• To anyone looking to acquire commercial radio programming software:

    Please do not make requests for copies of radio programming software which is sold (or was sold) by the manufacturer for any monetary value. All requests will be deleted and a forum infraction issued. Making a request such as this is attempting to engage in software piracy and this forum cannot be involved or associated with this activity. The same goes for any private transaction via Private Message. Even if you attempt to engage in this activity in PM's we will still enforce the forum rules. Your PM's are not private and the administration has the right to read them if there's a hint to criminal activity.

    If you are having trouble legally obtaining software please state so. We do not want any hurt feelings when your vague post is mistaken for a free request. It is YOUR responsibility to properly word your request.

    To obtain Motorola software see the Sticky in the Motorola forum.

    The various other vendors often permit their dealers to sell the software online (i.e., Kenwood). Please use Google or some other search engine to find a dealer that sells the software. Typically each series or individual radio requires its own software package. Often the Kenwood software is less than $100 so don't be a cheapskate; just purchase it.

    For M/A Com/Harris/GE, etc: there are two software packages that program all current and past radios. One package is for conventional programming and the other for trunked programming. The trunked package is in upwards of $2,500. The conventional package is more reasonable though is still several hundred dollars. The benefit is you do not need multiple versions for each radio (unlike Motorola).

    This is a large and very visible forum. We cannot jeopardize the ability to provide the RadioReference services by allowing this activity to occur. Please respect this.

I revived my corrupted Astro Saber without a Smart RIB! How to read/write S-records and do other things without a Smart RIB.

knockoffham

Member
Premium Subscriber
Joined
Sep 23, 2023
Messages
156
Location
Michigan, USA
First, this is a follow-up to my previous thread. I mentioned a no-no that made it have to get locked down. Happily, I have found a solution that I used to unbrick my radio witout anything that is a no-no on RadioReference. I used information I found on the W9CR wiki who I emailed asking for help since he seemed knowledgeable. However, due to a lawsuit going on against him from a grumpy radio dealer (long story on his wiki), he was not allowed to help me out. Then, I found the W3AXL wiki which contained a lot more useful information and I was able to save my radio. I also probably read through a lot of BatLabs threads as well when figuring this out. Long story short- I had to download and then upload an S-record. I did this with a normal RIB and a program called MotoTools. No Motorola-made unmentionalble software is needed to perform the fix, and you may be able to fix your radio for $0. I wanted to put all this info in one place and provide a little extra to show how MotoTools could be otherwise useful, and explain S-records and the like to those who are technically minded but want to know more.

Backstory, and how I messed up:
I have a passion for 2-way radios especially older Moto stuff and recently started a small radio shop. I have always found Astro Sabers cool and after programming and fixing a few Astro Spectras for some friends and clients I decided I really wanted an Astro Saber and Spectra so I went out and bought a VHF band of each. I got the Windows based CPS, programmed them up, but since I am weird I am always thinking of things to add to the codeplug whether it be more HAM repeaters, stuff to monitor, my business license frequencies, etc.. So typically after I buy a radio within the first few weeks of owning it I have modified and re-written the codeplug several times. Well, one day I was writing the codeplug on my Astro Saber and the room I was doing it in was a total mess that probably appeared like a bomb manufacturing plant. I ended up tripping on something and unplugging the Astro Saber programming cable when it was halfway through getting its shiny new codeplug. Now, most of the older Motorola radios I work on and mess with would have been fine with this- they'd either not know anything was wrong, or display a fail message, but you could just plug them back in and re-upload the codeplug with no issues. So, I assumed that was the case here. The radio displayed 'Fail 01/82' on the screen, a general codeplug corruption error as far as I know. I hit 'Write to Radio' and it started normally, then showed me a rather sucky message- 'Radio has been inhibited by dispatch.' It said that the radio could be uninhibited with [redacted] software or by the dispatch center. The radio was definitely not inhibited by dispatch- I didn't have it programmed to any trunking systems or anything public safety at all or even any systems with MDC capability, and it had never even been in range of anything P25 yet. I tried uninhibiting the radio with [redacted] software but no success- I could not figure out how and helpful RadioReference members told me I would need a Smart-RIB, or was F'd. Thankfully that was not the case.

My limited knowledge of a Smart-RIB: To start- you do NOT need a SmartRIB to fix your radio. This is just an explanation of what it is and does as far as I know. So basically, a Smart RIB is a regular RIB with added functionality. Having never owned or seen one I am no expert. But, it can perform regular RIB functions as well as firmware upgrades, and S-record things- reading and writing more memory than just codeplug info. It has internal volatile memory of its own. For example, if you wish to do a firmware upgrade, or write an S-record to a radio with Motorola software and an S-rib, what happens is first the computer sends that data to the S-RIB. The S-RIB then stores it in its brain, then sends that data to the radio using a special weird data rate. It is commonly speculated that computers of the era just wouldn't reliably communicate with radios at the rate of an S-RIB, and I agree especially concerning the janky serial protocols of some Motorola RSS applications. In short, the S-RIB is not much more than a data buffer that goes between your serial port and the radio that also performs some special handshakes. I suspect it was also created because it was meant to bar regular Joes from doing Depot type things with their radios and was one more expensive item that could go in the Motorola catalog.

What is an S-record: An S-record is a carbon copy of your radio's flash memory. It includes the entire codeplug, as well as your radio's flashport features, serial number, programming history, etc.. I am unclear as to whether it also includes firmware (the 'program' a radio runs when on that handles everything it does and how it behaves) or the radio's bootloader (the program memory needed for the radio to turn on and communicate). I am also not sure if it contains alignment information (settings that keep radios within spec and performing well, differ per radio because analog electronics need to be tuned) or not, but I think it does. If anyone here knows more information on what is and is not contained in an S-record please correct me. Whereas a codeplug only includes basic programming information such as freqeuncies, channels, user settings, etc.. Generally, unless you are in a Moto shop and even in most cases if you do work in one, you would only ever be changing a codeplug and leaving the S-record alone unless performing flashport upgrades or performing service or alignment.

What you need:
- A Windows computer with a serial port or a USB to serial adaptor. I used a 1997 Dell computer with a Pentium II or III and a serial port, running Windows 2000. Don't worry, you do not need to use a dinosaur computer, I just used this one because it is my only non-ancient PC with a serial port and I like using it for most of my old radio programming. You can use a brand new computer to perform this fix, or anything made after the mid 90s that runs an NT-based version of Windows (NT4, 2000, XP, Vista, 7, 8, 10, 11, etc).
- A copy of MotoTools. It is a free program that somebody awesome made that basically makes the S-rib obsolete. It allows you to read/write S-records and do more with only a regular RIB. Link here.
- A 'donor' S-record. You might need to buy a similar radio to download one from if you cannot find one online. You will need a radio of the same model, with the same bandsplit and hardware features. The flashport features do not need to match, but your bricked radio will assume the identity and features of the 'donor' S-record when all is said and done. If you end up purchasing a donor radio, by the end you will have 2 identical functional radios.
- If you end up downloading an S-record online, not using a donor radio, you will have to convert it from Motorola's proprietary S-record format (a binary file with some padding) to a binary file compatible with MotoTools. You will need a program called SREC2BIN, found on S-record.com. It will convert the Motorola-format S-records to the files used by MotoTools. Info on how to use it is on the creator's website. It is very simple and also runs on anything Windows NT.
- A RIB and/or programming cable. You probably have these things already if you got yourself into this predicament in the first place, if not then welcome to the rabbit hole of commercial radios, and I wish your wallet luck.


The process: Since I did not make an S-record of the radio before corrupting it, I had to go and get a known good S-record somewhere. I tried and tried and could not find an S-record for a VHF Astro Saber model II or III anywhere online, so I had to pony up and buy another from eBay. I found an identical one to the one I had bricked for $100, and ordered it. It arrived a few weeks later and now it was time to get to work.
1: Downloading an S-record from the donor radio (if you cannot find a suitable one online): Hook your donor radio to the RIB, launch MotoTools, and go to the 'Memory' tab and click read. Leave 'eeprom default' selected under 'Device.' If it fails, go to settings and make sure the correct serial port is selected. Once MotoTools begins reading the radio, the RIB data light will start flashing periodically and it will read much slower than with a normal codeplug and in short bursts. Once it is done, save the file with a name you'll remember like 'donorRadio.bin' or something.
1: Alternative- If you got your 'donor' S-record online: download and run SREC2BIN as discussed above, to convert the Motorola-format S-record to one compatible with MotoTools. The program is easy to use and use is documented on the author's website.
2: Make a backup S-record of your bricked radio. I know this seems dumb, but in the case that your S-record contains alignment info (I think they do) you should make a backup of the bricked radio's S-record so that someday you may be able to align it properly just by combining some info from both the donor S-record and the bricked one. I am not sure if or where alignment info is stored in an S-record but if I ever care to figure it out I will post a follow-up thread since importing alignment data is a lot easier and accessible for most people than going and doing a full alignment with a service monitor. My formerly bricked radio is probably out of alignment but I haven't realigned it yet since it seems to perform fine. TX/RX audio, PL, DPL, modulation, deviation, squelch, P25, etc all seem to work great without a realignment.
3: Reviving your bricked radio: Now attach your bricked radio to the RIB, turn it on, and open MotoTools. Go to the memory tab, and make sure 'eeprom default' is selected, and this time, press 'Write.' Select the S-record that you downloaded and saved from the known good donor radio, or that you got online and converted with SREC2BIN depending on which route you took. Now, the radio will write. This might take a few minutes. It does it slowly, and in blocks, and writing seems to speed up and slow down. Once it is done, your radio will reset and should be fully functional! It will be identical to the radio that the 'donor' S-record came from so you will probably want to go and reprogram its codeplug especially if you are using a system with P25/MDC/DMR/etc radio IDs.

After this, I now have 2 Astro Saber VHF model II radios that are identical and work great.

Cons: The formerly bricked radio may need a realignment, and its serial number, model number, and flash code will match the 'donor' S-record's, not the ones it left the factory with. This is why it is good to take S-records of radios you care about before messing with their memory whether it be codeplugs, flashport, firmware, etc. So that you can restore your radio if you mess up! A lesson I have learned several times in and outside the scope of 2-way radio... Always make backups!!!!

I was in a similar-ish predicament with some MT2000 radios and was able to read/write their S-records with MotoTools as well, and tried with an HT1000 too for the fun of it but it did not seem to be able to communicate with MotoTools 100% right, however that was with default settings. I have yet to try with any other models but MotoTools seems to be fairly universal for anything Motorola that is not super ancient.

This also means that you should be able to use MotoTools to perform flashport upgrades, maybe alignment, firmware, etc- everything a Smart-RIB can do. Maybe even key-loading depending on the radio? It is basically software S-RIB. I have not used it outside of this radio revival but I will definitely do some experiments with it in the future.

If in the future, any of my links are dead, web.archive.org is your friend. If anyone has any questions, corrections, or useful info to add do not hesitate to let me know. I am mostly self taught when it comes to this stuff so there may be even easier solutions or important info I am missing.
 

mikewazowski

Forums Manager/Global DB Admin
Staff member
Forums Manager
Joined
Jun 26, 2001
Messages
13,679
Location
Oot and Aboot
Oops, you're correct. Using MotoTools (or dumping in a new s-record) will allow you to change the flash without a SmartRib.

Firmware upgrades definitely require a SmartRib.
 

knockoffham

Member
Premium Subscriber
Joined
Sep 23, 2023
Messages
156
Location
Michigan, USA
Oops, you're correct. Using MotoTools (or dumping in a new s-record) will allow you to change the flash without a SmartRib.

Firmware upgrades definitely require a SmartRib.
I think W9CR figured out how to do it without an SRIB or almost did. There’s just no documentation on it. As far as I can tell, firmware upgrades are done with serial port communication, just perhaps with weird timing. Something I’d like to try and figure out some day because S-RIBs and the knowledge of all this stuff will only become more rare and expensive with time. Although figuring out how to do firmware upgrades with the old Astro line and no S-RIB is probably a pretty niche project. Astro No SRIB Project - W9CR

So an S-record does not contain firmware, just a sort of extended codeplug?

Edit: here’s probably where I remember reading about “it’s just serial but with weird timing.” Some very useful info. Astro Firmware Upgrades - W9CR
 
Last edited:

ElroyJetson

Getting tired of all the stupidity.
Premium Subscriber
Joined
Sep 8, 2002
Messages
3,868
Location
Somewhere between the Scylla and Charybdis
I don't think even Motorola would have invested all that hardware engineering into security-through-obscurity. I've always heard that the SRIB is electrically necessary for firmware flashing with the AS and XTS3K, at least, and I have no reason to disbelieve it.
 

knockoffham

Member
Premium Subscriber
Joined
Sep 23, 2023
Messages
156
Location
Michigan, USA
Ok. Could be as simple as pulling a bootloader pin low, but you make a good point about all that product engineering probably being for something. I’m very intrigued by W9CR’s one sentence on his “Astro no SRIB project” page: “Project to update firmware from a serial port by python.” Although it is interesting, there’s very little actual utility to be had figuring it out
 

Echo4Thirty

Active Member
Premium Subscriber
Joined
Oct 6, 2021
Messages
793
Location
Spring,TX
Ok. Could be as simple as pulling a bootloader pin low, but you make a good point about all that product engineering probably being for something. I’m very intrigued by W9CR’s one sentence on his “Astro no SRIB project” page: “Project to update firmware from a serial port by python.” Although it is interesting, there’s very little actual utility to be had figuring it out

on an ASTRO radio (ASaber, ASTRO Spectra, XTS3000) the SRIB contains the bootloader which is not present in the radio. It also converts the serial data to an oddball serial rate the radio is expecting to see during the flashport update process and acts as a buffer. The computer stores the data in the flash on the SRIB and then the SRIB actually is what flashes the radio. Its why the first in a series of radios takes the longest. Once that firmware is loaded in the SRIB, it does not have to change it to do subsequent radios of the same series. We label ours in the shop with what FW we flashed them with to make it faster to do one-offs. We are fortunate to have several and only use them to do flashport updates, we use a regular (and much cheaper) RIB for programming and alignment. We have popped a few along the way but its mostly been the protection diodes.

As stated, you dont need an SRIB to pull SRECS, even in DOS using the classic mtsx software. Just to firmware update and to do FlashPort upgrades to the FlashCode.

An S Record is simply an image of a chip. In the case of ASTRO Radios, it contains the tuning data, model number, serial number and flashcode (as well as all of the radio such as the codeplug etc).
 

knockoffham

Member
Premium Subscriber
Joined
Sep 23, 2023
Messages
156
Location
Michigan, USA
on an ASTRO radio (ASaber, ASTRO Spectra, XTS3000) the SRIB contains the bootloader which is not present in the radio. It also converts the serial data to an oddball serial rate the radio is expecting to see during the flashport update process and acts as a buffer. The computer stores the data in the flash on the SRIB and then the SRIB actually is what flashes the radio. Its why the first in a series of radios takes the longest. Once that firmware is loaded in the SRIB, it does not have to change it to do subsequent radios of the same series. We label ours in the shop with what FW we flashed them with to make it faster to do one-offs. We are fortunate to have several and only use them to do flashport updates, we use a regular (and much cheaper) RIB for programming and alignment. We have popped a few along the way but its mostly been the protection diodes.

As stated, you dont need an SRIB to pull SRECS, even in DOS using the classic mtsx software. Just to firmware update and to do FlashPort upgrades to the FlashCode.

An S Record is simply an image of a chip. In the case of ASTRO Radios, it contains the tuning data, model number, serial number and flashcode (as well as all of the radio such as the codeplug etc).
Yep. That’s mostly stuff I was able to figure out in the original post, but I was not aware that the SRIB contains the bootloader. Good to know. The only reason I thought that I needed an SRIB to upload/download an S record is because that’s just something I was told here and I saw a few people saying that on other threads here and on BatLabs as well.
 
Top