Comment below if you have the model numbers or names.
MD-380 Official Speaker MIC
Here is a picture of the three mics side-by-side.... Quality has its price...
TYT Tytera customer warning
TYT Tytera customer warning
How does that go again...you can paint a old taxi a new color, but it's still a taxi?.....something like that?
I HIGHLY suspect the new MD-390 is NOT a improved model, but the same exact guts from a 380 with a larger battery.
I have lost any faith in TYT to produce a decent product. I had also ordered a quad band mobile from them. We sent that pile of crap (well it LOOKED nice) back to them (on their dime). The receiver was as selective as a crystal diode set.
TYT tried HARD really hard to screw us, but we had Paypal on our side.Paypal got involved and found in our favor 4 times! It got to the point were we contacted TYT and demanded to know how they wanted their shit sent home.They finally gave us a number to use with DHL (their account). Meanwhile we got threats from Joey Pan and his boss "Sophia", they were extremely angry at Paypal for refunding us and told Paypal they could not do that! (they need to read their Paypal agreement).
Would we do business with TYT ever again? NOT ON A BET!
All I can say is this.....buy from a store thats going to back the sale.They are going to be your backup.Ask this question...."What is the warranty period on this product and does it include postage".If you deal directly with TYT THERE IS NO WARRANTY.TYT never wants to see that shit again.
Now if spending $200 on a radio is "Expendable" like fruit that's going to spoil, you are golden, but if you see this as a INVESTMENT..think again.I would love to hear from others that have needed parts support from TYT.You drop your MD-380 and crack the case, or break a knob or control.So far as we see it, the only thing you can get is extra batteries and belt clips.If you have a Motorola, Kenwood, Icom,Yaesu..getting parts is no problem.
MD380 out of band reception
I have worked out how to program out of band. I have been able to enter RX freq upto 498.000mhz.
Change this in the setup.ini
Original value is
The last two numbers determines the frequency.
You can then enter any freq from the keypad you like upto around 498.
My radio works really well.
The only problem is that when you program your radio using the software it will only only you to enter VHF 136 - 174.
If you ever want to go back to original just change the values in the setup.ini back to original
It's likely chirp can be used to program out of band. A chirp plugin already exist although I don't know how complete it is. Just because the display says something it doesn't mean it will actually work. I'm sure there are filters in the radio to attenuate signals outside the bands it was meant for. This make the question now.
How far out of band can the radio TX/RX effectively?
[setup]
language=english
testmode=1
model=DR780
oemmodel=MD_380
oemindex=255
windowtext=CPS MD_380
readwrite=0
chcount=1000
zonecount=250
password=0
readmodel=0
exeflag=0
exepassword=777777
languagemenu=1
jstdefault=0
voiceencrypt=1
timesetting=1
[FreqRange]
freq0=[136-174MHz]
data0=60134017
freq1=[350-400MHz]
data1=00350040
freq2=[400-520MHz]
data2=00400052
freq3=[450-520MHz]
data3=00450052
I am able to program upto 498 and it receives fine, once I go over 498, it seems very deaf.
You need to program the radio with a codeplug that already has all your channels you need except for the ones above 480Mhz. You then add the extra out of band channels you need, write this to the radio, then you have to program each channel from the keyboard, you require above 480.
Make sure when you program the radio with the TYT software you set the DIGITAL or ANALOGUE before you write to the radio as you can not change this via the keyboard.
You can program from the keypad in a limited capacity. It's really only useful in circumstances where you are modifying a channel. There is no way to create a new channel. To do it you must enable the option using the software first. Then it will appear under utilities.
The chirp plug-in is available via github from travisgoodspeed. It's part of the 380usbtools package. It's incomplete and can only do the analogue programming. Furthermore it requires a manual read/write to the radio currently.
TYT MD-380 DMR UHF $129
TYT MD-380 DMR UHF HT Radio for MotoTRBO
$199.99 - $129
http://www.grapevineamateurradio.com/store/?model_number
Model Number: MD380
Battery Eliminator
Battery Eliminator - Car Adapter (+$14.99 per order)
Your Price: $129.00
40 Left in Stock
$199.99 - $129
http://www.grapevineamateurradio.com/store/?model_number
Model Number: MD380
Battery Eliminator
Battery Eliminator - Car Adapter (+$14.99 per order)
Your Price: $129.00
40 Left in Stock
DMR Radios NEW at $130.00.usd
Update
Connect Systems stopped selling the MD380.
DMR Radios NEW at $130.00.usd
Connect Systems is having an early sale
Too meet competition, Connect Systems is selling the MD380 in either the UHF or VHF versions for $130 usd. Includes the programming cable. You can either buy it through their web store at www.csi-radios.com or by calling them at 818-889-0503
ConnectSystems.com
Connect Systems stopped selling the MD380.
DMR Radios NEW at $130.00.usd
Connect Systems is having an early sale
Too meet competition, Connect Systems is selling the MD380 in either the UHF or VHF versions for $130 usd. Includes the programming cable. You can either buy it through their web store at www.csi-radios.com or by calling them at 818-889-0503
ConnectSystems.com
Tytera MD380 jailbreak turn into DMR scanner
Last weekend at Shmoocon, Travis Goodspeed presented his reverse
engineering of the Tytera MD380 digital handheld radio. The hack has
since been published in PoC||GTFO 0x10 (56MB PDF, mirrored at https://hackadaycom.files.wordpress....ocorgtfo10.pdf ) with all the gory details that turn a $140 radio into the first hardware scanner for digital mobile radio.
The Tytera MD380 (and the Retevis RT-3 clone/rebrand ) is a cheap DMR radio with two main chips: an STM32F405 with a megabyte of Flash and 192k of RAM, and an HR C5000 baseband. The STM32 has both JTAG and a ROM bootloader, but both of these are protected by the Readout Device Protection (RDP). Getting around the RDP is the very definition of a jailbreak, and thanks to a few forgetful or lazy Chinese engineers, it is most certainly possible.
In Digital Mobile Radio, audio is sent through either a public talk group or a private contact. The radio is usually set to only one talk group, and so it’s not really possible to listen in on other talk groups without changing settings. A patch for promiscuous mode – a mode that puts all talk groups through the speaker – is just setting one JNE in the firmware to a NOP.
In the past few months Travis, (1) jailbroken the hardware to allow for free extraction and modification of firmware, (2) broken the hilarious crypto so that we can wrap and unwrap updates from the official tool, (3) reverse engineered enough of the firmware to patch in new features, (4) made room for large firmware modifications by creative abuse of Chinese fonts, and (5) wrapped all of this into a handy, freely available toolset.
The Tytera MD380 (and the Retevis RT-3 clone/rebrand ) is a cheap DMR radio with two main chips: an STM32F405 with a megabyte of Flash and 192k of RAM, and an HR C5000 baseband. The STM32 has both JTAG and a ROM bootloader, but both of these are protected by the Readout Device Protection (RDP). Getting around the RDP is the very definition of a jailbreak, and thanks to a few forgetful or lazy Chinese engineers, it is most certainly possible.
In Digital Mobile Radio, audio is sent through either a public talk group or a private contact. The radio is usually set to only one talk group, and so it’s not really possible to listen in on other talk groups without changing settings. A patch for promiscuous mode – a mode that puts all talk groups through the speaker – is just setting one JNE in the firmware to a NOP.
In the past few months Travis, (1) jailbroken the hardware to allow for free extraction and modification of firmware, (2) broken the hilarious crypto so that we can wrap and unwrap updates from the official tool, (3) reverse engineered enough of the firmware to patch in new features, (4) made room for large firmware modifications by creative abuse of Chinese fonts, and (5) wrapped all of this into a handy, freely available toolset.
Jailbreaking Tytera TYT MD-380 Digital Two Way Radio
Jailbreaking a Digital Two Way Radio
Travis Goodspeed travisgoodspeed - YouTube
Jailbreaking a Digital Two Way Radio
Travis Goodspeed travisgoodspeed - YouTube
TYT/Tytera MD380 DMR HT
TYT/Tytera MD380 DMR HT the Chinese do not want to stand behind their product. The first US importer of the Tytera, Kirk Nemzer received 2 radios w/o serial # stickers, & a radio with a defective charger. He asked for, but never received the replacements he was owed. Finally he gave up in disgust, & sent all his inventory back to Tytera. They did not want to refund him his $, but fortunately he paid with Paypal, & they gave him his refund. Tytera was LIVID, but their service was very poor. Can you imagine, 2 radios w/o ser # decals? They kept saying they'd make it right with the next order, instead of sending the parts because it was the right thing to do. So I wonder if the US importers can actually return the defective radios to China for free replacemant, or do they charge an extra $10 per radio sort of as an insurance policy to cover the loss on any defective radios.
Here's a brief description of Kirk's problems with Tytera as the first importer of them into the US. Note, I had to heavily sanitize many "strong words" to post here on RR.
*** UPDATE *** Well all the bull between us and TYT/Paypal is finally over.We shipped their stuff back, and TYT didn't want to fully refund us.We launched MANY complaints against TYT, complaints for padded shipping fees,complaints for not supporting DOA equipment,complaints for shipping equipment without serial numbers and not following thru with serial number tags after being asked to do so many times.We complained about TYT charging fees to utilize Paypal to transfer monies to TYT in China.We got LIED to about the TH-9800 specs, basically told "Tough Luck"...it is what it is.We got promised free "Accessories" (Whatever the heck THAT is) that never materialized, promised they would ship a replacement drop in charger (that never arrived)."Joey Pan" told us what we wanted to hear, and screwed us at the same time.We feel that he did exactly what TYT told him to do.We shipped EVERYTHING back to TYT.They signed for it and STILL didn't want to refund the complete amount! Paypal found IN OUR FAVOR and the case was closed. FULL REFUND. Now TYT fires off some threatening letters to us (Comical to say the least) and get this.....PAYPAL REOPENS THE CASE! Un heard of! Paypal does another full investigation. Now granted....we had documentation for EVERYTHING...I mean EVERYTHING. Paypal didn't have to go very far to see that TYT was full of crap.PAYPAL ONCE AGAIN FINDS IN OUR FAVOR. CASE CLOSED! From what we have heard (and have no proof) as this is hearsay...that TYT won't be able to use Paypal in the future.Is this the case? Please let us know?
Here's a brief description of Kirk's problems with Tytera as the first importer of them into the US. Note, I had to heavily sanitize many "strong words" to post here on RR.
*** UPDATE *** Well all the bull between us and TYT/Paypal is finally over.We shipped their stuff back, and TYT didn't want to fully refund us.We launched MANY complaints against TYT, complaints for padded shipping fees,complaints for not supporting DOA equipment,complaints for shipping equipment without serial numbers and not following thru with serial number tags after being asked to do so many times.We complained about TYT charging fees to utilize Paypal to transfer monies to TYT in China.We got LIED to about the TH-9800 specs, basically told "Tough Luck"...it is what it is.We got promised free "Accessories" (Whatever the heck THAT is) that never materialized, promised they would ship a replacement drop in charger (that never arrived)."Joey Pan" told us what we wanted to hear, and screwed us at the same time.We feel that he did exactly what TYT told him to do.We shipped EVERYTHING back to TYT.They signed for it and STILL didn't want to refund the complete amount! Paypal found IN OUR FAVOR and the case was closed. FULL REFUND. Now TYT fires off some threatening letters to us (Comical to say the least) and get this.....PAYPAL REOPENS THE CASE! Un heard of! Paypal does another full investigation. Now granted....we had documentation for EVERYTHING...I mean EVERYTHING. Paypal didn't have to go very far to see that TYT was full of crap.PAYPAL ONCE AGAIN FINDS IN OUR FAVOR. CASE CLOSED! From what we have heard (and have no proof) as this is hearsay...that TYT won't be able to use Paypal in the future.Is this the case? Please let us know?
Now I have said this before, the MD-380 is a pretty cool radio, it's a great deal and I am sure it will get better.No fear in buying one from a dealer.
THIS IS MY * OPINION *.....just my opinion, yours may vary. If you want a MD-380 buy it from Amazon, buy it from Ebay (use Paypal), buy it from CSI (Jerry know how to deal with TYT), buy it from our very own online dealers in this group, but you need your head examined if you want to deal with TYT directly.If this whole mess was mishandled by a sales person thats one thing, but so far TYT has proven it has absolutely ZERO RESPECT for it's customers or it's downline dealers.If your thinking of becoming a "Dealer" for these Dirtbags, you may want to think it over a few more times as this company has no second thoughts about screwing their customers.
Go ahead (TYT) and continue to send your threatening E-Mails, whats next...maybe some tainted dog food, some toothpaste sweetened with Antifreeze, maybe some chew toys painted with lead based paint? How about some lousy home electronics that burst into flames even when switched off? We TRUSTED you, and you let us all down. We won't forget that anytime soon.
Thanks all for listening!
THIS IS MY * OPINION *.....just my opinion, yours may vary. If you want a MD-380 buy it from Amazon, buy it from Ebay (use Paypal), buy it from CSI (Jerry know how to deal with TYT), buy it from our very own online dealers in this group, but you need your head examined if you want to deal with TYT directly.If this whole mess was mishandled by a sales person thats one thing, but so far TYT has proven it has absolutely ZERO RESPECT for it's customers or it's downline dealers.If your thinking of becoming a "Dealer" for these Dirtbags, you may want to think it over a few more times as this company has no second thoughts about screwing their customers.
Go ahead (TYT) and continue to send your threatening E-Mails, whats next...maybe some tainted dog food, some toothpaste sweetened with Antifreeze, maybe some chew toys painted with lead based paint? How about some lousy home electronics that burst into flames even when switched off? We TRUSTED you, and you let us all down. We won't forget that anytime soon.
Thanks all for listening!
Reverse Engineering the Tytera MD380
Travis Goodspeed has been playing with Digital Mobile Radio (DMR) lately, a competitor to TETRA and P25 that is used for amateur radio, as well as trunked radio for businesses and cash-strapped police departments. Page 76 contains his notes for jailbreaking the Tytera MD380’s bootloader, dumping all of protected memory, then patching its application to enable promiscuous mode. These tricks should also work on the CS700, CS750, and a variety of other DMR handhelds. On page 88, the last and most important page, we pass around the collection plate. We don’t need your dimes, but we’d love some nifty proofs of concept.
Reverse Engineering the Tytera MD380
The following is an adventure of reverse engineering the Tytera MD380, a digital hand-held radio that can be had for barely more than a hundred bucks. In this article, I explain how to read and write the radio’s configuration over USB, and how to break the readout protection on its firmware, so that you fine readers can write your own strange and clever software for this nifty gizmo. I also present patches to promiscuously receive audio from unknown talkgroups, creating the first hardware scanner for DMR. Far more importantly, these notes will be handy when you attempt to reverse engineer something similar on your own.
This article does not go into the security problems of the DMR protocol, but those are sufficiently similar to P25 that I’ll just refer you to Why (Special Agent) Johnny (Still) Can’t Encrypt by Sandy Clark and Friends.
8.1 Hardware Overview
Speaker
Microphone
SP- D- SP+
D+ MIC
The MD380 is a hand-held digital voice radio that uses either analog FM or Digital Mobile Radio (DMR). It is very similar to other DMR radios, such as the CS700 and CS750 from Connect Systems.
DMR is a trunked radio protocol using two-slot TDMA, so a single repeater tower can be used by one user in Slot 1 while another user is having a completely different conversation on Slot 2. Just like GSM, the tower coordinates which radio should transmit when.
The CPU of this radio is an STM32F405 from STMicroelectronics. This contains a Cortex M4, so all instructions are Thumb and all function pointers are odd. The LQFP100 package of this chip is used. It has a megabyte of Flash and 192 kilobytes of RAM. The STM32 has both JTAG and a ROM bootloader, but both of these are protected by a Readout Device Protection (RDP) feature. In Section 8.8, I’ll show you how to bypass these protections and jailbreak your radio.
There is also a radio baseband chip, the HR C5000. At first I was reconstructing the pinout of this chip from the CS700 Service Manual, but the full documentation can be had from DocIn, a Chinese PDF sharing website.
Aside from a bunch of support components that we can take for granted, there is an SPI Flash chip for storing the codeplug. “Codeplug” is a Motorola term for the radio settings, such as frequencies, contacts, and talk groups;
Reverse Engineering the Tytera MD380
The following is an adventure of reverse engineering the Tytera MD380, a digital hand-held radio that can be had for barely more than a hundred bucks. In this article, I explain how to read and write the radio’s configuration over USB, and how to break the readout protection on its firmware, so that you fine readers can write your own strange and clever software for this nifty gizmo. I also present patches to promiscuously receive audio from unknown talkgroups, creating the first hardware scanner for DMR. Far more importantly, these notes will be handy when you attempt to reverse engineer something similar on your own.
This article does not go into the security problems of the DMR protocol, but those are sufficiently similar to P25 that I’ll just refer you to Why (Special Agent) Johnny (Still) Can’t Encrypt by Sandy Clark and Friends.
8.1 Hardware Overview
Speaker
Microphone
SP- D- SP+
D+ MIC
The MD380 is a hand-held digital voice radio that uses either analog FM or Digital Mobile Radio (DMR). It is very similar to other DMR radios, such as the CS700 and CS750 from Connect Systems.
DMR is a trunked radio protocol using two-slot TDMA, so a single repeater tower can be used by one user in Slot 1 while another user is having a completely different conversation on Slot 2. Just like GSM, the tower coordinates which radio should transmit when.
The CPU of this radio is an STM32F405 from STMicroelectronics. This contains a Cortex M4, so all instructions are Thumb and all function pointers are odd. The LQFP100 package of this chip is used. It has a megabyte of Flash and 192 kilobytes of RAM. The STM32 has both JTAG and a ROM bootloader, but both of these are protected by a Readout Device Protection (RDP) feature. In Section 8.8, I’ll show you how to bypass these protections and jailbreak your radio.
There is also a radio baseband chip, the HR C5000. At first I was reconstructing the pinout of this chip from the CS700 Service Manual, but the full documentation can be had from DocIn, a Chinese PDF sharing website.
Aside from a bunch of support components that we can take for granted, there is an SPI Flash chip for storing the codeplug. “Codeplug” is a Motorola term for the radio settings, such as frequencies, contacts, and talk groups;