I agree that reverse engineering the ota clone protocol would be half the battle. For example, I recall seeing somewhere a while back that someone had already mapped this out for TH-79A, but cant seem to find it at the moment.
One possible initial approach also comes to mind, assuming it is DTMF based, which might be useful for quick prototyping/testing:
1. Implement the file-based radio class to convert to/from a file-based, intermediate representation of the memory, i.e. sequence of dtmf digits in ascii txt file
2. use some "off-the-shelf" executables/libs/etc to convert audio (direct output, wav file, etc) to/from the text file

Integrating the conversion and management of audio representation output/file generation could be done separately if the initial approach works.

This actually makes me want to do something for my wife's TH-79A, _if_ I can ever find that document...


From: Angus Ainslie <angus@akkea.ca>
To: af5mi@yahoo.com
Cc: "chirp_devel@intrepid.danplanet.com" <chirp_devel@intrepid.danplanet.com>
Sent: Saturday, April 2, 2016 9:44 AM
Subject: Re: [chirp_devel] Yaesu FTM-10R

Hi Jens,
Thanks for the analysis.
You've basically outlined what I was thinking of doing. I figured that I would need generate the DTMF/modem tones via the sound card and tx it through a different radio.
I was hoping that if someone had 2 of them it would make it easier to reverse engineer any real time comms that might be going on.
I picked up one of these now and it's a real pain to program so I'm going to start trying to figure out how the clone works.
Angus
On Apr 1, 2016 1:34 PM, af5mi@yahoo.com wrote:
A quick scan of the manual seems to indicate its a "wireless-only" clone.


This suggests it is some sort of sequence of tones sent OTA. Older Kenwood HT's, e.g. TH-79A did something similar using sequence of DTMF tones transmitted to other radio.

Because this is not serial- or file-based communication, Chirp currently doesnt have any support for it.

Opinion and conjecture follow...

I'm guessing it would be theoretically possible to write an OTA chirp driver, but it would likely have to accomplish two things:
1. generate the actual (DTMF) tones for cloning to radio (either outputting to sound-card, or a wav file, etc which could be replayed via another radio), and
2. decode (DTMF) tones received from master radio.

This assumes that there is no real-time ack/verification. (Otherwise this would require some real-time radio interaction with a surrogate radio coupled to pc/chirp in order to rx/tx audio OTA to the clone target.)

You would likely have to find some python modules which support this tone generation/decoding, or lash up something low-level, using python audio stream modules.

-Jens

From: Angus Ainslie via chirp_devel <chirp_devel@intrepid.danplanet.com>
To: chirp_devel@intrepid.danplanet.com
Sent: Wednesday, March 30, 2016 9:22 PM
Subject: [chirp_devel] Yaesu FTM-10R

Hi All
There isn't a programming cable for this radio but it can clone channels to other FTM-10R radios.
Has anyone tried to reverse engineer this cloning ?
Is it done via RF or Bluetooth ?
Does anyone have 2 of these radios and the equipment to capture the cloning ?
Thanks
Angus

_______________________________________________
chirp_devel mailing list
chirp_devel@intrepid.danplanet.com
http://intrepid.danplanet.com/mailman/listinfo/chirp_devel
Developer docs: http://chirp.danplanet.com/projects/chirp/wiki/Developers