enc update involved.

I've never heard of a voice annunciation system for this model radio. Didn't know the M7300 did that. Or if I did, I never bothered with exploring it.

I've got to find my laptop's power adapter to recharge the battery. It's been such a while since I've messed with this, I've actually misplaced it.

As for my status, be aware that once I was "up" on everything I'd learned and quite capable of offering assistance to those who ask for it, within certain limits. But it's been close to 10 years since I left the field and my knowledge base is out of date and stale and I don't remember it all with enough clarity to trust it. I don't encourage people to ask me for help when I'm not confident I'm remembering well what they're asking for.
I really don't want to give out bad information.

I also don't want to give out information that would facilitate someone doing something that could be illegal. I won't accept any risk or liability in that regard. I've never had trouble with the law myself, but I have had to answer questions over the actions of others I'd dealt with who were less than discreet or sensible, and I'm not willing to do that again.

In short, I have good reasons for not being as willing to offer advice as I once was. But in fact I will still listen to a question if someone has the courage to put that question before me, and depending on my judgement and knowledge, I may at times give advice and answer those questions. I simply don't wish to be the information clearinghouse for the entire radio-obsessed portion of the internet! And I sure don't want anybody to get in any trouble over it, least of all me!

 

[merlin]

Hey, I am learning from all this too. I didn't know of the voice annunciation.
I don't know who copied who, but Motorola is quite similar, and I have a bricked high power some of this stuff may work on to bring that high power back to life.

 

[ElroyJetson]

This is basic information I got from a dealership/repair shop regarding this issue:

When dealing with a 7300 the reason for a LOST MRU can be a result for several different reasons. Some of the issues can result in low voltage to the transceiver or the control head connection is failing up to a bad fuse in the main motherboard of the transceiver.