CHIRP

I have an HX370S, brief notes are on:

• http://www.paul.sladen.org/toys/vertex/hx370sas.html

The HX270 has an 8kB EEPROM, and the HX370 has a 16kB EEPROM. The first 64 bytes are not used, and then the model number appears at offset 0x40 (model number 0x10e == 270, 0x172 == 370). The last two bytes at the end of the EEPROM also contain the model as some sort of sanity check.

The EEPROM size and layout vary between each series of Vertex/Standard Horizon radio, although they share a general theme in terms of layout. The actual EEPROM read/write (ACMD:002/#CMDSY/#CEPRD/#CEPWR) protocol /is/ the same across the Standard Horizon radios, but with newer radios running the serial port at higher-speeds. The protocol is described in:

• http://www.paul.sladen.org/toys/vertex/hx851e.html

It's a few months since I last had a stint on the HX370S, but from memory there are three banks of preset (127?) channels for the marine range, plus a single bank of 40 fully-programmable channels. The frequencies are fairly obvious and stored in kHz as BCD + 100MHz. I have an emulator for the Standard Horizon EEPROM protocol, which you can test against (without risking bricking the radios):

• http://www.paul.sladen.org/toys/vertex/hx851emu.py

If you are running under Wine, this is usable as a COM part with eg.:

ln -s ~/.wine/dosdevices/com3 /tmp/fake-hx851
./hx851emu.py

Since I haven't worked on it for a while, I'm happy to loan the HX370S to anyone else (ideally in the UK). As well as the EEPROM read/write mode, there is a radio-to-radio clone mode; although I didn't get around to reverse engineering this but I don't know if there's much immediate value given the direct EEPROM access.