batlabs is one of our fav sites...we check it daily...

ARRL


"private" wrote in message
om...
r0f's guide to ASTRO radios - What you need to know to have a clue -

Lately, there have been several Ebay ads, and other questions asked on
the board, that finally motivated me to write an ASTRO "guide" for
newbies. When people ask questions, we should be able to point them
somewhere. The main site (batlabs) has a lot of info, but not nearly
enough to guide newbie/lamers through the woods

Let's start off with the basics.

Currently, there are 7 ASTRO portable models on the market.

- ASTRO Digital Saber (Models I, IR, II, IIR, and III)
- XTS3000 (Models I, IR, II, IIR, and III)
- XTS1500 (16ch only, no keypad/display)
- XTS2500 (Models I, IR, II, IIR, and III)
- XTS3500 (Models I, IR, II, IIR, and III)
- XTS5000 (Models I, IR, II, IIR, and III)
- SSE5000 (SP Radio, NYPD Only. Looks like a model I ASTRO Saber, but
grey)

The lowest tier ASTRO portable is currently the XTS1500. This is an
entry-level portable, designed for utility companies and public works
users. It is 16 channels only, and does not support encryption. It
supposedly is FLASHport upgradeable, but there is no mention of this
on Motorola's website. It is dual band, 700/800 MHz, and supports
ASTRO25 and APCO16 trunking. (3600/9600bps control channels)

The ASTRO Saber has long been a favorite of batlabbers. It is the last
"real" radio that Motorola released, before going to the XTS series
radios, which just aren't built the same. One could easily use the
ASTRO Saber to beat down a bad prisoner, or get revenge on a locker
thief (personal story, I won't go there). There are 2 versions of the
ASTRO Saber available -- One with a 512K flash memory, and one with
1-meg. The 512K ASTRO Sabers are the most popular, but do not support
9600bps (ASTRO25) trunking, or firmware higher than Host R05.60.00 /
DSP DSPN06.05.02. The 512K ASTRO Sabers support nearly every FLASHport
option. Unfortunately, if the user
wishes to use one of the newer UCM Encryption modules with EMC R03.xx
firmware, the radio MUST be upgraded to a 1-meg vocoder board, as EMC
R03.xx requires Host firmware of R07.xx.xx to function. The ASTRO
Saber comes in VHF, UHF-low, UHF-high, and 800 MHz flavors. The ASTRO
Saber has 2 lines of 14 characters for the display.

The XTS3000. Released in 1996, it was Motorola's second ASTRO Portable
to hit the market, and is the most common ASTRO portable in use, to
this day. It comes with a 1-meg vocoder board, and supports
encryption. How could you go wrong with this? It's shorter than the
"HUGE" (As ASTROMODAT puts it) ASTRO Saber, but the XTS3000 is a
FATTER radio, even with the Lithium Ion battery. The XTS3000 supports
3600/9600bps trunking, and any other FLASHport option you wish to have
added in. It does not require a vocoder upgrade. Like the ASTRO Saber
model, certain features/hardware are firmware dependant. The XTS3000
and ASTRO Saber share the same host/dsp firmware releases. Example:
R05.51.00 / DSPN06.04.11 can be found in both ASTRO Sabers, and
XTS3000's. The XTS3000 comes in VHF, UHF-low/UHF-hi, and 800 MHz.

The XTS2500 and XTS5000 were released in early 2002. While the XTS2500
is a nice portable with 160 modes, it does not support encryption. It
hasn't been hacked yet either, meaning if you buy a "featureless"
XTS2500 on ebay, it's going to stay that way. It's a medium-tier
radio, supporting 3600/9600bps trunking and conventional. It's nice
eye candy, but that's about it.

The XTS5000 is Motorola's "top of the line" digital portable. It
supports 512 modes, encryption, and 3600/9600bps
trunking/conventional. It hasn't been hacked yet, and the only
portables floating around on Ebay at the moment, all appear to be
alpha-series developmental models. Their serial numbers are
123ABC1234. Keep away from them! They require special Alpha CPS to
program, and are not supported via "R" CPS. The XTS5000 supports
8-meg's of FLASHport memory, and supposedly IP-data features. The
"r0f" opinion of the XTS5000, is that it's a recased XTS3000 with a
new display and more
memory. Motorola didn't put a lot of effort in to the XTS5000, and it
is overpriced and currently does not support anything that the XTS3000
or ASTRO Saber is capable of. Do not be fooled in to purchasing an
XTS5000 thinking it's "the bomb", because it's just not!

The XTS2500, XTS5000, and SSE5000, are all programmed with the RVN4181
software package.

The XTS3500 is an XTS3000, with a faster CPU, and supposedly it
supports higher levels of encryption -- however this has never been
confirmed. It looks identical to the XTS3000, but it's only available
in VHF and UHF models -- No 800 MHz. The 3500 is programmed with RSS.
As far as I know, no CPS exists and the radio has not been hacked.

The SSE5000 is an SP radio developed for the NYPD. It looks like a
Model I ASTRO Saber, in a grey case. It's exact features are unknown
at the moment, and Motorola does not list it on their website. It's
most likely got 1-meg of FLASHport memory, a faster CPU, and a few
custom "one touch" buttons. Any information on this radio would be
greatly appreciated!

So now I've covered, in a somewhat brief way, all 7 portables, and
what they are. Now it's time to talk about what makes a radio worthy
of an Ebay purchase, or just flat out hacking. I will only cover the
XTS3000 and ASTRO Saber, as they are the most popular models, and are
easily "reconfigured" for the intended use.

First, when looking at an Ebay auction, or making a deal with someone
to buy an ASTRO Portable, you MUST have the below information provided
to you. If the seller is too ignorant or clueless to give you this
information, then DO NOT chance your hard earned money! This
information is obtained via 2 methods.

1. Via the F9 menu after reading the radio in RSS (or equiv in CPS)
2. Via SERVICE mode. To enter SERVICE mode, press the ".." button on
the side
of the radio 5 times, within the first 10 seconds of powering up the
radio. The information will scroll across the screen. This process may
have to be repeated a few times to get everything.

First, ask the person selling the radio if it's IMBE or VSELP. If they
don't know, then they are just stupid and ignorant. I'd be tempted to
just not deal with them at this point, but sometimes you can "steal"
the radio for under $500 from these people simply because they're too
stupid to know what it is they're selling.

VSELP = Vector Sum Excited Linear Prediction
IMBE = Improved Multi-band Excitation

VSELP was Motorola's first attempt at a digital voice codec. It's
inferior to IMBE, and is proprietary. The City of Baltimore uses VSELP
on their 800 MHz trunked system. Other than that, it's almost extinct.
IMBE is made by DVSI, and is the APCO-25 codec. 99% of the time,
you'll want an IMBE radio.

- What is the Model #? H04UCH9PW7AN is an ASTRO Saber III 800 MHz. You
need this
to be sure of what you're getting. I've seen MONGOLIAN MORONS selling
800 MHz
radios as "VHF" on Ebay. These people are either retarded, or are
selling something
they know nothing about. i.e. STOLEN.

To decode the model #, visit this page:
http://www.batlabs.com/astromob.html#model

Next, you'll need the HOST and DSP firmware revisions installed in the
radio. This
is probably the most important part. If the MONGOLIAN RETARD selling
the radio
doesn't know if it's an IMBE or VSELP radio, you can obtain that
information from
the firmware revisions. Here's the breakdown:

Host Firmware R0x.xx.xx R= Release. If it's anything but "R" here,
it's a factory
test radio, and is probably stolen. Don't bother. Here is version
information:

Less than HOST R04.xx.xx Less than DSP DSPx06.xx.xx = VSELP KEEP
AWAY!!!
Higher than HOST R04.xx.xx Higher than DSP DSPx06.xx.xx = IMBE UNF
UNF! YES!

The latest HOST/DSP firmware (as of this writing) is R07.10.xx /
DSPN08.02.xx.

Now a few notes about the firmware that you need to know for certain
features to
work..

If you desire SmartZone Omnilink Q173/G173 in your radio, you'll need
HOST firmware
higher than R05.xx.xx. it is not supported in R04.xx.xx.

If you're using an EMC or UCM Encryption module, with EMC firmware
higher than
R03.xx, you'll require at the very least HOST firmware R07.xx.xx or
the encryption
module will not work. R07.xx.xx HOST firmware supports older R02.xx
EMC firmware,
just not the other way around.

The next thing you'll want to ask the seller is what the FLASHCODE is.
This lists
what features are installed in the radio. This even determines whether
or not your
radio will transmit/receive in ASTRO mode. This is VERY important.
Flashcodes look
like this:

540008-000400-3
591008-4F1E00-9 (Whored out Nick flashcode)

They are 12 digits long, with a checksum at the end. You can decode
the flashcode
by punching it in to Lindsay Blanton's flashcode decoder he

http://www.radioreference.com/modules.php?name=Flash

To see a list of all available FLASHport options, type FFFFFF-FFFFFF-F
in to his
decoder.

Next, if the seller says "Radio has encryption installed", you'll need
to ask what
algorithms are installed. Encryption comes in many flavors, and not
all algorithms
are compatible with each other. An excellent write-up on encryption
was made by
Batwing (Doug) and is available he

http://www.trunkedradio.net/trunked/stuff/encrypt.html

The encryption algorithms you may see in ASTRO portables are as
follows:

DES DES-XL DES-OFB DVP DVP-XL DVI DVI-XL AES-256

If you see FASCINATOR, your phones will be tapped and you better buy
some
preperation H, because you'll have a date with Bubba. FASCINATOR is a
classified encryption algorithm used to carry US Government
communications,
and is NOT available to the public. If you have it, chances are
it'stolen, or
stolen. Could also be stolen. Get the picture?

DES - 56-bit
DVP - 32-bit
DVI - 24-bit
AES-256 - 256-bit

While AES-256 may look appealing, there is a massive back-door in this
algorithm so that big brother can listen in. Do you really think the
boys would release 256-bit encryption to the public to use, without a
way of snooping?
DES was developed for the US Government in the late 1970's. It is
still to this
day, considered "safe" from eavesdroppers. There are 72-quadrillion
possible
keys, and the amount of computing power required to brute-force the
prime
number the key is based upon, is not something joe-schmoe has access
to. DES
is not "secure" in the sense you would pass classified communications
over it,
but it's definitely a hell of a lot tighter than AES-256. There is no
known
back-door for DES.

DVP was developed by Motorola for business users. It's weak, and most
likely
is back-doored. Security companies and many police agencies in Canada
use (or
did use) DVP in the past, due to tight licensing/export policies back
in the
day. DES was restricted to the US only, but that's not the case any
longer.

DVI was also developed for Motorola for use by business and law
enforcement
users, overseas. It is 24-bit, has a back-door, and is weaker than
George
Bushes self-esteem. The "I" in DVI, stands for "International".

Anyway enough of my encryption rant. The next thing you'll need to ask
your
seller, is how big the vocoder board is. This is required when asking
about
an ASTRO Saber. Is it 512K, or 1-meg? Read above for the differences.

Finally, I'll move on to "parts built radios". These radios are
EVERYWHERE!
Originally they were sold by a mysterious man named "Nick", aka
Watchbuddy,
but he has since disappeared in to the dark Motorola night. His radios
were
supposedly built from "parts" that he or somebody else had ordered
from M,
and then later constructed fully functional radios. They work fine,
look fine,
and even smell fine (heh heh). They just have one fault; NO SERIAL
NUMBER.
A parts radio is usually easy to identify. They all have the same
host/dsp
firmware revisions, and usually the same flashcode.

2002 Nick Radios

Host Firmwa R05.51.00
DSP Fimrwa DSPN06.04.11
Flashcode: 591008-4F1E00-9

2003 Nick Radios

Host Firmwa R07.08.00
DSP Firmwa DSPN08.02.02
Flashcode: 548008-000480-9

The 591008-4F1E00-9 flashcode has become known as the "Whored Out"
flashcode. This is because it supports nearly every option Motorola
offers,
except it has options that are not compatible with each other.
Examples
are Software Encryption, and OTACS and OTACR -- which are proprietary
to
the LAPD, UHF high band. Finding these in 800 MHz XTS3000's is messed
up.

In early 2003, I started bitching on batboard that Nick's radios had
old
firmware in them, and did not support new UCM modules, and described a
noted
bug when used with speaker mics. I'm not sure if this is why Nick
suddenly
started releasing newer host/dsp with his radios, but things changed a
few
weeks after. His second flashcode (less whored out) comes with ASTRO25
9600bps
trunking installed. Unfortunately, it isn't supported by R07.08.00
host
firmware, and caused grief for 3600bps trunking users, as they could
no longer
monitor without forced affiliation. After people started bitching, he
went back
to the 591008-4F1E00-9 whored out flashcode. Then suddenly, Nick
disappeared.
Nobody knows what really happened, but there are lots of stories.

If you come across a parts built radio on Ebay or elsewhere, don't be
afraid
of it, just pay attention to host/dsp and FLASHport options. Also be
aware that
if you send it in to the depot, it may not come back, due to the
serial # issue.

I'm almost done, but I think I should continue ranting about KVL's
(Key Variable
Loaders).

A few of us whores like running encryption on ASTRO. Doing so requires
encryption modules, AND.. a keyloader. There are a few keyloaders out
there. I
will talk about DES, since they are the most common. The same applies
to other
models.

T3011DX -- Works fine for all ASTRO portables/mobiles. NEEDS to be
"D". C will not
work. A T3011DX is a DES/DES-XL/DES-OFB capable keyloader. It has 16
key memories,
and 16 shadow-key (used for OTAR) memories. It's big and ghetto
looking, but it
works just fine. Don't pay more than $600US for one, or else you're
getting hosed.

KVL3000/KVL3000 PLUS. -- There have been a few of these on Ebay
lately. The
sellers I've seen, have NOT listed what algorithm is installed! Can
you believe
that? "DUh I have a KVL3000 for sale". And? When I've emailed them
asking what
algorithm is installed, they rudely reply "THEY DO NOT KNOW". That's
like putting
a car on Ebay. "Selling: a car". You need a little more info than
that! Buyer
beware! These vary in price, but don't pay more than $1500-1600 for
them. One just
went for $2100, and the dork selling it didn't even list the
algorithm(s)! I hope
the buyer wasn't scammed.

Well it's been a slice writing all of this, I hope it proves
entertaining and useful
to ASTRO lovers. Additions, comments, and arguments are all welcome.
Remember,
it's just a hobby

- r0f
10/28/03