by Travis Goodspeed, KK4VCZ

Jul 07, 2017 The Tytera Flash Tool is a super easy way to get a modified firmware, which gives lots of extra features, onto your TYT MD-380 or MD-390 radio. The tool also downloads the latest user database of. The TYT MD-2017 User Manual is a genuine paperback TYT OEM replacement manual and is identical to the one that comes with an MD-2017 Dual Band Digital Two-Way Radio. JavaScript seems to be disabled in your browser. The following links will generate DMR ID database files formatted and ready to update to the following models. Database Generator TYT - BTech - Anytone - Ailunce.

To support users by using the md380tools or the resulting patched firmwarea Google Group is public opened and reachable viahttps://groups.google.com/forum/#!forum/md380tools. No extra registrationshould be necessary. You could also feed it via e-mail atmd380tools@googlegroups.com. So feel free to put in your questions into it!

A few of us are also on the #md380 IRC channel on Freenode.

A helpful site is available at http://md380.org/

There are also some related groups you may find interesting:

This repository contains tools for working with codeplugs and firmwareof the Tytera MD380, which is also sold under a variety of differentbrand names. The codeplug format is sufficiently similar to theradios from Connect Systems (CS700, etc) that these tools mightsomeday be made compatible.

Client Tools:

• md380-dfu reads and writes MD380 codeplugs and firmware.
• md380-tool communicates with the patched firmware. (Fancy stuff!)

Development Tools:

• stm32-dfu modifies firmware for jailbroken devices. (No longer required.)
• md380-fw wraps and unwraps devices firmware.
• md380-gfx modifies firmware graphics.

Build Status

Supported Hardware

The patched firmware is known to work on the following devices:

• The 'D'-Version (NoGPS) for radios without GPS

  • Tytera/TYT MD380
  • Tytera/TYT MD390
  • Retevis RT3

• The 'S'-Version (GPS) for radios with GPS

  • Tytera/TYT MD380
  • Tytera/TYT MD390
  • Retevis RT8

Both types of vocoder (old and new vocoder radios) are supported.

The DMR MARC user's database required a 16 MByte SPI Flash memory chip.In some VHF Radios is only an 1 MByte SPI Flash installed.

Known models

Name	vocoder	GPS	exp FW	original FW
MD-380	old	N	D02,D13	D02,D03
MD-380	new	N	D02,D13	D02,D13
MD-380G	new	Y	D02,S13	S13
MD-390	new	N	D02,D13	D13
MD-390G	new	Y	D02,S13	S13

• RT3 = MD-380 (old)
• RT8 = MD-390G

License:

This software is licensed in exchange for two liters of India PaleAle, to be delivered at a neighborly bar, preferably one withouttelevisions.

Tytera's firmware is of unknown license and is not included in thisrepository. We use a heap-less printf library under the BSD license.

Specifications:

• The MD380 uses a custom variant of DFU that isn't quite compatiblewith the spec. Their code seems to be forked from an STMicroexample for the STM32 chip.

• Universal Serial Bus Device Class Specification for DeviceFirmware Upgrade, version 1.1:http://www.usb.org/developers/docs/devclass_docs/DFU_1.1.pdf

Requirements:

• Python 2.7 or newer:http://www.python.org

• PyUSB 1.0: (0.4 does not work.)https://github.com/pyusb/pyusb

• libusb 1.0: (0.4 does not work.)http://www.libusb.org/

• python-requestshttp://python-requests.org/

This project should work across Linux, Mac OS, and Windows, but hasnot been tested on all platforms. A separate client, MD380Tool,is under development for Android.

Preparation of build environment

Additional steps for linux based installations

(The 99-md380.rules file is copied to /etc/udev/rules.d/ in order to allow users to access the radio over USB without having to use sudo or root permissions.)

Flash updated firmware for linux based installations

Turn on radio in DFU mode to begin firmware update with USB cable:

• insert cable into USB.
• connect cable to MD380.
• power-on MD380 by turning volume knob, while holding PTT button and button above PTT.

For non-GPS-models do:

For GPS-models do:

Flash updated users database for linux based installations

Turn radio normally on to begin database loading with USB cable

For European users:

Note: for European users it is probably illegal to use the other method for updating, due to privacy laws.(This is no legal advice, please consult your lawyer to be sure.)

For the rest of the world:

(The users.csv file located in the db directory must be refreshed this way,with make updatedb, otherwise it will continue using any already-existingusers.csv file when running make flashdb.)

Convenient Usage:

Anything with md380-tool requires a recent version of our patchedfirmware. You can check your version in Menu/Utilities/RadioInfo/Version. If it's a recent date you're good; if it's a number,you need to upgrade.

To dump the recent dmesg log:

Firmware Compilation

This archive does not ship with firmware. Instead it grabs firmwarefrom the Internet, decrypts it, and applies patches to that revision.

You can reproduce the patched firmware with make clean dist afterinstalling an arm-none-eabi cross compiler toolchain. The firmwareand a Windows flashing tool will then appear inmd380tools-yyyy-mm-dd. Alternately, you can flash them from Linuxwith make clean flash, after starting the recovery bootloader byholding PTT and the button above it during a radio reboot.

Windows Firmware Installation

You can install any of these patched firmware files into your MD380 byusing the respective .bin file with the Tytera Windows firmwareupgrade tool, upgrade.exe, available inside their firmware upgradedownloads. Here are the steps:

• Turn off your MD380 using the volume knob.
• Attach the Tytera USB cable to the SP and MIC ports of your MD380.
• Attach the Tytera USB cable to your host computer.
• Hold down the PTT and the button above the PTT button (not the button with the 'M' on it).
• Turn on your MD380 using the volume knob.
• Release the buttons on the radio.
• The status LED should be on and alternating between red and green, indicating you're in flash upgrade mode.
• Start the Tytera Upgrade.exe program.
• Click 'Open Update File' and choose one of the .bin files produced from the process above.
• Click 'Download Update File' and wait for the flash update process to finish. It takes less than a minute.
• Turn off your MD380 using the volume knob.
• Disconnect the USB cable from your MD380 and host computer.
• Turn the MD380 back on, and you should see the 'PoC||GTFO' welcome screen. You're running patched firmware!

Chirp Driver:

Also included is a partial driver for the MD380 in Chirp. This driverdoesn't yet support the essential DMR features, but it does handleanalog channels and banks well enough to load analog repeaters intoyour radio.

This driver can't yet communicate with the radio, so use md380-dfu read foo.img to read an image out of the radio, then open it in Chirpafter installing chirp/md380.py as a driver. Once you've made yourchanges, you can load the image back in by running md380-dfu write foo.img.

More Info

Some articles:

• Jailbreaking the MD380, PoC||GTFO 10:8 (pocorgtfo10.pdf page 76.) by Travis Goodspeed
• Running AMBE Firmware in Linux, PcC||GTFO 13:5 (pocorgtfo13.pdf page 38.) by Travis Goodspeed

Pat Hickey has some notes and tools up in his own repository,https://github.com/pchickey/md380-re

Tyt Md 380 Manual

Customization

Temponary not avaible, see https://github.com/travisgoodspeed/md380tools/issues/221

Images extracted from the firmware have comments at the beginning ofthe file, telling md380-gfx where they came from. Comments begin with a '#', and end with a new line.

Image editors like GIMP will discard the original comments, but you canreplace them by opening the file in a text editor and copy-pasting thecomment lines from the original extracted file to your custom image.

Boot logo

380 Tools Firmware Tyt

There are several boot logos provided that you can choose from by editingpatches/2.032/Makefile, and commenting/uncommenting as you see fit.

The original boot logo is 160x40 pixels, and only 2 colors. This meansan image that has the same properties can be written into the firmwareas a direct replacement, as seen in the Makefile.

Tyt Md 380 Programming Software

An image with more than two colors requires the 'relocate' argument tomd380-gfx. There are examples of this in the Makefile as well.