Thanks to the work of Kai DG4KLU and @forkoz aka @rootstar, and of course myself ;-)….
The work to reverse engineer the GD-77 is progressing…
@forkoz has done some great work to analyse the operating system used by the GD-77, which is called MQX, and has identified at over 100 functions associated with this, including the top level “Tasks” including
Plus a whole load of other things.
I have found the AMBE codec related functions, by decompiling the MD-380 firmware and cross referencing the “annotations” list produced by the MD-380 toolz guys, to find any telltale mathematical constants associated with the codec, and by looking for the same constants and other patterns in the GD-77 firmware.
In the end, I found a 100% match between the functions in the MD-380 firmware and the GD-77 firmware, which means that Radioddity (aka TYT), used exactly the same source code for the codec in both radios, and probably used the same compiler (called IAR workbench).
I have also tracked down all the functions related to the AT1846 transceiver chip, using a similar technique; but this time, I looked for patterns of “register” use in the AT1846, because I knew that the registers to set the frequency are 0x29 and 0x2A.
Searching though the binary file of the code, I identified occurrences 0x2A and looked for close occurrences of 0x29, and when I found a match, I used the Ghidra decompilation to confirm that I had indeed found the function to set the frequency.
Once I’d found one AT1846S function it was relatively simple, although time consuming, to follow the hierarchy upwards and downwards, to find where the set_frequency function was used, and also what sub functions the set_frequency function used.
Then cross referencing the incomplete documentation of the AT1846, I was able to find this list of functions
I’ve also loaded RAM snapshots into Ghirda, and I have found the location of the active TalkGroup / PC ID, which I can change using the debugger, and have confirmed, changes the TG or PC that the radio uses.
I’ve also found the current Rx group list
Kai (DG4KLU) has been busy building some firmware from scratch, which will hopefully eventually become an alternative Open Source firmware for the GD-77, but just getting the radio to work on FM will require, hundreds if not thousands of hours of work.
Kai has also supplied information on the way the radio reads the keypad, and I have now identified 6 hidden commands that are activated by holding various keys down when the radio is turned on, as well as many other snippets of information.
PLEASE DON’T TRY THESE BUTTON COMBINATIONS ON YOUR RADIO, BECAUSE I DON’T KNOW WHAT THEY DO 😉
Blue button and “3”
Blue button and “6”
Both look like they are doing something like resetting back to factory settings, as the radio seems to reboot after using these sequences.
However I could not see any difference to the codeplug in the radio after pressing these combinations
Black button and “1”
Black button and “2”
Black button and “5”
Black button and “6”
See to set some internal configuration inside the GD-77, but I don’t know what these configuration do. They could potentially reset the codeplug or the calibration or anything.
Now that I know where the keyboard reading and decoding function is, I’m hoping to be able to patch the code to allow direct input of TalkGroup, but one complication is that the new TG would need to be added to the Rx Group list, so I think I first need to modify the Rx group handling so that the Tx TG is automatically added to the Rx Group list.
IMHO the Tx TG should always be part of the current Rx Group list, as this is a gotya that catches people out when they select “None” for the Rx Group list on a Channel in the CPS and then find they can’t hear any audio.
So I want to patch the Rx Group list code, to also read the Tx TG, under all circumstances first – though this is easier said than done.
After that I want add a function, where pressing the star key, will allow direct entry of a Talkgroup.
But I think it could be a few weeks before I manage to even get the initial change to the Rx Group handling to work.
What we really need is more people to help with analysing the GD-77 firmware, its only going to be slow progress with me and @forkoz doing the analysis 🙁