Updating Simoco to P25 - Firmware Updates

1. Firmware Updates
2. SIMOCO Authorisation Code Updater
3. Install the CheatEngine Application
4. Upgrading Simoco Firmware to P25
5. Activating the P25 board
6. Glossary

1. The Simoco SRM9030plus Radio Transceiver
2. The Simoco SRM9030plus Teardown
3. The Simoco SRM9030plus Radio Head Unit
4. Alignment Tool
5. DMAP - Dual Mobile Application Processor Board
6. Installing the Simoco P25 CPS or the FPP
7. Installing Simoco FM CPS or FPP
8. Making-a-Programming-Cable
9. Programming an Analogue Radio
10. Loading Profile Data from csv files
11. Updating the Simoco SRM9030plus with P25 Functionallity
12. The P25 Digital Mode
13. P25 Repeaters Frequencies
14. Glossary

• Model 9030 Radio
• Programming Cable
• Simoco Applications:
• The version of the FPP. Version 5.36 or later
• The Aligment Tool
• The Feature Authorization (Simoco Code Loader.exe)
• Cheat Engine application

Firmware Updates

To operate in P25 mode the radio must be fitted with an IMBE MAB2 board. This is a small board about 10 cm by 30 cm mounted on the main board of the radio with a DB9 at one end. Look for the DB9 protuding from the rear of the radio or inspect the information tab in the programming software.



the Allignment Tool (align.exe0 and the Feature Authorisation ( Determine the radio's firmware status by displaying the Radio Information screen. This screen indicates that this radio has already been upgraded to IMBE P25 and has been activated. Furthermore, the radio has a PLA (programmable logic array) Config at V3.31. so this radio needs no further updates and is ready to use.

SIMOCO Authorisation Code Updater

Install the CheatEngine Application

Install the ChearEngine Application on a Windows platform and plug the programming cable into the radio and powerup the radio.

Cheat Engine:

Upgrading Simoco Firmware to P25

Make sure the IMBE MAB2 Mobile board is inserted and detected in the radio. Check the radio is set to Power-on Mode P25 using the FPP standard software. If the radio has a Trunk Profile delete the trunk from radio first and set it to Power On in P25 mode.



Now open the P25 Software – This process requires the IMBE MAB2 Mobile board to be detected.

The PLA firmware can be located in the program's installed folder, usually in the folder:
C:\Program Files (x86)\Simoco\SRM + SRP FPP\P25 FPP v5.36/Radio_SW or sililar for the v5.38 version.

1. The radio has to have the correct PLA (programmable logic array) code,
   PLA Config: 5/2/2007 V3.31, loaded to support the MAB2 board.
   Depending on the Hardware revision use the appropriate PA version:
2. • Hardware Rev9b use m_pla319.dat (MAB2 support)
   • Hardware Rev9e use e_pla331.dat (MAB2 support)
3. This can be uploaded using the ”Software Alignment Tool”.
   Do NOT update the radio to the latest MAB 4 firmware.
   You cannot downgrade the PLA (programmable logic array) Code.
4. Upload the P25 Software to the radio.
   In the options (Get File) select the 99as639 firnware file (from the 5.38 version).
   If that is not available try 99as635 firmware file (from the 5.36 version + patch).
5. Then select Download.
6. MAB P25 Application software to V2.30.39
   In Options (Get File) select P25MAB2SV023039
   Then select Download. (This may take some time to complete).
   
7. MAB P25 Sw Upgrade.
   In Options (Get File) select SWUMAB2V0300
   Then select Download.

Activating the P25 board

The objective is to locate, for the radio we are upgrading licence number, in the running process "Authorisation Code Loader" application's memory. Once located we appempting to change the radio "burnt-in" serial number to the serial number for which we have the activation code.

Unfortuantly, we have two things working against us:

• Firstly, the serial number appears in several places in the processes memory and only only one of which is relevant to activation, and we do not know which one, so it is a trial and error process changing each progressively.

• Secondly, When we do find the correct serial number we need to change to our desired serial number it only lasts a second or two before the memory precess is refreshed and the orginal serial number reappears. In that second or two, before the refresh, we have to be ready to execute the Authorisation Code Loader with the known activation key. Because of the nature of DRAM a constant refresh of memory is required. See https://en.wikipedia.org/wiki/Memory_refresh

1. Plug in the Simoco head and turn the radio on, then unplug the RJ45 head and plug in the programming cable.
2. Now open the SIMOCO Authorisation Code Loader application. The Code Loader application is started by selecting the Simoco->Feature Authorization Tool item on the start-up menu. Once again the P25 IMBE MAB2 Mobile board has to be detected.

3. When the Authorisation Code Loader application loads select Options -->Port and select the relevant comms port from the dropdown box.
   
   

4. Select OK then Enter and the radio's "burnt in" serial number should appear in the box. If you get the message "UNSUPPORTED MAP27 DEVICE" you have the wrong comms port.
   
   
   
   

5. Load the Activation Keys into the Authorisation Code Loader so we are ready to hit Activate before memory is refreshed. Note that the "known" serial number and it's matching keys have been obfuscated in the image.

   
   
   
   
   
6. Open Notepad and copy the radios real "burnt-in" serial number from the Athorisation Code Loader to Notepad.
   
   
   
   
7. Open CheatEngine and Select File -->Open Process. Then, in the Appications tab search for SIMOCO - Authotisation Code Loader and Select Open
   
   
   
   
8. Then select the Memory Viewer
   
   
   
   
9. Highlite the radios "burn-in" serial number and copy it into the clipboard memory.

10. Move to the CheatEngine's memory view window and use Ctrl-F or Search -->File Memory from the menu. paste the serial number from the clipboard and the memory view will change to show the first instance of serial number in the process's running memory.

    

11. The serial number in the Authorisation Code Loader shoud change to the serial number you just pasted. If it dose not then it is not the correct memory location and you must search for the next instant of the serial number by repeating the search.

12. If it is the correct location the Authorisation Loader will change to the pasted "known" serial number. You have about one second to hit the Activate button to complete the authorisation before memory is refreshed.

Glossary

• PLA - Programmable logic array is a programmable AND array and a programmable OR array make up a digital circuit
  known as a programmable logic array (PLA), which enables variable logic implementation.
  See: https://en.wikipedia.org/wiki/Programmable_logic_array.

• IMBE - Multi-Band Excitation is a series of proprietary speech coding standards developed by Digital Voice Systems, Inc. Improved Multi-Band Excitation. See: https://en.wikipedia.org/wiki/Multi-Band_Excitation

  IMBE

• MAB - Multi-purpose Application Board (MAB1 MAB2 MAB3 MAB4). The Multi-Purpose Application Board is designed to enhance the functionality of radios. It allows for various applications and modifications to make radio suitable for different operational needs. In this case P25.

• FPP - Field Personality Programming - Software Allows users to program radios for specific operational requirements