Radioddity GD-55/TYT MD-398: An Unbricking Experience

So as you may or may not have gathered from this page; I am a bit of a nut about the digital mode hotspots. Some don’t like the idea and saying internet isn’t ham radio, but I look at it this way; the internet is just plugging me up to multiple repeaters. Am I still actually using my license? Yes. I need it to send the RF From the HT to the hotspot; and that means we’re all nice and legal for coming out of whatever repeaters are linked to a group. I do look at this hobby from multiple angles; HF is fun for the hard-core experimentation…things like DMR and D-Star are fun for less-stressful ragchewing. Plus it gets in a hefty dose of networking and IT infrastructure.

With that being said..I’m gonna tell a story about a particular lousy DMR radio I managed to salvage.

It basically started in a ham-radio chat room talking about DMR HT’s. A guy in the group had just gotten a hotspot (mostly because I explained just what was involved in “building” one and he found it was easy); but he was soon to have a new problem. He’d have a hotspot and no digital radio. That’s because he’d just gotten himself an IC-7300 and in need of a better radio myself; was selling me his IC-7100. For those that don’t know offhand; the IC-7100 is an all-mode HF/6M/2M/70CM rig with D-Star.

During this conversation another person commented they had a Radioddity GD-55 they had “bricked” and was offering it to anyone who wanted to tackle cracking it open “and fixing it with JTAG”. Apparently in his conversations when he got this radio and broke it, he was told the only way to fix it was to hook up with JTAG and “brute force” the correct stuff in to it. I said “hey, I know how to solder, have some Arduinos, and love a challenge”. On a Friday morning as I was leaving for work; FedEx was dropping the radio off.

How Bricked Is Bricked?

So this wasn’t a full firmware brick like I thought. When I got the radio and turned it on; it booted up like normal. But it was when it got to the channel display that it was clear something was broken. It was showing “Zone 1 Unprogrammed”, emitting a tone, and turning the screen off after 15 seconds. It responded to nothing. No matter what buttons you pushed….it wasn’t doing anything. So it wasn’t a hard-brick, but a soft-brick. But information about fixing this…was hard to find.

Just About Everyone Disavowed This Radio

So as a DMR radio..this thing was majorly flawed compared to how it was advertised. It was advertised as Tier II compatible with just a single timeslot available. That would be fine if it was actually Tier II compatible. It’s actually not. What was found was that it wasn’t attenuating transmissions on it’s unavailable timeslot; it was just duplicating the data on both. That’s bad news for something that’s supposed to be Tier II compatible. As a result…the radio was universally panned as a total piece of garbage…so much so that Radioddity pulled it pretty quickly and largely deleted every reference to it’s existance. It was replaced by the GD-55Plus…which was fully Tier II compatible.

So the real issue was finding any information was impossible. The only thing I found was warnings from just about everyone to not use it; with demands from repeater owners that they never attempt to use one of these radios on their repeaters. Many people bricked them after hearing there was a way to make both timeslots work; and many figured out that even if you fixed the programming…it actually didn’t.

So I was starting to look like I was up the creek. There was no information out there except on how bad and flawed the radio was. No one had done any serious reverse engineering.

Luck, or Dumb Luck

What I did find though was some user who had attempted to unbrick his radio before who provided two key components; firmware and the program to flash the firmware to the radio from it’s service mode. But this person didn’t write how to get the radio in to service mode; it was another user on that thread with a bricked GD-55 Plus who figured out the service mode.

So knowing I’m out nothing if I can’t fix a free radio; I put the thing in to what was supposed to be it’s service mode and fired up a serial connection to it’s COM port. I was greeted with a banner indicating it was waiting for firmware. Excellent. I loaded the proper TYT firmware and told it to program. Then I waited.

At first this didn’t seem to fix anything. The radio was still emitting a tone and unresponsive; but the display was different. Time and date had decided to appear and rather than “Zone 1 Unprogrammed” and emitting the tone; it was just emitting a tone with garbage text on the screen that changed. It still didn’t respond to buttons or anything. So I booted it back in to service mode just to see if I’d completely killed it. That was still working.

So I decided to boot it up with another key combo; PTT and the orange “man-down” button. This was supposed to be another way of getting the radio in to service mode; it did not. What it did was take the radio 5 seconds longer to boot up and it was all in Chinese. But it was the behavior as I pushed buttons that got me…as it was now doing something. There were now three channels programmed in to the thing and I could get in to the menus.

It was all in Chinese…but it was successfully unbricked.

No CPS/CPE? Really?

So the next part was to actually get a codeplug in to this radio and see if it worked with a simplex DMR hotspot. Simplex hotspots don’t have timeslots, that’s only a feature you can get on duplex MMDVM boards. So the fact this was a Tier 1 radio was just fine for hotspot usage. In fact it was at this point that I decided…since I have a full duplex MMDVM board and this radio is useless to me; I’d pass it along to the guy selling me his IC-7100.

I just had to get the radio working the rest of the way.

So Radioddity doesn’t list this model anymore, at all. If you need the Radioddity software; you’re screwed. That makes me think less of Radioddity. I mean…they may have screwed up…but I guess they expect people to just outright stop using a radio even if they have a valid use. I mean…sure it’s Tier 1; but if your only DMR use is a simplex hotspot…what does that matter? I guess people were so turned off by the thing they don’t even see that aspect.

But…needless to say…if you want the Radioddity software; you’re screwed.

Now TYT does make the MD-398 programming software available for the old model; but the problem is I could not access TYT’s website. In fact; I haven’t been able to access TYT’s website for over a year…and it’s an issue with my ISP (this is why we need net neutrality; the ISP refuses to route packets to the website in any form and has informed us they have zero intention of doing so). Of course…what was really pissing me off is every “is it down” detector told me it wasn’t down; but both my home connection and even the connection on my data-center hosted VPS couldn’t make it. So…I actually tried Tor. Tor couldn’t even get to it. If Tor can’t get to it…then WTF, right?

What I wound up doing was finding some “free” VPN extension for Chrome with horrible spelling that looked slightly sketcky; but I was only going to use it for long enough to get to TYT’s website. After routing my connection through someplace in Asia, I was finally able to connect. With the MD-398 software downloaded..it was time to test the radio.

Put The DMR ID In The Right Place

So I popped my simplex MMDVM board back on to the DMR Hotspot and sent a codeplug over to the radio. Nothing. The hotspot responded to the signal…but it wasn’t showing up on the dashboard. Maybe this thing is completely bricked afterall. Maybe I didn’t actually fix it but just made the issue worse by making it look like it worked.

Nope! I put the DMR ID in the wrong “ID” field in the codeplug. The radio was announcing itself as ID “1” and being ignored by everything. So I fixed that, uploaded it again, and keyed up Brandmeister Parrot.

There we go! Now it’s working.

The End Of The Journey

While I was hoping to have pictures of this thing hooked up to an Arduino with some crazy story about how I had to manually flash the firmware and stuff in to the memory; that didn’t happen. Through either dumb-luck or a combination of new firmware and dumb luck; I turned what was once a bricked GD-55/MD-398 in to a usable radio.

Next week, on my way to work; It will be going to the ham that sold me his IC-7100 and is in the market for a DMR HT. And the funny thing was he originally wanted to work a DMR HT as part of a trade before finding out I only had one myself. Crazy how things work out. He’s still getting a DMR HT. IT cost me a few hours of time that taught me a little bit I didn’t know; and it’ll cost me a few bucks to ship it. Hey, he sold me a good radio with shipping for a stupid cheap price; I even told him I was covering the shipping on the HT when he offered to pay for it.

The Circle of Ham continues. Gear getting passed around, gear getting repaired and passed around, everyone getting radios and playing. This is the type of stuff I love about ham; not the OM on QRZ bitching about they don’t like field-day rules so they decide to be dicks and ignore stations; or denying you a contact when they find out you’re in a station class they’re boycotting.

In my opinion, the ARRL should boycott their logs; but that’s a different harmonic for another time.

Leave a Reply