Reverse Engineering the GPS Data Format of Tytera MD-390

[Florian Wolters]

Dear guys,

the Brandmeister development team is looking for people with Tytera
MD-390 GPS who are willing to support the reverse engineering of the GPS
data format. Requirement is that you are running the S013.020 firmware.
This is a public test.

All you have to do is using ID 204999 as destination for GPS data. We
are dumping the data for analyzing purposes there. Additionally we would
need reports about DMR ID, APRS callsign, date/time in UTC, actual and
reported coordinates in decimal degrees with fractional part. So please
send the GPS data to 204999 and supply a picture of the radios GPS state.

If you are willing to support please configure your MD-390 as outlined
above and post your reports on the group.

Most interesting would be reports from westen heminsphere as well as the
southern hemisphere. So USA would be of interest as well as
Australia/New Zealand for example.

vy73 de Artem R3ABM, Rudy PD0ZRY and Florian DF2ET

[Will KD8DRX]

Hi Florian,

We're going to be hiking in the Marin Headlands, just north of San Francisco, tomorrow. I'll program my 390 with a few GPS test channels tonight and see if I can't send some data in.

Thanks for working to get the 390 talking,

Will, KD8DRX

[Florian Wolters]

Will,

tank you very much. We would need information about the real current position of the radio and the reported position on e.g. aprs.fi. The main thing to know is how big the deviation is between the two. So if you could please let us know the direction and distance from your current position and the the one on APRS that would be great.
And for comparison options a time stamp in UTC is needed.

mni tnx es vy 73 de Florian DF2ET

[eb4...@gmail.com]

Hi Florian,

I was in contact with Rudy about this. It seems that MD-390 sends gps info in 1/2 rate data (96bits).

My MD-390 is configured with 204995 GPS destination as Rudy asked me two months ago, do you want me to change it to 204999? Whay type of destination? Group or private ID?

Unfortunatelly, i don't have good repeater coverage at home. But i usually have when driving to work. However i have logged some data frames with DSD+ and DMRDecoder (they agree) in two locations. That could be also useful for the reverse engineering. I can post them if you like.

Regards,

Carlos EB4FBZ

[eb4...@gmail.com]

Hi all. 

Given no one got a clue about the GPS data format, i decided to inject simulated NMEA frames into my MD390 and dump the DMR frames with DSD for analysis. With help of a friend (EA4EOZ) we reversed the encoding. Will post soon!

Regards,

Carlos EB4FBZ

[Will Davidson]

Carlos:

Good to hear. Despite my attempts this weekend, I couldn’t even get my MD390 to successfully pass a location update to Brandmeister - I’ll need some time to sit down and dig through the settings to puzzle out what they should be.

Thanks

Will KD8DRX

-- 
You received this message because you are subscribed to a topic in the Google Groups "md380tools" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/md380tools/GDm-aOuPV2g/unsubscribe.
To unsubscribe from this group and all its topics, send an email to md380tools+...@googlegroups.com.
To post to this group, send email to md380...@googlegroups.com.
Visit this group at https://groups.google.com/group/md380tools.
To view this discussion on the web, visit https://groups.google.com/d/msgid/md380tools/1f79b3be-fd2f-4aa2-a0b6-7a58b0c67dfa%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[ea2bb....@gmail.com]

Hi¡ I´m Daniel EA2BB from Spain.

Where I can find the firmware S013.020 for MD390?

El domingo, 4 de septiembre de 2016, 22:52:35 (UTC+2), Florian DF2ET escribió:

[Kim Heinz Huebel]

You can get it here: https://archive.org/download/TYTMD380FW2/TYT-Vocoder-MD390-S13.20.bin

 

73 de Kim

DG9VH

-- 
Amateurfunk ist das, was uns verbindet! Bleiben wir in Kontakt!
Ortsverband Q05, Völklingen

--
You received this message because you are subscribed to the Google Groups "md380tools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to md380tools+...@googlegroups.com.

To post to this group, send email to md380...@googlegroups.com.
Visit this group at https://groups.google.com/group/md380tools.

To view this discussion on the web, visit https://groups.google.com/d/msgid/md380tools/051192f7-594d-462e-96cd-05e8e06e2356%40googlegroups.com.

[mhil...@gmail.com]

Hello, Carlos,

We would be very interested to compare notes here.  A friend and I were encouraged by your post, which indicated that the parsing was a tractable problem.  We were also able to decode much of the GPS format using an MD-390 w/ GPS.  Using D3D to get the raw buffer and the GPS coordinates visible on the radio itself, we were able to look for patterns in the output.

We used D3D which gives us 12 bytes for each data packet.  The md380-tool output gives us 14 bytes, but you can ignore the first two bytes for our purposes here.  My offsets below assume the D3D 12 byte packet.  The trick to parsing the GPS is realizing that the ints are not byte aligned and that they're not typical data lengths.

(0-based indexing convention)

Bit offset  Length  Field

--------------------------------------------
10          8       Latitude Degree
18          6       Latitude Minute
24          14      Latitude Minute Decimal
38          8       Longitude Degree
46          6       Longitude Minute
52          14      Longitude Minute Decimal

We haven't identified the bits indicating N/S and E/W, but that's not critical for our use.  There are plenty of additional bits before and after the lat/long which we have not parsed.

 - Michael, KG6LPY

[eb4...@gmail.com]

Hello Michael, these are my notes in 0 based indexing:

bit 0: Not used

bit 1 : 1=N, 0=S
bit 2 : 1=E, 0=W
bit 3 : Fix
bits(4:10): Speed in knots/2
bits(11:17): Latitude. Degrees
bits(18:23): Latitude. Minutes integer part
bits(24:37): Latitude. Minutes decimal part
bits(38:45): Longitude. Degrees
bits(46:51): Longitude. Minutes integer part
bits(52:65): Longitude. Minutes decimal part
bits(66:79): Altitude in meters, only least 8bits used (bug)
bits(80:95): Garbage?

This is working on BM network since 2 weeks ago, i'm pretty sure it's correct. I injected simulated NMEA frames into the radio instead of the real GPS ones and tested each value.

Best regards,

Carlos EB4FBZ

[mhil...@gmail.com]

That's fantastic, thanks!

[Dan Colquhoun]

Hi,

I've tried to get my MD 390G GPS data through Brandmeister and over to APRS without any luck.  What servers and TGIDs are known to work?  I have a feeling the server I connect to in Canada might not support this yet.

Thanks,

-- 

Dan

[Carlos Cabezas]

Hi Dan,

You should configure the MD390G to send GPS reports to private ID 5057. However due to some Tytera data frames implementation bugs, it only works on Hytera repeaters.

Regards,
Carlos EB4FBZ

[Mike, DL2MF]

Hi Dan, hi Carlos,

no, you should use xxx997 (replace xxx with your countrycode!) to use APRS on MD390/G, this is working fine and will use your national master.
The 5057 (that has special purpose in DMRplus setting your APRS icon to a walker) always routes your traffic to an inofficial gateway in the netherlands!

It's a better idea to use the features, the network is providing to you and not to copy only invalid codeplug entries.

The MD390/G is working very fine for DMR/APRS in BrandMeister and the data is submitted in telemetry channel. Configure your GPS interval to several settings (you can use up to 15 different), so you can use several time intervals).

73 Mike, DL2MF

[Carlos Cabezas]

Hi,

xxx997, xxx999 or 5057? Information is very confusing. According to the Brandmeister wiki, the APRS Gate isap 5057.
https://wiki.brandmeister.network/index.php/Server_Configuration

Regards,
Carlos EB4FBZ

[Kim Heinz Hübel]

It's depending on the local master server of your country.

In Germany it is 262999, in Sweden it's 5057.

Kim
DG9VH

--
You received this message because you are subscribed to the Google Groups "md380tools" group.
To unsubscribe from this group and stop receiving emails from it, send an email to md380tools+...@googlegroups.com.
To post to this group, send email to md380...@googlegroups.com.
Visit this group at https://groups.google.com/group/md380tools.

To view this discussion on the web, visit https://groups.google.com/d/msgid/md380tools/820fe48c-9ec1-8512-f931-e04e2dad833d%40gmail.com.

[Mike, DL2MF]

Hi,

posting from my mobile was no good idea, should read xxx999 sorry! As Kim explained, it's your national master depending.
Master admins using 50xx probably use this to enable DMRplus users to use their CP settings.

With MD380/390G you have a very comfortable setup with the 15 GPS settings to store -7, -9  from DMRplus and xxx999 with different time intervals for BM.

Mike, DL2MF

[Dan Colquhoun]

Hi,

Thanks for the info.  I had been trying 302999 on the Canadian server without success.

Should the contact be programmed as a Private or Group call?

-- 

Dan

--
You received this message because you are subscribed to the Google Groups "md380tools" group.

To unsubscribe from this group and stop receiving emails from it, send an email to md380tools+unsubscribe@googlegroups.com.

To post to this group, send email to md380...@googlegroups.com.
Visit this group at https://groups.google.com/group/md380tools.

To view this discussion on the web, visit https://groups.google.com/d/msgid/md380tools/0952f30c-15f8-4801-8dc5-33ec4c992af2%40googlegroups.com.

[Dan Colquhoun]

I found a BM server that provides the server logs (AUS http://44.136.151.11/).  Here's a sample from a GPS position report.  The logs are pretty consistent; loss rate is always 1/12, block expected is always 10.  There's nothing in the APRS.log.

I'm thinking the issue might lie with my OpenSpot and not the MD-390 given the log lines seen here?  Would others agree?

Dec  1 08:37:59 5051 brandmeister: New session 273f8d8b-0cd5-4cbe-86a8-31672dc6cba8 of Homebrew Repeater system 3023703 at slot 0

Dec  1 08:37:59 5051 brandmeister: Invalid block checksum

Dec  1 08:37:59 5051 brandmeister: Repeater reported RSSI -40.00 dBm (session 273f8d8b-0cd5-4cbe-86a8-31672dc6cba8)

Dec  1 08:37:59 5051 brandmeister: Repeater reported RSSI -40.00 dBm (session 273f8d8b-0cd5-4cbe-86a8-31672dc6cba8)

Dec  1 08:37:59 5051 brandmeister: Session 273f8d8b-0cd5-4cbe-86a8-31672dc6cba8 marked as Group Control Block from 3023703 to 505999, expect 10 block(s)

Dec  1 08:37:59 5051 brandmeister: Frame or block loss detected (session 273f8d8b-0cd5-4cbe-86a8-31672dc6cba8)

Dec  1 08:38:00 5051 brandmeister: Session 273f8d8b-0cd5-4cbe-86a8-31672dc6cba8 of Homebrew Repeater system 3023703 expired

Dec  1 08:38:00 5051 brandmeister: Session 273f8d8b-0cd5-4cbe-86a8-31672dc6cba8 removed

Dec  1 08:38:00 5051 brandmeister: Loss rate of session 273f8d8b-0cd5-4cbe-86a8-31672dc6cba8 is 8.33% (1/12)

-- 

Dan

[Mike, DL2MF]

openSPOT in the past didn't support GPS Reports:

https://forum.sharkrf.com/viewtopic.php?f=6&t=113&p=659&hilit=GPS#p659

Also the current firmware seems to have remaining issues:

https://forum.sharkrf.com/viewtopic.php?f=6&t=315&p=1711&hilit=aprs#p1711

[d.lo...@gmail.com]

Op zondag 4 september 2016 22:52:35 UTC+2 schreef Florian DF2ET:

Lieve jongens,

is het Brandmeister development team op zoek naar mensen met Tytera
MD-390 GPS die bereid zijn om de reverse engineering van de GPS-ondersteuning
dataformaat. Voorwaarde is dat u werkt met de S013.020 firmware.
Dit is een openbare proef.

Het enige wat je hoeft te doen is met behulp van ID 204999 als bestemming voor de GPS-gegevens. We
dumpen de gegevens ter evaluatie doeleinden zijn. Daarnaast zouden we
berichten over DMR ID, APRS callsign, datum / tijd in UTC, de werkelijke behoefte en
gerapporteerd coördinaten in decimale graden met fractionele deel. Dus gelieve
stuurt de GPS-gegevens naar 204.999 en leveren een beeld van de radio GPS staat.

Als u bereid bent om te ondersteunen kunt u configureren van uw MD-390 zoals beschreven
hierboven en post uw rapporten op de groep.

Meest interessant zou zijn verslagen van westen heminsphere evenals het
zuidelijk halfrond. Dus de VS zou interessant zijn als
Australië / Nieuw-Zeeland bijvoorbeeld.

   vy73 de Artem R3ABM, Rudy PD0ZRY en Florian DF2ET

[Kim Heinz Huebel]

Is it possible to get this in English, pls?

Kim
DG9VH

Am Mon, 27 Feb 2017 00:36:13 -0800 (PST)
schrieb d.lo...@gmail.com:

[tony....@gmail.com]

Hi Carlos - I am looking to decode GPS locally from my MD-390G as well. Did you use the open source DSD 1.7 to do the decoding and packet inspection? Did this require any modification to the DSD code base to dump the packet values?

Thanks!

[Carlos Cabezas Prudencio]

Hi Tony,

I used DMRDecode, by Ian Wraith. It worked right away.

Regards,

Carlos

El 8 may. 2017 23:36, <tony....@gmail.com> escribió:

Hi Carlos - I am looking to decode GPS locally from my MD-390G as well.  Did you use the open source DSD 1.7 to do the decoding and packet inspection?  Did this require any modification to the DSD code base to dump the packet values?

Thanks!

--
You received this message because you are subscribed to a topic in the Google Groups "md380tools" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/md380tools/GDm-aOuPV2g/unsubscribe.
To unsubscribe from this group and all its topics, send an email to md380tools+unsubscribe@googlegroups.com.
To post to this group, send an email to md380...@googlegroups.com.

Visit this group at https://groups.google.com/group/md380tools.

To view this discussion on the web, visit https://groups.google.com/d/msgid/md380tools/df8a5c7f-5c33-493c-bf61-1cbb335a79b8%40googlegroups.com.

[Gijs Hoskam]

Hi all,

have used a SDR with DSD setup to get GPS data on my MD390's and I can confirm that the bits as described below are indeed working.

Only major issue for now is discovering WHICH radio has sent the GPS-data, since that is not part of the standard output of the DSD-logfile.

Any thoughts on how to get this data? For now I use bits 80-95 as some sort of identifier, as these bits seem somewhat device-dependant, although I still see minor deviations over time per radio. They are too short for serial number, also when converting to hex or dec, no relation with device ID can be found (tried all permutations and checked against all numbers in CPS... yes, that takes a while... :) )

I am working on c-based software to decode received data to a google-earth-compatible XML (KML) file, so you can follow your radio(s) around. :)

Questions:

- any idea to get a truely unique device identifier?

- anyone with more ideas what these garbage bits may contain?

- Is there a way to get the received locations on 1 radio to the PC? (so when sending GPSdata to deviceX, these will come up on screen, can these be send as serial output via the USB?)

Will of course share code when the time is right, for now it is still a-lot-of-work in progress...

Thanks!

Gijs, PD8G

Op maandag 26 september 2016 08:18:22 UTC+2 schreef Carlos Cabezas Prudencio:

[franci...@gmail.com]

Hello

Just want to ask any news to settle the issue (TYT MD-380G/390 GPS data cannot display in the aprs.fi map. I am using MMDVM_HS hot spot and try to plot the gps data to the aprs.fi map. I tested, 5057, 450999,262999,5059,204999 but all are not work.

But APRS sms is ok at 5057.

Br

Francis

Florian DF2ET於 2016年9月5日星期一 UTC+8上午4時52分35秒寫道：

[eb4...@gmail.com]

Ask in your network (Brandmeister, DMR+...) support forum. This is about md380tools development and general md380 reverse engineering.

I think MD380 GPS decoding does not work in MMDVM due to a TYT frame bug. It only work via Hytera repeaters.

Regards,
Carlos EB4FBZ

[ognjen...@gmail.com]

Is there any way that AGWPE or Packet Radio Pro decodes MD 390G data?

[Ian Fritzsche]

Hi Gijs,  I know this is an old thread, wondering if you ever successfully completed this project of decoding MD-390 GPS data out to a useable KML file, or if there is another tool appropriate for this? 73's and Thanks.