AFSK messenger with T9 typing support
- download mod uv_k5_01_26_cold_messenger_encoded.bin
- to enable messenger view press flash light button
- use keyboard to type message
- press MENU to send message
- press EXIT to clear message
- if message is cleared use EXIT to exit messenger view
To show your appreciation and support for ongoing work, you can make a donation.
update
Spectrum scanner. It prints a spectrum graph. Zoom in well as resolution can be controled via keyboard.
- download mod uv_k5_01_26_spectrum_2MHz_encoded.bin
- to enable spectum view press flash light button
- hold up or down key to change center frequency
- press 8 / 2 for zoom in / zoom out
- press 1 / 7 to increase / decrease resolution (smaller resolution == faster update rate)
- press PTT or EXIT to disable spectrum view
- download mod uv_k5_01_26_rssi_sbar_encoded.bin
- flash with original quansheng update tool
mod for printing rx signal level (RSSI) in numerical format, also includes small signal level chart.
- download mod uv_k5_01_26_rssi_printer_encoded.bin
- upload it through original firmware update tool:
Quancheng website
- download mod uv_k5_01_26_pong_game_encoded.bin
Chinese mcu DP32G030 has feature called flash masking, here is how it works:
The idea is to run this firmware 'parallel' with the original Quencheng firmware. This can be achieved by relocating the original vector table to the end of the original firmware, and placing a new vector table at the beginning, with entities pointing to the par_runner functions that wrap the original firmware handlers.
Every interrupt is first processed by the par_runner handlers, which can perform tasks like responding to a button press(todo), before invoking the original firmware handler
When building the "par_runner" target automaticly "bootloader" target will be build
building par_runner target will result in following outputs:
- par_runner.bin / .hex - right part of image, can be used to generate encrypted firmware compatible with orginal Quescheng update tool
- bootloader.bin - stripped bootloader from orginal firmware
- par_runner_with_bootloader.bin - complete firmware image
To change the original firmware that will be wrapped and placed into the original firmware section, replace ./original_fw/original_fw.bin
or set the variable
CMakeLists.txt set(ORGINAL_FW_BIN orginal_fw.bin)
in ./orginal_fw/CMakeLists.txt
and rebuild par_runner
currently tested on windows, requred:
- arm-none-eabi-gcc
- python (i have newest version)
- cmake
- ninja
- open-ocd
All folders with executables of the above programs should be added to the PATH environment variable.
for debugging:
- vs code
- Cortex-Debug plugin
- CMake plugin
$ mkdir build
$ cd build
$ cmake ../ -G Ninja
$ ninja par_runner
outputs ./build/src/par_runner/par_runner.bin / hex / elf
$ ninja par_runner_flash
Select the par_runner build target in the bottom bar and press build.
Enter the 'Run & Debug' tab, select 'kwaczek DBG', and press run.
- currently firmare that is wrapped by par_runner comes from Tunas1337 mod k5_26_encrypted_18to1300MHz.bin UV-K5-Modded-Firmwares
- crypting/encrypting/modding py tools amnemonic repo
I'm not responsible for radios bricked by this trojan xD