Marco,
It isn't just the lengh of the file. Since the "ident" that is returned is written to the .img first and the rest of the radio's memory follows it, all of the memory is shifted 4 bytes.
So...
#seekto 0x0B08;
struct {
u8 code[5];
u8 unused[11];
} pttid[15];
for a "normal" BaoFeng UV-5R style radio would need to be...
#seekto 0x0B0C;
struct {
u8 code[5];
u8 unused[11];
} pttid[15];
For this "odd" class of UV-6 and UV-8 radios.
I think there is a similar problem when writing to the radio. CHIRP currently does this...
# Main block
for i in range(0x08, 0x1808, 0x10):
_send_block(radio, i - 0x08, radio.get_mmap()[i:i + 0x10])
_do_status(radio, i)
It starts a 0x08 (right after the normal 8 byte "ident"). I think it would need to start at 0x0C (right after the 12 byte "ident").