So I had the fun task of programming a “TYT MD-UV390”
So I tried to make AES256 work inter-op with a XPR 7550e on DMR.
While in the pursuit of happiness, I came across a few errors.
First mistake: I neglected to check the current FW version.
So I did what the box and sticker says, it’s the MD-UV390! Right?
But wait… Flashing… And flashing. AFTER finding this flash tool that is, found from an old facebook post a Google Drive link, I tried Again and again, nothing. TYT Boot screen. It doesn’t change. It doesn’t get better from here…
A friend suggested something:(after 4 hours…)
to flash to MD-UV380 FW and see what happens…
It… Fucking… Works… Yes that’s correct, it works
No more TYT screen — it booted! Maybe it does get better from here.
Next I tried upgrading the firmware to the newest, since the old version could decrypt the Moto but not the other way around. Asymmetrical, weird. I’ve read that both keyslots have to match, which tracks — DMR frames actually transmit the keyslot number — and lining them up got us that one-way decryption working in practice (Moto → TYT).
We went from the default loaded FW D219.043 (found the original version from the CPS save file afterward) to FW D219.074 and now AES inter-ops fine with the Motorola.
So now this has me questioning, does the MD-UV390 truly even exist? WTF?
What is the difference? and why does the MD-UV380 AND MD-UV390 software work on this supposed “390 Plus”…
Well it turns out, Their basically the same radio but with a different name. Oh, China!
It comes down to this: The MD-UV380 (dualband is denoted as “UV”) and 390 share HW platforms: STM32 + HR C6000.
Apparently this is a common thing on the RR forums:
under the battery says MD-UV390, same with the FCC ID, and in the radio under the radio info says MD-UV380
To make things worse, TYT (Tytera) decided to make a dual and monoband 380. The monoband 380 uses a STM32F405 + HR C5000. While both MD-UV380 and 390 dualbanders seem to use the STM32 + HR C6000 combo.
China is making radio prices go up with what I have now coined “RadioFlation” because, the MD-UV390 is basically a +3db RF power + IP67 rated MD-UV380.
Their essentially the exact same hardware except for the PA, and water resistant case.
So, in my opinion, does the MD-UV390 exist? On paper, yes. In real life, it depends on who you ask.
Thank you to Travis Goodspeed’s (KK4VCZ) reverse-engineering work (“Reverse Engineering the Tytera MD380,” PoC‖GTFO #10) (https://hackaday.com/2016/01/19/shmoocon-2016-reverse-engineering-cheap-chinese-radio-firmware/)
TLDR; UV390 wouldn’t take 390 firmware, looked bricked, then booted fine on the UV380 FW, their basically the same radio, or TYT fucked up the FW names in the zip file I got.