Radioddity GD-55/TYT MD-398 Resources

The Radioddity GD-55 (a rebadged TYT MD-398) was released sometime around 2015/2016 and was popular for about half a minute. Sadly the radio is plagued some massive design flaws that made so hated, Radioddity was refunding people from the beginning and has since disavowed the existence of the radio. It was replaced by the GD-55 Plus/MD-398G which fixed those problems; but is still not spoken about as much as the other radios; like the TYT MD-380s or GD-77s and it’s many clones…two lines of radios which have had alternative modified firmware created. However the GD-55 (Plus) boasts 10 watts of output power and IP67 waterproofing.

The main problem with the original version is that while it was sold as a single timeslot capable Tier II radio, it is in fact not a Tier II radio. It does not silence it’s transmissions during the unavailable timeslot; opting to just duplicate the data between both. While I feel people may have forgiven the radio for being a single timeslot if it had complied properly with Tier II specifications; the improper support makes it completely unsuited, in fact illegal, for repeater use.

However there is one use the radio has, and that’s with the ever-growing popularity of MMDVM based hotspots. While you can actually get full-duplex models of the boards now; the basic setup is just a simplex node with a single timeslot on DMR. The behavior of the GD-55 is not an issue on DMR simplex, which doesn’t make use of time-slots (apparently, I have not read Tier I specs); meaning the radio is just fine for using with a DMR hotspot.

Firmware/Software

These have been provided by user Gyuri961012 via a RadioReference Thread. I have mirrored them locally because download sites are sketchy; but not everyone self-hosts like I do.

I am mirroring this here as it took me a while to find a VPN that could connect to TYT’s website; and this was after both my server and home connections also failed to connect.

I have provided an ISO copy of the disc that came with the programming cable. I was unable to find anything that wanted to work with the GD-55 on this disc; though I’ll admit I didn’t try every single program. None of the radios software was provided for seemed to be based on the same thing as any of these radios. It does however, have drivers for various cables. I am providing an image of this for those that lack optical drives.

Start-Up Options

xSmurf started a reverse engineering guide over on GitHub. One of the things it contains is a chart with the key-combinations for booting the radio up in a special mode:

PTTTOP SIDE BUTTONBOTTOM SIDE BUTTONEMERGENCY BUTTONFunction
XXFlip + Mirror screen
XX??? Black screen no chime, upgrade mode?
XXGPS Test mode
xxFactory Reset (?)
The possible factory reset mode was found by me and I’m assuming this is what it is. See “Recovery Procedure” for more information.

The main two functions you’ll need to recover a bricked radio based on the stuff I write up will be the upgrade mode and factory reset. The factory reset was not part of the original reverse engineering chart. It was actually found accidentally. There was a reference to that key combination on the radioreference thread; I decided to try it.

How I Recovered A Bricked Radio

The radio I got was only somewhat bricked. It was not very functional as it was, but was functional enough to make accidentally fixing the thing easier than expected. The one I received apparently had a invalid codeplug of some sort; causing it to lock up on the screen and ignoring all controls. I was partially flying blind here without much information out there.

Windows 10 automatically installed a driver that worked with my programming cable; so that was rather easy. After finding what COM port it was on, I loaded up PuTTY and configured a serial connection:

I started the terminal and then held the top and bottom side buttons while turning the unit on. I was greeted with this:

Since the radio had a valid firmware and apparently just had an invalid codeplug, I expected it to boot in to service mode. But if you’re recovering a GD-55/MD-398 that’s in any kind of bricked state; try that boot procedure while watching the output and see if service mode boots. If it does, we can probably save it. I’m not sure how bricked a unit has to be before it won’t go in to programming mode.

I unpacked the firmware archive and found the one for my radio. There are several of them in the archive for the various models/options. The one I was interested in was the 470MHz version with GPS, version 0.79. I then installed the firmware update tool; which I just ran as administrator in Windows since it made it not crash instantly. I pointed it to the firmware file, picked the proper COM port, booted the radio up in service/program mode, and clicked “Activate”. You will get an error message like this:

Not knowing what else to do, I ignored it. Given the fact it’s talking about a key file; I’m guessing it might be encryption? Doesn’t matter anyway since we can’t use encryption. I just clicked OK, ignored it, and clicked write. It sat there uploading the firmware for a couple of minutes, telling me it was a success. I rebooted the radio.

It still didn’t want to respond to any buttons; but things were different. It was now displaying the time and date; but it was displaying a bunch of changing commas for the channel name and frequency. It was still emitting the tone and ignoring all buttons, except the screen remained on now.

What drove me to try the PTT+Emergency Button key combo; I don’t know. It was mentioned in the radioreference thread as putting a radio in to programming mode (but not a working radio, which used the two side buttons). I don’t know why I thought I somehow bricked it further; but I held down the PTT and Emergency button while powering it on. Nothing happened, at first.

Then it started displaying Chinese. Everything was in Chinese. But…when I turned the channel knob a few times; it hit some programmed channels. I hit the menu button, the menu loaded. I can’t read any of it…but there it is!

The defaulting back to Chinese makes me think I hit some kind of factory reset key-combo; and that maybe all I had to do to start with was hit that key combo. I also don’t know how old the original firmware was compared to what I uploaded. It’s entirely possible the firmware flash combined with the factory reset is exactly what it needed. The guy that gave me this radio (K8BMZ) was apparently told by Radioddity that the only way to fix it was “doing something with JTAG”. That seemed like something to fun to try…now it seems I don’t even need to do it.

But hey, it’s a start; and now we can start to see just how bricked it still might be.

CodePlug & Test, Baby

Up to this point…everything has been a remarkably easy and mildly educational experience. But when it came time to get a codeplug in to the radio, that’s where things went south. Radioddity doesn’t acknowledge the non plus version of this radio anymore. The GD-55 Plus software isn’t compatible (or wasn’t for me). To top this off; my ISP wasn’t routing me to TYT’s website; neither was my own server or the first few VPNs I ultimately tried. So there were hours of frustration just trying to get the piece of software I needed.

Ultimately…I found a VPN that got me (slowly) to TYT’s website; where it was well worth the 10 minutes it took to download the 989Kb archive that had the programmer. That’s why I’m gladly mirroring it here where that should be less of a problem for people. In fact I’m half tempted to rip a mirror of TYT’s download site just for that purpose. But…another harmonic, another time.

(Update: At some point before finding a way in to TYT’s website, I decided to email Radioddity about getting a copy; afterall it’s their brand on the radio, right?

Wrong! Apparently that means nothing to them; as they informed me “they don’t sell it, contact who you bought it from”. I had explained once in the email that I acquired this from someone who had bricked it; so there was no seller. I am literally going to the company whose brand name is on the product. For any of the other guys, this probably wouldn’t have been a problem. But Radioddity basically told me to go take a hike; that they weren’t even going to send me software. That they’d rather see a product with their name on it sit useless.

Don’t buy Radioddity.)

If DMR codeplugs weren’t confusing enough; this software is either really bad…or I’ve been spoiled by the alternative CPE for my MD-380.

You’re probably going to want to click on this for the full thing.

For those who don’t know…DMR codeplugs are interesting. Due to the closed nature of commercial radio services; it does things that we as hams might not like. Programming the radios is one of them. While any other mode just requires you to point your radio to the repeater and go (D-Star, Fusion/C4FM); DMR is channelized to an insane degree. Rather than programming a repeater, you have channels. Each channel consists of a frequency pair and a digital contact; this can be a “group call” talkgroup ID number, or it can be a private call to an indvidual’s ID. But before you can assign a contact to a channel, you also have to create it as a contact.

Where it gets fun is the fact you have to program each talkgroup on a repeater as an individual channel; as well as private calls. So if there are 5 talkgroups on your local DMR repeater, it will consume 5 channels. Then you arrange your channels by “zones”; which can be by repeater or however you want it. It’s a lot more complicated than punching in the frequency and offset of the repeater, setting the color code, and then being able to type in the talkgroup ID on-the fly.

But, you have to remember; this is a commercial radio system. It’s designed for an environment where the radio is licensed by type; and many features we take for granted aren’t allowed. They’re designed for services that have much tighter restrictions. Most of the alternative firmwares, for example; offer on-the-fly talkgroup and private ID entry.

But one of the main annoyances is this program boots up with a Chinese GUI. But not a big deal; just go to the top menu bar and look for “(S)”, click that and select English. Now you’re good to go.

I’m going to cover the basic process for how I configured mine for a test. I was going in to a simplex MMDVM board (borrowing one of the frequencies from my duplex config) on 447.9, and make a private call to the Parrot at ID 9990.

Basic Setting(s):

On this window the main things you’ll want to do is change the radio’s language to English and enter your DMR ID as the Radio ID. I had a brainfart and entered it as the serial number in another window; don’t do that. It was stupid, I admit it. Everything else I left as my screenshot shows.

Create Parrot Contact:

Now on the left side I go down to the “Digit Contact” sub-section of “Contact”. There may already be some created, I’d just erase all of them, click on the “Digit Contact” folder, and select add. You will be able to create three different types of contacts; single, group, full. I have no clue what full is; we’re interested in single for private calls, and group for talkgroups. After selecting single, I give it a name that fits and enter it’s ID: 9990.

Create Parrot Channel:

Now we need to actually create a chanel that uses the Parrot contact we created. These are stored under “Zone Settings” on the left folder view, with each “zone” being a subfolder. You can rename zones by right clicking the zone name. But for now, we’ll click one of the default channels and reprogram it.

Give it a new name, set it’s color code to 1 (or whatever your hotspot is set to), and make sure the Channel Mode is “Digit”. I didn’t set any options for RX (though I could be wrong and need to set a group RX), but set it’s frequency to 447.9. On the TX Side, I entered the simplex frequency, selected the contact, and left everything else pretty much default.

I wrote this to the radio, which booted up in English and on the Parrot channel. I keyed a test, and a few seconds later; Brandmeister returned.

Success. The radio has been repaired. I’m actually going to pass this along to K8RDH; who recently got a hotspot just before he decided to give me a fantastic deal on his IC-7100 and was looking to get a DMR HT. I’ve got the information for the configuration he wants; so I’ll do some additional testing to make sure it’s 100% and ship him out a pre-programmed DMR HT.

Note: The software provided on this website the property of the original authors and the copyright of any entity that may hold such rights. nq4t.com does not wish to infringe upon the copyright of those holders. We feel that most of this software is distributed freely by the authors for use in products; and that by offering a mirrored copy will help ensure accessibility during times of network issues or blocks.