CHIRP

What has been decoded so far:
Serial coms are at 19200 baud and the data is passed in variable length
records with a checksum.

Record structure:
Offset Usage
0 start of record (\x7d)
1 Command (\x80 Identify \x81 End/Reboot \x82 Read \x83 Write)
2 direction (\xff PC-> Radio, \x00 Radio -> PC)
3 length of payload (excluding header/checksum) (n)
4 payload (n bytes)
4+n+1 checksum - byte sum (% 256) of bytes 1 -> 4+n

Memory Read Records:
the request payload is 3 bytes, first 2 are offset (big endian), 3rd is
number of bytes to read

Memory Write Records:
The maximum payload size (from the Wouxun software) seems to be 66 bytes
(2 bytes location + 64 bytes data).

I have got as far as getting Chirp to successfully identify the radio.

A Gotcha: the first identify packet returns a bad checksum, subsequent
attempts return the correct checksum... (well it does on my radio!)

The ID record returned by the radio also includes the current frequency
range as 4 bytes big endian in 10Hz increments

Offset
00:10 Model, zero padded (Use first 7 chars for 'KG-UV8D')
11:14 UHF lower limit 1 (in units of 10Hz)
15:18 UHF upper limit 1
19:22 UHF lower limit 2
23:26 UHF upper limit 2
27:30 VHF lower limit 1
31:34 VHF upper limit 1
35:38 VHF lower limit 2
39:42 VHF upper limit 2

Limit 1 = Rx and Limit 2 = Tx (just my guess!)

Present status:
I have got support for identifying and reading the memory from the radio. By a long process of changing either 1 menu item or factory software setting at a time and downloading the memory, I have determined the following memory layout: (Structure member names starting with an x e.g. x0845, are ones I have not been able to determine yet)
#seekto 0x0044;
struct {
u32 rx_freq;
u32 tx_freq;
} uhf_limits;

#seekto 0x0054;
struct {
  u32   rx_freq;
  u32   tx_freq;
} vhf_limits;

#seekto 0x0400;
struct {
  char  model[8];
  char  unknown[2];
  char  oem1[10];
  char  oem2[10];
  char  unknown2[8];
  char  version[10];
  u8    unknown3[6];
  char  date[8];
} oem_info;

#seekto 0x0480;
struct {
  u16    lower;
  u16    upper;     
} scan_groups[10];

#seekto 0x0500;
struct {
  u8   call_code[6];
} call_groups[20];

#seekto 0x0580;
struct {
  char  call_name[6];
} call_group_name[20];

#seekto 0x0800;
struct {
  u8    ponmsg;
  char  dispstr[15];
  u8    voice;
  u8    timeout;
  u8    toalarm;
  u8    channel_menu;
  u8    save;
  u8    autolock;
  u8    keylock;
  u8    beep;
  u8    stopwatch;
  u8    vox;
  u8    scan_rev;
  u8    backlight;
  u8    roger_beep;
  u8    mode_sw_pwd[6];
  u8    reset_pwd[6];
  u16   pri_ch;
  u8    ani_sw;
  u8    ptt_delay;
  u8    ani[6];
  u8    dtmf_st;
  u8    bcl_a;
  u8    bcl_b;
  u8    ptt_id;
  u8    prich_sw;
  u8    rpt_set;
  u8    rpt_spk;
  u8    rpt_ptt;
  u8    alert;
  u8    pf1_func;
  u8    pf3_func;
  u8    workmode_a;
  u8    workmode_b;
  u8 x0845;
  u8    dtmf_tx_time;
  u8    dtmf_interval;
  u8    main_ab;
  u16   work_cha;
  u16   work_chb;
  u8 x084d;
  u8 x084e;
  u8 x084f;
  u8 x0850;
  u8 x0851;
  u8 x0852;
  u8 x0853;
  u8 x0854;
  u8    rpt_mode;
  u8    language;
  u8 x0857;
  u8 x0858;
  u8 x0859;
  u8 x085a;
  u8 x085b;
  u8 x085c;
  u8 x085d;
  u8 x085e;
  u8    single_display;
  u8    ring;
  u8    scg_a;
  u8    scg_b;
  u8 x0863;
  u8    rpt_tone;
  u8    rpt_hold;
  u8    scan_det;
  u8    sc_qt;
  u8 x0868;
  u8    smuteset;
  u8    callcode;
} settings;

#seekto 0x0880;
struct {
  u32   rxfreq;
  u32   txoffset;
  u16   rxtone;
  u16   txtone;
  u8    unknown1:4,
    scan:1
        power:1,
        unknown2:1;
  u8    unknown3:1,
    shift_dir:2
    unknown4:2,
    mute_mode:2,
    wide_fm:1;
  u8    step;
  u8    squelch;
  } vfoa;

#seekto 0x08c0;
struct {
  u32   rxfreq;
  u32   txoffset;
  u16   rxtone;
  u16   txtone;
  u8    unknown1:4,
    scan:1
        power:1,
        unknown2:1;
  u8    unknown3:1,
    shift_dir:2
    unknown4:2,
    mute_mode:2,
    wide_fm:1;
  u8    step;
  u8    squelch;
} vfob;

#seekto 0x0900;
struct {
    u32 rxfreq;
    u32 txfreq;
    u16 rxtone;
    u16 txtone;
    u8  unknown1:4,
    scan:1
        power:1,
        unknown2:1;
    u8  unknown3:2,
    scan_add:1,
    unknown4:2,
    mute_mode:2,
    wide_fm:1;
    u16 padding;
} memory[1000];

#seekto 0x4780;
struct {
    char name[8];
} names[1000];

#seekto 0x6700;
u8 valid[1000];

Corrected memory layout:

#seekto 0x0044;
struct {
u32 rx_start;
u32 rx_stop;
u32 tx_start;
u32 tx_stop;
} uhf_limits;

#seekto 0x0054;
struct {
u32 rx_start;
u32 rx_stop;
u32 tx_start;
u32 tx_stop;
} vhf_limits;

#seekto 0x0400;
struct {
char    model[8];
u8  unknown[2];
char    oem1[10];
char    oem2[10];
char    unknown2[8];
char    version[10];
u8  unknown3[6];
char    date[8];
} oem_info;

#seekto 0x0480;
struct {
u16 lower;
u16 upper;     
} scan_groups[10];

#seekto 0x0500;
struct {
u8  call_code[6];
} call_groups[20];

#seekto 0x0580;
struct {
char    call_name[6];
} call_group_name[20];

#seekto 0x0800;
struct {
u8  ponmsg;
char    dispstr[15];
u8 x0810;
u8 x0811;
u8 x0812;
u8 x0813;
u8 x0814;
u8  voice;
u8  timeout;
u8  toalarm;
u8  channel_menu;
u8  power_save;
u8  autolock;
u8      keylock;
u8      beep;
u8      stopwatch;
u8      vox;
u8      scan_rev;
u8      backlight;
u8      roger_beep;
u8      mode_sw_pwd[6];
u8      reset_pwd[6];
u16     pri_ch;
u8      ani_sw;
u8      ptt_delay;
u8      ani[6];
u8      dtmf_st;
u8      bcl_a;
u8      bcl_b;
u8      ptt_id;
u8      prich_sw;
u8      rpt_set;
u8      rpt_spk;
u8      rpt_ptt;
u8      alert;
u8      pf1_func;
u8      pf3_func;
u8      workmode_a;
u8      workmode_b;
u8 x0845;
u8      dtmf_tx_time;
u8      dtmf_interval;
u8      main_ab;
u16     work_cha;
u16     work_chb;
u8 x084d;
u8 x084e;
u8 x084f;
u8 x0850;
u8 x0851;
u8 x0852;
u8 x0853;
u8 x0854;
u8      rpt_mode;
u8      language;
u8 x0857;
u8 x0858;
u8 x0859;
u8 x085a;
u8 x085b;
u8 x085c;
u8 x085d;
u8 x085e;
u8      single_display;
u8      ring;
u8      scg_a;
u8      scg_b;
u8 x0863;
u8      rpt_tone;
u8      rpt_hold;
u8      scan_det;
u8      sc_qt;
u8 x0868;
u8      smuteset;
u8      callcode;
} settings;

#seekto 0x0880;
struct {
  u32   rxfreq;
  u32   txoffset;
  u16   rxtone;
  u16   txtone;
  u8    unknown1:5,
    power:1,
    unknown2:2;
  u8        unknown3:1,
    shift_dir:2
    unknown4:2,
    mute_mode:2,
    iswide:1;
  u8        step;
  u8        squelch;
  } vfoa;

#seekto 0x08c0;
struct {
u32 rxfreq;
u32 txoffset;
u16 rxtone;
u16 txtone;
u8      unknown1:5,
    power:1,
    unknown2:2;
u8      unknown3:1,
    shift_dir:2,
    unknown4:2,
    mute_mode:2,
    iswide:1;
u8      step;
u8      squelch;
} vfob;

#seekto 0x0900;
struct {
    u32     rxfreq;
    u32     txfreq;
    u16     rxtone;
    u16     txtone;
    u8      unknown1:5,
    power:1,
    unknown2:2;
    u8      unknown3:2,
    scan_add:1,
    unknown4:2,
    mute_mode:2,
    iswide:1;
    u16 padding;
} memory[1000];

#seekto 0x4780;
struct {
    char    name[8];
} names[1000];

#seekto 0x6700;
u8 valid[1000];

This mornings beta ...
.
Although CHIRP shows Wouxun UV8D in the selection menu,
CHIRP will not allow the Download to take place.

John
http://www.miklor.com

Jim, that looks like a separate issue. Could you open a separate bug (assigned to Ron) for that?

Thanks!

This seems to be mostly working, however I noticed a few issues trying to add new memory channels that were otherwise empty from chirp. Most settings are stored correctly except high/low power (always reads as L on channels that are are actually H) and some weird mute mode gets programmed on the new channels which can be cleared on the radio's menu (but it takes a couple extra button clicks to let you change it, it's as if the firmware is confused by an invalid value in memory at first and doesn't enter the menu correctly). Has anyone else noticed this? My radio has V1.05 "Sain Sonic" firmware dated 20141013.

I'll do some more poking around with memory dumps when I have more time.

A few times I would get "string index out of range" errors trying to connect:
File "/usr/lib64/python2.7/site-packages/chirp/kguv8d.py", line 397, in _download
raise errors.RadioError("Failed to communicate with radio: %s" % e)
RadioError: Failed to communicate with radio: string index out of range

Also does anyone know if this model has a transmit disable setting? On the UV6D you could set the duplex column to "off" to block transmitting on a certain memory channel, useful for receive-only frequencies like weather channels.

Looks like the power setting is actually the high bit of "unknown2"

(first channel dump is high, second is low, both show up as low in chirp)

struct {
rxfreq: 0x00DF9260
txfreq: 0x00DF9260
rxtone: 0x0000
txtone: 0x0000
unknown1: 0x00 (...00000b)
power: 0x00 (.......0b)
unknown2: 0x02 (......10b)
unknown3: 0x00 (......00b)
scan_add: 0x01 (.......1b)
unknown4: 0x03 (......11b)
mute_mode: 0x00 (......00b)
iswide: 0x01 (.......1b)
padding: 0x0000
} memory (16 bytes at 0x09A0)

struct {
rxfreq: 0x00DF9260
txfreq: 0x00DF9260
rxtone: 0x0000
txtone: 0x0000
unknown1: 0x00 (...00000b)
power: 0x00 (.......0b)
unknown2: 0x00 (......00b)
unknown3: 0x00 (......00b)
scan_add: 0x01 (.......1b)
unknown4: 0x03 (......11b)
mute_mode: 0x00 (......00b)
iswide: 0x01 (.......1b)
padding: 0x0000
} memory (16 bytes at 0x09B0)

Stephen Cavilia wrote:

[...]This seems to be mostly working, however I noticed a few issues trying to add new memory channels that were otherwise empty from chirp. Most settings are stored correctly except high/low power (always reads as L on channels that are are actually H) and some weird mute mode gets programmed on the new channels which can be cleared on the radio's menu (but it takes a couple extra button clicks to let you change it, it's as if the firmware is confused by an invalid value in memory at first and doesn't enter the menu correctly). Has anyone else noticed this? My radio has V1.05 "Sain Sonic" firmware dated 20141013.[...]

Yes, I have noticed the odd mute mode issue as well. The "T" icon to the left of the bandwidth "N/W" icon lights up, which according to Page 06 of Wouxun manual is "QT Mute Mode". Not quite sure what that means, but I get no audio unless I turn it off by going to menu 31 (SP-MUTE) and set it to QT. Yes, I also see the same behavior you see at first when entering menu 31. The firmware doesn't display any value, but you can change the value with the arrow keys.

My radio is v1.03 dated 20140617. I bought the radio less than a month ago at my local Ham Radio Outlet store.

After writing to the radio with Chirp on my Mac and reading the radio back with the Wouxun supplied software on Windows, I see that every channel is set to "QT*DTMF" for mute mode. Changing that to "QT" on the Wouxun software and writing it all back to the radio fixed the mute problem. So I guess whatever Chirp is writing to the radio is making all these channels QT*DTMF mode.

Regarding the Narrow vs Wide band issue, I think Chirp sets the exact opposite of what I specify. My narrow channels get set as wide and vice versa.

Code corrected for Power setting (I made a mistake in interpreting the memory structure!) and have forced the mute mode to QT instead of allowing a random value (which seemed to always be QT*DTMF).

Ron Wellsted wrote:

Code corrected for Power setting (I made a mistake in interpreting the memory structure!) and have forced the mute mode to QT instead of allowing a random value (which seemed to always be QT*DTMF).

Thanks. I think the mute mode works ok now (daily-20141202)
But it seems that power is always set to H irrespective of whether I set L or H.