Motorola GP2000 UHF Out Of Band Mod

This post details how to modify the band split for a Motorola GP2000 UHF portable radio.

Introduction

The GP2000 is a relatively low cost single band portable FM transceiver, while prefixed with GP its construction is a bit cheaper than the typical GP300 series radios. It seems to have been launched around 1999, targeting the Asian markets. Marketing materials highlight the smaller size as being better suited to this market, though users all over the world seem to appreciate a compact radio.

It also has a VFO mode with full keypad programming, this is very uncommon for professional gear but probably appreciated by dealers in developing countries that can save money by not buying cable kits and CPSes. This mode being available and seemingly always an option (no disable feature in the CPS) is probably why this radio is not FCC certified according to the stickers on my units.

The UHF variant is available as 400-440, and 435-480 MHz. As usual I have the wrong version, Norwegian hams need 432-435 for repeater access and simplex, other EU countries probably want an even lower minimum frequency.

The radio launched with NiCd, NiMh, and Alkaline (primary cell) battery packs, this is another feature more typical of a ham radio than a commercial radio. The radio is separately calibrated for Alkaline batteries, presumably due to the higher source impedance of these batteries.

The issue with these radios is finding batteries, this seems to be one of those radios where demand is too low to justify third party batteries. It's likely all batteries available are old stock. If you have old batteries for these I suggest replacing the cells in them instead of discarding them.

I did buy some "Li-Ion" batteries for the radio off AliExpress, but this turned out to be a lie, since the batteries I got were Ni-Mh.

Finding a charger for this radio also appeared to be tricky, maybe some other radios charging cradle can be modified to work?

This radio has some software tuning, but a key difference between this and e.g. the GP300 series is that this radio uses primarily discrete analog signal processing, as opposed to the ASIC used for higher end radios.

Required Software

• Alpha Series CPS R01.00
• PRO 2150 Tuner ver 102
• Hex Editor (HxD)
• VB6 runtimes (all of them)
• Service Manual

I have only tested this on Windows 2000 (via VMware), but it looked like it would work fine on Windows 10 as well if the required VB6 libraries are installed.

Required Hardware

• Power supply/battery
• Alignment aids like a service monitor, signal generator, cables etc.
  • The antenna-BNC adapter is the HLN8262A, this is not the same as for the GP3x0 series
  • There's no ground for the adapter so sensitivity and output power will be somewhat inaccurate when measured with this
• Programming cable (2.5 mm jack type)
  • The programming cable is similar to e.g. the Icom IC-T70, with a single TTL two-way serial port. The radio has a 4.7 kΩ pullup to 5 V on the line.

Fixing the Tuner

To use the Tuner software to update the EEPROM data, we need to bypass the password restrictions. Find TUNER.exe (md5 sum 412345a924705e1d7e72b29433ed60f6) and open it in a hex editor.

Find the value 0x74 (JZ) at offset 0x362B4, change it to 0x75 (JNZ). This inverts the passord check so it will accept everything but the correct password.

After editing my TUNER.exe file had a md5 sum of b5d92dc40d4832bd03cba81b1d7c8273.

Informative: the tuner password is not stored in plaintext, but is calculated at runtime based on some parameters inherent to the program file. Bypassing it is the easiest way to deal with it. For some weird reason it's possible to change the password, so that's probably why its computed at runtime.

The Tuner software will check that the model number matches when writing EEPROM files, this check can probably be bypassed as well, but there's no real reason to update the model info (it's only used by the CPS/Tuner software).

The only reason I can think of would be if a radio had a bad EEPROM and the contents were wiped entirely after replacement.

EEPROM/Codeplug Format

I only did a small amount of work with the codeplug, I determined the addresses initially by zeroing them in the file and seeing what the CPS made of the data.

The radio has a VFO mode, because of this the radio actually checks the allowable frequency range by itself, and will reject out of band programming (RX might work but TX won't). There is a checksum in the EEPROM data, this is checked by the radio, but the Tuner/CPS software doesn't seem to use it.

It should be noted that all the EEPROM data and CPS data is inverted; things like model no. and serial are inverted so they don't immediately light up in the text view.

The .eep file (tuner made) and .cpg file (cps made) have the same content and size, the .cpg file has a prefix used by the CPS.

Reading the radio codeplug actually seems to read the entire EEPROM, but writing a codeplug will not update the start sections containing serial, model, tuning etc. info. To update this the tuner software must be used.

The following offsets apply only to the .eep file made by the tuner software EEPROM Read function:

Offset (.eep file)	Value	Description
0x0D++	Inverted ASCII	Model no. in plain text
0x57 (LSB), 0x58 (MSB)	0x6D83 (480 MHz)	Maximum tuning frequency See below
0x60 (LSB), 0x61 (MSB)	0x7B3F (435 MHz)	Minimum tuning frequency 0x0000 gives 839 MHz 0xFFFF gives 0 MHz

 Procedure to lower the band split

1. Use Tuner software to read the EEPROM data
   1. Tuner Init to connect to the radio
   2. File -> EEPROM Read (just hit Enter when the password prompt comes up)
   3. Save the EEPROM, the EEPROM data is unique to each radio and must be read and modified for each unit since it contains tuning data and the serial number
2. Modify the EEPROM data

   1. 

   2. 0x7C3F gives a limit just below 432 MHz
3. File -> EEPROM Write the new EEPROM file
4. Radio will show "EEP ERROR"
5. Tuning Init again and modify a parameter or two, then do a Tuning Exit
6. Radio is now modified and can be read/written by the CPS with the new band split

The fact that the radio will refuse to accept the new EEPROM data when we modify it indicates that there is a checksum. However, the Tuner software is happy to ignore that when reading, and it seems to calculate a new checksum when any data is modified and the tuning is closed.

The location of the checksum can be determined by reading back the EEPROM again after writing it the second time, but I haven't bothered to do so.

It is advisable to now do a radio alignment since the tuning parameters now cover a wider range than before. 

Note that you can also move the upper limit down (this might improve the tuning accuracy), 480 MHz = 0x6D83 in the EEPROM, offset 0x57, 0x58. Larger number = lower frequency.

Other Info

The radio has a VFO mode that can be used in Dealer mode (see Service Manual, it's a keypad sequence to enable). Program a key to be VFO and you're good to use it. The VFO settings show up in the CPS if the radio was read with the VFO active. See the service manual for instructions and list of menu options.

Wide/Narrow FM (for 12.5/25 kHz capable models like mine) is set per channel under Advanced -> Channel Bandwidth. 12.5 kHz means ±2.5 kHz peak deviation and will use the narrower filter for receive.

The wide path has a 455F type filter (±6 kHz; fairly narrow for Wide), narrow adds an additional 455H filter in series (±3 kHz, also quite narrow). The demodulator IC is a TA31136FN with a ceramic discriminator element.

To change between channel numbers and the Alias defined per channel, assign a key to the function "DISP". 

To use DTMF, assign a key to "PHN", the DTMF parameters are set using the Signalling→Advanced setting.

The CPS is bad at regionalisation, you will need to change your OS region to one that uses a period as a decimal separator to enter frequencies correctly. I couldn't find a trivial way to patch this to work properly. This is why modern programming languages use regionalisation information when dealing with numbers.

Plan your channel numbering, there's no copy/move feature in the CPS, but you can enable/disable channels so leaving some gaps between e.g. simplex and repeater frequencies can save some headache later.

I found the programming software would occasionally hang, this didn't cause any issues with normal CPS programming (just reset the radio and force quit the CPS, try again). Not sure what would happen if this happened during EEPROM programming.