Skip to content

Commit 6f9eff4

Browse files
JKI757silseva
JKI757
authored and
silseva
committed
add CS7000 and C62 pages
1 parent 96a0223 commit 6f9eff4

File tree

6 files changed

+317
-0
lines changed

6 files changed

+317
-0
lines changed

‎_media/c62_bk4819.jpeg‎

583 KB
Loading

‎_media/c62_csk6011b.jpeg‎

500 KB
Loading

‎_media/c62_mainboard.jpeg‎

2.48 MB
Loading

‎hardware/c62.md‎

Lines changed: 133 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
# Retevis C62
2+
3+
## Development Status
4+
5+
**⚠️ Important Note: The Retevis C62 is not yet ready to run M17 protocol. While the hardware is capable of supporting M17, firmware development is currently in progress.**
6+
7+
The C62 was identified as a candidate for M17 development after discovering an undocumented DMR-like digital mode in its factory firmware, which prompted investigation into its suitability for open-source protocol implementation.
8+
9+
## Device Models
10+
- Retevis C62 5W Long Range UV Dual Band Business Radio
11+
12+
## Specifications
13+
14+
### General Specifications
15+
* **Power Output**: 5W
16+
* **Frequency Bands**: Dual Band (UV - specific ranges TBD)
17+
* **Display**: TBD
18+
* **Battery**: TBD
19+
* **AI Noise Reduction**: Built-in AI noise reduction technology
20+
21+
## Hardware Configuration
22+
23+
### Key Components
24+
* **Main MCU**: ListenAI CSK6011B
25+
* **RF Front-end**: BK4819 (same chip used in UV-K5 radios)
26+
* **FM Receiver**: BK1080
27+
28+
### Hardware Images
29+
30+
#### Main Processor (CSK6011B)
31+
![CSK6011B Main Processor](../_media/c62_csk6011b.jpeg)
32+
33+
#### RF Front-end (BK4819)
34+
![BK4819 RF Chip](../_media/c62_bk4819.jpeg)
35+
36+
#### Main Board Overview
37+
![C62 Main Board](../_media/c62_mainboard.jpeg)
38+
39+
## Development Environment
40+
41+
### Docker Setup
42+
The C62 development environment uses Docker for cross-platform compatibility:
43+
44+
```bash
45+
docker run --platform linux/amd64 --privileged -v /dev:/dev -v /run/udev:/run/udev -it listenai/csk6:latest
46+
```
47+
48+
**Note**: The `--platform linux/amd64` flag is required only when developing on M-series Mac computers.
49+
50+
### Required Hardware
51+
* **Programming Cable**: TalkPod A36 (recommended)
52+
* **Debug Access**: Debug pads located on opposite side of CSK6011B chip
53+
54+
## Firmware Development
55+
56+
### Firmware Extraction
57+
To extract the original firmware for analysis:
58+
59+
```bash
60+
cskburn --read "0x0000000:4096000:app.bin" -C 6 -b 115200 -v -s {device}
61+
```
62+
63+
**Parameters:**
64+
- `0x0000000:4096000:app.bin`: Read 4MB starting from address 0x0
65+
- `-C 6`: Communication parameter 6
66+
- `-b 115200`: Baud rate 115200
67+
- `-v`: Verbose output
68+
- `-s {device}`: Specify device path
69+
70+
### Development Tools
71+
* **Reverse Engineering**: Ghidra with armv8-LE processor definitions
72+
* **Firmware Tool**: Modified cskburn from OE3ANC
73+
74+
## Hardware Disassembly
75+
76+
### Disassembly Process
77+
1. Remove 4 corner screws from the radio case
78+
2. Carefully disconnect the volume knob
79+
3. Disconnect the antenna connection
80+
4. Remove the screen carefully (secured by 2 clips)
81+
5. Separate internal components to access main board
82+
6. Locate debug pads on the opposite side of the CSK6011B chip
83+
84+
**⚠️ Caution**: Handle internal components with care, especially the screen and cable connections.
85+
86+
## Build Instructions
87+
88+
### Development Environment Setup
89+
1. Install Docker on your development machine
90+
2. Pull the ListenAI CSK6 development image:
91+
```bash
92+
docker pull listenai/csk6:latest
93+
```
94+
3. Run the development container with appropriate permissions
95+
4. Set up the modified cskburn tool for firmware operations
96+
97+
### Firmware Development Status
98+
* **Current Status**: Firmware development in progress
99+
* **Memory Mapping**: Incomplete - community contributions welcome
100+
* **Decompilation**: Partial success with Ghidra armv8-LE definitions
101+
* **Target Protocol**: M17 implementation planned
102+
103+
## Technical Notes
104+
105+
### Unique Characteristics
106+
* Undocumented digital mode discovered in factory firmware
107+
* Shares BK4819 RF chip with popular UV-K5 platform
108+
* ListenAI CSK6011B processor offers development potential
109+
* Hardware architecture suitable for M17 protocol implementation
110+
111+
### Development Challenges
112+
* Incomplete memory map requires further reverse engineering
113+
* Decompilation accuracy needs improvement
114+
* Community contributions needed for complete chip understanding
115+
116+
### Hardware Compatibility
117+
* BK4819 RF chip provides proven radio frequency performance
118+
* CSK6011B processor architecture supports complex protocol development
119+
* Hardware debugging access available through exposed pads
120+
121+
## Community Development
122+
123+
The C62 development effort welcomes community contributions, particularly in:
124+
* Complete memory map development
125+
* Improved decompilation accuracy
126+
* M17 protocol firmware implementation
127+
* Hardware debugging and analysis
128+
129+
---
130+
131+
*Hardware analysis and development information from:*
132+
- *GitHub Repository: https://github.com/JKI757/C62_Teardown*
133+
- *Official Product Information: https://www.retevis.com/retevis-c62-5-w-long-range-uv-dual-band-ai-noise-reducation-business-radio-us*

‎hardware/cs7000.md‎

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
# CS7000-M17
2+
3+
## Device Models
4+
- Connect Systems CS7000-M17
5+
- Connect Systems CS7000-M17 Plus
6+
7+
The CS7000-M17 series represents the first amateur digital radios specifically designed for M17 protocol support while maintaining compatibility with traditional DMR and analog modes.
8+
9+
## Model Variants
10+
11+
### CS7000-M17 (Standard)
12+
- Basic M17/DMR/Analog radio
13+
- Optional GPS module
14+
- Standard processing capabilities
15+
16+
### CS7000-M17 Plus
17+
- Built-in GPS
18+
- Built-in Bluetooth
19+
- Man Down Sensor
20+
- Vibrator
21+
- Enhanced processing (3x faster processor)
22+
- Expanded memory configuration
23+
- Advanced protocol development capabilities
24+
25+
## Specifications
26+
27+
### Common Specifications (Both Models)
28+
* **Display**: 1.8" color TFT, 160x128 resolution
29+
* **Frequency Range**: 400-512 MHz (UHF)
30+
* **Receiver Type**: Dual Conversion Superhetrodyne
31+
* **Front-end**: Varactor tuning
32+
* **Battery**: 2400 mAh with belt clip
33+
* **Waterproof Rating**: IP67
34+
* **Programming Port**: Compatible with Motorola
35+
* **Accessories Included**: Programming cable, power supply, and charger
36+
37+
### Memory Configuration
38+
39+
| Component | CS7000-M17 | CS7000-M17 Plus |
40+
|-----------|-------------|------------------|
41+
| Flash Memory | 128MB | 256MB |
42+
| Code Memory | 1MB | 2MB |
43+
| RAM | 384KB | 1MB |
44+
45+
## Hardware Configuration
46+
47+
### MCU and Baseband
48+
* **MCU**: STM32F405VG (CS7000-M17), STM32H743VI (CS7000-M17 Plus)
49+
* **DMR Baseband**: HR-C6000
50+
* **RF Chip**: SKY72310
51+
* **Display Controller**: HX8302A
52+
* **Non-volatile Memory**: 25Q128FV SPI flash
53+
* **GPS**: MC-1010-2RE (Plus model built-in, standard model optional)
54+
55+
### Additional Hardware (Plus Model Only)
56+
* Built-in Bluetooth module
57+
* Man Down Sensor
58+
* Vibrator motor
59+
* Enhanced processing unit (3x faster than standard DMR radios)
60+
61+
## Firmware Features
62+
63+
### Multi-Protocol Support
64+
The CS7000-M17 series supports multiple digital protocols:
65+
- **M17 Protocol**: Native support for the open-source M17 digital mode
66+
- **DMR**: Full DMR digital mode compatibility
67+
- **Analog**: Traditional FM analog operation
68+
69+
### DMR Mode Features
70+
* Digital encryption
71+
* Voice auto record
72+
* Channel voice announcement
73+
* CTCSS/DCS encode and decode
74+
* DTMF/MDC1200/2 Tone/5 Tone encode and decode
75+
* Dual priority scan
76+
* VOX (Voice Operated eXchange)
77+
* Kill/Revive functionality
78+
* DMR slot, color code, and contact support
79+
80+
## Development Features
81+
82+
### Enhanced Development Capabilities (Plus Model)
83+
- Increased program memory for complex protocol stacks
84+
- Expanded Flash and RAM
85+
86+
## Build Instructions
87+
The CS7000 plus adopts a relatively complex procedure for storage of firmware. First, it stores two different applications, and must be rebooted between use of DMR and M17.
88+
89+
If you need to flash the radio, the instructions are here:
90+
[CS7000 M17 Plus Software](https://www.connectsystems.com/amateur-software/CS7000_m17_plus_software.html)
91+
92+
Flashing the radio in the factory manner requires windows and the use of the factory flash tool.
93+
94+
If you all you want on the radio is openRTX for FM/M17 use, there is an alternate procedure that involves rebuilding/linking OpenRTX. That procedure can be done on Linux/Mac.
95+
96+
Again, be aware, you will *NOT* have DMR capability if you flash the radio this way.
97+
98+
Procedure follows:
99+
100+
Make the following modifications:
101+
102+
[meson.build](https://github.com/OpenRTX/OpenRTX/blob/master/meson.build) (currently on line 892)
103+
The code section looks like this:
104+
105+
```
106+
{
107+
'name' : 'cs7000p',
108+
'opts' : cs7000p_opts,
109+
'flashable': true,
110+
'wrap' : ' ',
111+
'load_addr': '0x08100000'
112+
},
113+
```
114+
115+
You need to replace the `load_addr` with `0x08000000`
116+
117+
And the second file:
118+
[linker_script_cs7000p.ld](https://github.com/OpenRTX/OpenRTX/blob/master/platform/mcu/STM32H7xx/linker_script_cs7000p.ld) (currently line 52)
119+
120+
The code section looks like this:
121+
122+
```
123+
MEMORY
124+
{
125+
flash(rx) : ORIGIN = 0x08100000, LENGTH = 1M
126+
127+
/* NOTE: for now wer support only the AXI SRAM */
128+
ram(wx) : ORIGIN = 0x24000200, LENGTH = 512K-0x200
129+
}
130+
```
131+
132+
Again, you need to replace the "origin" variable with `0x08000000`
133+
134+
When this is complete, build the firmware using the commands from the developer's guide:
135+
136+
```bash
137+
meson setup --cross-file cross_cm7.txt build_arm
138+
```
139+
140+
Then put the radio into dfu mode (press TK1 and hold while turning the radio on -- you should see a grey screen)
141+
142+
Then run:
143+
```bash
144+
meson compile -C build_arm openrtx_cs7000p_flash
145+
```
146+
This will take a while without a lot of output, and there won't be any indication on the radio. Just wait.
147+
148+
Eventually you'll get some output and then it should finish up with this:
149+
150+
```
151+
DfuSe interface name: "Internal Flash "
152+
Downloading element to address = 0x08000000, size = 200496
153+
Erase [=========================] 100% 200496 bytes
154+
Erase done.
155+
Download [=========================] 100% 200496 bytes
156+
Download done.
157+
File downloaded successfully
158+
```
159+
160+
The size could be slightly different if you're not building the same version as this was taken from, but the start address is what's important.
161+
162+
Reboot the radio and it will boot into OpenRTX. You will *NOT* have DMR capability if you flash the radio this way.
163+
164+
165+
166+
## Technical Notes
167+
168+
### Unique Characteristics
169+
- First amateur digital radio designed specifically for M17 protocol
170+
- Hardware optimized for multi-protocol operation
171+
- Enhanced memory architecture supporting protocol flexibility
172+
- Professional-grade build quality with IP67 rating
173+
174+
### Development Considerations
175+
176+
---
177+
178+
*Information gathered from Connect Systems product specifications at:*
179+
- *https://www.connectsystems.com/products/top/radios/CS7000_M17.htm*
180+
- *https://www.connectsystems.com/products/top/radios/CS7000_M17_PLUS.htm*
181+
- *https://www.connectsystems.com/amateur-products/CS7000-M17-plus.html*

‎hardware/hardware.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ This table provides a glance on the underlying hardware of each of the supported
1616
| T-TWR Plus | ESP32-S3 | SA868S | AT1846S | SH1106 | optional microSD | L76K |
1717
| CS7000-M17 | STM32F405VG | HR-C6000 | SKY72310 | HX8302A | 25Q128FV SPI flash | MC-1010-2RE|
1818
| CS7000-M17 Plus| STM32H743VI | HR-C6000 | SKY72310 | HX8302A | 25Q128FV SPI flash | MC-1010-2RE|
19+
| C62 | CSK6011B | - | BK4819 | TBD | TBD | - |
1920

2021
### Device documentation
2122

@@ -28,3 +29,5 @@ This table provides a glance on the underlying hardware of each of the supported
2829
* [Anytone UV878](hardware/uv878.md)
2930
* [LILYGO T-TWR Plus](hardware/ttwrplus.md)
3031
* [Radtel RT-4D](hardware/rt4d.md)
32+
* [Connect Systems CS7000-M17 and CS7000-M17 Plus](hardware/cs7000.md)
33+
* [Retevis C62](hardware/c62.md)

0 commit comments

Comments
 (0)