Yaesu-350-(A)R Firmware modification

[aquaregia]

Well, I looked around and couldn't find anything similar, so here goes. Attached is the firmware dump and some sort of executable that the Yaesu Update program uses. Poking around the file, at the end is the string:

"FTM-350 series USA 1.3 H8S/2268"

preceded by a bunch of padding, so that and the 256k file size makes it a pretty safe bet this is the actual firmware, and not encrypted image that is decrypted by the weird second file.

I've also attached a link to the H8S/2268 product line, but I've never reversed this family, nor do I have the tools to do so (I think.)

So there you have it.
On another note, anyone have a schematic or service manual (not alignment) for this rig?

Renesas MPU/MCU / H8S Family / H8S/2200 Series / H8S/2268

 

[aquaregia]

After a few hours of kicking the update thru various disassemblers and Hitachi H8 settings, I've come up with zip. Maybe someone on here will have more luck than I. I sent a message to the 0xdecafbad blog, he's been trying the same thing with the FT-897, but also has a VX-8R (which uses alot of the same chips as the 350.) He also apparently has way more reversing experience than I. Hopefully he can add some insight.

 

[aquaregia]

FIF-8

Somebody suggested the WRITE_PROGRAM "binary" looks similar to FIF-8 operation. I don't have one so I don't know. Given the fact that Yaesu allows us to update via USB, it would make sense that Yaesu has incorporated this capability into the radio itself. Hopefully, this applies to the VX-8(2/97) as well.

 

[aquaregia]

Oh well, this thread is dead.

Back to dumping the VX-8xx.

Laters.

 

[Moleculo]

If you figure out something to hack with the firmware, we're all ears! . But honestly, I just don't know where to begin with this. Maybe you or somebody can figure it out.

 

[aquaregia]

Actually, thanks for the reply, and for your (brave!) mods!

Right now I'm going thru the AU/EU/US firmwares, trying to see what's different.

It's slow, and I don't give it much time, but it's doable.

I wish 0xdecafbad would wake up.

 

[aquaregia]

Basically I'm trying to emulate a FIF, I think.