Motorola Mts2000 Trunking Key Generator

Posted on by
Motorola Mts2000 Trunking Key Generator Rating: 3,6/5 1330 votes

From The RadioReference Wiki

  1. Motorola Mts2000 Trunking Key Generator Manual
  2. Mts2000 Radio
  3. Motorola Mts2000 Trunking Key Generator Download
  4. Motorola Mts2000 Trunking Key Generator Free

Or alternatively, depending on how new the system is, it could be an Advanced System Key required, which is an actual hardware dongle that has to be connected to the computer, research ibuttons for more info, but essentially there is a single Master key, from Motorola, which daughter keys can be created, that customizes what the end user can. ASTRO XTS 3000 Digital Portable Radio Specification Sheet FEATURES. Multiple modes of operation in a single. Code Key Generator External hand held microprocessor controlled key variable loader. MOTOROLA, XTS 3000, FLASHport and the Stylized M Logo are registered in the U.S. Patent and Trademark. Motorola is a leader in Project 25 (P25 systems serving the needs of government and utilities that require mission critical communication. Two of Nebraska's key. Point leader-board. This leader-board shows the top 5 point holders as of this week (updated weekly). Apr 29, 2016 - Motorola System Key Generator (Skeygen.exe v0.3)Missing. Jul 17, 2004 - The codeplug will even retain the serial number of the advanced key that programmed it. The advanced key is a hardware based system using the Dallas / Maxim I-button technology. Sep 29, 2015  When it comes to system security Harris and EF Johnson/Kenwood run circles around Motorola. Just to run RPM-2 you have to have a license key and system key and can only do what the system key owner allows. ASK is nothing more then security through obscurity like ADP encryption is to voice security.

      • This info is combined from an existing Jedi page along with information from Batlabs.com. ***


  • 1General Info
    • 1.14Error Codes
  • 3Programming
    • 3.1MTS2000 Toolproofing
    • 3.5Cloning
      • 3.5.1Cloning Instructions 68P8073C80

General Info

  • B3: No keypad, no display, 48 channels (3 zones x 16 channels)
  • B4: No keypad, top display (1 line, 6 characters), 99 channels on continuous rotary knob (3 zones)
  • B5: Limited keypad, front display (1 line, 14 characters), 160 channels capable (10 zones x 16 channels)
  • B7 or C7: Full DTMF keypad, front display (1 line, 14 characters), 160 channels capable (10 zones x 16 channels)


MTX series

Available in VHF, UHF, 800 and 900mhz.

MTX-LS: 800mhz LTR and Conventional. 16-channels/talkgroups

MTX838: VHF, UHF, 800mhz. Type I/II

MTX2000 VHF and UHF. Type I/II

MTX8000 800mhz only Type I/II

MTX9000 900mhz only Type I/II

The MTX-LS series was only availble in a B3 style case (no display). The remaining MTX series radios were available in 4 models: 3 (no display/no keypad), 4 (top display/no keypad), 5 (front display/limited keypad) and 7 (front display/full keypad).

While the top display models were offered for the MTX8000/9000 series, these weren't very common.

While the Type II MTX radios do operate on SmartNET systems, they lack APCO-16 features such as emergency signalling.

B5 & B7 models are Type II Trunking. If you are (un)lucky enough you might find an F3 modem that does Type II.

If it is an MTX8000 or 9000 and has a front mounted display with either a 6 button or full keypad, you have a radio that will do Type II.

There were a few B3's that were Type II produced by Motorola. However, you can clone a Type II code plug into a B3 radio and it will work just fine.


MTS series

Available in Mid-Band(66-88mhz), VHF, UHF, 800 and 900mhz.

The North American MTS2000 radios were available in 3 models: Model 1 (top display/no keypad), Model 2 (front display/limited keypad) and Model 3 (front display/full keypad). These Models are commonly refered to as B4, B5 and B7, although they are technically not assigned those designations in the model number.

A 512k MTS2000 will say 'MTS2000 Flashport' on the label. The older non-flashport versions will just say MTS2000.

MTS2000 radios are also the first series of radios to offer feature upgrades via flashing. A Flash Code determines the feature set that the radio is capable of. These can be upgraded by an authorized service center or dealer via a SmartRIB and appropriate software.

You can run system watch using a MTS2000 handheld. Firmware version has to be above 5.44 (which has a 512k controller in it). Most MTS2000/MTX8000's only have a 256k controller, which will not work. You can put the radio into RF modem mode from the F4-F4-F4 (Trunking Config).

NOTE: When the radio is in the RF MODEM mode, it will do a self test and then the screen will go blank. The radio DOES NOT have to be programed to the system you want to watch. You set SYSTEMWATCH to the Spectra with RIB mode (works best). Even watches Type I systems.

mts2010.jpgMTS2010 - VHF (FuG-10b) 136-174mhz for the German BOS Radio System

mts2013.jpgMTS2013 - 4m (FuG 13b) 66-88 MHz for the German BOS Radio System

HT1000

Basic, very rugged and durable Public Safety radio. Comes in 2, 8, and 16 channel versions on the VHF, UHF and 800 bands.Basic, very rugged and durable Public Safety radio. Comes in 2, 8, and 16 channel versions on the VHF, UHF and 800 bands.

HT1100

Nothing known about this.Some model numbers though:H01KDC9AN1ANH01KDC9AN3AN

JT1000

Similar to the HT1000, but can have front-key pad programmable key installed so one does not have to have the RSS (Radio Service Software) or the RIB (Radio Interface Box) normally required to program Motorola radios. Some 'GOVT' models do not require a programming key. There is a codeplug mod that will allow the direct key programming without the special key.

This 'FPP' (Front Panel Programmable) radios allow an authorized user to change transmit and receive frequencies as well as squelch type (CSQ/PL/DPL). A unique feature on this radio is that the display shows the frequency it is operating on, changing when the user transmits (assuming the transmit frequency is different from the receive).

They are also unique in that their model display esteucheon is blue, as opposed to the standard white found on all other models.

GP900 [Radius]

Conventional 16-Channel in MB/VHF/UHF *MB=66-88mhzEuropean MTP Trunking Radio. Comes in MB/VHF/UHF Flavors. MB=66-88mhz

GP1200 [Radius]

European MTP Trunking Radio. Comes in VHF/UHF Flavors.MTS2010 - VHF (FuG-10b) 136-174mhz for the German BOS Radio System]]

PTX1200

MPT 1327 handheld in VHF and UHF. Works MPT 1343, RegioNET 43, Dutch PTT and ANN Dialing Plan

PTX3600

(European)More info to follow

MT2000

Comes in VHF/UHF/800mhz flavors, conventional only.VHF (FuG-10b) 136-174mhz for the German BOS Radio System

MT2100

European version of the MT2000

Accessories

If you have the accessory adapter for the side connector on the radio, the typical schematic of the speaker mic looks like this.

If you are using a Public Safety speaker mic with the radio, you might want to order part number 3205514W01 to cover the antenna connector on the radio.

Service Manuals

  • 6881200C15 -- HT1000/JT1000/MT2000 & MTX8000/9000 Radio Theory
  • 6881200C40 -- HT1000/JT1000 & MT2000 Service Manual
  • 6881200C25 -- MTX8000/9000 Service Manual
  • 6881076C65 -- MT2000 Operator's Manual
  • 6881072C10 -- MTX8000/9000 B3 Operator's Manual
  • 6881072C40 -- MTX8000/9000 B5/B7 Operator's Manual

Error Codes

Power-up Display Codes

14 Character Display6 Character DisplayType of FailureDescriptionPossible source
FAIL 01/81F01/81FATALExternal ROM/Flash checksum errorBad ROM data, Defective ROM
FAIL 01/82F01/82FATALExternal EEPROM checksum errorBad external codeplug data, Defective external EEPROM
ERROR 01/02E01/02NON-FATALExternal EEPROM checksum errorBad external codeplug data
FAIL 01/84F01/84FATALExternal EEPROM checksum blankUnprogrammed external codeplug data
FAIL 01/88F01/88FATALExternal RAM errorDefective RAM
FAIL 01/90F01/90FATALHardware failureDefective IC
FAIL 01/92F01/92FATALInternal EEPROM checksum errorBad internal codeplug data, Defective microcontroller
ERROR 01/12E01/12NON-FATALInternal EEPROM checksum errorBad internal codeplug data
FAIL 01/94F01/94FATALInternal EEPROM checksum blankUnprogrammed internal codeplug data
FAIL 01/98F01/98FATALInternal RAM errorDefective microcontroller


Operational Display Codes

14 Character Display6 Character DisplayDescriptionPossible source
FAIL 001F001Synthesizer out of lockBad frequency data in codeplug, defective synthesizer
FAIL 002F002Selected Mode (Zone/Channel) codeplug checksum errorBad codeplug data
FAIL 100F100Incompatible trunking s/w and h/wTrunking h/w decoder disabled in codeplug, Old SLIC IC version
FAIL 101F101Incompatible MDC1200 s/w and h/wMDC1200 h/w decoder disabled in codeplug, Old SLIC IC version

Model Numbers & Bandsplits

Online Decoder Tool [ http://scanmd.org/public/form/motorola.cfm ]


File:Mtsxmod.gif

Programming

The RKN4035D is the actual Motorola cable used for programming and servicing.






MTS2000 Toolproofing

Motorola Service Bulletin

Service Repair Note SRN 1173


Date March, 1995
Deadline Date n/a
Memo To SRN Mailing List
From Radio Network Solution Group/Product Services, Plantation
Subject MTS2000 Programming Sources - Unauthorized Tool Usage
Symptoms Radio Inoperative Error 01/93
Potential Problem Radios MTS2000 Models Only with firmware 5.42 or greater
Cause Implementation of Toolproofing in release 5.42 and greater
Motorola has been shipping FLASHport software upgrades on the MTS2000 radio since September of 1994. To date, 9,000 units have been upgraded in the field. To protect against illegal software copying and/or radio upgrades, Motorola is implementing 'TOOLPROOFING' into the MTS2000 radio at the Florida factory beginning 2/27/95.
The result is many existing upgrade tools (PCON Plus, Depot RSS, Lab RSS, etc.) will no longer work with the MTS2000 radio. If these tools are used with MTS2000 radios that ship after the 2/27/95 date, the radio will fail upon power up. Any questions that arise as a radio fails to power up should be directed to Florida Product Services for diagnosis and further instructions. The number is 1-800-523-4007. Once an issue is diagnosed with the TOOLPROOFING as the violation, the individual will be instructed to send the radio(s) into the nearest depot location, where the 'FLASHport depot tool' will be used.
Corrective Action
All Motorola owned Depots and International Regional Support Centers (RSC s) will be equipped with a FLASHport depot tool . This proprietary tool will ONLY be distributed to the National Subscriber Depot in Schaumburg, the Florida Regional Support Center, and 18 previously established International Regional Support Centers Worldwide who have signed license agreements not to copy or distribute the tool. This new tool will have the capability to reprogram as required to perform repairs.
This bulletin is for information only, no warranty is implied.


Explanation

Now, above is the official explanation of the toolproof situation and its rectification. What follows below is what we have been told is the way this silly protection scheme is implemented.

First, a little info on the structure of the MTSX series codeplug.

In its native format (the format that is actually dumped to the radio), the codeplug file is actually a standard Motorola S-record. It is unpacked from the archive file format and converted to an s-record which is stored in memory when the codeplug is read from disk. When the codeplug is written to disk, the s-record is packed and converted to the archive file that is stored.

The native codeplug is a list of blocks or records. The first block/record begins at address 0000h of EEPROM space. The format of each block/record follows the general s-record format:

S<TYPE><LENGTH><ADDRESS><DATA..><CHECKSUM>

S-Record Content

Motorola mts2000 trunking key generator manual

S-Records are character strings made of several fields which specify the record type, record length, memory address, data, and checksum. Each byte of binary data is encoded as a 2-character hexadecimal number: the first ASCII character representing the high-order 4 bits, and the second the low-order 4 bits of the byte.

The 5 fields which comprise an S-record are defined as follows:

FieldCharactersDescription
1Type2S-record type - S1 or S9.
2Record Length2The count of the character pairs in the record, excluding the type and record length (in bytes).
3Address4The 2-byte address at which the data field is to be loaded into memory.
4Data0-2nFrom 0 to n bytes of executable code, or memory loadable data. n is normally 20 hex (32 decimal) or less.
5Checksum2The least significant byte of the one's complement of the sum of the values represented by the pairs of characters making up the record length, address, and data fields (One's complement of the length, address and data fields modulo 256 minus 1).

Each record is terminated with a CR/LF/NULL. Accuracy of transmission is ensured by the record length (byte count) and checksum fields.

Some specific info relating to the radio's codeplug:

  • The block type (S1) refers to 'InternalCodeplugRootBlock'
  • The data is radio parameters defined by various tools like Lab, Factory test and tuning equipment, RSS and others. Also contains pointers to linked Blocks (ie. ExternalCodepluRootBlock).

Now, on to toolproofing..

  • It is available only on open architecture controllers (with flash memory).
  • It checks if the codeplug and the FLASH platform were created together (that they are syncronized).

Internal codeplug block 01 contains a 9 byte fingerprint record, which is calculated as the result of Encryption(FlashSignature, ModelNumber, SerialNumber, HardwareDefinitionVector, FlashCodeVector). The Encryption() function is similar to ordinary DES.

On power up, the radio always calculates the current fingerprint of the radio, and this value is compared to the 9 bytes stored in the codeplug.

So, if anything changed in internal codeplug (model, serial, Hvector, FlashCode, fingerprint itself) the radio will display the dreaded error message 'F01/93' and execute ROS_Idle (ROS means Radio Operating System).

The important thing at this state, the ROS is able to communicate with the external world using serial bus, so, if you have codeplug image from THIS radio, you will be able to put it back (by labtool for example) any time and resume normal operation.

NOTE: THERE IS NO TOOL CAPABLE OF CREATING A GOOD CODEPLUG, EXCEPT THE FACTORY ROBOT! There is some field software like LABTOOLS, but they can create WORKING codeplug, not GOOD one. The radio will be operational with such a codeplug, but someone will need to spend hours with test equipment tuning this radio to meet the specifications and adjust hundreds of settings to have all the specs in their type-approval window for the specified temperature and battery level range. Field Labtools do not support toolproof radios. Of course this fine tuning can be omitted if the radio used for HAM radio purposes.

Recovering from a Toolproof

To properly backup a MTSX radio before attempting to hack it with lab perform the following:

USE LAB SOFTWARE FOR BACKING UP THE RADIO! Conventional RSS will NOT back up a radio like was previously thought!

  • From the Main menu select F3>F4>F2 to read the radio with no unpack
  • From the Main menu select F3>F6 to Write S-Record
  • Type in a unique name ending in &guot;.bin' so as to not mistake it for anything else
  • Then press F6 to write the archive.

GUARD THIS IMAGE FILE WITH YOUR LIFE! It saves you $300 and a very tough explanation to Motorola if something goes wrong!

This doesn't unpack the codeplug, rather what you have stored on disk is a raw binary image of the radios codeplug, internal and external. That way, if something goes drastically wrong when you are hacking later, and you get the dreaded FAIL 01/93, you can use the procedure below to dump the raw image back to the radio to restore it.

You cannot edit this codeplug from memory. As far as the RSS is concerned you did not load a codeplug BUT the information is there. In order to edit a codeplug using RSS, the codeplug has to be unpacked and we bypassed that step so that the RSS won't hose things up.

Now, if you do screw up your radio and end up with FAIL 01/93, simply do the following to restore it:

Udf to generate surrogate keys. $$MAXCUSTSK which will be set with the value of MAX (SK) in Customer Dimension table. So, we will have the following ports in the EXP:. SELECT MAX (CUSTOMERKEY) AS CUSTOMERKEY FROM CUSTOMERDIMWe will have the CUSTOMERDIM as our source table and target can be a simple flat file, which will not be used anywhere. We pull this MAX (SK) from the SQ and then in an EXP we assign this value to the mapping variable using the SETVARIABLE function.

  • From the Main menu select F3>F6
  • Type in the filename given to your image from step 2 above
  • Then press F2 to read the archive without unpack. If you read with unpack you will still end up with FAIL 01/93
  • From the Main menu select F3>F4>F8>F8 to write the radios internal and external codeplug
  • When this is done, the radio will reset and come up just as it was when you made the image

This procedure has been performed several times successfully.

It is safe to say that trying to do anything with a toolproofed radio in Lab is useless. These methods should be able to protect one from screwing up their radio if they want to try to circumvent the toolproofing. I'm sure there are persons out there that may be able to.

Changing band limits in all MTSX RSS versions

Grab yourself a good hex editor like Hex Workshop.

Open the MTSX.ODB file.

Search for the ASCII text string of one of your band limits (ie 136). This should get you to a list like this:

Notice these are all the different bandsplits. Find yours and edit it to what you want.

Next you will have to find the actual frequency limits for the radio and change these as well. If you look further down in the file you should see a few lists like:

If you try and enter an invalid frequency in the RSS you will get a warning in the upper right box on the screen informing you of the legal band limits for your radio. This is where those limits are stored. Change them as required for your radio and you should be able to enter any frequency you want (no guarantees that it will actually transmit or receive there though).

Converting a B5 to B7 (C7)

Well, it looks like so far, the only way to convert a MTX B5 or B7 into a MTS C7 is to use Lab RSS. You need to read an archive for a MTS C7 and program it into the MTX.

Just remember to beware of the Toolproofing error..

If you are creating a codeplug from scratch with Lab/Depot RSS, you need to ensure the following options are set:

In the 'Config, Features, Buttons, Lab' menu (page 1), set the following:
ButtonFeature
PTTPTT
External PTTExternal PTT
External AudioExternal Audio
Normal ModeNormal Opt Select
3 Pos SwitchSwitch 2
2 Pos SwitchSwitch 0
Hub MonitorSwitch 1
Soft Power OffSoft Power Off
Left Arrow KeyLeft Arrow
Home KeyHome
Right Arrow KeyRight Arrow
JVAVehicle Adapter
Man DownMan Down
Digit 0Keypad Digit


In the 'Config, Features, Buttons, Lab' menu (page 2), set the following:
ButtonFeature
Digit 1Keypad Digit
Digit 2Keypad Digit
Digit 3Keypad Digit
Digit 4Keypad Digit
Digit 5Keypad Digit
Digit 6Keypad Digit
Digit 7Keypad Digit
Digit 8Keypad Digit
Digit 9Keypad Digit
Digit *Keypad Digit
Digit #Keypad Digit
In the 'Labtool, Labtool Config 2, Radio Wide', menu, set the following:
ButtonFeature
Keypad TypeMenu & Num Keys
Display Type1 Line 14 Chars
HHCH CapableDisable
Button Debounce (ms)50
Synth Out of LockDisabled
Zone/Chan SelectLast Zone

Remember, if you are creating a codeplug from scratch, you will need to do a fill service alignment after programming the radio.

Upgrading your MT2000 from 160 to 255 modes

This may be a little too scary for some of you to want to attempt but..

It appears that all A7 model MT2000's are capaple of doing 255 modes rather than the 160 they are shipped with. The problem is getting the radio to do it. I have found one way to do this.

NOTE:There are a couple of things you should be aware of before you undertake this project:

  • once you create your own model profile and program your radio, it becomes an individual radio
  • you will not be able to program any old saved files you have from this radio into it
  • you will not be able to clone this radio to any other 'normal' MT2000
  • there is no way of going back to a 'normal' MT2000 unless you can create a model profile identical to a 'normal' MT2000 and program the radio with it
  • for each zone you add after 10, you loose one channel (11 zones gives you 254 channels)
  • write down the tuning data from the radio before you reprogram it, the reprogramming effort changes tuning data all to default so your radio won't work as well until it is retuned.

An additional note, the Version 4.00 software will let you add modes beyond 160 in the Add Personality screen. I don't know if the software will let you program more than 160 modes into the zone lists though, under the Radio Wide Information the software still reports 160.

What you have to do is get your hands on a copy of the MT2000 LAB RSS. Get the newest version you can. This software will let you create your own model profile and then a blank codeplug. All you need to do is create a model profile (with any model number you want ie. MY_MT2000) and in the Maximum Channels field, enter 255. Set everything else the way you want or think it should be.

Create yourself a blank (default) codeplug and program it into the radio. Load your normal RSS and read the radio. Program it up the way you want and program the radio.

Cloning

The actual Motorola sheet is number 68P80360B79 for the RKN-4036B Cloning Cable.

Mts2000

Pinout is:

RIB Pin (Colour)Radio Pin (Function)
8 (Black)8 (Ground)
9 (Yellow)9 (LH Busy/KID/Data In)
13 (White)13 (LH Data/(Key/Fail)

For pin assignments on the radio, look here the accessory connector pinout.

For the circuit board inside the housing, there is a completed part for that which costs less than the individual parts. That is Motorola p/n 01-80359B36. It includes the latch pin, latch spring, latch, connector housing, and the circuit board.

Cloning Instructions 68P8073C80

Cloning duplicates the contents of radio 1 (source radio) into radio 2 (target radio). Tuning and alignment information is not affected by cloning.

Radios to be cloned must have the identical model number and be equipped with the same software options. Radio functionality inherent in one radio cannot be cloned to another radio that does not contain the same functionality.

Note: Only HT1000 and MT2000 model radios support radio-to-radio cloning.

An attempt to clone radios that are not of the same model number or software options will result in an unsuccessful error message, but will not damage the radio.

MDC and Star IDs (Identification Numbers) are duplicated in the cloning process. Unique IDs may be assigned with the radio service software.

Procedure
  1. Begin with both radios off.
  2. Connect the cloning cable (RKN4036A) to the side connector of both radios.
  3. Turn on radio 2 (target radio).
  4. Simultaneously depress the PTT and monitor button (side button nearest the PTT) on radio 1 (source radio) an turn it on.
  5. The green LED on both radios will light, and display equipped radios will display 'CLONING'. At this point, release the PTT and monitor buttons.
  6. The cloning process is complete when the green LEDs turn off. The radios will reset and return to normal operation. Cloning will take approximately one to three minutes.
  7. Disconnect the cloning cable, and the radios are ready for operation.
Error Conditions

On display radios, an unsuccessful cloning attempt may result in one of the following display messages:

  • 'ERR RESP' is displayed on radio 1 (source radio), if communication cannot be established between the radios. If this occurs, the cloning cable should be checked to verify that it is properly connected to both radios, as well as checkig the cable's integrity. Radio 2 (target radio) should also be checked to verify that it is turned on. Return to step 1 and repeat the procedure.
  • 'ERR MOD' is displayed on radio 1 if the model numbers or the software options are not the same. Cloning cannot be performed in this case.
  • 'ERR ABRT' is displayed on radio 1 if communication between the two radios is disrupted during the cloning process. If this occurs, check the cloning cable and all connections. Return to step 1 and repeat the procedure.

MTSX MVA

MTVA Vehicular Adapter Instruction Manual 6881075C95.

If you have the MTSX Convertacom (MTVA), you will notice that there are two DIP switches located on the bottom rear corner of the MTVA holder. These are used to select whether the microphone you are using has a manual PTT or serial data PTT.

For HMN1035 and HMN1056 microphones, set both dip switches toward the front of the holder. For HMN4044, HMN4047, NMN6209, and NMN6210 microphones, set both dip switches toward the back of the holder.

The pinout of the 6pin power connector on the NTN1340A is:

According to the manual the top row is 4 5 6 left to right with a square over pin 5. The bottom row is 3 2 1.

Pinouts as they are in the holder unit schematic diagram for the NTN1340A:

The 25 pin connector is listed as J100:

Connector J104 goes to the Battery Board it's a 10 pin connector, pins are:

NOTE: The NTN1340A is NOT a complete MVA if you only have the radio holder portion. You need the control box (with or without integrated power amplifier) that interfaces to the DB25, otherwise that's all you have is a radio holder.

Retrieved from 'https://wiki.radioreference.com/index.php?title=Motorola_Jedi_Series&oldid=193109'

From The RadioReference Wiki

This page contains links and downloads for utilities that can be used to decode the data streams of various trunked systems. Many, though not all, of these applications require audio from the Discriminator output of your scanner. Some of the older utilities (like Trunker) require you to convert the audio from your scanner into serial data by using one of the circuits (or pre made units) shown on the Data Slicers page. Newer applications such as UniTrunker, DSD and DSDPlus don't require the use of a data slicer. See the applications' page for more information.


Some of these utilities may also be directly addressed by Software Defined Radios, such as the RTL-SDR, or may be used via piping. For this unit, and possibly many others, see the Big List of RTL-SDR Supported Software.


If you have questions about these utilities, please post on the Voice Control Channel Decoding Software forum. SDR related questions should be posted in the Software Defined Radio forum.


MultiProtocol Decoders

These decoders support multiple trunked system types:

  • UniTrunker - auto-detects and decodes Project 25 9600 baud, Motorola 3600 baud, EDACS, EDACS ESK, and MPT-1327 systems
  • T4Win - development has ceased in favor of Unitrunker, above
  • TrunkMon for Motorola and EDACS systems
  • TrunkPCR- Motorola and EDACS trunking for the Icom PCR computer-driven receivers
    • See our TrunkPCR article for tips on where to find it and how to use this software. The IC-PCR100 requires a discriminator tap, the other supported radios don't.
  • OP25
    • Description: software defined radio implementation of a P25, DMR Yaesu Fusion and DSTAR receiver and transmitter based on GNURadio.
  • Digital Speech Decoder (software package) - Decodes many voice trunking systems, including a few currently not supported on todays scanners (see below)
  • DSDPlus - Software that decodes audio for NXDN4800 (Kenwood NEXEDGE and Icom IDAS), NXDN9600 (Kenwood NEXEDGE), DMR/MotoTRBO (TDMA inputs + both output slots), P25 Phase 1, X2-TDMA, and ProVoice. D-STAR & dPMR can be decoded but without audio.
  • SDRTrunk - multi-channel audio and control data decoder for USB software defined radio dongles and scanner audio output with decoder support for P25 Phase 1 C4FM/LSM Simulcast, P25 Phase 2, LTR, LTR-Net, Passport, MPT-1327, Fleetsync II, Lojack, MDC-1200 and Tait GPS protocols
    • Compatible with some SDR Dongles- see the website for more

TETRA decoders

  • osmo-tetra - is a in-development open source decoder using gnuradio and USRP1/2 for signal processing

Project 25 9600baud decoders

  • PRO96Com
    • Description: This utility is designed to log and map 9600bps APCO-25 trunked systems only using the following models of scanners:
      • GRE/Radio Shack: Pro-96, Pro-2096, Pro 106, Pro 197 (trunking stream monitoring only)
      • GRE: PSR-500, PSR-600 (trunking stream monitoring or as secondary radio)
      • Uniden: BC250D, BC296D, BC785D, BC796D, BCD996T, BCD396T (secondary radio only, controlled by PRO96Com)
      • AOR: AR5000 (secondary radio only, controlled by PRO96Com)
    • Plans for EDACS and 3600bps APCO-25 support are planned for a later release for GRE PSR-500/600 only (the Pro-96 cannot be supported due to the fact it does not output the necessary data). Of note, PRO96Com does not require a discriminator tap.
  • SDRTrunk
    • Description: decodes C4FM and CQPSK LSM Simulcast control and traffic channels and provides decoded audio support via the JMBE library
    • Compatible with some SDR Dongles- see the website for more

Motorola Decoders

  • Trunker - The original DOS based Motorola Control Channel decoder. Provides scanner control and basic talkgroup/id tracking.
    • The Yahoo support group for Trunker and its variations can be found here
  • TrunkerDM - Dead Link
  • MTrunker ported to Win32
    • A forum for this software can be found here
    • You will need .RAR decompression software, such as WinRAR to decompress this file
  • Treport - mainly displays diagnostic information for a Motorola trunking datastream
  • Trunk88 - A Trunked Radio Decoder for Motorola Systems. Very similar in operation to trunker, will control most Uniden radios, will accept data slicer or SB16 compatible sound input. Program download is here. Support can be found on the TRUNK88 Yahoo group.
    • Compatible with some SDR Dongles such as the RTL-SDR

EDACS Decoders

Description: Displays EDACS Diag Information for EDACS systems.

Description: A version of the Etrunker EDACS decoder that supports EDACS System Key (ESK) systems.

Description: The E-Trunker Utility. Decodes and Displays information from the EDACS Trunked Radio Datastream. This version is dated 07/27/2001 (See yahoo group info for Trunker shown above.)

Description:Utility for managing EDACS talkgroups in the Etrunker program. Note this is a DOS application, but is compiled to only run under Windows.


Adobe photoshop cc 2015 keygen.

MPT-1327 Decoders

  • Tronkito - Original MPT1327 open source linux decoder for Icom receivers.
  • SDRTrunk - provides full traffic channel following when used with one or more USB dongle receivers. Decodes control channel from normal scanner audio or from USB dongle.
    • Compatible with some SDR Dongles- see the website for more
  • Trunksniffer
    • The Yahoo mailing list for this software can be found here
  • TrunkView - Does NOT require a discriminator tap.
    • The Yahoo mailing list for this software can be found here

LTR Decoders

Description: Eric Cottrell has graciously compiled LTR, Passport and MultiNet Tracking support into a trunker like interface. This is the latest beta release RC4. Some modifications to the discriminator input are necessary to add additional filtering for using this utility. The schematic for these changes is shown here

  • LTR Analyzer
    • Compatible with some SDR Dongles- see the website for more
  • LTRLogger - Windows commandline application to output LTR data in an easily human-readable format
  • SDRTrunk - LTR Standard, LTR-Net, Passport
    • Compatible with some SDR Dongles- see the website for more

Winradio Trunking Decoders

  • Winradio Trunking Option For Analog Motorola and MPT1327 systems
  • Winradio APCO-25 Option For G305 Series receivers

Development and Source Code

Description: Holds some C++ source code of a crude port of crucial portions the Motorola Trunker program. This program served as a proof of concept for using a sound card instead of a serial port for input. Persons so inclined may wish to compile this into an executable using Visual Studio 6 or Visual Studio .NET. This example runs in console mode and displays talk group information as it is decoded from the microphone input of the soundcard.

Description: Source code for the Trunker / Etrunker decoding applications. This is the full C++ code for both applications

Miscellaneous Utilities

Motorola Mts2000 Trunking Key Generator Manual

  • Marshall Sherard, KE4ZNR, has an online talkgroup converter that can be used to convert between the various formats of talkgroups (EDACS hex, AFS, Uniden, Decimal and Motorola)

Mts2000 Radio

Description: DOS Type I utility to convert hex or decimal values to all Sizecode variations. And now supports converting a hex or decimal number to Uniden AFS.

Motorola Mts2000 Trunking Key Generator Download

Description: Conversion utility for DUMP.TRE to TREPORT.OSW [Initiate load with 'O'] 'OUT2OSW /6 treport.osw'

Description: This spreadsheet for MS Excel allows you to figure various options for frequency defined systems (VHF/UHF). You can calculate a base frequency for each allowable offset, print out a full range with a given base and offset, convert a channel hex id to an 800 or 900 frequency, and define a configuration for programming a Motorola radio or system.

Motorola Mts2000 Trunking Key Generator Free

Retrieved from 'https://wiki.radioreference.com/index.php?title=Trunked_Radio_Decoders&oldid=264152'