Talk to RadioShack/GRE Pro93 Scanners (RS Cat No 20-523).
Many, many thanks to tk92 by Bob Parnass for providing information on how to setup the serial port and initiate communications.
Dumps an image of the pro93's memory to a file.
Writes the contents of an image to the pro93.
Decodes an image and writes a summary to standard out. Also writes out CSVs of the channels and bank names. CSVs of options is a TODO.
Takes a base image, the channel csv, and the bank name csv and produced a new image.
Utility that takes the (or a list of) image-format frequency and prints the corropsonding frequncy and flags.
Takes a frequncy in MHz and produces the image-formatted value.
4800 baud, 8 bit data, even parity, 2 stop bits, xon/xoff off, RTS/CTS off, DSR/DTR on
A byte of 0xCD will trigger the scanner to dump an image and will be reflected back.
The image is preceded by a 54 byte preämble consisting of 50 bytes of 0xAD followed by 0x01991352.
The image is sent in reverse order (e.g. first byte received is the last byte of the image) and is 20256 bytes long.
- Memory Slot config (4 bytes * 300)
- Memory Slot labels (12 bytes * 300)
- TalkGroup Slot Config (((100*2 bytes) + 24) * 10)
- Search Group Lockouts (4 * ((50 * 4) + 2))
- TalkGroup Slot labels (12 bytes * 1000)
- CB Lockout (40 * 1 byte)
- Unsure? (64 bytes)
- Marine Lockout (60 * 1 byte)
- Unsure? (4 bytes)
- Limit Search text (12 bytes)
- Bank Text (10 * 12 bytes)
- Unsure? (12 bytes)
- Unsure? (38 bytes)
- Limit Search Limits (2 * 4 bytes)
- Priority channel (4 bytes)
- Unsure (46 bytes)
|0 1 2 3 |
|01234567012345670123456701234567|
|Encoded Frequency LDAMM|
L = Lock Out
D = Delay
A = Attenuated
MM = Mode
| Mode | MM Value |
|---|---|
| AM | 0b00 (0) |
| FM | 0b01 (1) |
| Motorola (need to confirm) | 0b10 (2) |
| EDACS | 0b11 (2) |
The Encoded Frequency is the first 3 bytes of a 4-byte little-endian encoded
integer. The encoded frequency can be multiplied by 250 to get the display
frequency. 090909 is an invalid step and used as a marker for when a
frequency isn't set.
12 bytes of ASCII text. 12 0xff bytes represents an unset text-tag.
2 bytes (Little Endian encoded unsigned short) for each of the 100 talkgroups in each bank, followed by 24 bytes per bank. (All-in-all 224 bytes per bank.)
In my dump, each bank is followed by
000000000000000000647c01c0c71800d007000000000000
I'm not sure what this is? Perhaps the fleetmap is in here somewhere?
The search channel lock out has ffXXYY...YY where XX is the number of
lockouts and each YYYYYYYY quartet is a frequency that is locked out. Note that
old locked-out frequencies may not actually removed from the list, the number
of lockouts may be decremented.
The ordering seems to be
- Police/Fire (SR2)
- Aircraft (SR3)
- HAM (SR4)
- Limit (SR5) (need to confirm)
12 bytes of ASCII text. 12 0xff bytes represents an unset text-tag.
Each CB channel is represented by 1 byte. 4th MSB is lockout, bottom 2 LSB are mode. I assume attenuation and delay are in their usual spots.
38 bytes (really 37.5 for 300 bits) of 1-bit flags (0=custom name) if the channel has a custom name. Channels are stored with the lowest in the lsb, e.g. if the first byte is 0x7E => 11101110 => channel 0 and 4 have custom text tags.
76543210
11101110
26 bytes, not sure?
Same encoding as the CB lockout. Note that Channels 2,3,4 aren't mapped (and aren't part of the search bank at all).
4 bytes, not sure?
12 bytes
10 sets of 12 bytes, defaults to spaces, not 0xff like for other tags. (I presume it's always "shown" but spaces make it invisible.
12 spaces? I'm not sure what this is the text tag for.
38 bytes, not sure?
4 bytes for each of the lower and then the upper limit.
4 bytes for the priority frequency
2 bytes of 1-bit fields, 1 = selected. Lowest channel in LSB. e.g: A203 => 10100010 00000011 which means channels 1, 5, 7, 8 and 9 are selected
76543210 XXXXXX98
10100010 00000011
44 bytes, not sure?
See pro93-dump-2019-06-13T05:09:06.494256.parsed for an example of the output of the pro93-dump-explore program.
This diff was obtained from two sequential dumps from the scanner with no changes in between via
diff <(xxd -c 12 pro93-dump-2019-06-12T23:09:17.548718.bin) <(xxd -c 12 pro93-dump-2019-06-12T23:24:28.168973.bin)
An subsequent dump was identical to pro93-dump-2019-06-12T23:24:28.168973.bin
diff <(xxd -c 12 pro93-dump-2019-06-12T23:24:28.168973.bin) <(xxd -c 12 pro93-dump-2019-06-12T23:29:47.925511.bin)
I'm not sure what these values represent.
1681c1681
< 00004ec0: 0005 0009 1407 90e0 0209 0092 ............
---
> 00004ec0: 0505 0009 1407 90e0 0209 0092 ............
1683c1683
< 00004ed8: 0708 f0d9 0809 c8df 0289 6309 ..........c.
---
> 00004ed8: 0708 f0d9 0809 a8e1 0289 4a09 ..........J.
I'm also not sure what all of the "Unsure" sections are for, but at this point I'm willing to move forward with writing something to generate an image and upload it.