Are you ready for this? : Spectra Moflags Cracked AND Hacked

John G · Post by **John G** » Mon Jan 05, 2004 10:50 am

I have been trying to get some 900 Spectras to have talk around without success. I have cloned them with a codeplug that, when read by itself, says that talkaround is available. If I read the radio the codeplug came from, I can program a talkaround frequency. However, when I dump that codeplug into another radio, even if I enable the Moflags for talkaround, when I first look at a mode, it says talkaround is there, but when I go to program the frequency, changes to not available. This has happened on at least three radios. There is something in the radio itself that is prohibiting talkaround from being used even if the moflag is set and the model number supports it. Any ideas what it could be?

Post by **wavetar** » Sun Nov 06, 2005 8:48 am

Back in it's entirety....actually, with all of the Cowthief BS removed from it. There are some interesting tidbits in the thread not covered on the main Batlabs site, so I've reposted this thread for all members to enjoy.

Todd

Victor Xray · Post by **Victor Xray** » Sun Nov 06, 2005 10:58 am

THANK YOU WAVETAR!

This was the number one (of only two) threads that everyone has heard me b!tch about having been removed. Good to have it back again.

Now what I'd like to see are address value difference between MLM verisions. And maybe more information/identification on the other address registers that haven't already been identified.

Zap · Post by **Zap** » Sun Nov 06, 2005 8:58 pm

Reguarding the moving checksums...

Back in '02, while spending (far too) much time examining the maxtracs .mdf file I learned of how organized it was and how to predict where the tables would start and end. I haven't posted this as I didn't think maxtracs where still being examined (but will if asked).
This seems like a good time to bring this up.
There are pointers at the beginning of the mdf file that tell you;
for table 1:
hex start address of table 1word
unknown 1word
length of characters per entry 1word
number of entries in table 1word
for table 2:
same...

Seems that the number of tables is fixed and expected.
so when the data varies, there are pointers to setup the rss.
So I am suggesting there is a pointer to show where to look for the checksum, perhaps as functions expands the table shifts, like when hacking the mtx820(portable), it used vector tables you could modify but you had to keep track of where you should be depending on what you modified.
the pointer if exists maynot be so hard to find.
look for reversed byte orders loByte/hiByte as that is typical of the format I have found.

Doug

EPC_1111 · Post by **EPC_1111** » Fri Oct 13, 2006 12:49 pm

apco25 wrote:I wonder the "algeria SP" option does....

Makes your spectra talk french ?

It deploys a white flag from any whip antenna.

MattSR · Post by **MattSR** » Fri Oct 13, 2006 5:24 pm

ROFL!!!

EPC_1111 · Post by **EPC_1111** » Tue Nov 14, 2006 3:47 pm

I hate to ask newbie questions, but does this mean I can buy any newer spectra from the net or wherever I choose to find a radio, and put in the options I want?

ka8ypy · Post by **ka8ypy** » Wed Nov 15, 2006 4:53 am

Victor Xray · Post by **Victor Xray** » Wed Nov 15, 2006 8:59 am

To the extent that the MLM will support. Not all features available on all MLMs.

SpectraBob · Post by **SpectraBob** » Mon Jan 15, 2007 10:28 pm

OK, I've just finished reading all of the info here and am a bit overwhelmed (but impressed) by everybody's technical expertise. What I'd like to know is, has the "just for dummies" version of these changes come out yet? LOL

In my case, I simply want to use an A5 (or even an A7 head) on an A9 Spectra mid-power 800-mhz conventional radio. While I am capable of programming changes in channels, etc (basic changes), I honestly have no idea of what is being discussed here, as far as hacking the codeplug to make changes (such as changing the control head type). I'm not that well-versed in such technical aspects.

Has anybody provided a step-by-step downloadable version of how to do some of these changes (without necessarily fully understanding the deeply-technical aspects), and if so, where might we find such a valuable resource?

Thanks...

bellersley · Post by **bellersley** » Mon Jan 15, 2007 11:00 pm

If all you want to do is change control head types, that's fairly easy and doesn't require any mo-flag hacking.

There is a page out there which I can't seem to find, but it had screenshots of exactly what you need to change. I want to say JAYMZ made it, but I can't recall.

kcbooboo · Post by **kcbooboo** » Mon Jan 15, 2007 11:46 pm

JAYMZ posted his info in the Knowledge Base section of this BBS. Check Mobile Radios, Spectra Model/Serial.

While it's not necessarily a simple "change this, change that" article, it does tell you what to change.

Similarly there's some useful Spectra info on http://www.repeater-builder.com, in the Motorola area, Spectra section, in an article titled Miscellaneous Spectra Topics. It describes changing the control head byte to turn an A9 radio into an A7, based on the info found above.

Bob M.

SpectraBob · Post by **SpectraBob** » Tue Jan 16, 2007 7:40 am

Thanks for all the comments here; I will take a look at that website as well.

Bob

JAYMZ · Post by **JAYMZ** » Tue Jan 16, 2007 1:37 pm

Actually Bob, there is a primer for model/control head changes in the knowledge base as well.

http://batboard.batlabs.com/kb.php?mode=article&k=31

It's all a work in progress, of course.

SpectraBob · Post by **SpectraBob** » Tue Jan 16, 2007 9:14 pm

Thanks, but unfortunately it appears that the article doesn't exist, at least yet. I'll try again later.

Thanks again!

Bob

Are you ready for this? : Spectra Moflags Cracked AND Hacked

MOFLAGS aren't the Whole Answer

Re: Hacking a codeplug to change the control head type