先创对讲机 cctf std880A 进系统改参数方法

kelchdeng · 发表于 2024-8-29 00:32:22

爱科技、爱创意、爱折腾、爱极致，我们都是技术控

您需要登录才可以下载或查看，没有账号？立即注册

x

本帖最后由 kelchdeng 于 2024-8-30 10:34 编辑

首先按之前帖子之前帖子40楼的线序连接

开机时按任意键，进入uboot
执行printenv

U-Boot 2009.11 (May 29 2012 - 18:23:12)
Hit any key to stop autoboot: 0
U-Boot > printenv
bootcmd=cp.l 0x60080000 0xc0700000 0x42f00;bootm 0xc0700000
bootdelay=1
baudrate=115200
ethaddr=67:48:01:38:00:01
bootfile="uImage"
bootargs=mem=48M console=ttyS0,115200n8 root=/dev/mtdblock2 rootfstype=jffs2 rw ip=off
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 2009.11 (May 29 2012 - 18:23:12)
Environment size: 304/131068 bytes

复制代码

可以看到bootargs的参数，默认开机不会直接进入shell。是直接进入系统。使用editenv在bootargs加上init=/bin/sh
再输入boot命令，进入系统。

U-Boot > editenv bootargs
edit: mem=48M console=ttyS0,115200n8 root=/dev/mtdblock2 rootfstype=jffs2 rw ip=off init=/bin/sh

复制代码

Loading Kernel Image ... OK
OK
Starting kernel ...
Linux version 2.6.33-rc4 (root@erjie-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #400 PREEMPT Mon May 12 16:58:27 CST 2014
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: DaVinci DA850/OMAP-L138/AM18xx EVM
Memory policy: ECC disabled, Data cache writeback
DaVinci da850/omap-l138/am18xx variant 0x1
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 12192
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 48MB = 48MB total
Memory: 46256KB available (2164K code, 152K data, 80K init, 0K highmem)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:245
Console: colour dummy device 80x30
Calibrating delay loop... 153.19 BogoMIPS (lpj=765952)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
DaVinci: 144 gpio irqs
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
Switching to clocksource timer0_1
NET: Registered protocol family 1
JFFS2 version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
msgmni has been set to 90
io scheduler noop registered (default)
da8xx_lcdc da8xx_lcdc.0: GLCD: Found Tianma_TM020GDZ44 panel
serial8250.0: ttyS0 at MMIO 0x1d0c000 (irq = 53) is a AR7
console [ttyS0] enabled
serial8250.0: ttyS1 at MMIO 0x1d0d000 (irq = 61) is a AR7
brd: module loaded
impA7:probing 0x00800000 at 0x00000000
impA7:probing 0x00800000 at 0x10000000
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
omap_rtc omap_rtc: rtc core: registered omap_rtc as rtc0
watchdog watchdog: heartbeat 60 sec
omap_rtc omap_rtc: setting system clock to 2000-01-01 00:24:22 UTC (946686262)
VFS: Mounted root (jffs2 filesystem) on device 31:2.
Freeing init memory: 80K
/bin/sh: can't access tty; job control turned off
/ #

复制代码

可以看到，我们已经进入系统。
从之前的正常启动打印来看系统的设置config是如下

========== Application started ==========
->channel_para.conf ok
msl_number.conf ok
misc.conf ok
sys_info.conf ok
davinci_misc_open

复制代码

使用find命令查找

/ # find -name channel_para.conf
./home/root/channel_para.conf
/ #

复制代码

然后进到/home/root
配置文件都在这个目录下。
channel_para.conf，本想改成430段来使用，结果发射无功率。

~ # vi channel_para.conf
#..........16..
Tm_Channel_Para_Begin
#TSCC_Freq_No Rx_Freq(KHz) Tx_Freq Pri_Flag
0 3661250 3561250 1
Tm_Channel_Para_End
Rm_Channel_Para_Begin
#Rx_Freq(KHz) Tx_Freq Pri_Flag
Rm_Channel_Para_End
#................
Dm_Channel_Para_Begin
#CHAN_Alias Freq(KHz) Color_Code slot
........1 4350000 4350000 3 1
........2 ***0000 ***0000 2 1
........3 ***0000 ***0000 1 1
Dm_Channel_Para_End
Am_Channel_Para_Begin
#rxfreq txfreq
4300000 4300000
Am_Channel_Para_End
DmZone_Setting_Begin
#zone1 chan1 chan2 chan3 chan4 chan5 chan6 chan7 chan8 chan9 chan10 chan11 chan12 chan13 chan14 chan15 chan16
....1 ........1 ........2
....2 ........1 ........1
DmZone_seting_End
END

复制代码

系统sys_info.conf，希望有400段的机器作为参考，这样直接改感觉没用。

~ # vi sys_info.conf
#SoftWare_Version:: format: *.*.*.*
#HardWare_Version:: format: *.*.*.*
#Device_Info
Device_Info_Begin
#DeviceType DeviceName Manufacturer SoftWare_Version HardWare_Version ESN FrequencyRange
...... ...... CCTF May-29-2014 1.0.0.0 1010100 400-435 2
Device_Info_End
# 0: direct 1: repeat
Work_Mode_Begin
#Work_Mode FreqPoint ShowFreqPoint u8SqulechLevel
7 4000000 1 1
Work_Mode_End
#..............
#Tx Power(w)
Tx_Power_Begin
#u8TxPowDbm0 u8TxPowDbm1
50 100
Tx_Power_End
#............(0......1....)
#PowerLevel
PowerLevel_Begin
1
PowerLevel_End
# 0:normal 1..been remote shutted
Remote_Control_Status_Begin
#u8OpenLoopPCFlag u8RemoteShut u8VoiceService u8DataService u8Tx
1 0 0 0 0
Remote_Control_Status_End
System_Setting_Begin
#backlight_timeout u8Volume keylock Language Timeformat YMDformat keylocktime Alertvoice Screenbrightness GPSstatus
1 8 0 1 0 0 0 11 12 1
System_Setting_End
LAI_ROAM_Begin
#ProvinceCode CityCode BSCode Roamingmode Fst(0.1KHz)) CHst
11 10 200 1 3610125 241
LAI_ROAM_End
PDT_Other_Ne_info_Begin
#MDS_Number PSTN_GATE_Number PABX_GATE_Number MPT_GATE_Number Priority_Level MS_Category MS_level CALLALL_Level
229376 16776896 16776897 122 0 0 0 1
PDT_Other_Ne_info_End
#........
Text_Info_Begin
......(PDT)....................
Text_Info_End
Status_Info_Begin
#Status Alias
33 ......(PDT)....................^M
Status_Info_End
END

复制代码

本机id设置。ms_number.conf，这很重要，设置了个性id后，可以互发短信。和个呼
Indiv_Id_Begin
80020301
Indiv_Id_End
就是机器id

~ # vi ms_number.conf
#MS individual ID, Only One ID. range:0000001-9999999
Indiv_Id_Begin
80020301
Indiv_Id_End
#MS Group ID, Allow 16 IDs. range: 0000001-9999999
Grp_Id_Begin
58420902 ......1^M
80097000 ......1^M
80097001 ......2^M
Grp_Id_End
BJGrp_Id_Begin
BJGrp_Id_End
JoinGrp_Id_Begin
80020911 ......2^M
JoinGrp_Id_End
#........
Contact_Info_Begin
800123 1
80020912 912
Contact_Info_End
#........................PTT................
#Call_Type: 0:.... 1:....
Default_Call_Id_Begin
#Call_Id EmgCallId EmgEnable
58420902 1075380332 584100 1 1
Default_Call_Id_End
END

复制代码

inittab的信息

/etc # vi inittab
# /etc/inittab: init(8) configuration.
# $Id: inittab,v 1.91 2002/01/25 13:35:21 miquels Exp $
# The default runlevel.
id:5:initdefault:
# Boot-time system configuration/initialization script.
# This is run first except when booting in emergency (-b) mode.
si::sysinit:/etc/init.d/rcS
# What to do in single-user mode.
~~:S:wait:/sbin/sulogin
# /etc/init.d executes the S and K scripts upon change
# of runlevel.
#
# Runlevel 0 is halt.
# Runlevel 1 is single-user.
# Runlevels 2-5 are multi-user.
# Runlevel 6 is reboot.
l0:0:wait:/etc/init.d/rc 0
l1:1:wait:/etc/init.d/rc 1
l2:2:wait:/etc/init.d/rc 2
l3:3:wait:/etc/init.d/rc 3
l4:4:wait:/etc/init.d/rc 4
#l5:5:wait:/etc/init.d/rc 5
l6:6:wait:/etc/init.d/rc 6
# Normally not reached, but fallthrough in case of emergency.
z6:6:respawn:/sbin/sulogin
# /sbin/getty invocations for the runlevels.
#
# The "id" field MUST be the same as the last
# characters of the device (after "tty").
#
# Format:
# <id>:<runlevels>:<action>:<process>
#
#1:2345:respawn:/sbin/getty 38400 tty1
S0:2345:respawn:/sbin/getty -n -l /usr/sbin/auto-login 115200 ttyS0
#S1:2345:respawn:/sbin/getty 115200 ttyS1
#S2:2345:respawn:/sbin/getty 115200 ttyS2

复制代码

改完后

~ # reboot -f

重启。配置生效。uboot的设置还原。
扣电池后，固件配置依旧生效。

补充内容 (2024-9-9 09:53):
备份固件和上传固件方法见16楼（待验证，为其他频段的机器）
上传和下载配置文件，解决新建频道中文显示。

补充内容 (2025-1-10 14:56):
880a和880s改400m方法见70楼和71楼。
期待大家更好的改机分享。

补充内容 (2025-2-19 14:47):
改善接收信号方法见79楼
功率测试见80楼

公子霜叶 · 发表于 2025-4-17 16:32:55

对讲机竟然是linux

kelchdeng · 发表于 2025-4-3 21:02:31

本帖最后由 kelchdeng 于 2025-4-3 21:05 编辑

另一款F600A机器，如果不能直接用D860C软件写时，就先用之前帖子中568或860E的那款凯笛迅软件随便写入提示机型不匹配时也确定写入，写入后就有了机器串码。
再用D860C软件就一切正常了。

soma · 发表于 2025-3-29 18:02:03

xichuanlong 发表于 2025-3-28 06:47
最近老王家的带屏盲盒
先拆为敬，看着跟880a一样

还带GPS啊

xichuanlong · 发表于 2025-3-28 06:47:20

最近老王家的带屏盲盒
先拆为敬，看着跟880a一样

gfsyip126 · 发表于 2025-3-24 23:14:25

dbxzjq 发表于 2024-11-29 18:16
我收到的也是这机型，可惜频率是350MHZ的

撕开里面是400的

tom4700 · 发表于 2025-3-19 22:05:19

2016固件提取码不对下载不了。

tomac88 · 发表于 2025-3-18 17:07:40

原来也是跑的LINUX真是没想到呀

kuailedexiaozhu · 发表于 2025-3-5 23:09:15

楼主辛苦啦。请问880A刷2016的固件后就能*70#手植频了吗？怎样用什么工具刷2016的固件，小白一个，望出个详细教程

kelchdeng · 发表于 2025-2-8 21:13:02

改了前端电感后的880A，用rs-40驻波表测量。数字制式下高功率输出功率不到3w。

模拟制式输出功率超5w。

对照测试组1，原装880s外观的880A，原厂400mhz∶数字3w不到，模拟超5瓦。

对照测试组2，原厂880s，你懂的频率:数字3w不到，模拟超5瓦。

改造了前端电感后的880a，接收中继台的-108dbm信号，效果清晰。
结论:改造符合预期。
一般常见的国产数字制式手台都标的参数是数字4w，模拟5w。

kelchdeng · 发表于 2025-2-6 12:33:44

本帖最后由 kelchdeng 于 2025-2-6 19:26 编辑

把前端的几个电感用塑料片拨稀疏是有用的。
改造前没法接收到中继信号，改造后能收到中继信号。能收到中继下行信号了，接收效果应该提高了很多。两手台之间接收效果还没测试。

工具是一片食品包装盒塑料片，纯净水瓶子塑料也可以。塑料片不会伤到电感的绝缘漆。

kelchdeng · 发表于 2025-1-16 22:46:03

bg4rff 发表于 2025-1-10 16:14
只是只改了VCO部分，使其能起振，但是通道部分还需要改，接收和发射低通那里需要把截止频率提高点，电感或 ...

我是把那几个大绕线电感用指甲顶稀了点。电感绕长度稀了，电感值降低

raoergsls · 发表于 2025-1-14 15:27:18

把楼主发的2016版本传上去提示这个错误，而且启动失败
root@cctf:~# lrz --help
lrz version 0.12.20
Usage: lrz [options] [filename.if.xmodem]
Receive files with ZMODEM/YMODEM/XMODEM protocol
(X) = option applies to XMODEM only
(Y) = option applies to YMODEM only
(Z) = option applies to ZMODEM only
  -+, --append             append to existing files
  -a, --ascii                ASCII transfer (change CR/LF to LF)
  -b, --binary             binary transfer
  -B, --bufsize N          buffer N bytes (N==auto: buffer whole file)
  -c, --with-crc             Use 16 bit CRC (X)
  -C, --allow-remote-commands allow execution of remote commands (Z)
  -D, --null                write all received data to /dev/null
   --delay-startup N    sleep N seconds before doing anything
  -e, --escape             Escape control characters (Z)
  -E, --rename             rename any files already existing
   --errors N             generate CRC error every N bytes (debugging)
  -h, --help                Help, print this usage message
  -m, --min-bps N          stop transmission if BPS below N
  -M, --min-bps-time N       for at least N seconds (default: 120)
  -O, --disable-timeouts    disable timeout code, wait forever for data
   --o-sync             open output file(s) in synchronous write mode
  -p, --protect             protect existing files
  -q, --quiet                quiet, no progress reports
  -r, --resume             try to resume interrupted file transfer (Z)
  -R, --restricted          restricted, more secure mode
  -s, --stop-at {HH:MM|+N} stop transmission at HH:MM or in N seconds
  -S, --timesync             request remote time (twice: set local time)
   --syslog[=off]       turn syslog on or off, if possible
  -t, --timeout N          set timeout to N tenths of a second
  -u, --keep-uppercase       keep upper case filenames
  -U, --unrestrict          disable restricted mode (if allowed to)
  -v, --verbose             be verbose, provide debugging information
  -w, --windowsize N       Window is N bytes (Z)
  -X  --xmodem             use XMODEM protocol
  -y, --overwrite          Yes, clobber existing file if any
   --ymodem             use YMODEM protocol
  -Z, --zmodem             use ZMODEM protocol

short options use the same arguments as the long ones
root@cctf:~# lrz -Z
▒*Sending: e8_arc_hl.elf*B0100000023be50

Uploading: 99% (ETA 00:00 1410 kB / 1410 kB 2372 kBPS)       Retry 0: Got TIMEOUT

Transfer incomplete

raoergsls · 发表于 2025-1-13 15:24:32

买了宝峰的k线，接上去以后打印出下面的信息，结果敲键盘没反应，怀疑是只有接收，发送线接的不对？下一步打开k线看看重新接一下

U-Boot 2009.11 (May 29 2012 - 18:23:12)

Hit any key to stop autoboot:  0
Loading Kernel Image ... OK
OK

Starting kernel ...

Linux version 2.6.33-rc4 (root@erjie-desktop) (gcc version 4.3.3 (Sourcery G++ Lite 2009q1-203) ) #400 PREEMPT Mon May 12 16:58:27 CST 2014
CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00053177
CPU: VIVT data cache, VIVT instruction cache
Machine: DaVinci DA850/OMAP-L138/AM18xx EVM
Memory policy: ECC disabled, Data cache writeback
DaVinci da850/omap-l138/am18xx variant 0x1
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 12192
PID hash table entries: 256 (order: -2, 1024 bytes)
Dentry cache hash table entries: 8192 (order: 3, 32768 bytes)
Inode-cache hash table entries: 4096 (order: 2, 16384 bytes)
Memory: 48MB = 48MB total
Memory: 46256KB available (2164K code, 152K data, 80K init, 0K highmem)
SLUB: Genslabs=11, HWalign=32, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
Hierarchical RCU implementation.
NR_IRQS:245
Console: colour dummy device 80x30
Calibrating delay loop... 153.19 BogoMIPS (lpj=765952)
Mount-cache hash table entries: 512
CPU: Testing write buffer coherency: ok
DaVinci: 144 gpio irqs
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
Switching to clocksource timer0_1
NET: Registered protocol family 1
JFFS2 version 2.2. (NAND) (SUMMARY)  漏 2001-2006 Red Hat, Inc.
msgmni has been set to 90
io scheduler noop registered (default)
da8xx_lcdc da8xx_lcdc.0: GLCD: Found Tianma_TM020GDZ44 panel
serial8250.0: ttyS0 at MMIO 0x1d0c000 (irq = 53) is a AR7
console [ttyS0] enabled
serial8250.0: ttyS1 at MMIO 0x1d0d000 (irq = 61) is a AR7
brd: module loaded
impA7:probing 0x00800000 at 0x00000000
impA7:probing 0x00800000 at 0x10000000
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
omap_rtc omap_rtc: rtc core: registered omap_rtc as rtc0
watchdog watchdog: heartbeat 60 sec
omap_rtc omap_rtc: setting system clock to 2000-01-01 00:00:00 UTC (946684800)
VFS: Mounted root (jffs2 filesystem) on device 31:2.
Freeing init memory: 80K
INIT: version 2.86 booting
INIT: Entering runlevel: 5

login[272]: root login  on `ttyS0'

insmod dsplinkk.ko
DSPLINK Module (1.65.00.02) created on Date: Jun  6 2013 Time: 15:30:50
run app.elf
0 0:0:4

open /dev/ttyS0 device! fdRdPSda8xx_gpiotable_open: dev = gpio-table
C == 3................................
console_cfg.c_cflag = 14b2
console_cfg.c_iflag = 1500
console_cfg.c_oflag = 5
console_cfg.c_lflag = 83b
OSP_SYS_POWER_LOCK:1
========== Application started ==========
->channel_para.conf ok
msl_number.conf ok
misc.conf ok
sys_info.conf ok
davinci_misc_open
OspIpcMsgRevNotifyHandle: recev IPC_MSG_DSP_START msg form dsp
========== Application terminated ==========
OspTaskStart: wait for msg!
Establishing handle for timer signal
OspIpcMsgRevNotifyHandle: recev IPC_MSG_DSP_ACK_GPP msg form dsp
osp start: dsp status is OSP_STAT_DSP_APP_START
OspIpcMsgRevNotifyHandle: recev IPC_MSG_DSP_ACK_GPP msg form dsp
osp start: dsp status is OSP_STAT_DSP_DRIVER_davinci_misc_ioctl:uart1 is closed
START
1 0:0:6
OspSendMsg: msg Ind:0, msgbuf:429b0084!
May-29-

raoergsls · 发表于 2025-1-11 16:31:49

改完以后效果怎么样？

bg4rff · 发表于 2025-1-10 16:14:16

本帖最后由 bg4rff 于 2025-1-10 16:18 编辑

只是只改了VCO部分，使其能起振，但是通道部分还需要改，接收和发射低通那里需要把截止频率提高点，电感或电容换小一点的
要是能对照一下这些个电感的匝数，看看有多大差异
一般把频率调高点，把电感拨的稀疏写也可以

kelchdeng · 发表于 2025-1-10 14:51:12

880S改400M方法：去掉标记的两个电容。然后接收部分电感成0402大小的24nh。

kelchdeng · 发表于 2025-1-10 14:48:27

880A改400M方法：发射部分，把33nh电感换成0805的24nh。下面接收部分那电感换成24nh，原电感是0603，但也可焊0805大小。

kelchdeng · 发表于 2024-12-31 20:07:40

880a和880s这两款D-880系列机器，350-390mhz硬件使用的是PDT数字制式，由公安部牵头，PDT产业联盟制定的国产自主标准。400-435mhz硬件的固件采用的是FDMA ARC数字制式，由福建联拓科技提案，并自研了专用芯片lt1801，实际是先创子公司。
fd568，860c和860e都是用的联拓芯片方案。
所以ARC开头的固件，频率设置中没有色码和时隙，可能借鉴了dpmr制式。
经过qq群主实操改造，350版本硬件的机器都可以到400mhz民用频率发射，但接收效果还不理想。
kevin.z自制电感比较电路和手搓电感，接收距离有所改善，但没有400mhz原机对比，还有一些坑要踩。

敬佩群里，论坛里爱折腾的各位电子爱好者。