Hytera MD782 Password

[leighplt]

Hi everyone. Can anyone share DMR Flashburn v5 ?

 

[radioopperator]

Might want to try? Austech - Australian Technology Discussion Forum the communications tab

 

[0xFF1E071F]

It is too dangreous for people who do not know how to (and what to) use FB. Anyone can easily turn their radios into brick! Be very careful!

 

[leighplt]

FB is like Linux - direct access to the OS. But FB is hard to find.
P.S. I didn't find it

 

[Forts]

It is too dangreous for people who do not know how to (and what to) use FB. Anyone can easily turn their radios into brick! Be very careful!

I both agree and disagree with this.. Can you put your radio into an unbootable state? Yes, absolutely. But can you revive it? Also yes. No matter how badly you hose the codeplug you can seemingly always get back into it. Morale of the story: Back things up before playing!

 

[Forts]

@leighplt Did you try the site suggested above? I'd PM you but your post count is too low.

 

[leighplt]

@leighplt Did you try the site suggested above? I'd PM you but your post count is too low.

I only asked now about flashburn

 

[jasej]

Hi friends

In my recent experience that I had with these models, such as the PD786 and PD986, in these devices and with newer firmware, the option to reset to factory mode does not work, as it previously worked with Hytera devices that had older firmware..

This case is beyond to be able to solve it...

Regards

 

[McDeeJ]

Hi,
I need the same thing as described.
total noob here.

Got a PD785G
firmware A6.05.07.006
A6.05.07.006
Need to completely go back to factory default, without any passwords or other data.

Please help?

 

[Tarnish05]

Slightly off topic but......

Can someone please tell me a step process how to brute-force the Basic Key from a Hytera dump after a successful FBurn extraction?

I'm wanting to try a MotoTRBO set against a Hytera set.

The Hytera is set with BP and I would like to extract the key and then program it to a Moto set with EP as they should work, right?

Do you need a powerful PC? Special tools? etc..... I've got this far just a few more steps??? PM me if its a little sensitive for some.

 

[Forts]

Couple things...

1 - Hytera BP and Moto BP are completely different. Hytera Full Encrypt and Moto Enhanced Privacy are both RC4 and are compatible.
2 - Hacking of encryption can not be discussed here.

 

[radalia]

Hola W4ADC;
¿Resolviste tu problema? Si no, podría ayudarte. No mencionaste tu versión de firmware. De todos modos existe una herramienta llamada flashburn para radios hytera. Lamentablemente, creo que está prohibido compartir este tipo de herramientas en este foro. Pero puedes encontrarlo en línea.
1. Descargue e instale flashburn
2. Lea los datos "definidos por el usuario". El resultado debería ser de aproximadamente 15-16 Mb (necesita un cable de programación para esto)
3. Envíame ese archivo. Voy a utilizar la fuerza bruta e intentaré encontrar tu pase o restablecerlo.

Hola, buenas tardes. Tengo una Huyera PD705G con bloqueo de lectura, escritura y clonación. Si te envío el archivo que indicas en tu post es posible que puedas ayudarme. Agradeciendo de antemano si me ayudan, quedo a su disposición. Saludos cordiales desde Cádiz España

 

[0xFF1E071F]

Hola, buenas tardes. Tengo una Huyera PD705G con bloqueo de lectura, escritura y clonación. Si te envío el archivo que indicas en tu post es posible que puedas ayudarme. Agradeciendo de antemano si me ayudan, quedo a su disposición. Saludos cordiales desde Cádiz España

One more problem solved

 

[Tarnish05]

Motorola BP can simply be guessed by reprogramming the codeplug each time until the radio filters the clear audio through, so you have 1-255 possible options.

Can anyone explain how to 'guess' the Hytera Basic Privacy? What would be the way to test this? It may be easier to attempt this rather than Brute Force a flashburn extraction.

 

[0xFF1E071F]

Motorola BP can simply be guessed by reprogramming the codeplug each time until the radio filters the clear audio through, so you have 1-255 possible options.

Can anyone explain how to 'guess' the Hytera Basic Privacy? What would be the way to test this? It may be easier to attempt this rather than Brute Force a flashburn extraction.

In Hytera user can enter a basic protection/encryption key. And AFAIK on the flash, it is stored encrypted (At least I cannot find any clear text encryption keys). And probably you cannot just bruteforce it. Do you even know how Hytera encrypt keys? ¯\_(ツ)_/¯

 

[Tarnish05]

In Hytera user can enter a basic protection/encryption key. And AFAIK on the flash, it is stored encrypted (At least I cannot find any clear text encryption keys). And probably you cannot just bruteforce it. Do you even know how Hytera encrypt keys? ¯\_(ツ)_/¯

I don't know how or where it’s stored.

I had misread that Hytera BP was capable of being received on a Motorola set so long as it was set to Enhanced Privacy but that’s not possible so thanks to 'Forts' pointing that out.

Hytera says that Basic Privacy solution offers provides key option between 1-255 using 10, 32 or 64 characters to the transmission and receiver frequency, each of which must match up. The keys are not customised, so if a hacker was so minded they need only scan all 255 keys to potentially hit on the one you are using.

You have 1-30 Key IDs to set (as a maximum) and a Key Value.

So, if I have a radio set to set with ‘Key ID 1’ and ‘10-Characters’ I only need to find the Key value field.

Im guessing its not as straightforward as trying 1-255 under the Key Value with FFFFFFF for the rest given that the value can be 0-F.

So, what options are available to find/read/sniff/decode it? Method, Tools etc can I use with the RCDB file.

Regards

Mike

 

[radioopperator]

you might have to be like 0001 ? not sure I use enhanced on the Hytera and enhanced on the Motorola xpr they seem to work together.

 

[0xFF1E071F]

@Tarnish05 before admins get mad open a new thread and let's discuss it there. What do you want to do? Reveal already written basic enc keys from a Hytera Radio? Or you want to make motorola and hytera to communicate in basic privacy? Explain it in a new thread!

 

[Tarnish05]

New thread started - Hytera Basic Privacy - Recovering Key Value Hytera Basic Privacy - Recovering Key Value

 

[deanhod]

I have a couple of new Hytera radios and 12 old PD705LT that i want to program to work together. Problem is the PD705LT were bought second hand and all have passwords set when trying to read the data in the Hytera CPS.

Is there any way to download the config so i can program to the 2 new radios?