New Model #11669
openBaofeng UV-5RH Pro (GPS)
0%
Description
Hello, I have just bought a Baofeng UV-5RH Pro GPS - https://www.baofengradio.co.uk/uv-5rh-pro-gps-multi-band-walkie-talkie/
and have not had any success downloading its initial details using CHIRP. I tried using the '5RM' (as per home page) and 'UV-5RH' options, to no avail.
I was informed there may be a connectivity/cable issue, but can use the same Baofeng Programming cable with my UV-5RTP (the debug log attached shows this successful import at the end).
I'd be happy to help run test versions or different drivers, etc. to get this working.
I notice this radio has the same volume knob as the other new radios they're bringing out, that look very similar to the Quansheng UV-K6 - e.g. the Baofeng UV-K6 (can't believe they can just 're-use' the model name like that!).. I wonder if there's any other similarities w.r.t. programming?
Kind regards, and many thanks for CHIRP,
Matt Gumbley M0CUV
Files
Updated by Jim Unroe 4 months ago
This radio appears to be electronics similar to that of a UV-17 Pro GPS stuffed in to a case similar to that of the (UV-)5RM. So in reality I would expect it to be closer to the new BF-F8HP PRO with 1000 channels (10 zones of 100 channels) than anything else. You can try both selections (UV-17 Pro GPS and BF-F8HP PRO) but I would not be surprised if neither selection recognizes it.
I recently ordered a UV-5RH PRO GPS to compare with my BF-F8HP PRO.
Updated by Matt Gumbley 4 months ago
Hello Jim,
Thank you for your suggestion - however neither of these selections worked. I was only told "The unit did not respond as expected (A)" (words to that effect).
I watched this video by "Big Will" https://www.youtube.com/watch?v=XZsp6oH-j7w - in which he mentions that CPS software has been obtained for this radio, and posted to the "Baofeng Owner's Club" group on Facebook. I've now downloaded that, and will experiment. The software is called "5RH Pro v1.10 EN_CPS.zip", and was obtained from the AliExpress vendor that one group member bought their handheld from.
If it would assist the CHIRP team, I believe I could capture traffic over the USB connection with Wireshark, whilst running this CPS software.
Kind regards,
Matt Gumbley
Updated by Neil Marshall 3 months ago
I have the same model, have tried selecting "5RM" & "UV-5RH" and have tried Jim's suggestions. I either see the same error message as Matt ("Radio did not response as expected (A)" (on the first try to connect to the radio after turning it on) or "No response from radio. Check connector and cabling!" (on subsequent tries).
However, using Baofeng software "5RH Pro v1.10 EN_CPS" and "5RH Pro v1.14" I am can sucessfully read/write to the radio.
For what is worth the model name on the front of the unit and on the label on the rear are "5RH PRO". The radio definitely has the GPN/GNSS functionality.
Updated by Dan Smith 3 months ago
Guys, we need debug logs of you trying the other models. Just telling us what error you see is leaving out 90% of the info we're looking for. Please use the procedure in How_To_Report_Issues to update this bug with debug information after you try each of the other models.
Thanks!
Updated by Neil Marshall 3 months ago
- File config.txt config.txt added
- File win_system_info.txt win_system_info.txt added
- File debug_log.txt debug_log.txt added
[Uploaded from CHIRP next-20241129]
Failed attempt to download from radio having selected model "5RM".
Updated by Neil Marshall 3 months ago
- File config.txt config.txt added
- File win_system_info.txt win_system_info.txt added
- File debug_log.txt debug_log.txt added
[Uploaded from CHIRP next-20241129]
Faild attempts to download from radio having selected "5RM", "UV-5RH", "UV17ProGPS" and "BF-f8HP PRO" in turn.
Updated by Neil Marshall 3 months ago
- File 5RH Pro 001.pcapng 5RH Pro 001.pcapng added
Does this help?
I have attached a wireshark trace of a download using the Baofeng "5RH Pro v1.14" software.
It looks like the initial handshaking starts at packet 1539 (time 10.888078) and the radio responds with an 'A' character in packet 1541. Is this the 'A' refered to in the error message ("Radio did not response as expected (A)") ?
In subsequent packets I can see the channel and zone names.
Regards, Neil
Updated by Adam Nowak 28 days ago
- File 5RH PRO.zip 5RH PRO.zip added
I can confirm the issue - neither model in chirp-next-20250124-win64 - I receive "Radio did not response as expected (A)" or "No response from radio. Check connector and cabling!". In the attached file 5RH PRO.zip - I've captured sniff for serial port communication trough the CPS software - full read with success, and failures for chirp Baofeng models: 5RM, 5RX, BF-F8HP, BF-F8HP-PRO, GM-5RH, UV-5R, UV-5RH, UV-6, UV-6R, UV-13Pro, UV-17, UV-17Pro, UV-17ProGPS, UV-17R-Plus. All captures are in CSVs including columns: Function(Serial), Direction(UP or DOWN),Status,Data (hex), Data (chars)
Seems that handshake for this model changed - I hope my dumps will be helpful here - captured via FTDI cable.
firmware: 1.0.94, hw: 1.0.0
Updated by Terry Kennedy 22 days ago
Jim Unroe wrote in #note-1:
This radio appears to be electronics similar to that of a UV-17 Pro GPS stuffed in to a case similar to that of the (UV-)5RM. So in reality I would expect it to be closer to the new BF-F8HP PRO with 1000 channels (10 zones of 100 channels) than anything else. You can try both selections (UV-17 Pro GPS and BF-F8HP PRO) but I would not be surprised if neither selection recognizes it.
I recently ordered a UV-5RH PRO GPS to compare with my BF-F8HP PRO.
I believe they are completely different. Every analog full-color display Baofeng I've seen except for this one is descended from a development model called the BF-H802 which was apparently never sold as an actual product. This includes both the zoned and no-zones models. The UV-G30 Pro / BF-UV20 is probably the closest radio to the H802 ancestor.
The 5RH Pro has a very different CPS, handshakes in binary instead of ASCII "PROGRAMblah", and so forth. The CPS does some very questionable things for a supposedly modern software package - it sets its Windows Application Compatibility version to Windows 2000 in some cases, saves its settings in "setting.ini" in the program installation directory and other behavior that has been discouraged in new designs for many years.
The 5RH Pro has gone through 100 firmware versions already (my unit came with 1.0.56, new ones apparently ship with 1.0.94, and there's now a 1.1.0). I mention this because programming the radio is likely to be a moving target. I know of 3 different, slightly incompatible CPS versions - 1.04, 1.10. and 1.14.
Several versions of the 5RH Pro firmware update utility are detected as malware by VirusTotal. This is unlikely to be a false positive as the same detections persist across multiple versions of the utility.
If you want the decompiled CPS, contact me. However, when I offered the same for the UV-17 Pro GPS, you didn't find it helpful.
Updated by Andrej Novak 14 days ago
It seems that Baofeng now has its own version of 5RH PRO for sale, it is called UV-5RM Plus GPS.
https://www.baofengradio.com/collections/analog/products/uv-5rm-plus-gps
Updated by Adam Nowak 12 days ago
- File pcapng-3timesRow.zip pcapng-3timesRow.zip added
I've managed to capture 3 times in a row (dump in zip file - pcapng-3timesRow.zip) communication using CPS and USBpcap on FTDI cable. Wireshark filter below is really helpful
(ftdi-ft ) && (ftdi-ft.if_a_rx_payload || ftdi-ft.if_a_tx_payload)
What I observed:
- After com port setup, payload 000000000000000000000000ffffffff is send to radio
Radio responds: 41 (letter A)
next payload 11130e0613000c41 xor (random mask) is sent -> examples in my dump:
A TX payload: 02001d1500131f52 => 11130e0613000c41 xor 1313131313131313 = 02001d1500131f52 - here in example mask is 13
A TX payload: 6b69747c697a763b - here mask is 7a
A TX payload: 65677a7267747835 - here mask is 74Radio responds with detected mask
Then to radio is send string "bebebebebebebebe" xor mask
A TX payload: adadadadadadadad => bebebebebebebebe xor 1313131313131313 = adadadadadadadad
A TX payload: c4c4c4c4c4c4c4c4 => bebebebebebebebe xor 7a7a7a7a7a7a7a7a = c4c4c4c4c4c4c4c4
A TX payload: cacacacacacacaca => bebebebebebebebe xor 7474747474747474 = cacacacacacacacaRadio again respond with mask same as in point 4
Then string 80f070e130c0015080e0f xor mask is send to radio ???put radio in program mode???
A TX payload: 1b1c141d001f13061b1d1c => 80f070e130c0015080e0f xor 1313131313131313131313 = 1b1c141d001f13061b1d1c
A TX payload: 72757d7469767a6f727475 => 80f070e130c0015080e0f xor 7a7a7a7a7a7a7a7a7a7a7a = 72757d7469767a6f727475Radio is sending back 3076c741309bebe41bebebebebebebe xor mask by byte.
the 00 is sent to radio
10 Radio response: 13Radio flash read is initiated by 13414141 xor mask ???read flash command???
A TX payload: 00525252 => 13414141 xor 13131313 = 00525252Radio sent flash content
I hope that above analysis will help to add support for this radio.