MOTOROLA SYSTEM SABERS HW HACKING
Posted: Tue Apr 01, 2014 3:08 pm
Hi All:
I have just posted this evocative topic to encourage experimentation on Motorola Systems Saber radios. Those familiar with the Systems Saber radio are aware that a fraction of the interior cubic space is occupied by either a SECURENET module or a bypass module consisting of a wire. Now due to FCC part 90 narrowbanding the SECURENET operation of these radios is largely obsolete. For experimenters this is good news because e-bay is flooded with System Sabers to experiment with.
I have taken a few hours out of my very busy schedule to map out schematically the signals available in the SECURENET space of these radios.
Briefly; there is complete access to transmit and receive audio paths, switched and unswitched B+, Regulated +5V, paths to and from the universal connector as well as access to the 9600 baud interior serial data bus, serial data /busy line and radio /reset.
Functionally when the radio is programmed to operate with a Multikey SECURENET module, the radio can communicate TX and RX modes, 0-7 multi-key, secure/clear commands from the U400 CORE processor to the SECURENET module. In theory one could hijack these signals and install a module that uses these signals to do something completely different.
The communications protocol used is somewhat cryptic, however terms such as LH (Long Horn?), SCI and SB9600 have been found in the documentation. Since some of you have reverse engineered these protocals in more current product, it seems likely the same could be done for the SYSTEM SABER.
What sort of things could be done?
1) A multipurpose board with a microchip to exploit the signalling bus to provide interface to other experiments such as APRS.
2) A D-STAR interface. Maybe an ICOM UT-121 D-STAR board can be angled into the space along with the interface board to provide basic D-STAR features. Maybe an AMBE 2020-10 chip can be installed along with a CML data pump? I know there have been some large scale D-STAR retrofits, maybe time is right to miniaturize?
3) A frequency hop spread spectrum (FHSS) module using a small GPS receiver for synchronization. I am curious to know if the synthesizer can be bit banged to a new frequency while transmitting and receiving without significantly disturbing the PLL lock.
4) An analog encryption module interface.
5) A Rodger Beep (ha ha ha!)
6) A Blue Tooth headset adapter
7) Ideas??????
Please feel free to visit the web page below and copy the bit map of the schematic. Those wishing a Visio file may contact me directly.
http://leikhim.com/page15.php
I have just posted this evocative topic to encourage experimentation on Motorola Systems Saber radios. Those familiar with the Systems Saber radio are aware that a fraction of the interior cubic space is occupied by either a SECURENET module or a bypass module consisting of a wire. Now due to FCC part 90 narrowbanding the SECURENET operation of these radios is largely obsolete. For experimenters this is good news because e-bay is flooded with System Sabers to experiment with.
I have taken a few hours out of my very busy schedule to map out schematically the signals available in the SECURENET space of these radios.
Briefly; there is complete access to transmit and receive audio paths, switched and unswitched B+, Regulated +5V, paths to and from the universal connector as well as access to the 9600 baud interior serial data bus, serial data /busy line and radio /reset.
Functionally when the radio is programmed to operate with a Multikey SECURENET module, the radio can communicate TX and RX modes, 0-7 multi-key, secure/clear commands from the U400 CORE processor to the SECURENET module. In theory one could hijack these signals and install a module that uses these signals to do something completely different.
The communications protocol used is somewhat cryptic, however terms such as LH (Long Horn?), SCI and SB9600 have been found in the documentation. Since some of you have reverse engineered these protocals in more current product, it seems likely the same could be done for the SYSTEM SABER.
What sort of things could be done?
1) A multipurpose board with a microchip to exploit the signalling bus to provide interface to other experiments such as APRS.
2) A D-STAR interface. Maybe an ICOM UT-121 D-STAR board can be angled into the space along with the interface board to provide basic D-STAR features. Maybe an AMBE 2020-10 chip can be installed along with a CML data pump? I know there have been some large scale D-STAR retrofits, maybe time is right to miniaturize?
3) A frequency hop spread spectrum (FHSS) module using a small GPS receiver for synchronization. I am curious to know if the synthesizer can be bit banged to a new frequency while transmitting and receiving without significantly disturbing the PLL lock.
4) An analog encryption module interface.
5) A Rodger Beep (ha ha ha!)
6) A Blue Tooth headset adapter
7) Ideas??????
Please feel free to visit the web page below and copy the bit map of the schematic. Those wishing a Visio file may contact me directly.
http://leikhim.com/page15.php