Looking at Motorola/Vertex hand helds...

[berkinet]

Our local CERT group is considering upgrading some of our (GMRS) radios and are looking at the Motorola/Vertex EVX-S24 and VX-264. Model numbers EVX-S24-G6-3 and VX-264-G7-5.

 

Both radios seem suitable for our needs and the VX264 looks a bit more attractive with 5 watts output and a slightly lower price point on the used market. However, the EVX-S24 is available in Yellow which is something to consider for our application.

 

Anyway, I was wondering if anyone here has direct experience with these radios, or some good information to help us decide if we should get a couple of radios for testing.

 

Any thoughts welcomed.

 

 

[gman1971]

I have a lot of Vertex gear, some 2nd hand, some new, but I really like it overall, and before they were fully absorbed by Motorola last year, they were basically Motorola quality without all the red tape associated with the Moto stuff. Software is free, just the FIF-12 cable was expensive for my EVX stuff... other than that they are pretty straightforward radios to use.

 

If you don't need to have a DMR radio, then the VX-5500 and VX-6000 mobiles have one of the hottest receivers I've seen.

 

With that said, one of the biggest let downs with the models you've posted is (as explained on another thread) that the bells and whistles factor on those radios is rather low. You get an alphanumeric LCD segment screen, so if you want to use them for DMR stuff like the DMR-Marc etc, you might find the screen a bit lacking lacking compared to, say, the XPR7550e series of portables.

 

G.

[berkinet]

[Vertex Standard was] basically Motorola quality without all the red tape associated with the Moto stuff. Software is free, just the FIF-12 cable was expensive for my EVX stuff... other than that they are pretty straightforward radios to use.

 

If you don't need to have a DMR radio, then the VX-5500 and VX-6000 mobiles have one of the hottest receivers I've seen.

 

With that said, one of the biggest let downs with the models you've posted is (as explained on another thread) that the bells and whistles factor on those radios is rather low. You get an alphanumeric LCD segment screen...

 

Thanks for the comments. We do not need DMR or bells and whistles, these radios are solely for use on GMRS so the key requirement, besides overall quality, is simplicity of use. Thus the need for a display - so users get visual confirmation they are on the right frequency/channel. The VX-**** radios are also interesting. But, for the moment t we are concentrating on hand-helds to augment our existing P1225s. BTW, the major problem with the P1225s is battery capacity and life -- the only available batteries are NiCad & NiMh. For some reason, nobody makes a lithium pack for the P1225

[gman1971]

Thanks for the comments. We do not need DMR or bells and whistles, these radios are solely for use on GMRS so the key requirement, besides overall quality, is simplicity of use. Thus the need for a display - so users get visual confirmation they are on the right frequency/channel. The VX-**** radios are also interesting. But, for the moment t we are concentrating on hand-helds to augment our existing P1225s. BTW, the major problem with the P1225s is battery capacity and life -- the only available batteries are NiCad & NiMh. For some reason, nobody makes a lithium pack for the P1225

 

Then those radios should fit the bill rather nicely. I still think, based on the specsheet at least, that the EVX-53x series might have the better receiver and are more futureproof. The EVX-534 might be a good trade off, if you don't need a DTMF keypad... but the 539 is a fine radio too, the G7 model for 450-512 is the one I would chose if you want to use it for GMRS only.

 

G.

[Radioguy7268]

The only potential GMRS trouble I've seen with the Motorola branded EVX-S24 and EVX-261 is getting them to work in Wideband. The Motorola units I've gotten in are strapped as Narrowband out of the Box, and I've yet to be successful in changing them over to Wideband. I've done that with ease on Vertex labeled units, but there's something that I haven't bothered to figure out when it comes to the MSI branded version.

 

I've heard people say that you NEED to use the FIF-12 cable in order to use the Wideband enablement mode (as well as using the Export version of software) - but I haven't bothered to try that out, as my basic Vertex cable worked for updating (backdating?) previous Vertex units to Wideband enablement.

 

They do seem to be great little units for the price.  Be aware that the EVX-S24 is only listed at 2 watts for Analog UHF (3 watts DMR).

 

*Edit - just noticed that you specifically said the VX-261.  Same issues may apply, but the analog VX-261 is a screaming steal in the Used market. I've been snatching them up in good condition at less than $40 per unit with accessories.

[gman1971]

I am pretty certain that Vertex radios can be made wideband by using the NON-USA programming software. I've done it to my EVX mobiles without any issues.

 

and YES, other cables will certainly not work. I did try, but didn't work, almost ruined the radio so I returned these and got the OEM FIF-12, never had an issue with that.

 

G.

[berkinet]

I found a YouTube video on configuring the VX-231. According to Vertex

From January 1st in 2013, if the USA version is used for the radio programming in the following frequency range, the CE programmer automatically/forcedly programs the radio with 12.5 kHz width. In addition, once the USA version is used for programming (even the programmer was used before that date), the radio is marked electrically in the radio memory that the radio is sold/used for the USA (NA) market, and this marking cannot be erased.

 

However, that same announcement also says there is a way to reset the radio:

The software tool is “Wide_Band_Recovery_Tool_1_00”. Located via VSOL > Resource Center > Technical Information > General Information.

 

So far I have been able to locate the international version of the programming software for the VX-264. But not the Wide_Band recovery software.  I have also read that even with the recovery software, it must be used with a genuine Vertex FIF-12 cable ($150).

 

I have already bought a VX-264 and BlueMax49ers cable on eBay, due to arrive Saturday. So, I will report back on what happens when I try to re-program the radio.

 

In the meantime, any tips/pointers most welcomed.

[berkinet]

...*Edit - just noticed that you specifically said the VX-261.  Same issues may apply, but the analog VX-261 is a screaming steal in the Used market. I've been snatching them up in good condition at less than $40 per unit with accessories.

 It was the VX-264, with display, I was most interested in.

[berkinet]

Updating my last post. I found my old Motorola support credentials and was able to download more current versions of the programming tool (5.01 international - I had v2.04), the VX-264 firmware (2.07 - I had v2.04) AND the Wide Band Programming Recovery Tool - Version 1.02 (though I have heard there is a v1.03).

 

Any thoughts on how to proceed? I am thinking I should try to program the radio as it arrives and if that fails, try updating the firmware, that might reset the US/Wide lock - if it is locked.

[Radioguy7268]

I'd say you're on the right path, but if they are brand new units, you are 99.999% guaranteed that they're going to be locked to Narrowband.  If they're just some used units that are Vertex branded with older firmware, the Wideband Recovery tool should be the ticket.

 

Motorola will tell you that you need to buy the FIF-12 tool for updating. No ifs, ands, or buts. I have updated older units using their Wideband Recovery tool and a simple USB cable. I have not had that same success on newer EVX radios that were MSI branded. I've read the same info about a mystery version 1.03 that isn't available through the MOL site, but I haven't bothered to call Motorola to see about getting it directly.

 

Good luck with it.

[gman1971]

No, is not just Motorola, I tried two different cables, and none of my EVX radios worked with those. I had communication errors and all kinds of headaches, on 2 different machines. After 2 hours of mucking with these, they went back to oriental chasm whence they came.

 

The FIF-12 cable can be found in Wiscom.com for ~100 bucks IIRC.

 

If you are going to buy/use quality radios, cheaping out on the cable is like buying a Ferrari and purchasing narrow steel rims and tires b/c these OEM tires are too expensive to replace...

 

G.

[berkinet]

...The FIF-12 cable can be found in Wiscom.com for ~100 bucks IIRC.

 

If you are going to buy/use quality radios, cheaping out on the cable is like buying a Ferrari and purchasing narrow steel rims and tires b/c these OEM tires are too expensive to replace...

 

Thanks... Bit the bullet and ordered:

FIF-12A - Motorola Vertex Standard USB PROGRAM CABLE PC I/F AAJ23X501 1 @ $105.03

CT-106 - Motorola Vertex Standard Programming Cable AAD68X501 1 @ $29.25

 

According to Wisscom the CT-106 is required to connect the FIF-12A to the VX-264.

 

BTW, v1.03 of the recovery tool is online at communications.support in this thread. However, attachments cannot be accessed until after some probationary period and some minimal number of posts, so I can't download it, yet.

[gman1971]

Sweet.... I think you'll be very happy with those radios, and if you ever decide to venture into DMR you'll find that those radios are absolutely AMAZING compared to the CCRs...

 

G.

[berkinet]

Update:  Thanks to @Radioguy7268 my first VX-264 is on the air in wide-band mode.

 

Some notes for those who may follow...

My Vertex Standard branded VX-264 with firmware 2.07 just arrived today and I used the Motorola CS150 v5.01 international version software to program it.

 

To switch the radio to accept wide-band channel settings I used the Wide_Band_Recovery_Tool software v1.03. (This is not available from Motorola but, thanks to Radioguy7268, I can share a copy with anyone who needs it.)  NOTE: with the VX-261/264 radios you must use v1.03,  v1.02 does not support them.

 

I did not use, though I have ordered one, the FIF-12 programming adapter. Instead, I used the <$20 CT-106p cable from BlueMax49ers. 

 

Extras: I do not own any windows machines so I used a Win-7 VM in VirtualBox for the wide-band recovery and programming. Also, as my MacBook only has USB-C ports, I used a USB-A to USB-C adapter.

 

So far I am very pleased with the radio and find it almost ideal suited for CERT type applications.

[gman1971]

Very cool. Thank you.

 

G.

[jlag]

I received 2 new US EVX-S24's a couple of weeks ago. Was able to run the wide band recovery with no issue using the USB cable. Great radios, fantastic TX/RX audio. The dual watch polling drop outs are very minimal compared to my Alinco, scan speed is great and superb tail suppression. A little lacking in power and buttons but I can't expect more from a package this size. I have been running some EX-560XLS's which I also like very much as well,

 

I am looking to receive some public safety in the 480+ range. I was able to do this with the EX-560's but the S24 seems locked down pretty tight. Looks like the plugs are encrypted. 

 

I am wondering if anyone has had any success at increasing the upper RX frequency limit on the EVX-S24.

[Lscott]

I am looking to receive some public safety in the 480+ range. I was able to do this with the EX-560's but the S24 seems locked down pretty tight. Looks like the plugs are encrypted. 

 

I don't know about Motorola but some of the Kenwood radios the code plug is encrypted too. I found out it's a simple XOR type encryption using a key byte stored in the code plug. For the several radio models where the code plugs are encrypted that key was always stored in the same place. Using a hex editor to load the code plugs and the data manipulation tools I was able to decrypt the code plugs easily. Maybe Motorola does some similar.

[wayoverthere]

Following as well. Unlike kenwood, vertex seems pretty solid about not letting you program out of the listed bands. I was trying for something in the 440's with a stated 450-512 setup (evx539's), and it just errored and didn't load anything

[jlag]

I don't know about Motorola but some of the Kenwood radios the code plug is encrypted too. I found out it's a simple XOR type encryption using a key byte stored in the code plug. For the several radio models where the code plugs are encrypted that key was always stored in the same place. Using a hex editor to load the code plugs and the data manipulation tools I was able to decrypt the code plugs easily. Maybe Motorola does some similar.

 

Could be, but it seems to key off of date/time/filename as well perhaps. If I save the same plug twice with different names the binary compare is a sea of red all through the file.

[Roadtrekker]

I have had a Vertex 5R for more than 20 years. Even though I have a new spare battery, I am still using the battery that came on the radio new.

 

When I first got the radio, I wide banded it be desoldering two joints. I can’t remember which ones, but I am sure it can be found on line. I got the info from a Japanese ham

[jlag]

On 4/28/2021 at 1:35 PM, wayoverthere said:

Following as well. Unlike kenwood, vertex seems pretty solid about not letting you program out of the listed bands. I was trying for something in the 440's with a stated 450-512 setup (evx539's), and it just errored and didn't load anything

Interesting information. What was your method of modifying the plug?

Did you attempt xor decryption of the plug? 

Were you using CE157 CPS?

[wayoverthere]

20 minutes ago, jlag said:

Interesting information. What was your method of modifying the plug?

Did you attempt xor decryption of the plug? 

Were you using CE157 CPS?

I'll have to check the version a little later, but I believe it's CE151 (I have the later display models). And no decryption, just straightforward load with the cps

[jlag]

23 minutes ago, wayoverthere said:

I'll have to check the version a little later, but I believe it's CE151 (I have the later display models). And no decryption, just straightforward load with the cps

I see, I take it the file was plain binary that you could read/edit with no type of encryption?

If the radio rejected that this may be a dead end without modifying the FW in the radio.

Also, did you drop the 512 down by 10MHz as well or did you go for 440-512? Or were you just trying to hack a single channel out of band?

[wayoverthere]

1 hour ago, jlag said:

I see, I take it the file was plain binary that you could read/edit with no type of encryption?

If the radio rejected that this may be a dead end without modifying the FW in the radio.

Also, did you drop the 512 down by 10MHz as well or did you go for 440-512? Or were you just trying to hack a single channel out of band?

Haven't honestly dug into whether there's encryption going on or not; I started from a blank codeplug for the g6 (400-470), added frequencies, and tried to load, and got a message similar to 'frequency out of range', and nothing loaded. After a few tries I read from the radio and discovered they were g7 (450-512) and filled with that accordingly, which it took first try.

Unless there's somewhere I'm missing it, there isn't a place to fill in the range;even starting with a blank template it's a choice of vhf, 400-470, or 450-512, and given how the picked it up when I read from the radio I suspect its built into the firmware. 

Truthfully, I kind of just accepted the limit, loaded them with gmrs and some public safety stuff, and moved on from messing with those 2...soon after  picked up others that cover the lower range I want (more vertex gear). 

[Lscott]

I don't know about Vertex or Motorola radios how the frequency range is verified, but with Kenwood I do. Maybe Vertex or Motorola radios are similar.

The radio programming software reads the code plug which has the radio's model number and sub type embedded in it. When the software tries to write the code plug to the radio it first queries the radio for model and sub-type. If the two don't match the software generates an error message. One version of the software with the license key I used for installation even offered to let me change the "market code" changing a radio from a European or Asian model to a US type! The service manual claimed if you used the wrong model type, and the associated market code, to program the radio "the first time" it can't be changed later. Apparently that's not true if you have the right software.

Some of the Kenwood radios use "XOR" encryption on the code plug contents I discovered, for example the popular TK-3170 and TK-3173 radios. After some lucky guesses and looking I found where in the code plug the encryption key is stored. It seems to be located in the same place even between totally different radio models. I suspect the software programmers used the same code plug file structure for the beginning section across model types. The key however can vary from code plug to code plug even for the same model type.

After decrypting the code plug the version of the radio software, radio model type and the installation license key, used to install the software which created the code plug, was found. The frequency was stored in little Endian integer BCD  format. For example 462.67500 MHz was stored as 00 75 26 46, two BCD digits packed into each byte.

Any passwords set in the radio, such as power up enable, radio read or radio over write are also stored in the code plug. Without the engineer's license key for example even if you loaded the code plug in to the programming software the radio over write password is blanked out with asterisks. If you know where to look in the decrypted code plug even that password is in the clear and can be recovered allowing a radio to be reprogrammed. The software will prompt the user for the password if one is used and will refuse to either read the radio or over write the current code plug depending on which passwords are set.

The channel names, group names, strings in general, are stored in normal ASCII format.

Other options and features are likely stored as bit fields or some other type packed data structure. Since none of this will ever be documented by the manufacture so a good deal of experimenting has to be done to reverse engineer the code plug further.