Radtel RT-890 Firmware Flasher

An RT-890 flasher tool written in Python. Might work with the Ruyage UV58Plus and the Iradio UV 5118 plus.

Disclaimer

He who enters here is proceeding at his own risk, and will void the warranty of his walkie.

Usage

First, put your radio on flashing mode by turning it on while pressing both Side-Keys. Then issue command

./rt_890_flasher.py <serial_port> <firmware_file>

to get your warranty void.

Note that you will have to reset the radio if the FW does not fill the whole memory.

Full help

usage: rt_890_flasher.py [-h] [-v] serial_port firmware_file

A tool for flashing RT-890 (and clones) firmware.
First, put your radio on flashing mode by turning it on while pressing both Side-Keys.

positional arguments:
  serial_port    serial port where the radio is connected.
  firmware_file  file containing the firmware.

options:
  -h, --help     show this help message and exit
  -v, --verbose  set verbose output

RT-890 Firmware Flasher (c) 2023 JuantAldea (https://github.com/JuantAldea)

Ouput example (excerpt)

Firmware size 54648 (0xD578) bytes
CMD Read:
 Off | 0x00 0x01 0x02 0x03
=====|====================
0x00 | 0x52,0x00,0x00,0x52
=====|====================
Response:
 Off | 0x00 0x01 0x02 0x03
=====|====================
0x00 | 0xFF,0xFF,0xFF,0xFF
=====|====================

CMD Erase:
 Off | 0x00 0x01 0x02 0x03 0x04
=====|=========================
0x00 | 0x39,0x00,0x00,0x55,0x8E
=====|=========================
Response:
 Off | 0x00
=====|=====
0x00 | 0x06
=====|=====

Bytes at 0x00000:
 Off | 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F
=====|================================================================================
0x00 | 0xF0,0x3F,0x00,0x20,0x0F,0x15,0x00,0x08,0xCD,0x14,0x00,0x08,0xCF,0x14,0x00,0x08
0x10 | 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
0x20 | 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xD1,0x14,0x00,0x08
0x30 | 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xD3,0x14,0x00,0x08,0xD5,0x14,0x00,0x08
0x40 | 0xD7,0x14,0x00,0x08,0xD9,0x14,0x00,0x08,0xDB,0x14,0x00,0x08,0xDD,0x14,0x00,0x08
0x50 | 0xDF,0x14,0x00,0x08,0xE1,0x14,0x00,0x08,0xE3,0x14,0x00,0x08,0xE5,0x14,0x00,0x08
0x60 | 0x00,0x00,0x00,0x00,0xE7,0x14,0x00,0x08,0xE9,0x14,0x00,0x08,0xEB,0x14,0x00,0x08
0x70 | 0xED,0x14,0x00,0x08,0x59,0x3A,0x00,0x08,0xF1,0x14,0x00,0x08,0x00,0x00,0x00,0x00
=====|================================================================================
FLASHING at 0x00000 response:
 Off | 0x00
=====|=====
0x00 | 0x06
=====|=====
FLASHING at 0x00000, length: 0x80, result: OK

[...]
[...]
[...]

Bytes at 0x0D500:
Note: Padding FW chunk with zeroes to align it to 0x80 bytes.
 Off | 0x00 0x01 0x02 0x03 0x04 0x05 0x06 0x07 0x08 0x09 0x0A 0x0B 0x0C 0x0D 0x0E 0x0F
=====|================================================================================
0x00 | 0x4B,0x65,0x79,0x20,0x42,0x65,0x65,0x70,0x3A,0x20,0x4F,0x66,0x66,0x00,0x20,0x46
0x10 | 0x4D,0x00,0x20,0x41,0x4D,0x00,0x4C,0x53,0x42,0x00,0x41,0x72,0x65,0x61,0x20,0x42
0x20 | 0x20,0x49,0x44,0x3A,0x00,0x41,0x72,0x65,0x61,0x20,0x41,0x20,0x49,0x44,0x3A,0x00
0x30 | 0x56,0x6F,0x6C,0x74,0x61,0x67,0x65,0x3A,0x00,0x4E,0x6F,0x20,0x43,0x48,0x20,0x41
0x40 | 0x76,0x61,0x69,0x6C,0x61,0x62,0x6C,0x65,0x00,0x50,0x6C,0x65,0x61,0x73,0x65,0x20
0x50 | 0x43,0x68,0x61,0x72,0x67,0x65,0x21,0x00,0x30,0xE3,0xFF,0x7F,0x01,0x00,0x00,0x00
0x60 | 0x28,0x28,0x55,0x50,0x20,0x03,0xFF,0x14,0x28,0x10,0x00,0x00,0x19,0x00,0x00,0x00
0x70 | 0x5A,0x00,0x00,0x00,0x5A,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
=====|================================================================================
FLASHING at 0x0D500 response:
 Off | 0x00
=====|=====
0x00 | 0x06
=====|=====
FLASHING at 0x0D500, length: 0x80, result: OK
Flashed a total of 54656 (0xD580) bytes.
All OK!
#############################################################################
# Note: The FW does not fill the whole memory. You have to reset the radio. #
#############################################################################