Modifications, hints, tips and technical information for the
AnyTone AT-D868UV
AnyTone AT-D878UV
and
BTech DMR-6x2

(Some relevance to Alinco DJ-MD5 too)

dual band DMR digital handheld radio


 

Version 5.1 --- 8th December 2018



This information is primarily intended for amateur ’ham’ radio operators who wish to maintain and adjust their AT-D868UV, AT-D878UV or DMR-6x2. Any regulatory authority approval (e.g. FCC certification) may become invalid by the use of this information. Users should always ensure that they and their radios are operating in accordance with their licence conditions. In any case, the user alone accepts all responsibility and risk from the use of this information and tools provided here.



General warnings to all users:
  • Be very careful not to accidentally hit the PTT (Push to Talk) button while you have the USB cable plugged in to the radio, or while it is sitting in the charger. Doing so can cause RF to be picked up by the USB cable or charger, and cause damage to the hardware - both radio and charger. This has happened to some unfortunate 868 owners previously.
  • Similarly, keep the radio away from your cellular / mobile phone, cordless phone and wifi devices when the USB cable is plugged in to it.
  • Use caution if writing non standard data to the radio in some of the advanced modifications listed below. It is possible to cause the radio to cease functioning correctly if instructions are not carried out with care.



Introduction:
AnyTone’s AT-D868UV & AT-D878UV and its twin Btech DMR-6x2 (unless otherwise stated, I’ll refer to them going forward as simply ’ 868 ’) are excellent dual band DMR / FM handheld radios. They have a fabulous receiver, enough memory to hold the entire DMR user database - for the time being, anyway! - and have many nice features, allowing the user to control just about every aspect of the radio from its operating controls. Perhaps that is why so few modifications have been seen for these models, everyone is happy with them as they come from the factory?

Presented here is a collection of modifications for the 868. Not all of these modifications are my own ideas, and credit has been given to the original author of the information as best as I have been able to find. Each modification is rated on a difficulty scale as follows:

Easy: no specialist skills required, easy soldering, minimal disassembly. If the thought of picking up a screwdriver makes you break out in a cold sweat, however, you might want to seek some assistance
Moderate: some skill required in soldering, electronics and/or computing, some disassembly needed. Any self respecting ham / electronics geek will be comfortable at this level.
Advanced: excellent soldering skills required, very good knowledge of electronics and/or computing, extensive disassembly.

If you have any more information or modifications that you’d like to share here, please contact me at vk7zja at gmail dot com and I will make sure you receive credit for your work, though you are welcome to remain anonymous if you wish.



Are the AnyTone AT-D868UV and Btech DMR-6x2 really the same radio?
From a technical viewpoint of the hardware, I believe so, yes. The only difference appears to be the firmware loaded to give the DMR-6X2 extra features - and even then, it has even been demonstrated that the Btech DMR-6x2 firmware can be loaded into the AnyTone AT-D868UV. More on this below.



What is the difference between the AnyTone AT-D868UV and AT-D878UV?
(Credit to Sergei Shilov)
From a features viewpoint, the D878 has some extra features over and above the D868, such as APRS for FM, roaming (automatic switching to a repeater with the strongest signal, intended for large linked networks) and at extra cost can have either Bluetooth or extra audio recording capacity added as an add-in module. The D878 also has a new screen colour scheme, and talker alias has been implemented. Some other literature mentions the 878 has a faster processor and more memory than the 868, but my investigations show this is not factual.

Thanks to Sergei, his internal examination of a new D878 shows that the hardware is identical to D868 v2 hardware: same processor, same flash memory, the D878 PCB is even stamped with D868UV2!
FCC documents relating to the 878 Part 90 approval confirm this: the same processor & flash are used, and the PCB is stamped with D868UV2.
So it seems the only difference between the V2 hardware 868 and the 878 is the firmware loaded and some other data in the external flash memory. However, attempts at loading the 878 firmware in to an 868 fails with a black screen on power up. Using an ST-Link to load a 878 firmware file into an 868 results in a partly working radio, but not enough to be declared a success.
That aside, you could likely apply many of these hints, tips & modifications to the 878 equally as you could the 868.



Similarities between Alinco DJ-MD5 and AnyTone 878?
A quick glance at Alinco’s new dual band DMR handheld DJ-MD5 shows many similarities to the AnyTone 878 radio: similar size, similar general layout, near identical display icons, display layout and menus, and the Alinco CPS programming software looks & feels the same as the AnyTone CPS. There are some differences, too: change in case and branding labels of course, more narrow and taller LCD display, no P1 or P2 function buttons, no top mounted PF3 button, and more.
Closer examination of the internals of the Alinco DJ-MD5 from the FCC approval portal at https://fccid.io/PH3DJ-MD5 reveals that the DJ-MD5 and 868/878 are different internally, but that both use the very same major components e.g. MCU, AT1846, RF PAs, DMR DSP, bulk flash memory chip and so on. It appears as if the DJ-MD5 is a redesigned AnyTone 878. To take it one step further, I even downloaded the CPS programming software for the Alinco, and it was able to talk to the AnyTone - it recognised that the model didn’t match, but that in itself proves that the Alinco & AnyTone share the same USB driver, same MCU and same USB communication protocols.




Comparison of the AnyTone 868, 878, Btech 6x2 and Alinco DJ-MD5
Thanks to the wizard John Miklor, we have the following quick comparison chart of the AnyTone 868, 878, Btech 6x2 and Alinco DJ-MD5:
http://www.miklor.com/COM/Compare-DMR.php



Hint when using the programming software / CPS
When making changes or additions in the programming software, the changes or program additions you made don’t automatically ’take’ when you close the window. You must first select the ’OK’ button then close the window. This has caught me out several times, and though it might seem obvious when reading this, it is easy enough to overlook when slaving over your keyboard.



Hint for being able to recall and dial Private Call IDs
(Thanks to Sergei Shilov)
While you can load 150,000+ DMR contacts in to the radio, you can’t recall any of them via the radio menu to place a private call to those contacts, and you are forced to dial their DMR ID manually to do so.
Sergei has worked out that if you enter the Private IDs you want to be able to recall via the radio menu into the Digital > Talk Groups menu tree in the CPS where you would normally add Talk Groups, adding your desired contacts as a Private Call will make them available from the dial list in the radio menus. Easy!



Hint when using the radio menus
(Credit to Jason VK7ZJA and Jose EB4DOL)
  • In large menus with lots of selections, instead of lots of up or down button presses to get to the menu item you want, press the P1 button; this will scroll the menu selection down one entire page of selections, allowing you to get to your desired selection quicker and with fewer button presses.
  • The P2 button in menu mode will take you one step back / up in the menu, even if Exit or Back doesn’t appear on the display.
  • If you are deep within multiple selections of menus, rather than pushing Back and Exit multiple times to get to the main screen, you can simply push either # or * once to exit the menus and go back to the main screen in one step.



Cross compatibility of accessories for the AT-D868UV
It has been found that some accessories for other radios are also compatible with the 868:
Batteries: the Btech DMR-6x2 and AnyTone AT-D868UV batteries, their chargers and programming cable are interchangeable, as you would expect.
Programming cable: TYT MD-380 / Retevis RT3 and GD-77 programming cables also work for the 868 / 6x2, but note ANY of the other, regular Baofeng programming cables are NOT compatible
Antenna: Any decent quality single band or dual band antenna with a female SMA connection will work on the 868.
Speaker microphone: Any of the regular two pin speaker microphones suitable for the usual Baofeng radios etc. will work with the 868. Just ensure the plug is firmly pushed in and seated into the speaker mic sockets.



Need a spare battery for your AnyTone AT-D868UV, AT-D878UV or BTech DMR-6x2?
If you’re in the United States, there are many options for getting a spare battery available to you. But for those of us outside the USA, options are limited as sellers are reluctant to send just a battery on its own, fearful that the postal system will confiscate a battery not properly packaged to nebulous safety guidelines. I’ve recently had luck ordering from BTech directly and having a battery sent to Australia, which transited the USPS and Australian postal systems and cleared our Customs / Border Protection without problem. Their shipping costs are quite reasonable, too. While I can’t promise that you’ll always have the same successful result in your home country, try shopping (add to cart) with BTech at their website: https://baofengtech.com/purchase#tabs-5



Differences in battery sizes
The standard battery as delivered with the 868 is a 3100mAh fat battery, while the 6x2 comes with this fat battery and also a lower capacity 2200mAh thin battery. The smaller battery makes the radio both lighter and slimmer to wear on your belt or slipped into a pocket. Here’s a picture visually showing the difference between the two:



868 / 878 / 6x2 programming cable pin out
Unlike many other Baofeng programming cables, the 868 cable has no electronics inside, but does need a driver to be installed. You can even make your own spare programming cable if you wanted, using this pin out as a guide.




Known button held during power up sequences
There are several power up sequences which involve holding down buttons to invoke certain modes on the 868 as follows:
  • Top orange button + PTT for main firmware update mode
  • Top orange button + # for DSP SCT update mode
  • PTT + PF1 enters the reset radio confirmation menu
  • PTT + PF2 enters a display icon update mode
  • PTT + 1 enters test mode where you can select operational bands and/or adjust alignment parameters
  • PTT + 3 enters a GPS module test mode
My recommendation is to use these power up sequences sparingly, one person has reported his radio now freezes on boot after using the GPS test function, probably due to flash memory corruption while entering that mode.
The test mode (PTT + 1) has two levels of access; normally you will only be able to select MODE to change operational frequency bands of the radio, but in full unlocked test mode, some degree of calibration / alignment is possible from the front panel of the radio for deviation levels, power output levels, received signal strength indication (RSSI) levels, squelch levels, frequency fine setting and more. See below for more detail.



Selecting operational bands
At the time of writing, there are thirteen (fourteen for the 878) combinations of bands that you can select to use.
Begin by turning the radio off, then press and hold the PTT and 1 buttons while turning on the radio, hold those two buttons until you see ’TEST MODE’ appear on screen. After releasing the buttons the radio will start up with the text ’MODE:00000’ to the bottom of the screen. Rotate the top dial to change the mode number, which will select the following bands:

Standard bands selectable 868 / 6x2 (878 bands are slightly different):
Mode UHF RX UHF TX VHF RX VHF TX
0 400-480 400-480 136-174 136-174
1 400-480 400-480 144-146 144-146
2 430-440 430-440 136-174 136-174
3 430-440 430-440 144-146 144-146
4 440-480 440-480 136-174 136-174
5 440-480 440-480 144-146 144-146
6 446-447 446-447 136-174 136-174
7 446-447 446-447 144-146 144-146
8 400-470 400-470 136-174 136-174
9 430-432 430-432 144-146 144-146
10 400-480 430-450 136-174 144-148
11 400-480 430-440 136-174 144-146
12 403-470 403-470 136-174 136-174

Then turn off the radio, which will save your selected mode setting, and from that point on, your radio will use the frequency limits that correspond with the mode setting you selected. You can repeat the process to change bands at any time.

Note that whenever you do change mode / bands, the radio will reset and you will lose your programmed data. Make sure you have a saved copy of your codeplug. Each saved codeplug will have the mode / band it was created under encoded within it. If you try to reload the same codeplug after changing mode / band, the CPS software will reject it, saying that it is the wrong band. To fix this, you will need to ’hex edit’ the codeplug rdt file: change byte 0x0011 to match the mode / band selected. For example, if you set mode=00002 then edit your codeplug file 0x0011 to be hex value 02. Or if you set mode=00010 then set 0x0011 to hex value 0A.



New knobs for the 868. Easy
The knobs as fitted by the AnyTone factory are, in my opinion, awful design. They are difficult and slippery to grip and look a little odd. Some people add a little bit of heatshrink around the existing knobs for a bit of extra grip, while others replace them with knobs from other radios. I recommend some after market knobs that suit the Motorola MTX, GP339 and some PRO series radios. The smaller knob has to be drilled out a little, while the larger knob needs something to fix it to the tuning shaft. Hot melt glue works well. The end result looks rather nice, and the knobs can be bought on eBay for just a few dollars:



Screen scratch protection. Easy
To save your screen plastic lens from getting scratched up, you can buy screen protectors, just like the cell / mobile phone screen scratch protection film, but made especially for the 868 screen. You can find these on eBay.



Protective carry case for 868 / 878 / 6X2
PowerWerx have a heavy duty protective carry case for USD $29.99, which looks very professional. View it here: https://powerwerx.com/csc-868-anytone-atd868uv-nylon-radio-case
An eBay user ’letsgetready’ also sells a light duty carry case for USD $15 (not including postage):



Headphone adaptor. Easy
Here is a simple and easy to make adaptor so you can listen to the 868 with normal headphones. You’ll need a right angle stereo 2.5mm audio plug, a stereo 3.5mm audio socket, a short length of shielded audio cable and a 22 ohm 1/4 watt resistor. Connect them up following the wiring diagram below, and you’re good to go. I also filled the right angle audio plug with hot melt glue to secure the connection and give the connector a bit more solidity.




Improving top mounted LED visibility Moderate
My personal opinion is that the top mounted LED isn’t quite bright enough to be seen in daylight to see what is going on. After taking the radio apart, it is apparent the tri-colour LED is plenty bright enough, the problem is not enough of that light is making it’s way up the ’light pipe’ to the top of the radio. This was fairly easily fixed by placing some silver reflective tape or paint behind the area where the light pipe is, and pulling the bottom edge of the light pipe so it sits on top of the display PCB. This causes more of the LED output to be coupled in to the light pipe, and as a result it is easier to see in daylight.



Expanding RX frequencies Easy
As delivered by the factory, the 868 / 6x2 covers 136-174 MHz and 400-480 MHz (the 878 already covers up to 520 MHz). There are countries around the world that make use of the radio spectrum above 480 MHz for two way radio, and this modification will allow you to hear those transmissions. The modification intentionally inhibits transmit in these expanded areas.
At the heart of the 868 is an AT1846S ’radio-on-a-chip’ that is designed to work from 134-174 MHz, 400-520 MHz and 200-260 MHz. In practice, the chip will cover even more than that, as you will soon see.


To carry out this modification do the following:
  1. Make sure you have saved your codeplug / rdt configuration file first.
  2. For AnyTone AT-D868UV, download the expanded frequency coverage firmware (based on version 2.33) here:
    http://members.optuszoo.com.au/jason.reilly1/868UV_V2.33_official_expanded.zip (289kb)
    For BTech DMR-6x2, download the expanded frequency coverage firmware (based on version 1.02) here:
    http://members.optuszoo.com.au/jason.reilly1/DMR_6x2_V1.2_expanded.zip (291kb)
    For AnyTone AT-D878UV, download the expanded frequency coverage firmware (based on version 1.06) here:
    http://members.optuszoo.com.au/jason.reilly1/D878UV_V1.06_expanded.zip (496kb)
  3. Unzip this firmware into a folder
  4. Using the regular firmware updating software & process, send this frequency expanded firmware to the radio.
  5. Power off your radio, press and hold the PTT and number 1 button while turning it on. Hold these keys until TEST MODE is displayed on the screen. Then release the buttons, the radio will power up into a test mode.
  6. At the bottom of the screen will be a MODE:0000x display. Use the top selector rotary knob to select whichever mode you want according to your desired TX frequency range from the table below; RX permitted tuning range for all bands (modes) will be set to the same 120-200 MHz and 210-520 MHz. The text displayed on the LCD sometimes will not match the actual bands selected, refer to the table below which will be correct. Power off the radio.
  7. If necessary, update your codeplug / rdt configuration file to be compatible with version 2.33 (AT-D868UV), version 1.06 (AT-D878UV) or version 1.02 (DMR-6x2) firmware. If you want to reuse your saved codeplug rdt configuration file, you may need to modify one byte with a hex editor as detailed below in red.
  8. Enjoy extra receive frequency coverage of around 127-178 MHz, 190-280 MHz (with a gap between 200-210 MHz) and 380-520 MHz.
Note that whenever you do change mode / bands, the radio will reset and you will lose your programmed data. Make sure you have a saved copy of your codeplug. Each saved codeplug will have the mode / band it was created under encoded within it. If you try to reload the same codeplug after changing mode / band, the CPS software will reject it, saying that it is the wrong band. To fix this, you will need to ’hex edit’ the codeplug rdt file: change byte 0x0011 to match the mode / band selected. For example, if you set mode=00002 then edit your codeplug file 0x0011 to be hex value 02. Or if you set mode=00010 then set 0x0011 to hex value 0A.

Modified frequency coverage when using the expanded RX firmware files above:
Mode UHF RX UHF TX VHF RX VHF TX
0 210-520 400-480 120-200 136-174
1 210-520 400-480 120-200 144-146
2 210-520 430-440 120-200 136-174
3 210-520 430-440 120-200 144-146
4 210-520 440-480 120-200 136-174
5 210-520 440-480 120-200 144-146
6 210-520 446-447 120-200 136-174
7 210-520 446-447 120-200 144-146
8 210-520 400-470 120-200 136-174
9 210-520 430-432 120-200 144-146
10 210-520 430-450 120-200 144-148
11 210-520 430-440 120-200 144-146
12 210-520 403-470 120-200 136-174


Your mileage may vary of course, due to individual radio & component manufacturing tolerances. You can use the VFO and add memory channels to use these new expanded receive frequency ranges. The easiest way to enter out of band frequencies in memory is to use the channel export/import feature of the programming software. Add your desired channel, but program it with a unique frequency in the standard limits, for example 444 MHz. Then export the channels to a .csv file, and edit the channel with a text editor for your desired frequency. Then import the channel, and you’ll see the channel has been updated with your out of band frequency entered.

Note that with the expanded frequencies, you can’t enter frequencies via keypad direct entry that start with a 2, 3 or 5 (e.g. any frequency in the 200, 300 or 500 MHz range) the only way to get to them is via lots of knob twisting in VFO mode, or by entering those frequencies in the CPS programming software using the export-edit-import method.

But how do we know it is actually working, not just displaying a frequency and nothing else? Conveniently, the 868 has a quirk that will tell you if the receiver is ’unlocked’ and not working at that frequency: program a button as FM monitor, or turn the squelch level to off. If the radio makes a pulsing or popping noise, the receiver is unlocked and is too far out of band to work. If you hear a constant rush of noise, that indicates the receiver is locked and is working as well as it can do.
If you have a signal generator, you can test that the 868 is actually receiving this signal, or you can use an off air signal to confirm reception is working.
Transmit remains standard according to each mode / band. Typically, the receiver locks and actually works around 127-178 MHz, 190-280 MHz (with a gap between 200-210 MHz) and 380-520 MHz, though note that frequencies between 210-400 MHz are very insensitive.

You’ll notice that this mod will permit coverage of some of the VHF airband. So how well does the 868 receive airband? Not very well, since transmission there are AM and this is strictly an FM & DMR receiver. But if you tune off frequency by about 2.5 to 10 kHz, stronger AM airband signals can be resolved, though with some distortion. Take a look at this YouTube video for an example:
https://www.youtube.com/watch?v=_pNxBCeeXCQ

What about the 1.25 metre band, does this mean the 868 could be used for 222 MHz reception? Yes you can, but it’s very insensitive in this area. Refer to the sensitivity plots below:




Looking at these plots, the very sudden drop in sensitivity immediately below 400 MHz is due to the frequency tracking front end employed in the 868, and that there isn’t any valid tracking data for tuned frequencies between 210 and 400 MHz. As a result the 868 is very deaf here. I’ll continue to investigate this and perhaps come up with an improved mod that will offer better sensitivity in this area. Other modified radios (e.g. Radioddity GD-77 & others) offer sensitivity around -90 to -100dBm in the 220 MHz area which makes them somewhat usable, and the hope is the 868 can join this group too.



Introduction to hex editing. Moderate
Hexadecimal - more commonly abbreviated to just ’hex’ - is a system of counting with sixteen symbols. We humans are used to counting from one to ten with our ten symbols we call numbers, those being 0-9. If we want to go above 9, we join two numbers together e.g. 1 and 0 to be 10, and so on. Hexadecimal begins with 0 and goes up to 9, but instead of moving on to 10, hexadecimal uses letters A through to F, so A in hex would be 10, B=11, C=12 and so on up to F which is equal to 15, then hex "10" is equal to 16, 11 in hex = 17 and so on. Once 19 in hex is reached, the next number is 1A. Get the picture? Have a play around with a scientific calculator to convert hex numbers to decimal numbers, and you’ll soon see how it all works.

OK, so why hex? As you probably know, computers use digital logic circuits which have just two values: on and off. These can be thought of as a 1 or 0, and computers ’talk’ with lots of 1s and 0s - that’s called binary. For us humans to try and make inputs to a computer in binary with just 1s and 0s would be mind-numbingly tedious, but using hexadecimal is a compromise. You’ve probably heard the term ’byte’ before, and it turns out that two hexadecimal numbers fits perfectly into a byte. So 00, 3A, D2 and FF (all examples of hex numbers) can be represented with one byte of memory.

If you were to open a new text document with simply the word "HELLO" in it, and save that text document, you could open the text document in Notepad and edit it at a later time. But that’s not the only way you can edit this text document. By opening the text document in a hex editor application, you can edit the document in it’s raw form as it is stored on your hard disc. What you would see is the word HELLO represented by it’s hex numbers: 48 45 4C 4C 4F. Now lets say you want to change HELLO to APPLE instead. In the hex editor, you would change those hex values to 41 50 50 4C 45, and then save the file.

The advantage of hex editing a file is that it doesn’t matter what created the file or what the file contents are, they all get stored on hard disc the same way, and with hex editing you’re editing the raw data and there are no limitations to making those edits, rather than any artificial limits a program might impose.

One more thing to know before moving on to your first software modification is to know about the concept of little-endian formatting. Little-endian formatting is listing a value with it’s least significant bytes first. Take a number like 490 for example. First break the number up into two bytes: 04 and 90 (add a zero in front of the first number if it’s not already two digits). Now simply reverse the order of the bytes, so that is 90 04. That is little-endian format of (0)490. Another example with a bigger number: 12345678. Broken up into bytes, that’s 12 34 56 78. Now reverse the order of those groups: 78 56 34 12. Not hard, is it? Little-endian formatting can be equally applied to decimal or hex numbers, simply break the number down into two digit groups (i.e. bytes) and then reverse the order of the groups.

To make edits in hex, you’ll want to use a hex editor. It’s just like a word processor, only it edits in hexadecimal. I recommend using a hex editor called HxD. It’s free to download at:
https://mh-nexus.de/en/downloads.php?product=HxD (about 860kb)


Theory behind the frequency expansion mod. Advanced
The age of hardware expansion modification is over, 99% of the time these days software is the route to achieving results. When looking to make frequency expansion modifications by software, the first step is to see if the programming software can accept, or be tricked to accept out of band frequencies; if you can’t send those frequencies to the radio, then modification becomes a lot more difficult. Thankfully, a lot of programming software only checks for valid frequency entry when entering details by hand inside the software. If you edit a saved configuration file, or import frequencies / channels, often this doesn’t go through the software sanity test. The 868 programming software is no exception to this; while out of band frequencies can’t be entered by hand, they can be imported just fine.

The next step is to ensure these out of band frequencies are actually being sent to the radio as intended. For capturing USB data as it is being sent to the radio, WireShark is the go-to tool to analyse USB packets and ensure that the frequencies you want are actually being sent. If the radio accepts and uses these out of band frequencies, you are done and dusted.

In the case of the 868, the firmware inside the radio does have a sanity check going on to trap any frequencies that fall outside permitted limits.
Where a radio is doing a sanity check on a programmed channel’s frequency, it will compare it against a limit that is programmed in to the radio, perhaps as part of its firmware, or perhaps compared against another memory location. In this case, the 868 has multiple limits stored as part of its firmware. These multiple limits are there to set one of (currently) thirteen options of permitted bands. Things become interesting when trying to find out exactly how the radio represents these limits.

One of the essential tools for snooping inside and modifying software like this is something called a hex-editor.
If you need a good hex editor, download HxD in your preferred language here (about 860kb)

Numbers representing frequencies and frequency limits could be stored in one of many ways, including:
  • BCD - binary coded decimal. Example: 146.500 MHz might be seen in a hex editor as 01 04 06 05 00 00. That’s quite wasteful on memory, so it could be represented in a ’packed’ form and you would see in a hex editor the following sequence: 14 65 00. The Radioddity GD-77 happens to use this method, combined with little endian format as explained below.
  • Direct hexadecimal notation. Continuing to use the example of 146.500 MHz, if we convert this to a kHz value of 146500 kHz, that is equal to hexadecimal 23C44, or if we break it up into bytes as seen by a hex editor: 02 3C 44. More commonly though, the frequency is represented as a value in Hz, as 12.5kHz step frequencies couldn’t be represented with a whole number value in just kHz. So again using our frequency of 146.500 MHz, that’s 146500000 in Hz. Converting that to hex gives 8BB69A0, and broken up into bytes: 08 BB 69 A0.
  • Other methods that might be convenient to use: it might be feasible to represent frequencies in a form that is directly used by the frequency synthesis hardware. In PLL schemes, this might be in the form of a ’divider word’ that is sent to a programmable divider.
  • For radios using the AT1846S ’radio-on-a-chip’ they receive data in the form of a hex representation of frequency in kHz x16. Yet again using 146.500 MHz as an example: 146.500 MHz is 146500 kHz, and then multiply by 16 = 2344000 in decimal. Then convert to hex: 23 C4 40. It is possible some radios may store frequencies in a form that can be directly sent to the AT1846S.
It is also worth mentioning that in most systems, a ’little endian’ format is used, which simply means to give the lowest significant value byte first. If we have calculated our value as 23 C4 40, then the little endian representation of that is 40 C4 23.
So you can see there could be a variety of methods used to represent frequency values inside software and firmware, and you would have to search for byte patterns for each potential method.
In the case of the 868, none of these methods seem to work, but there is another clue: the .rdt file. After careful examination, you will find that each channel’s frequency is stored as a little endian format hex representation of the programmed frequency in Hz divided by 10. Using our example of 146.500 MHz, converting to Hz gives 146500000, and then divide by 10 = 14650000. Now convert to hex: DF 8A 90. And then finally little endian format it: 90 8A DF.
Using this method the 868 stores frequencies in the .rdt ’codeplug’ file, we do get some hits if we search for byte patterns of 480 MHz using this method in the firmware .CDD file. Now it’s a matter of determining which of those byte groups should be changed. Taking an educated guess, we can assume that the thirteen user selectable band limit frequencies would all be stored together in one area. And so they are!


We can take another educated guess and say that the first lot of bytes in each group indicated correspond to the first user selection in the MODE: 0000x. Now all we need do is to alter those bytes to our new frequency limit. Let’s try to go for an upper frequency limit of 520 MHz: 520 MHz = 520000000 Hz, divide by 10 = 52000000, in hex = 03 19 75 00, and finally little endian format = 00 75 19 03. We would replace the first appearance of the representation of 480 MHz (00 6C DC 02) with our new limit of 520 MHz (00 75 19 03).
Sending this modified firmware image to the radio works! You can now tune the VFO above 480 MHz. But now there seems to be another problem: for some reason the tuning stops at 500 MHz exactly. It turns out there is yet another coded limit within the firmware; it assumes the radio will never need to tune above 500 MHz. We can fix that, too!
Performing another search in the firmware for the representation of 500 MHz (80 F0 FA 02) gives just one hit - this must be it. Change that out for our new limit of 520 MHz (00 75 19 03) and now save that and send to the radio. It works! The 868 is now tuning up to 520 MHz.
Incidentally, the 868 also has a lower limit for UHF defined, at 300 MHz. In order for the 868 to tune down to 220 MHz, you have to change this limit as well. Change it out for 210 MHz. Don’t try to define a lower UHF frequency limit below 210 MHz as the 868 firmware gets awfully confused and some strange things begin to happen.
But how do we know it is actually working, not just displaying a frequency and nothing else? If you have a signal generator, you can test that the 868 is actually receiving this signal. Conveniently, the 868 has a quirk that will tell you if the receiver is ’unlocked’ and not working at that frequency: program a button as FM monitor, or turn the squelch level to off. If the radio makes a pulsing or popping noise, the receiver is unlocked and is too far out of band to work. If you hear a constant rush of noise, that indicates the receiver is locked and is working as well as it can do.
Do note that due to the bandpass filtering and front end tracking gain, out of band frequencies between 200 & 400 MHz are not very sensitive, only very strong signals will be heard.
As a final note, when a new version of firmware is released, the addresses at which the changed bytes are written are highly likely to change. You would have to do a fresh search for the byte patterns and replace them appropriately in the new version of firmware.



Expanding FM band frequencies 76 to 121 MHz Easy
The present firmware version 2.33 only permits FM band VFO tuning from 87.5 to 108 MHz. The software however, permits entry of frequencies from 76.0 to 108.0 MHz for memories in the FM band. This is the easiest way to get the 868 to tune down to 76 MHz - put those frequencies into a FM band memory channel. Tuning below 76 MHz isn’t possible at this stage as the RDA 5802 needs to be set up differently to go below 76 MHz. But going up past 108 MHz is possible, - though I’m not sure why you’d want to. Reception of airband transmissions using wideband FM, even with a very strong AM signal, is impossible. But, if you have the need to, I found that my 868 was able to receive test signals all the way up to 121 MHz. Entering such frequencies is quite easy, all you need to do is to enter some ’dummy’ channels, and then using the Tool > Export menu in the CPS programming software, export your FM channels and open the file with Notepad for editing. Change the frequencies of the dummy channels you entered and save the file, then use the Tool > Import menu in the CPS programming software to import your edited file. This way you can enter any FM frequency, in 50 kHz steps, between 76.00 and 121.00 MHz. You can edit and import frequencies outside these limits, but the receiver won’t actually work properly beyond those limits.



Changing the display font / modifying some of the icons Advanced
(Credit to Colin G4EML & Ronan EI4KN - the ’font master’ hihi)
Would you like to change the display font on your 868, and don’t mind getting your hands dirty with a hex editor and a few other tools? Then do I have a deal for you!
There are five different fonts encoded into the 868 firmware .CDD file. The location within the firmware file at which the fonts are encoded will change from version to version. Therefore, the first thing you need to do is identify exactly where the fonts you want to replace are located. To make this job easier, Colin G4EML has created a small executable which allows you to graphically view a file as a bitmapped image. You can download it here:
http://members.optuszoo.com.au/jason.reilly1/ImageTest.zip (15kb)
Be aware that the bitmapped icons and fonts are vertical raster, not horizontal. It could take a lot of scrolling through the file to identify the font, but the auto step feature makes life a lot easier.
In the 868 v2.33 firmware, there are five font sizes: 8x5 H x W (tiny) at 0x06D6F7-0x06D908; 12x10 H x W (medium) at 0x06D921-0x06E1EB; 16x16 H x W (main font) at 0x06E20B-0x06EDC8; and 24x12 H x W (VFO digits) at 0x06EDEF-0x06FB2C. You will also find a fifth and unused super large 24x16 font of numbers and upper case letters only at 0x06FB2D-0x07037E. Other symbols such as the antenna signal meter, battery level meter etc. will be found at 0x07037F-0x070812. Remember, these addresses / locations are only valid for firmware version 2.33, the exact locations will change a little in other versions.


Once you find the location of the font you want to play with, make a note of its starting location. Now you’ll want to create a font of the same size. A very useful tool to convert fonts from your computer into bitmaps is Rays Font Editor which you can download here:
http://www.rayslogic.com/Software/RaysFontEditor/RaysFontEditor_24Aug12.zip (3.0 Mb)

Make sure you convert the font to the same size as the one you are going to replace. To use Rays Font Editor to produce a bitmap ready for the 868:
  1. Install your desired TTF font as a system font on your PC
  2. Select Capture System Font, then select your desired font from the list
  3. Select input size by point, and play around with the value to get each character fully visible. Typically the letters M and W are difficult to fit in smaller pixel widths and get truncated at the sides, and lower case letters g, j, p, q and y can get cut off at the bottom: try smaller point values to get the font small enough to fit or manually tweak the problem letters yourself. As an example, the Courier New TTF font works well if imported at 10 point size
  4. Select Output character size - Change font size and enter height and width to suit the font you are replacing, and click OK
  5. Examine your characters that have been imported to make sure they all fit nicely and are fully legible. You can edit the appearance and shift characters up/down/left/right to make them look nice.
  6. Select Font settings, and choose character range starting at 32 and ending at 126, as those are the only characters the 868 needs
  7. Select Export font. You want to select ’custom’, format is binary file, scan direction set to start top-left, scan vertical and leave the other settings as they are. Give your font a name and save it
  8. Rename the extension of your font from a .dat to .bin and you have a file that’s ready to go into the 868.
Once you have a binary image of your desired font, you might want to use Colin’s ImageTest application to examine the fonts and confirm how they’ll appear on the radio screen.
Now it is simply a case of using your hex editor to copy this binary data from the file you just created over the top of the font data in the firmware file, at the start address you noted earlier. If using HxD, use paste write, not paste insert when copying your new font binary data into the firmware image. Write the firmware to your 868 and enjoy a new look display.

Multi-coloured icons, other than the basic mono-chromatic symbols, are mostly stored in the 868 flash memory locations 0x0015A000 to 0x00200000. The icon update file D868_1G_ICON_V1.11.CDD will write icon data to those memory locations, so it is easiest to edit a copy of this file if you want to customise some of your coloured icons. They are encoded as RGB565 raw bitmap format, and of varying sizes. You could use a raw bitmap viewer to explore the contents of the icon update file. A good website to do this is located at: http://rawpixels.net/
For full screen bitmaps such as the startup image, select a width of 128 pixels, height of 160 pixels, select Flip V, select Predefined format of RGB565, and make sure Little Endian is not selected. For other icons you will need to play around with the width and height, but should use the same settings.
This is what all the standard icons in the 868 look like:


A few other coloured icons are encoded into the firmware image at locations 0x0708A8-0x07166F (v2.33 firmware), the main one used here is the 11x11 digital monitor speaker symbol.



Modify a speaker microphone to keep out DMR pulsed RF feedback. Moderate
(Credit to Owen Duffy VK1OD for this)
If you have a speaker microphone that you like, but is affected by RF feedback from DMR’s pulsed RF getting back into it, causing your transmitted audio to become distorted, you can perform modifications to reduce or even eliminate this problem. I have carried out the modifications, adding a SMD capacitor across the speaker microphone electret element, and adding a SMD inductor in line with the positive line of the electret element, and confirm it works very well indeed. See Owen’s mods at:
http://owenduffy.net/blog/?p=9326



Swapping Btech DMR6x2 firmware into an AnyTone AT-D868UV Moderate
(Credit to Ronan EI4KN)
If you would like to experiment with some of the features of the Btech DMR6x2 (e.g. store & forward repeater) in the AnyTone AT-D868UV, then this simple hex edit hack will permit you to do that. Simply load the Btech DMR6x2 .SPI file in your favourite hex editor, and shorten it to 14 bytes long. Save it, and then you’ll be able to load that firmware into the AnyTone AT-D868UV. There will be a few icons that are blank or missing, the radio might start up in Chinese language but otherwise it functions fine. Newer versions of the Btech DMR6x2 firmware causes the AnyTone AT-D868UV to ’black screen’, but is recoverable by reloading AnyTone AT-D868UV firmware again.
It isn’t confirmed if the reverse is true, that the AnyTone AT-D868UV firmware can be loaded into the Btech DMR-6x2, but I strongly suspect it could be.

If you need a good hex editor, download HxD in your preferred language here (about 860kb)



Enabling full test / self adjustment mode Advanced
(Credit to Colin G4EML and Jason VK7ZJA)
Tested with AnyTone AT-D868UV, AT-D878 and BTech DMR-6x2.
Warning: you can seriously mess up your radio with this adjustment mode to the point that it may not transmit, receive, or even have a visible display with careless changes to certain values. If you do not know what you are doing, leave this alone.
By now you are probably familiar with the TEST mode on the 868, where you can set the operational bands using the top dial to adjust the value next to MODE. There is a way to enable the full test mode menu on the radio so you can not only alter the operational bands, but also things like setting Turbo, High, Mid & Low RF output power levels individually, fine tune the frequency, set the tight squelch values, change the received signal strength S-meter (RSSI) meter curve, even calibrate the battery voltage readout.
  • Begin by downloading one of the following zip files that applies to your model:
    http://members.optuszoo.com.au/jason.reilly1/AT868testmodes.zip (2kb)
    http://members.optuszoo.com.au/jason.reilly1/AT878testmodes.zip (2kb)
    http://members.optuszoo.com.au/jason.reilly1/6X2testmodes.zip (2kb)
  • Unzip your chosen file into a new folder. There are two sets of files in there, one to switch the radio into full test mode, and another to return back to normal test mode where only MODE is selectable.
  • Connect your radio to the PC with it’s programming cable
  • Start up the firmware / icon updating software, QXCodePro_Update
  • Point that updater to the new folder and select fulltestmode.spi file
  • Place the radio in icon update mode by holding PTT and the bottom side button together while turning on the radio, you should see UPDATE MODE appear on the radio screen
  • Make sure you have the right COM port selected and hit write, it will only take a fraction of a second to complete.
  • Turn the radio off and on again. The radio will take a few extra seconds more than normal to boot up, this is OK as it is reconfiguring internal memory
  • To activate test mode, turn off the radio, hold down the PTT + keypad 1 buttons until TEST MODE is displayed on the radio screen, then let the two buttons go. The radio will boot up into it’s full test / self adjustment mode.
If you want to go back to normal, select the normaltestmode.spi file instead.
Once you start test mode, you can scroll up and down between different test adjustment points using the zone up/down button. The following adjustments are available: will be slightly different on the 6x2 and 878

I strongly recommend you go through each setting and write down what they are before making any adjustments
CH Setting Adjustment range Description
1 nil nil nil
2 nil nil nil
3 nil nil nil
4 nil nil nil
5 nil nil nil
6 nil nil nil
7 FQCU 0-65535 Frequency fine tune
8 PAHU 0-255 UHF RF power output turbo setting
9 PAMU 0-255 UHF RF power output high setting
10 PALU 0-255 UHF RF power output medium setting
11 PASU 0-255 UHF RF power output low setting
12 MODU 0-255 Overall deviation setting for both UHF & VHF (value copied to 39 below)
13 TONEU nil Push PTT to transmit a test 1000 Hz tone on a UHF FM frequency
14 CTCW 0-63 Deviation setting for CTCSS in both UHF & VHF (value copied to 41 below)
15 DCSW 0-63 Deviation setting for DCS in both UHF & VHF (value copied to 42 below)
16 RXVLU 0-4095 UHF receive tracking gain, low end of band
17 RXVMU 0-4095 UHF receive tracking gain, mid band
18 RXVHU 0-4095 UHF receive tracking gain, top end of band
19 SQTHU 60-134 UHF squelch tight threshold
20 RSSIU nil UHF RSSI, inject RF at desired level for 1 bar reading, rotate top dial to sample and lock in value
21 A OBHU 0-65535 not yet known, but seems to adjust screen brightness (suspect this is a bug)
22 A OBLU 0-65535 not yet known
23 D OBHU 0-65535 not yet known, unable to adjust from test menu
24 D OBLU 0-65535 not yet known, unable to adjust from test menu
25 D CTCW 0-65535 not yet known
26 D DCSW 0-65535 not yet known
27 DIGIU FSKL nil Push PTT to send test FSK signal (heard as 2400 Hz) at low end of UHF band
28 DIGIU FSKM nil Push PTT to send test FSK signal (heard as 2400 Hz) at mid UHF band
29 DIGIU FSKH nil Push PTT to send test FSK signal (heard as 2400 Hz) at high end of UHF band
30 DIGIU 600Hz nil Push PTT to send test 600Hz signal UHF band (heard on FM as 200 & 400 Hz?)
31 DIGIU 300Hz nil Push PTT to send test 300Hz signal UHF band (heard on FM as 800 Hz?)
32 DIGIU 1031 nil Push PTT to send test signal UHF band, heard on DMR as 1031 Hz
33 DIGIU BER nil Display received BER of DMR test signal
34 DIGIU TEST nil Test UHF DMR for both TX & RX as if it were on a regular DMR channel
35 PAHV 0-255 VHF RF power output turbo setting
36 PAMV 0-255 VHF RF power output high setting
37 PALV 0-255 VHF RF power output medium setting
38 PASV 0-255 VHF RF power output low setting
39 MODV 0-255 Overall deviation setting for both VHF & UHF (value copied to 12 above)
40 TONEV nil Push PTT to transmit a test 1000 Hz tone on a VHF FM frequency
41 CTCWV 0-63 Deviation setting for CTCSS in both UHF & VHF (value copied to 14 above)
42 DCSWV 0-63 Deviation setting for DCS in both UHF & VHF (value copied to 15 above)
43 RXVLV 0-4095 VHF receive tracking gain, low end of band
44 RXVMV 0-4095 VHF receive tracking gain, mid band
45 RXVHV 0-4095 VHF receive tracking gain, top end of band
46 SQTHV 60-134 VHF squelch tight threshold
47 RSSIV nil VHF RSSI, inject RF at desired level for 1 bar reading, rotate top dial to sample and lock in value
48 A OBHV 0-65535 not yet known
49 A OBLV 0-65535 not yet known
50 D OBHV 0-65535 not yet known
51 D OBLV 0-65535 not yet known
52 DIGIV FSKL nil Push PTT to send test FSK signal (heard as 2400 Hz) at low end of VHF band
53 DIGIV FSKM nil Push PTT to send test FSK signal (heard as 2400 Hz) at mid VHF band
54 DIGIV FSKH nil Push PTT to send test FSK signal (heard as 2400 Hz) at high end of VHF band
55 DIGIV 600Hz nil Push PTT to send test 600Hz signal VHF band (heard on FM as 200 & 400 Hz?)
56 DIGIV 300Hz nil Push PTT to send test 300Hz signal VHF band (heard on FM as 800 Hz?)
57 DIGIV 1031 nil Push PTT to send test signal VHF band, heard on DMR as 1031 Hz
58 DIGIV BER nil Display received BER of DMR test signal
59 DIGIV TEST nil Test VHF DMR for both TX & RX as if it were on a regular DMR channel
60 VBAT 0-200 Calibrate displayed voltage of battery
61 MODE 0-12 Changes operational frequency bands of radio
62 087.50M nil Receiver test of FM broadcast band
63 097.50M nil Receiver test of FM broadcast band
64 108.00M nil Receiver test of FM broadcast band

For the squelch threshold values, a higher value gives a more sensitive squelch, but no improvement to sensitivity is obtained with values higher than about 112 to 114. Lower values require progressively stronger signals to open the squelch.
The RSSI (received signal strength indicator - in other words the signal meter) has a fairly compressed range of 15dB. I’d have preferred to see at least 30dB range in the signal meter, but I’ve found an acceptable compromise has been to set one bar at -113dBm which equates to values of RSSIU of 36 and RSSIV of 39. The signal meter then reads:
  • 1 bar -113 dBm or about S-5
  • 2 bars -108 dBm or about S-6
  • 3 bars -103 dBm or about S-7
  • 4 bars -98 dBm or about S-9
Once finished changing your values, turn the radio off and on again to save them to memory. If you like, you can disable full test mode by loading normaltestmode.spi in to the firmware / icon updater software and writing that to the radio. The values you changed or adjusted will not be erased by doing this, it simply prevents you from accessing the full test mode and inadvertently changing them again. These values will not be overwritten, changed or restored to default by resetting of the radio. Once you change them, you can not get the original value back unless you wrote it down before making adjustments.

This process will overwrite your serial number and other such information that may be displayed in the ’local information’ from the programming software. While it isn’t necessary, if you would like to restore these details, hex edit the .CDD files to enter that information as you require. Most fields are 16 characters long, with the exception of area code of 4 characters, Manufacturer Code of 8 characters, and Maintained Description of 80 characters. Once you open the .CDD file in a hex editor, it will become obvious what goes where, edit as required, save and send the matching .spi file to the radio with the firmware / icon updating software.



Resolving received noise issues Easy to Advanced
(Credit to Colin G4EML)
Some people have noticed that, especially on VHF, ticking or other noise can affect weak analogue signals. There are a few things you can do to help this:
  • Turn off your clock display and GPS. It appears as if any display updates or GPS data that is multiplexed on the data lines connecting the display front half of the radio to the main PCB will cause some interference on VHF. The primary culprit for this is the clock flashing colon between the hours and minutes. Updating to firmware version 2.33 can help, as this stops the colon / time separator symbol from flashing.
  • Shielding the small flat flexible ribbon cable with some adhesive aluminium or copper tape helps a little bit, according to Colin G4EML, especially if you have the older white style flat flexible ribbon cable. If you have a brown cable with no tracks visible on the back side as indicated by the single grey arrow in the picture below, your cable is already upgraded and won’t benefit much from any adding any extra shielding to the cable.
  • Noise from display. Yet more noise appears to come from the LCD itself, and in later revisions of the radio, Anytone reduced this noise by earthing the metal frame that surrounds the display. You can see this indicated by two small grey arrows in the picture below. If your display doesn’t have this, then thoroughly scrape the paint from the two metal tabs poking through the bottom of the display PCB and solder them to the ground plane as pictured. Use a 60-100 watt soldering iron to rapidly heat the components and solder quickly. Use of a smaller iron will take longer to heat components up which isn’t ideal.
  • Chassis to PCB shielding: A good connection between the PCB earth and the chassis will ensure the best RF shielding possible. Critical for this good connection, you should ensure that all screws are done up snugly, but not so tight that they will strip the threads.
  • Nickel shielding spray paint. (Only for the really keen & fastidious radio operator: very extensive disassembly!) While AnyTone have done a good job of shielding sensitive parts of the circuitry with brass shields and the cast aluminium chassis, you can amp up the shielding by use of nickel shielding spray. If you look inside some cellular mobile phones or portable two way radios, you will sometimes see a coating of paint on the inside of any plastic parts. This paint could be black, brown, pink, grey or silver, and they all have a similar job: they’re conductive and add a thin layer of RF shielding to the electronics inside. Electrolube’s NSCP400H nickel spray paint is sold by Element14 (Farnell), or you might be able to find alternative products from other suppliers. You’ll need to follow these general steps:
    1. Completely disassemble the radio. You need a bare plastic shell with the keypad and LCD display, speaker, orange top button and the plastic ’light pipe’ for the top mounted TX/RX LED removed.
    2. Use masking tape to cover every surface that you don’t want the nickel spray paint to go. That not only includes all the visible exterior parts, but also many interior areas as well. Cut out a circle of cardboard to fit on the inside of the speaker grille, and also cut out a rectangle of cardboard to the same size as the LCD clear display window. Also block up any openings such as the holes where the keypad goes with cotton wool - I use craft work decorative soft balls for this and it works well. If you have a GPS model, you will also need to leave the area around the GPS antenna clear of any coating. This job of masking every surface you don’t want covered by the paint is fiddly and tedious in the extreme, but is necessary because the spray paint will go everywhere, trust me!
    3. Nickel spray paint is known to be rather hazardous. You will want to do this job outside, and on a calm wind free day. Wear goggles, dust mask, long sleeve shirt and rubber gloves. Place the masked up shell onto a piece of scrap cardboard and use good spray painting techniques to apply a thin coat of nickel spray on the inside of the shell. The spray will look uneven as you apply it, and don’t let that tempt you into applying more paint in those areas. Too much paint will attack the plastic and cause the coating to crack once dried.
    4. Let the first coat of nickel paint dry, about 24 hours. Apply one more very thin coat of nickel spray paint and let dry again.
    5. Slowly remove any masking tape, cardboard protective bits and cotton wool stuffing. You should have your same bare radio shell but with a nice grey coating of nickel spray paint on the inside.
    6. Refit the speaker and use hot melt glue or a contact type of glue to hold it in place.
Don’t coat the rectangular rubber piece that fits over the side speaker/mic connectors, these must be left ’floating’ from ground. This nickel coating will give an extra 10dB worth of shielding to the back side of the main PCB, which results in a ’cleaner’ receiver, especially in an area of moderate RF fields: weaker signals are less distorted and disturbed by nearby transmitters in comparison to a radio without this treatment.



FCC Part 90 approval information:
The FCC has documented quite a bit of interesting technical information regarding the AT-D868UV and AT-D878IV regarding their Part 90 approvals. You can find internal photographs, test reports, SAR radiation exposure limit testing reports and more. Visit the FCC report page at:
https://fccid.io/T4KD868UV
https://fccid.io/2AGND-DMR6X2 (less information here, but the approval refers back to the T4KD868UV approval)
https://fccid.io/T4KD878UV
Notice that the 878 approval documents also include details of the Bluetooth module. This Bluetooth module not only uses the Beken BK3260 Bluetooth IC, but also has a Beken BK2452 2.4GHz Wi-Fi IC installed as well, though it doesn’t have an antenna connected.



A look inside the 868

The back side of the GPS & LCD screen board. Ribbon cables removed for clarity. Note the mini GPS antenna to the right - it sits underneath the AnyTone badge above the display.



The 868 main board back side, with brass RF shield fitted



The 868 main board back side, with brass RF shield removed this time



The 868 main board front side



You can download higher resolution pictures of the main boards here:
http://members.optuszoo.com.au/jason.reilly1/868mainboard_back_full.jpg (3.6Mb)
http://members.optuszoo.com.au/jason.reilly1/868mainboard_front_full.jpg (3.7Mb)




Known bugs with the AT-D868UV:
May or may not apply to the DMR-6x2
The following is a list of bugs that I’m aware of with the AnyTone AT-D868UV under firmware 2.33. There may be other bugs not listed here, so it’s not an exhaustive list.
  • Analogue transmissions with CTCSS using ’reverse tone burst’ for squelch tail elimination do not quietly mute 100% reliably
  • FM broadcast band VFO only permits tuning from 87.5 to 108 MHz no matter what ’Mode’ the radio is set to, where as programming software allows 76.0 to 108.0 MHz to be programmed as a memory
  • When first starting the FM broadcast band receiver, it defaults to around mid-volume no matter what your volume setting is



General technical information
The 868 / 878 / DMR-6x2 contains the following devices:
  • GD32F303VTG6 ARM Cortex-M4 32 bit MCU with 1024kbyte flash and 96kbyte SRAM & 12.0 MHz oscillator
  • Toshiba TC58CVG0S3HRAIG 1Gbit / 128Mbyte NAND flash memory
  • Sicomm CT3258TD baseband processor for DMR & dPMR with built in AMBE2+ vocoder & 12.2 MHz oscillator
  • Texas Instruments TLV320AIC3204 DSP / codec
  • AT1846S radio-on-a-chip & 26.0 MHz reference oscillator
  • RDA 5802N FM broadcast band receiver
  • H&M Semiconductor HM8872 8 watt audio power amp
  • NXP AFT05MS006NT1 LDMOS 6 watt RF power amp, 18dB narrowband gain, for independent VHF & UHF power amp stages
  • 2SC3356 based low noise preamps for VHF & UHF receiver stages
  • VHF and UHF receive front ends each have four stages of varactor track tuned filtering
  • Infineon BGM781N11 GPS front end and ATGM336H GPS / GNSS positioning module (GPS models only)
  • Battery backup for real time clock
  • Solder pads for expansion memory SOIC size IC and a small push fit expansion connector for add on Bluetooth or extra memory module. (Not found on the 868 version 1 hardware)



Early investigations to flash memory structure in the 868 / 6X2
in general this information is also the same for the 878 too, with some tiny differences
The 868 / 878 / 6X2 is fitted with a 128 Mbyte flash memory, along with another 1 Mbyte of flash memory in the MCU that holds the operating firmware. Here’s what I know about the structure of memory in these radios so far:
0x00000000 to 0x07FFFFFF is mapped to external flash memory chip.
  • Lower half of flash is used for codeplug storage, icon data & RF ’soft’ alignment
  • 0x00000000 to 0x0014FFFF holds alternate language fonts eg: Pinyin (Chinese), Japanese, Greek, Cyrillic, Roman numerals. There is some English font there but it doesn’t appear to be used at all
  • 0x00150000 to 0x00159FFF holds the default AnyTone start-up picture
  • 0x0015A000 to 0x00200000 holds the multi colour icons bitmaps
  • 0x02F00000 to 0x02F8061F holds active RF ’soft’ alignment data and backup copies
  • 0x02FA0000 to 0x02FDFFFF holds active ’local information’ data and backup copy
  • Upper half of flash holds the DMR ID database and custom start up image, actually less than half the flash is used for this! (Plenty of scope for expansion by database compression, more efficient use of memory etc.)
  • 0x042C0000 to 0x042C9FFF is for custom start up image bitmap
  • 0x04500000 onward for DMR ID database, with other support data being written from 0x04000000

0x08000000 to 0x080FFFFF is mapped to MCU internal flash memory
  • 0x08000000 to 0x08003FFF used by the 868 / 6X2 boot loader for firmware updating etc.
  • 0x08004000 to 0x0807FFFF used by firmware and display fonts
  • 0x08080000 to 0x080FFFFF is empty (believed that at least half of this is available for firmware use on the 878)



Future developments & ideas
  • Better understanding and modification of receive tracking gain scheme to improve sensitivity between 210 & 400 MHz
  • Exploiting the capabilities of the TLV320AIC3204 audio codec chip inside the 868. This is a very powerful chip with the possible scope to facilitate DSP noise reduction, equalisation, tone control and digital AGC audio.
  • Explore some new fonts, perhaps some screen colour changes and icon customisation


© Copyright Jason Reilly, 2018