AnyTone AT-D868UV modifications mods
Modifications, hints, tips and technical information for the AnyTone AT-D868UV and BTech DMR-6×2 dual band DMR digital handheld radio
This information is primarily intended for amateur ’ham’ radio operators who wish to maintain and adjust their AT-D868UV or DMR-6×2. Any regulatory authority approval (e.g. FCC certification) may become invalid by the use of this information. Users should always ensure that they and their radios are operating in accordance with their licence conditions. In any case, the user alone accepts all responsibility and risk from the use of this information and tools provided here.
AnyTone’s AT-D868UV and its twin Btech DMR-6×2 (unless otherwise stated, I’ll refer to both going forward as simply ’ 868 ’) is an excellent dual band DMR / FM handheld radio. It has a fabulous receiver, enough memory to hold the entire DMR user database – for the time being, anyway! – and has many nice features, allowing the user to control just about every aspect of the radio from its operating controls. Perhaps that is why so few modifications have been seen for this model, everyone is happy with the 868 as it is?
Presented here is a collection of modifications for the 868. Not all of these modifications are my own ideas, and credit has been given to the original author of the information as best as I have been able to find. Each modification is rated on a difficulty scale as follows:
Easy: no specialist skills required, easy soldering, minimal disassembly. If the thought of picking up a screwdriver makes you break out in a cold sweat, however, you might want to seek some assistance
Moderate: some skill required in soldering, electronics and/or computing, some disassembly needed. Any self respecting ham / electronics geek will be comfortable at this level.
Advanced: excellent soldering skills required, very good knowledge of electronics and/or computing, extensive disassembly.
If you have any more information or modifications that you’d like to share here, please contact me at vk7zja at gmail dot com and I will make sure you receive credit for your work, though you are welcome to remain anonymous if you wish.
Are the AnyTone AT-D868UV and Btech DMR-6×2 really the same radio?
From a technical viewpoint, I believe so, yes. The only difference appears to be the firmware loaded to each – and even then, it has even been demonstrated that the Btech DMR-6×2 firmware can be loaded into the AnyTone AT-D868UV. More on this below.
Hint when using the programming software / CPS
When making changes or additions in the programming software, the changes or program additions you made don’t automatically ‘take’ when you close the window. You must first select the ‘OK’ button then close the window. This has caught me out several times, and though it might seem obvious when reading this, it is easy enough to overlook when slaving over your keyboard.
Cross compatibility of accessories for the AT-D868UV
It has been found that some accessories for other radios are also compatible with the 868:
Batteries: the Btech DMR-6×2 and AnyTone AT-D868UV batteries, their chargers and programming cable are interchangeable, as you would expect.
Programming cable: TYT MD-380 / Retevis RT3 and GD-77 programming cables also work for the GD-77, but note ANY of the Baofeng programming cables are NOT compatible Antenna: Any decent quality single band or dual band antenna with a female SMA connection will work on the 868.
Speaker microphone: Any of the regular two pin speaker microphones suitable for the usual Baofeng radios etc. will work with the 868. Just ensure the plug is firmly pushed in and seated into the speaker mic sockets.
868 / 6×2 programming cable pinout
Unlike many other Baofeng programming cables, the 868 cable has no electronics inside, but does need a driver to be installed. You can even make your own spare programming cable if you wanted, using this pinout as a guide.
Known button held during power up sequences
There are several power up sequences which involve holding down buttons to invoke certain modes on the 868 as follows:
- Top orange button + PTT for main firmware update mode
- Top orange button + # for DSP SCT update mode
- PTT + PF1 enters the reset radio confirmation menu
- PTT + PF2 enters a display icon update mode
- PTT + 1 enters test mode where you can select operational bands
- PTT + 3 enters a GPS module test mode
New knobs for the 868. Easy
The knobs as fitted by the AnyTone factory are, in my opinion, awful design. They are difficult and slippery to grip and look a little odd. I recommend some aftermarket knobs that suit the Motorola MTX and some PRO series radios. The smaller knob has to be drilled out a little, while the larger knob needs something to fix it to the tuning shaft. Hot melt glue works well. The end result looks rather nice, and the knobs can be bought on eBay for just a few dollars:
Screen scratch protection. Easy
To save your screen plastic lens from getting scratched up, you can buy screen protectors, just like the cell / mobile phone screen scratch protection film, but made especially for the 868 screen. You can find these on eBay.
Headphone adaptor. Easy
Here is a simple and easy to make adaptor so you can listen to the GD-77 with normal headphones. You’ll need a right angle stereo 2.5mm audio plug, a stereo 3.5mm audio socket, a short length of shielded audio cable and a 22 ohm 1/4 watt resistor. Connect them up following the wiring diagram below, and you’re good to go. I also filled the right angle audio plug with hot melt glue to secure the connection and give the connector a bit more solidity.
Expanding RX frequencies
AnyTone AT-D868UV only at this stage, I may look at making the Btech DMR-6×2 expanded firmware available if enough interest is shown in the future As delivered by the factory, the 868 covers 136-174 MHz and 400-480 MHz. There are countries around the world that make use of the radio spectrum above 480 MHz for two way radio, and this modification will allow you to hear those transmissions.
The modification intentionally inhibits transmit in these expanded areas. At the heart of the 868 is an AT1846S ’radio-on-a-chip’ that is designed to work from 134-174 MHz, 400-520 MHz and 200-260 MHz. In practice, the chip will cover even more than that, as you will soon see.
To carry out this modification do the following:
- Download via Mega
Download via Google Drive
Download via Sabercat host
- Unzip the package, and look for your model radio in the folders
- Make sure you have saved your codeplug (rdt) configuration file
- Using the regular firmware updating software & process, send this frequency expanded firmware to the radio.
- If necessary, update your codeplug / rdt configuration file to be compatible with the version of firmware you have downloaded. If you want to reuse your saved codeplug rdt configuration file, you may need to modify one byte with a hex editor as detailed below in italics.
- Enjoy actual extra receive frequency coverage of around 130-178 MHz, 195-290 MHz (with a gap between 200-210 MHz on the 868 & 6X2) and 390-527 MHz (varies from individual radio to radio)
Your mileage may vary of course, due to individual radio & component manufacturing tolerances. You can use the VFO and add memory channels to use these new expanded receive frequency ranges.
Note that with the expanded frequencies, you can’t enter frequencies via keypad direct entry that start with a 2, 3 or 5 (e.g. any frequency in the 200, 300 or 500 MHz range) the only way to get to them is via lots of knob twisting in VFO mode or use the up/down buttons to tune in 1 MHz steps.
To enter out of band frequencies in the CPS programming software, you will need to use the export-edit-import method: program some dummy channels with valid but easy to recognise frequencies, for example 456 MHz, then use the export feature (tool > export > channel > give it a name > export) and save your exported channels.
Open the exported channels file with a text editor – look for your dummy channels you had previously entered, and edit the frequencies as you require, and save the file. Back in the CPS software, use the import feature (tool > import > channel > find your edited csv file > import) to bring the channels with out of band edited frequencies into the radio.
But how do we know it is actually working, not just displaying a frequency and nothing else? Conveniently, the 878 has a quirk that will tell you if the receiver is ’unlocked’ and not working at that frequency: program a button as FM monitor, or turn the squelch level to off. If the radio makes a pulsing or popping noise, the receiver is unlocked and is too far out of band to work. If you hear a constant rush of noise, that indicates the receiver is locked and is working as well as it can do.
If you have a signal generator, you can test that the 878 is actually receiving this signal, or you can use an off air signal to confirm reception is working.
Transmit remains standard according to each MODE. Typically, the receiver locks and actually works around 130-178 MHz, 195-290 MHz (with a gap between 200-210 MHz on 868 / 6X2) and 390-527 MHz, though note that frequencies between 210-400 MHz vary in sensitivity quite a bit.
AnyTone 868 or 878 or Btech 6X2 or DJ-MD5 on VHF air band? You’ll notice that this mod will permit coverage of some of the VHF air band. So how well does the radio receive here? Not perfectly since this is strictly an FM & DMR receiver and air band signals are AM. But if you select narrow bandwidth FM and tune off frequency by 2.5 kHz, stronger AM air band signals can be resolved, with some distortion. Take a look at this YouTube video for an example:
What about 220 MHz, could the 868 / 878 / 6X2 / DJ-MD5 be used on the 1.25 metre band? You should use the radio for receive only on this band, as the transmitter is not designed for 220 MHz and attempting to transmit on this frequency will place huge stress on, and perhaps damage, the VHF transmit output transistor. In any case power output on 220 MHz is only about 100 milliwatts. Regarding receive on 220 MHz, the 868 is very insensitive in this area, but the 878, while not stellar, is considerably better due to a different receive front end tracking arrangement.
Refer to the sensitivity plots below:
Looking at these plots, given the very sudden drop in sensitivity immediately below 400 MHz, I suspect that there is a frequency tracking front end employed, and that there isn’t any valid tracking data for tuned frequencies between 210 and 400 MHz and as a result the 868 is very deaf here. I’ll continue to investigate this and perhaps come up with an improved mod that will offer better sensitivity in this area. Other modified radios (e.g. Radioddity GD-77 & others) offer sensitivity around -90 to -100dBm in the 220 MHz area which makes them somewhat usable, and the hope is the 868 can join this group too.
Theory behind the frequency expansion mod. Advanced
The age of hardware expansion modification is over, 99% of the time these days software is the route to achieving results. When looking to make frequency expansion modifications by software, the first step is to see if the programming software can accept, or be tricked to accept out of band frequencies; if you can’t send those frequencies to the radio, then modification becomes a lot more difficult.
Thankfully, a lot of programming software only checks for valid frequency entry when entering details by hand inside the software. If you edit a saved configuration file, or import frequencies / channels, often this doesn’t go through the software sanity test. The 868 programming software is no exception to this; while out of band frequencies can’t be entered by hand, they can be imported just fine.
The next step is to ensure these out of band frequencies are actually being sent to the radio as intended. For capturing USB data as it is being sent to the radio, WireShark is the go-to tool to analyse USB packets and ensure that the frequencies you want are actually being sent. If the radio accepts and uses these out of band frequencies, you are done and dusted.
In the case of the 868, the firmware inside the radio does have a sanity check going on to trap any frequencies that fall outside permitted limits.
Where a radio is doing a sanity check on a programmed channel’s frequency, it will compare it against a limit that is programmed in to the radio, perhaps as part of its firmware, or perhaps compared against another memory location. In this case, the 868 has multiple limits stored as part of its firmware. These multiple limits are there to set one of (currently) thirteen options of permitted bands. Things become interesting when trying to find out exactly how the radio represents these limits.
One of the essential tools for snooping inside and modifying software like this is something called a hex-editor.
If you need a good hex editor, download HxD in your preferred language here (about 860kb)
Numbers representing frequencies and frequency limits could be stored in one of many ways, including:
- BCD – binary coded decimal. Example: 146.500 MHz might be seen in a hex editor as 01 04 06 05 00 00. That’s quite wasteful on memory, so it could be represented in a ’packed’ form and you would see in a hex editor the following sequence: 14 65 00. The Radioddity GD-77 happens to use this method, combined with little endian format as explained below.
- Direct hexadecimal notation. Continuing to use the example of 146.500 MHz, if we convert this to a kHz value of 146500 kHz, that is equal to hexadecimal 23C44, or if we break it up into bytes as seen by a hex editor: 02 3C 44. More commonly though, the frequency is represented as a value in Hz, as 12.5kHz step frequencies couldn’t be represented with a whole number value in just kHz. So again using our frequency of 146.500 MHz, that’s 146500000 in Hz. Converting that to hex gives 8BB69A0, and broken up into bytes: 08 BB 69 A0.
- Other methods that might be convenient to use: it might be feasible to represent frequencies in a form that is directly used by the frequency synthesis hardware. In PLL schemes, this might be in the form of a ‘divider word’ that is sent to a programmable divider.
- For radios using the AT1846S ’radio-on-a-chip’ they receive data in the form of a hex representation of frequency in kHz x16. Yet again using 146.500 MHz as an example: 146.500 MHz is 146500 kHz, and then multiply by 16 = 2344000 in decimal. Then convert to hex: 23 C4 40. It is possible some radios may store frequencies in a form that can be directly sent to the AT1846S.
It is also worth mentioning that in most systems, a ’little endian’ format is used, which simply means to give the lowest significant value byte first. If we have calculated our value as 23 C4 40, then the little endian representation of that is 40 C4 23.
So you can see there could be a variety of methods used to represent frequency values inside software and firmware, and you would have to search for byte patterns for each potential method.
In the case of the 868, none of these methods seem to work, but there is another clue: the .rdt file. After careful examination, you will find that each channel’s frequency is stored as a little endian format hex representation of the programmed frequency in Hz divided by 10. Using our example of 146.500 MHz, converting to Hz gives 146500000, and then divide by 10 = 14650000. Now convert to hex: DF 8A 90. And then finally little endian format it: 90 8A DF.
Using this method the 868 stores frequencies in the .rdt ’codeplug’ file, we do get some hits if we search for byte patterns of 480 MHz using this method in the firmware .CDD file. Now it’s a matter of determining which of those byte groups should be changed. Taking an educated guess, we can assume that the thirteen user selectable band limit frequencies would all be stored together in one area. And so they are!
We can take another educated guess and say that the first lot of bytes in each group indicated correspond to the first user selection in the MODE: 0000x. Now all we need do is to alter those bytes to our new frequency limit. Let’s try to go for an upper frequency limit of 520 MHz: 520 MHz = 520000000 Hz, divide by 10 = 52000000, in hex = 03 19 75 00, and finally little endian format = 00 75 19 03. We would replace the first appearance of the representation of 480 MHz (00 6C DC 02) with our new limit of 520 MHz (00 75 19 03).
Sending this modified firmware image to the radio works! You can now tune the VFO above 480 MHz. But now there seems to be another problem: for some reason the tuning stops at 500 MHz exactly. It turns out there is yet another coded limit within the firmware; it assumes the radio will never need to tune above 500 MHz. We can fix that, too!
Performing another search in the firmware for the representation of 500 MHz (80 F0 FA 02) gives just one hit – this must be it. Change that out for our new limit of 520 MHz (00 75 19 03) and now save that and send to the radio. It works! The 868 is now tuning up to 520 MHz.
Incidentally, the 868 also has a lower limit for UHF defined, at 300 MHz. In order for the 868 to tune down to 220 MHz, you have to change this limit as well. Change it out for 210 MHz. Don’t try to define a lower UHF frequency limit below 210 MHz as the 868 firmware gets awfully confused and some strange things begin to happen.
But how do we know it is actually working, not just displaying a frequency and nothing else? If you have a signal generator, you can test that the 868 is actually receiving this signal. Conveniently, the 868 has a quirk that will tell you if the receiver is ’unlocked’ and not working at that frequency: program a button as FM monitor, or turn the squelch level to off. If the radio makes a pulsing or popping noise, the receiver is unlocked and is too far out of band to work. If you hear a constant rush of noise, that indicates the receiver is locked and is working as well as it can.
Do note that due to the bandpass filtering and suspected front end tracking gain, out of band frequencies between 200 & 400 MHz are not very sensitive, only very strong signals will be heard.
As a final note, when a new version of firmware is released, the addresses at which the changed bytes are written are highly likely to change. You would have to do a fresh search for the byte patterns and replace them appropriately in the new version of firmware.
Changing the display font / modifying some of the icons Advanced
(Credit to Colin G4EML & Ronan EI4KN – the ’font master’ hihi)
Would you like to change the display font on your 868, and don’t mind getting your hands dirty with a hex editor and a few other tools? Then do I have a deal for you!
There are three different fonts encoded into the 868 firmware .CDD file. The location within the firmware file at which the fonts are encoded will change from version to version. Therefore, the first thing you need to do is identify exactly where the fonts you want to replace are located. To make this job easier, Colin G4EML has created a small executable which allows you to graphically view a file as a bitmapped image. You can download it here:
Be aware that the bitmapped icons and fonts are vertical raster, not horizontal. It could take a lot of scrolling through the file to identify the font, but the auto step feature makes life a lot easier.
Once you find the location of the font you want to play with, make a note if its starting location. In firmware 2.32, the fonts – there are three of them! – start at 0x06D5B6 and the symbols at 0x070205. Now you’ll want to create a font of the same size. A very useful tool to convert fonts from your computer into bitmaps is Rays Font Editor which you can download here:
http://www.rayslogic.com/Software/RaysFontEditor/RaysFontEditor_24Aug12.zip (3.0 Mb)
Make sure you convert the font to the same size as the one you are going to replace. In the 868 there are three font sizes: 8×5 (small) starting at 0x06D5B6, 16×12 (medium) starting at 0x06D791 and 16×16 (main font) starting at 0x06E079.
To use Rays Font Editor to produce a bitmap ready for the 868:
- Install your desired TTF font as a system font on your PC
- Select Capture System Font, then select your desired font from the list
- Select input size by point, and play around with the value to get each character fully visible. Typically the letter W is difficult to fit in smaller pixel widths, try smaller point values to get the font small enough to fit. As an example, the Courier New TTF font works well if imported at 10 point size
- Select Output character size – Change font size and enter height and width to suit the font you are replacing, and click OK
- Examine your characters that have been imported to make sure they all fit nicely and are fully legible. You can edit the appearance and shift characters up/down/left/right to make them look nice.
- Select Font settings, and choose character range starting at 32 and ending at 126, as those are the only characters the 868 needs
- Select Export font. You want to select ’custom’, format is binary file, scan direction set to start top-left, scan vertical and leave the other settings as they are. Give your font a name and save it
- Rename the extension of your font from a .dat to .bin and you have a file that’s ready to go into the 868.
Once you have a binary image of your desired font, you might want to use Colin’s ImageTest application to examine the fonts and confirm how they’ll appear on the radio screen.
Now it is simply a case of using your hex editor to copy this binary data from the file you just created over the top of the font data in the firmware file, at the start address you noted earlier. If using HxD, use paste write, not paste insert when copying your new font binary data into the firmware image. Write the firmware to your 868 and enjoy a new look display.
Modify a speaker microphone to keep out DMR pulsed RF feedback. Moderate
(Credit to Owen Duffy VK1OD for this)
If you have a speaker microphone that you like, but is affected by RF feedback from DMR’s pulsed RF getting back into it, causing your transmitted audio to become distorted, you can perform modifications to reduce or even eliminate this problem. I have carried out the modifications, adding a SMD capacitor across the speaker microphone electret element, and adding a SMD inductor in line with the positive line of the electret element, and confirm it works very well indeed. See Owen’s mods at:
Swapping Btech DMR6x2 firmware into an AnyTone AT-D868UV Moderate
(Credit to Ronan EI4KN)
If you would like to experiment with some of the features of the Btech DMR6x2 (e.g. store & forward repeater) in the AnyTone AT-D868UV, then this simple hex edit hack will permit you to do that. Simply load the 6×2 .SPI file in your favourite hex editor, and shorten it to 14 bytes long. Save it, and then you’ll be able to load that firmware into the 868. There will be a few icons that are blank or missing, but otherwise it functions fine.
It isn’t confirmed if the reverse is true, that the AnyTone AT-D868UV firmware can be loaded into the Btech DMR-6×2, but I strongly suspect it can be.
Resolving received noise issues Easy to Advanced
(Credit to Colin G4EML)
Some people have noticed that, especially on VHF, ticking or other noise can affect weak analogue signals. There are a few things you can do to help this:
- Turn off your clock display and GPS. It appears as if any display updates or GPS data that is multiplexed on the data lines connecting the display front half of the radio to the main PCB will cause some interference on VHF.
- Shielding the flat flexible ribbon cable with some adhesive aluminium or copper tape helps a little bit, according to Colin G4EML.
- Noise from display backlight. Yet more noise appears to come from the PWM (pulse width modulated) LCD backlighting, and impacts reception at any brightness level setting. Colin and I will look into this issue and see if a solution can be arrived at.
- Chassis to PCB shielding: A good connection between the PCB earth and the chassis will ensure the best RF shielding possible. Critical for this good connection, you should ensure that all screws are done up snugly, but not so tight that they will strip the threads.
- Nickel shielding spray paint. (Only for the really keen & fastidious radio operator: very extensive disassembly!) While AnyTone have done a good job of shielding sensitive parts of the circuitry with brass shields and the cast aluminium chassis, you can amp up the shielding by use of nickel shielding spray. If you look inside some cellular mobile phones or portable two way radios, you will sometimes see a coating of paint on the inside of any plastic parts. This paint could be black, brown, pink, grey or silver, and they all have a similar job: they’re conductive and add a thin layer of RF shielding to the electronics inside. Electrolube’s NSCP400H nickel spray paint is sold by Element14 (Farnell), or you might be able to find alternative products from other suppliers. You’ll need to follow these general steps:
- Completely disassemble the radio. You need a bare plastic shell with the keypad and LCD display, speaker, orange top button and the plastic ’light pipe’ for the top mounted TX/RX LED removed.
- Use masking tape to cover every surface that you don’t want the nickel spray paint to go. That not only includes all the visible exterior parts, but also many interior areas as well. Cut out a circle of cardboard to fit on the inside of the speaker grille, and also cut out a rectangle of cardboard to the same size as the LCD clear display window. Also block up any openings such as the holes where the keypad goes with cotton wool – I use craft work decorative soft balls for this and it works well. This job of masking every surface you don’t want covered by the paint is fiddly and tedious in the extreme, but is necessary because the spray paint will go everywhere, trust me!
- Nickel spray paint is known to be rather hazardous. You will want to do this job outside, and on a calm wind free day. Wear goggles, dust mask, long sleeve shirt and rubber gloves. Place the masked up shell onto a piece of scrap cardboard and use good spray painting techniques to apply a thin coat of nickel spray on the inside of the GD-77 shell. The spray will look uneven as you apply it, and don’t let that tempt you into applying more paint in those areas. Too much paint will attack the plastic and cause the coating to crack once dried.
- Let the first coat of nickel paint dry, about 24 hours. Apply one more very thin coat of nickel spray paint and let dry again.
- Slowly remove any masking tape, cardboard protective bits and cotton wool stuffing. You should have your same bare radio shell but with a nice grey coating of nickel spray paint on the inside.
- Refit the speaker and use hot melt glue or a contact type of glue to hold it in place.
Don’t coat the rectangular rubber piece that fits over the side speaker/mic connectors, these must be left ’floating’ from ground. This nickel coating will give an extra 10dB worth of shielding to the back side of the main PCB, which results in a ’cleaner’ receiver, especially in an area of moderate RF fields: weaker signals are less distorted and disturbed by nearby transmitters in comparison to a radio without this treatment.
Future developments & ideas
- Expanding the FM broadcast band reception beyond the standard 87.5 – 108 MHz
- Exploring flash memory contents, where hidden data may reside, which is likely to include things such as ’soft’ RF alignment data, with the ultimate aim of producing a software tool to enable users to customise, align and maintain their own radio; for example setting low power at very low levels instead of 1 watt for hotspot use.
- Bug list
- Possible identification and modification of receive tracking gain scheme to improve sensitivity between 210 & 400 MHz
- Exploiting the capabilities of the TLV320AIC3204 audio codec chip inside the 868. This is a very powerful chip with the possible scope to facilitate DSP noise reduction, equalisation, tone control and digital AGC audio.
© Copyright Jason Reilly, 2018