Codeplug Hacking

Codeplug Hacking
Well, if you are brave enough to mess around in the codeplug using the EEPROM Access feature of the Maxtrac Lab RSS, there are some things you should know.
With version R07.02.00a Maxtrac RSS and newer, the codeplug errors you may get when reading the radio have been expanded from the usual Error #58 into a bunch of different codes. Depending on what the code is, determines the block of data in the codeplug which is corrupted. The blocks we have identified so far are as follows:

• Address 0x000 to 0x02D, checksum at 0x02E, Error #58
• Address 0x02F to 0x039, checksum at 0x03A, not checked
• Address 0x03B to 0x07E, checksum at 0x07F, Error #59
• Address 0x080 to 0x08B, checksum at 0x08C, Error #60
• Address 0x08D to 0x093, checksum at 0x094, not checked
• Address 0x095 to 0x09B, checksum at 0x09C, not checked
• Address 0x09D to 0x0A3, checksum at 0x0A4, not checked
• Address 0x0A5 to 0x0AB, checksum at 0x0AC, not checked
• Address 0x0AD to 0x0B3, checksum at 0x0B4, not checked
• Address 0x0B5 to 0x0BB, checksum at 0x0BC, not checked
• Address 0x0BD to 0x0C3, checksum at 0x0C4, not checked
• Address 0x0C5 to 0x0CB, checksum at 0x0CC, not checked
• Address 0x0CD to 0x0D3, checksum at 0x0D4, not checked
• Address 0x0D5 to 0x0DB, checksum at 0x0DC, not checked
• Address 0x0DD to 0x0E3, checksum at 0x0E4, not checked
• Address 0x0E5 to 0x0EB, checksum at 0x0EC, not checked
• Address 0x0ED to 0x0F3, checksum at 0x0F4, not checked
• Address 0x0F5 to 0x0FB, checksum at 0x0FC, not checked
• Address 0x0FD to 0x103, checksum at 0x104, not checked
• Address 0x105 to 0x10B, checksum at 0x10C, not checked
• Address 0x10D to 0x113, checksum at 0x114, not checked
• Address 0x115 to 0x11B, checksum at 0x11C, not checked
• Address 0x11D to 0x123, checksum at 0x124, not checked
• Address 0x125 to 0x12B, checksum at 0x12C, not checked
• Address 0x12D to 0x133, checksum at 0x134, not checked
• Address 0x135 to 0x13B, checksum at 0x13C, not checked
• Address 0x13D to 0x143, checksum at 0x144, not checked
• Address 0x145 to 0x14B, checksum at 0x14C, not checked
• Address 0x14D to 0x153, checksum at 0x154, not checked
• Address 0x155 to 0x15B, checksum at 0x15C, not checked
• Address 0x15D to 0x163, checksum at 0x164, not checked
• Address 0x165 to 0x16B, checksum at 0x16C, not checked
• Address 0x16D to 0x173, checksum at 0x174, not checked
• Address 0x175 to 0x17B, checksum at 0x17C, not checked
• Address 0x17D to 0x183, checksum at 0x184, not checked
• Address 0x185 to 0x18B, checksum at 0x18C, not checked
• Address 0x18D to 0x1B2, no checksum
• Address 0x1B3 to 0x1DD, checksum at 0x1DE, Error #61

If you use the bit banger (EEPROM Edit Utility) in the RSS, you will find that the base address used is 0xB600. This is the equivalent to offset 0x0000 above.
If you use the Fix Checksum option (F6) the software will correct the checksum for first block listed (0xB600 to 0xB62D/0x000 to 0x02D).
So, if you are hacking around in the codeplug (or changing the serial number), the locations of the checksums for each block will be important.
To calculate the checksum for a block of data, you will have to enter the data into Hex Workshop (version 2.54) manually. Once the block of data is enterred, highlight all the bytes except the checksum byte and hit F12 (Calculate Checksum). Make sure the Selection, Hex, and 1's Complement options are checked off, and click Generate. The value that is generated in the Checksum-8 field is what you want to use for the checksum for the block of data when you modify it in the RSS.