Kenwood Protalk Radios for GMRS or Ham Use?

[Lscott]

I'm working on hacking a Kenwood TK-3200 2-channel Protalk radio to work on GMRS or Ham.

https://www.buytwowayradios.com/kenwood-tk-3200-u2p.html

I had a buddy give me three of them for free with charger bases and battery packs. I have a custom hacked code plug, had to use a hex editor, I have to load into a radio for testing later. I need to test if the firmware will complain about the custom frequencies. If it doesn't work the radios are basically worthless for my use.

Has anybody else had any luck hacking the Protalk radios for GMRS or Ham use? For those not familiar with these the radios they are restricted to a fixed set of frequencies the user can select from a list. You can't enter a custom frequency through the programming software or using the self programming feature of the radio.

 

[KAF6045]

38 minutes ago, Lscott said:

I'm working on hacking a Kenwood TK-3200 2-channel Protalk radio to work on GMRS or Ham.

https://www.buytwowayradios.com/kenwood-tk-3200-u2p.html

I had a buddy give me three of them for free with charger bases and battery packs. I have a custom hacked code plug, had to use a hex editor, I have to load into a radio for testing later. I need to test if the firmware will complain about the custom frequencies. If it doesn't work the radios are basically worthless for my use.

Has anybody else had any luck hacking the Protalk radios for GMRS or Ham use? For those not familiar with these the radios they are restricted to a fixed set of frequencies the user can select from a list. You can't enter a custom frequency through the programming software or using the self programming feature of the radio.

 

Well, the TK3230 was approved for Part 90 and Part 95 (in 2007, so pre-reorganization). According to the FCC type acceptance, that radio is only spec'd for 460-470 MHz which would allow GMRS usage (actually, if one doesn't use high power on the 467MHz interstitial it now falls into FRS territory). Given the acceptance number, (ending in 3200), that may apply to most of the series.

Also, per the PDF manual for the TD3200, it is NFM only (GMRS is still the wider FM -- distinguished from real WFM used for FM broadcast stations). The pre-set channel list does not include GMRS frequencies. GMRS primary span 462.5500 to 462.7250, TK3200 jumps from 461.3625 to 462.7625.

While it may be possible to hack the frequency table for GMRS, that 460-470MHz spec most likely means that you will not be able to hack it down to 440MHz 70cm band.

 

[Lscott]

42 minutes ago, KAF6045 said:

Well, the TK3230 was approved for Part 90 and Part 95 (in 2007, so pre-reorganization). According to the FCC type acceptance, that radio is only spec'd for 460-470 MHz which would allow GMRS usage (actually, if one doesn't use high power on the 467MHz interstitial it now falls into FRS territory). Given the acceptance number, (ending in 3200), that may apply to most of the series.

Also, per the PDF manual for the TD3200, it is NFM only (GMRS is still the wider FM -- distinguished from real WFM used for FM broadcast stations). The pre-set channel list does not include GMRS frequencies. GMRS primary span 462.5500 to 462.7250, TK3200 jumps from 461.3625 to 462.7625.

While it may be possible to hack the frequency table for GMRS, that 460-470MHz spec most likely means that you will not be able to hack it down to 440MHz 70cm band.

 

I've had some success with Kenwood Part 90 radios getting them to work down into the Ham 70cm band. If it will function down to around 440MHz that would be OK since that's where most of the repeaters are located anyway.

I'm using the KPG-88D software for the TK-3200. The version I'm using allows wide and narrow band FM. I do the initial editing using the software then save the file. The custom hacking is done with a hex editor. In the attached file you'll see I have the local repeater frequency, RPT-16, and tone entered, and also the simplex frequency for channel 20. The software won't allow different TX and RX frequencies, even from the allowed list, nor split tones. That's what I had to do by hand along with the GMRS frequencies. The software always forces the same tone for ENC and DEC columns, and the same frequency for RX and TX. The attached photo shows what you see when the hacked code plug is loaded into the programming software.

[tweiss3]

I'm interested in this project. This seems the same process as getting on 902MHz for ham. I would bet GMRS wouldn't be a problem, firmware probably isn't smart enough to block that out completely. Getting down to 440MHz might prove difficult. I do wonder where the hard stop is at the bottom.

[Lscott]

2 hours ago, tweiss3 said:

Getting down to 440MHz might prove difficult. I do wonder where the hard stop is at the bottom.

That's true. I tested a TK-3160 16 channel radio with the 450-490 band split. The radio started beeping around 433MHz, couldn't phase lock. I tried the same thing with a NX-320 with the 450-520 band split and it failed between 442MHz to 443MHz. I'm guessing the wider the band split the harder it is to get the radio to operate outside of it's official specifications. For the used radios I'm buying I try to get only the 400-470MHz band split version. For some models those are nearly, if not, impossible to find.

[Lscott]

Well an update on the TK-3200 Protalk. Just got home from work and loaded the hacked code plug in the radio. It seems to work just fine on the local repeater in the area for GMRS so I count this as a success.

Now all I have to do is figure out how to use the full 8 channels, at least the selector switch on top has detentes for 8 with a channel stopper after two. Have to think about that a bit.

[tweiss3]

16 hours ago, Lscott said:

Well an update on the TK-3200 Protalk. Just got home from work and loaded the hacked code plug in the radio. It seems to work just fine on the local repeater in the area for GMRS so I count this as a success.

Now all I have to do is figure out how to use the full 8 channels, at least the selector switch on top has detentes for 8 with a channel stopper after two. Have to think about that a bit.

What does the radio do when you go to channel 3?

[Lscott]

2 hours ago, tweiss3 said:

What does the radio do when you go to channel 3?

With the stopper in place you can't turn it that far. Normally on the Kenwood radios I the radio will generate a warning tone and flash/change color or the LED on unprogrammed channels. When I tried it on this one, with a knob missing the stopper bit, nothing happens like the above. I guess I'll have to screw around with it a bit more.

I'm also looking at seeing what changes between the 2 channel Protalk version and the 2 channel LMR code plug versions of the radio. It would be far easier to do all of the editing using the LMR version for all the settings, then switch the ID in the code plug to the Protalk version. Otherwise the software will complain. So far I can get the software to think the LMR code plug is for the Protalk radio but I noticed the free memory count showed "-16", oops. I need to see which byte(s) might control that if any. It might not even matter so long as I can write to the radio.

[tweiss3]

Any further progress on this? I'm interested to hear if you do end up getting it to work as more than a 2 channel radio. 

[Lscott]

5 hours ago, tweiss3 said:

Any further progress on this? I'm interested to hear if you do end up getting it to work as more than a 2 channel radio. 

So far no. The programming software seems to set all of the “unused” channels frequencies to zeros if I switch between 8 to 2 channel models. It also sets those channel options to default values too. That’s VERY inconvenient. I had hoped it wouldn’t so I could do most of the channel setups through the software and just manually hex edit the code plug for the custom frequencies. 
 

I need to experiment and see if hex editing the code plug for just the frequencies and load it into the programming software if it leaves them alone for the extra memory channels so I can write it to the radio. If it does I’ll have to reverse engineer the code plug structure for a memory channel completely to figure out where the options are set, bandwidth, power, scan etc. and hex edit those for each one.

If that works maybe I can write a utility to read in the code plug and make the changes, then save it.

Right now the frequencies are stored as packed BCD in little endian format in 4 bytes. The tones are stored as a 16 bit unsigned integer in 2 bytes, also in little endian format. Why the difference? Beats me. I didn’t write the radio programming software. 
 

Some of Kenwood’s other radios the code plugs are encrypted using a simple XOR method. The key is stored in the code plug in a fixed location and might be different from one code plug to the next for the same exact model radio. I’ve seen the install key in the code plug along with radio serial numbers too for some models. I think this is done so Kenwood can trace where the code plug came from.