Jason Reilly VK7ZJA 578Mods

Colin G4EML has created an application called AT Options, which will allow you to enable the full test mode, enable a programming password (more about this below) and to edit other text such as the dealer you purchased your radio from, or any maintenance notes you might like to add. For example, you can enter your name, phone number and callsign in this text area in case your radio is stolen.
Download Colin G4EML AT Options version 8 (17kb) software from:

• Download from this webpage here
• Download via Mega
• Download via Google Drive
• Download via Sabercat host

*As always, this software is provided without any warranties, and you use it entirely at your own risk. Using this application to write any changes to your radio is also likely invalidate the manufacturer’s warranty
(The application is also suitable for the AnyTone 878, 878-II & 868, Btech 6X2, Alinco DJ-MD5 & DJ-MD5X, and Alinco DR-MD500/MD520 - thanks to Jason Alexander for assistance with the Alinco models)

Ensure that you do not have any power on password active. If you do, you must use the CPS software to remove it first. Use of AT Options while a power on password is active can, under certain circumstances, cause some data to be overwritten with default data.
When you run the software, select your COM port and READ from the radio. Then edit any text fields you may want, and make sure Band Select and Full Test Mode check boxes are ticked. Finally, WRITE the settings back to the radio - this only takes a fraction of a second to do, and the radio will reboot. It may take a few extra seconds more than normal to boot up, this is OK as it is reconfiguring internal memory.

To activate test mode, turn off the radio, hold down the P4 and dial buttons while turning on the radio until TEST MODE is displayed on the radio screen (this takes a few seconds to happen), then let the two buttons go. The radio will boot up into it’s full test / self adjustment mode.
Once you start test mode, scroll up and down between different test adjustment points using the zone up/down button. The following adjustments are available:

I strongly recommend you go through each setting and write down what they are before making any adjustments \

The typical values listed above are unique to one radio, and should not be used to create a complete alignment profile. It is highly unlikely that your radio will work properly using values from another radio, including these typical values. You need proper test & alignment equipment to be able to accurately set each value. As such, the typical values given here are only to provide context for any adjustments you may wish to make. Critical values are marked with an asterisk.

For the squelch threshold values, lower values results in a more sensitive squelch (to a point!) and higher values require a progressively stronger signal to open the squelch.
The RSSI (received signal strength indicator - in other words the signal meter) has a fairly compressed range of 15dB. I’d have preferred to see at least 30dB range in the signal meter, but I’ve found an acceptable compromise has been to set one bar at -113dBm which equates to values of RSSIU of 36 and RSSIV of 39. The signal meter then reads:

• 1 bar -113 dBm or about S-5
• 2 bars -108 dBm or about S-6
• 3 bars -103 dBm or about S-7
• 4 bars -98 dBm or about S-9

Once finished changing your values, turn the radio off and on again to save them to memory. If you like, you can disable full test mode again by de-selecting the Full Test Mode check box in AT Options application and writing back to the radio. Or, you can de-select both Full Test Mode and Band Select check boxes, which will totally inhibit test mode completely. The values you changed or adjusted will not be erased by doing this, it simply prevents you from accessing the full test mode and inadvertently changing them again. These values will not be overwritten, changed or restored to default by resetting of the radio. Once you change them, you can not get the original value back unless you wrote it down before making adjustments.

You can download a more comprehensive memory map of how each individual adjustment setting is stored in memory, and see more hidden values that are obviously used for RF alignment purposes, but are not available in this test mode.
To experiment and adjust those you will need to use Flash Utility to create your own custom binary image, and write your own custom CDI and SPI files to enable that data to be written to the radio (Flash Utility can’t write to that area of memory directly, it is safest to write using the Icon update mode with a CDD, CDI & SPI file set).
Download the more comprehensive memory map (11 kb) from here:

• Download from this webpage here
• Download via Mega
• Download via Google Drive
• Download via Sabercat host

Resetting your power on password Easy

If you’ve forgotten your power on password where the radio displays PLEASE INPUT THE PASSWORD! and will not let you go any further until you do, this will help you recover it and remove the password. Resetting the radio will not bypass this password check.

1. Do not connect your programming cable yet. Power up the radio and wait until it asks for the password
2. Only now should you connect your programming cable, and using the CPS software, read the radio
3. Go to the menu: Optional Setting > Power-on > Power-on Password Char and you will see your password. Record your password somewhere safe
4. Remove your programming cable, as you won’t be able to write back to the radio at this stage
5. Power cycle the radio and log in with the password you read in step 3 above
6. Using the radios own menus only, turn off the password check: Menu > Settings > Radio Set > Start Up Pwd > Off.
7. Power cycle the radio again and confirm you are not asked for a password this time
8. Now reconnect your programming cable, use the CPS software to read from the radio, and remove the power on password entirely

If your password has become corrupted in memory and the password read is anything other than pure digits, then your only option is to do a full defrost of the radio. A quick defrost will not work.

Programming password lock Easy

Apart from the power on password, there is also a hidden programming password that will require a four character password to be entered in the CPS software before it will do any read or write operation. The password must be four characters, no more or less, and can be made up of any standard ASCII characters that can be typed on a keyboard. To do this, use Colin’s AT Options application (download link in the Enabling Full Test / self adjustment mode section above) to enter a Program Password. To disable any program password that may be present, just use the backspace button to delete the password and leave this field blank; then write back to the radio.

FCC Part 90 approval information:

The FCC has documented quite a bit of interesting technical information regarding the 578 regarding their Part 90 approvals. You can find internal photographs, test reports, SAR radiation exposure limit testing reports and more. Visit the FCC report pages at:

• https://fccid.io/T4K-D578UV
• https://fccid.io/T4K-D578UV2

A look inside the 578

The back side of the display board. The GPS module ATGM336H is capable of tracking GPS & BDS (BeiDou) positioning systems. Also visible is the Bluetooth module.

Note the little cut out area and two mini coax connectors on the left bottom of the picture. One of the mini connectors is for the coax tail that goes to the GPS external antenna SMA connector on the back of the radio. The other connector is unused. Obviously this is a provision to have a tiny built in GPS antenna to the display unit itself, but AnyTone have decided against doing this in the end. A tiny 15x15x6mm or 18x18x7mm active GPS antenna with a short coax tail terminating in a U.FL / IPX connector looks to be ideal if you want to try adding your own, see adding your own internal GPS antenna

The back side of the display board. Bluetooth removed.

The front side of the display board.

578 MCU hides under the LCD display:

The 578 main board top side:

The 578 main board under side:

Close up of the twin 38 MHz IF crystal filters. Note the unpopulated PCB lands for a future version of the 578 that will have air band RX.

Notice how there is an unused position for a second crystal filter to be cascaded with the first... if you wanted even better selectivity, you could source a second pair of 38.550 and 38.850 MHz IF crystal filters, and install them after removing the little SMD 0 ohm resistor. But the 578 already has very good selectivity as it is already, so this is not really necessary.

What are the tiny backup batteries for?

With thanks to Francesco IK8JHL, we now know what each backup battery does. Located on the display / MCU printed circuit board are two tiny backup batteries. The one on the back side, near the ribbon connector, is used to backup the real time clock. The other battery on the front side in between the two volume control potentiometers is used to help the GPS with ’hot starting’ to obtain a quicker initial first position fix.

Each of these batteries are XH414HG IV01E rechargeable lithium batteries, which receive a trickle charge when ever the radio is connected to power - the radio doesn’t have to be turned on for this to happen. If your radio has been sitting around dormant and not connected to power for a while, these batteries could become flat. Very flat! A very flat battery can become short circuit and cause mis-operation of the radio MCU processor. If you have not had the 578 connected to power for a while, connect power for 48 hours to allow time for the batteries to recharge some before attempting to use.
If you find that the time & date is being lost, or you can’t confirm entry of time & date after a reset, even after allowing some time for the backup battery to recharge, it could be that the battery is damaged and needs replacing.
Likewise, if the GPS always seems to take a long time to get a lock, a dead GPS backup battery might be the reason.
The best way to determine if a backup battery is dead and requires replacement is to allow the batteries time to recharge first by leaving the radio connected to power for 48 hours, then disconnect the radio from all power. Open up the radio and measure the backup battery voltages with a multimeter. The positive (+) of the battery is the top side of the battery, and you can put your negative (-) probe of the multimeter on any ground point of the radio. Any battery that measures less than 2.7 volts should be replaced.

Modifying the internal speaker for extra volume Advanced (extensive disassembly)

The internal speaker of the 578 can be made to be slightly louder. Testing shows a 2dB improvement in output volume, which isn’t a lot, but might make the difference if you’re in a noisy environment.
The theory behind this modification is that with a solid backing plate behind the internal speaker cone, this increases the back-pressure on the cone as it vibrates back and forth producing sound. If holes were to be drilled in this backing plate, air will be able to be more freely move out of the way of the speaker cone, restricting it less and allowing it to move more freely, generating a higher output volume.
Begin by disassembling the radio - quite a lot of disassembly is necessary to get to the back of the speaker, including unsoldering the antenna connection. Once you have free access to the speaker backing plate, remove it, mark out a series of holes evenly around the perimeter and mark them with a nail punch. To make the job of drilling out 5mm holes easier, screw the plate to a piece of scrap timber. Once the holes have been drilled, de-burr them and reinstall the backing plate. Ensure the foam pad that was originally between the back of the speaker and the backing plate is put back into place, and screw the backing plate down firmly, and finally reassemble the radio.

Replacing the SO-239 socket with an N-type socket Moderate

I get why a SO-239 socket has been fitted to the 578. Many hams use them, mainly because that is what a lot of other radios use too. There is a lot to be said for maintaining the status quo. But the SO-239 is a 90 year old design, they don’t maintain a constant 50 ohm impedance, and are usually only good to use up to 100 MHz. It’s about time that we ditch the SO-239 / PL-259 combination and upgrade to something a bit better. The N-type connector is a much better choice: good to at least 1 GHz and high quality types are usable up to 18 GHz, they also maintain a constant 50 ohm impedance across the connection, and not that it matters in this application, they also have a degree of weatherproofing over and above the SO-239 / PL-259 series.

Key benefits:

• Higher quality, better design connector, less ’junk’ connectors around in the N-type
• Slightly lower loss, especially at UHF
• Better VSWR / return loss; SO-239 connectors have an impedance ’bump’
• Better weatherproofing than SO-239 / PL-259 types

Suitable diamond flange, two hole, N-type sockets can be purchased from: Mouser part number 523-172323 / RFparts part number 0-RFN1020-1 / many other suppliers if you look
To replace the SO-239 socket with an N-type on the 578, first desolder the centre and earth pins of the socket as shown below. Then undo the screws holding in the socket, and it should fall right out. Also remove the brass square U shape ground bracket, but replace the screws that held it in. Test fit your replacement N-type socket to make sure it fits nicely. If all is good, solder a short bit of 1mm thick solid copper wire to the N-type socket centre pin, and bend it slightly upwards. Fit the new socket in the radio chassis and refit the screws that hold the socket flange. Make sure the screws are done up quite snugly, but not so over-tight that you strip the threads. Lastly solder the centre pin on to the PCB, clean up any flux that might be left behind and the job is done.

Adding an internal GPS antenna to the 578 Moderate

If you have a GPS equipped 578, you will have received an external GPS ’mouse’ style antenna that connects to the rear panel SMA socket. This is all very good, but what happens if you don’t want to use an external GPS antenna? The 578 was originally designed to have an internal GPS antenna too, but in the end the factory decided to rely solely on an external GPS antenna. It isn’t hard to understand why, either. With many 578s destined to be installed in vehicles, an external GPS antenna offers the very best performance in picking up the incredibly weak signals from orbiting GPS satellites as you drive under trees, into deep valleys or just in and around the city with lots of obstructing buildings.
However, if you are happy to sacrifice the performance of an external GPS antenna, you could add in your own GPS antenna to the display unit of the 578 and make use of that instead. There is space within the display unit, just behind the "GPS" inscription above the front panel LED in fact, where you could install your own mini GPS antenna. This space measures 19mm wide by 7mm high, and has an available depth of 20mm maximum. You will need an ’active’ (built in amplifier) type of antenna that is this size or smaller, and works for 1575.42 MHz - this is suitable for GPS and BeiDou GNSS, which the ATGM336H receiver works with. The 15x15mm types, which came with a short tail of mini coax and ending in a u.FL / IPX connector, cost a fraction over USD $3 each from eBay. Search for ’GPS active IPX antenna’ and look for the 15x15x6mm model (or 18x18x7mm types but those are a bit more expensive). It may be worthwhile buying a pack of four of these antennae for USD $8, and then you can cherry pick the most sensitive antenna. I found one of the four antennae I purchased was consistently taking about twice as long as the other three to get a position fix. Installation is simplicity itself:

Begin by removing the four Torx T8 size screws of the underside cover of the 578, and remove the two top side Torx T8 screws on the back lip of the display unit and carefully separate the display unit from the main body of the radio. Don’t pull it out too far or you will damage the connecting ribbon cable. Then:

1. Unclip the existing u.FL connector that goes to the rear mounted SMA socket
2. Insulate the original u.FL connector and tuck it away somewhere; a little bit of 2mm or 3mm heatshrink is a professional way to do this, but some electrical tape is OK too
3. Find some double sided tape (maximum of 1mm thick). The double sided foam tape pictured here is used in the automotive industry to affix exterior trim to vehicle bodies etc. and works well
4. Add a small square of double sided tape to the top of the GPS antenna
5. Clip in the new antenna connector - due to it’s tiny size, this can be a bit tricky to get mated correctly, be patient and don’t force it. Mount the new antenna in the cut out as shown below

Reassemble the 578 and test to make sure everything is working OK. Remember you need to turn on GPS in the menu first!

So how well does it work? The below photograph illustrates just how well the new internal GPS antenna works. With a vehicle parked deep inside a large metal shed, completely obstructing a view to the sky, the 578 and 868 were set side by side on the dashboard. After 5 minutes, only the 578 with the added GPS antenna has a position fix. The larger size (roughly double) of the GPS antenna added in the 578 versus the smaller GPS antenna as fitted to the 868 accounts for this better sensitivity. All the same, don’t expect miracles from this antenna, if you mount the 578 low in a vehicle dashboard or console, your GPS fixes will only be intermittent. In situations where the GPS signal is weak, the external ’mouse’ antenna, mounted on the exterior of your vehicle will always be best.

In some 578s, you may find there are two u.FL / IPX GPS antenna connectors. If this applies to you, test your GPS antenna in both sockets; I found that connecting the new internal GPS antenna to the socket closest the volume control resulted in a consistently faster lock. You can also still keep the existing fly lead for the external SMA GPS socket connected to the other u.FL / IPX socket, and even have both GPS antennae connected and working at the same time, it doesn’t seem to upset the performance getting a position fix.

Improved cooling for the 578 Moderate

The 578 isn’t meant for high duty cycle transmit, such as that which many ham operators tend to do. Generating 60 watts of output in such a compact body means the radio will heat up quickly, there is no getting around that. This alone is a very good reason to operate using the lowest power possible for your requirements. However, if you simply must use high power for anything other than a very brief call, then there are things that you can do to improve the cooling of the 578 in these circumstances.
The first change to make is to reverse the direction of the airflow over the heatsink fins of the radio body, which is done simply by turning the fan around. Undo the four screws holding the fan to the back of the 578 chassis, and turn it around so it faces the other way. The fan will now blow air over the heatsink, rather than drawing or sucking air past the heatsink fins. This seems to be more efficient at cooling the radio. If you are handy with a bit of sheet metal or a 3D printer, you can also make a small cowl to place over the back of the heatsink fins, which will help direct airflow over them, further improving cooling efficiency. The difference isn’t huge, but worthwhile.

A good example of a small cowl added can be found here: http://f1dmg.free.fr/578a

However, if you are often going to be using high power, it would be a much better idea to fashion a bracket to hold a 120mm computer fan to the top of the heatsink. Noctua make some excellent quality, very acoustically quiet fans that would be excellent for this job.

Improved receiver shielding for the 578 Advanced

While the radio case is metal and provides a good degree of shielding for the 578 receiver, AnyTone provided the PCB lands to add extra shields over the receiver section. You can manufacture your own shields out of 0.8mm tin plate or brass plate and solder them over the receiver PCB. Make each shield just slightly smaller than required, so the sides fit just on the inside edge of the PCB lands provided. Each shield should be at least 2.5mm high to allow a reasonable clearance from the receiver components underneath. Use a 60+ watt soldering iron to run a fillet of solder around the shields. You might not be able to solder all PCB lands due to the close proximity of other components, that is OK, just leave those alone rather than risk burning a nearby component. The end result should look like this (added shields indicated by red arrows:)

After this is done, you will need to realign the following receiver tracking gain settings: BPFLUA, BPFMUA, BPFHUA, BPFLUB, BPFMUB, BPFHUB, BPFLVA, BPFMVA, BPFHVA, BPFLVB, BPFMVB, BPFHVB. Feed in a weak test signal at the test frequency indicated, and adjust the value for maximum spot frequency sensitivity. This is to compensate for the added stray capacitance the shields add to the varactor based front end tuning.
If done properly, this will result in a 2dB noise reduction on VHF, raising sensitivity by the same amount. No improvement on UHF was noticed.

General technical information

The 578 uses a hybrid receiver, with a conventional super-heterodyne 1st IF stage using 38.550 and 38.850 MHz Intermediate Frequencies, each followed by a direct conversion IF receiver; this is a design architecture that Motorola and others have used to great success for many years. There is also a relay and substantial diode for reverse polarity protection, and a third IF strip that is unpopulated.
The following devices are found within:

• GD32F303VKT6 ARM Cortex-M4 32 bit MCU with 3072kbyte internal flash and 96kbyte internal SRAM. 578s produced after mid 2022 will use an equivalent AT32 brand MCU.
• Toshiba TC58CVG1S3HRAIG 2Gbit / 256Mbyte NAND flash memory
• Sicomm CT3258TD baseband processor for DMR with built in AMBE2+ vocoder & 12.2 MHz oscillator
• Texas Instruments TLV320AIC3204 DSP / codec
• 4 x QA4818N transceiver ICs & 26.0 MHz reference oscillators. These devices have the same pinout as the more common AT1846S, but are more capable. One pair is being used as the 1st Local Oscillator for VFO-A and VFO-B, and the other pair are acting as a direct conversion 1st IF baseband receiver.
• RDA 5802N FM broadcast band receiver
• YD1517P (LM1517P equivalent) 2x 6 watt audio power amp, working in push-pull mode to give 12 watt output
• Two NXP AFT05MP075N LDMOS 70 watt RF power amps, 18dB narrowband gain, one each for independent VHF & UHF power amp stages
• VHF and UHF receive front ends each have four stages of varactor track tuned filtering
• ATGM336H GPS & BDS (BeiDou) positioning module (GPS models only)
• Battery backup for real time clock, plus a second backup battery for GPS ’hot start’

Flash memory structure in the 578

The 578 is fitted with a 2 Gbit / 256 Mbyte external flash memory, and the MCU has 3 Mbyte of internal flash memory that holds the operating firmware.
Here’s what is known about the structure of memory in these radios so far:

578 Toshiba TC58CVG1S3HRAIG 2Gbit / 256 Mbyte NAND external flash memory map

Flash Utility software:

Courtesy of Colin G4EML comes this small utility program that can read and write the external 2Gbit flash memory where the codeplug, DMR ID database, RF alignment data etc. lives. There are some rules to the safe use of this software:

• Reading the flash is perfectly safe, it is the writing of data that you need to be careful with.
• Through careless use when writing data, this software can most definitely ’brick’ or disable your radio, or cause hardware damage by writing RF output power values to destructively high levels for example. You accept all risk in use of the software.
• The radio will attempt to prevent overwriting of critical data in certain areas of the flash memory, typically stored between addresses 02F00000 and 02FDFFFF. It is generally better to create a set of CDD, CDI and SPI files to write to this area of memory, and write using icon update mode to ensure the radio MCU is safely halted.
• If using Flash Utility to write to the flash memory you need to apply a (hex) 20000 byte offset. For example, if you want to write to address 00000000 you should instruct Flash Utility to begin writing at 00020000. It is unknown why this is necessary, and exactly at what memory address this offset is no longer needed, but it applies at least as high as address (hex) 04000000.
• You should write to the radio in multiples of 256kbytes, even if you only want to change just one byte. (Do not forget the 128k offset that needs to be applied) This restriction doesn’t exist when only reading the flash.

I *** STRONGLY *** recommend you make a backup of your flash memory contents by reading at least the critical memory area between addresses 02F00000 and 02FDFFFF and saving to a file, and keep that file in a safe location. You can read the entire flash contents from 00000000 to 07FFFFFF if you wish, but this will take several hours to read a 1Gbit flash memory via a serial interface.

Download Flash Utility software (10kb) from:

• Download from this webpage here
• Download via Mega
• Download via Google Drive
• Download via Sabercat host

Flash Utility is compatible with the 578 of all flavours, 868, 878 & 878-II, Btech 6X2, Alinco DJ-MD5 & DJ-MD5X and Alinco DR-MD500/MD520. When reading from the radio, it might be a bit confusing to users to have to specify a file before reading begins - this is the file you will be saving your read results to.

Backing up or restoring vital alignment & configuration data of your 578

There is vital RF alignment and configuration data, unique to your radio alone, that is stored in memory. It would be a very good idea to make a backup of this data in case you ever need to restore it at some time in the future. This could be due to flash memory corruption, or any number of other reasons.

Making a backup

• Download Flash Utility software (10kb) from:
  Download from this webpage here
  Download via Mega
  Download via Google Drive
  Download via Sabercat host
• Plug in your programming cable to the radio and your computers USB port, and power on the radio
• Start AT_Flash_Utility_v3.exe
• In the Start Address (Hex) box type 2F00000 [ 2F and five zeros ] and in the Length (Hex) box type E0000 [ E and four zeros ]. Take care to correctly enter the hex addresses given in this step.
• Click the Select File button, and navigate to the directory you wish to save the data backup file into. Enter a file name of "myvital.bin" then select Save. If you have more than one radio, or perhaps you own another model of radio (eg: 878 etc), make sure you save each backup to a different directory and clearly identify which individual radio that directory and it’s backup file belongs to.
• Select your usual Com Port, and then click the Read button. AT Flash Utility will then read the vital bits of flash memory and save it to a file called myvital.bin and takes about a minute to complete.
• After the read is complete, click on the OK button. Confirm that your myvital.bin file was saved to your directory and that its size is 896kb. If not, go back to step 4 again, making absolutely sure you have given the correct Hex address and length values.
• Close down AT Flash Utility.
• Rename the file myvital.bin to myvital.CDD (i.e. change the file extension from .bin to .CDD) This step is very important, do not skip this step!


• Restoring a saved backup file
  This step shouldn’t be carried out unless you have strong reason to believe your RF alignment data is corrupt. There is inherent risk, though very slight, that writing data to parts of flash memory that isn’t normally user accessible can make things worse. Follow these steps carefully, and take your time.
  1. It is assumed you already have downloaded Flash Utility as per Making a backup step 1 just above.
  2. Download some supporting files (<1 kb) necessary to restoring a backup from:
     Download from this webpage here
     Download via Mega
     Download via Google Drive
     Download via Sabercat host
  3. Unzip these support files to your directory holding the backup file. You should now have the following files in there: myvital.CDD (your previously saved & renamed myvital.bin), myvital.CDI & myvital.spi
  4. Plug in your programming cable to the radio and your computers USB port, and power on the radio while holding down the P1 button & dial knob. Confirm the display shows "UPDATE MODE" with a flashing green LED
  5. In the CPS programming software, go to menu Tool > Firmware Upgrade (or manually execute QX_Firmware_Update.exe)
  6. Click on the Open Update File button, navigate to the directory where you saved your backup, select the myvital.spi file and click Open. Click on OK below the File Open Succesed! message. (If you have multiple radios and multiple backup files, make absolutely sure you have selected the correct backup file to send to the connected radio)
  7. Ensure Duplex box is ticked, and that Com Speed is set to 921600. Click on Write. This step will restore vital RF tuning data that is unique to your radio back in flash memory, and takes 25 seconds to complete.
  8. Turn the radio off, then power on the radio normally this time, without holding any buttons.
  9. You may need to set the time & date. The radio might also power up in Chinese language mode, this is OK, after writing your codeplug to the radio that will be corrected. You may need to power up the radio in test mode to change the band (MODE) or set the band with AT Options software to match the band you were using before, if you get Band Error when sending your codeplug back to the radio.
  10. You are now done!

   

  back to Index

   

  ---

   

Fix a frozen during boot up AnyTone 578 or Alinco DR-MD500 / DR-MD520 Easy

Some people have found that their radios have frozen on boot, that the radio displays the startup message "Booting... Please Wait!" or displays the startup picture and does nothing else. Try the following steps, in this order, to clear the problem:

• Turn the radio off, leave it off for ten seconds, and turn back on
• Turn the radio off, remove all power to the radio for 5 minutes, then reconnect and power on
• Attempt a reset: turn the radio off, and then hold P2 and the dial knob in while turning the radio on
• Reflash firmware: turn the radio off, then hold the MENU and EXIT buttons down together just after power off, the LED will flash red and you can then use the CPS software to load your firmware file using Tool > Firmware Upgrade
• Reflash the SCT3258 baseband: Download the SCT3258 software, instructions and baseband files (3.18 Mb) from:
  Download via Mega
  Download via Google Drive Note Google has recently tightened security for downloads and this file may or may not be available to download by you entirely at Google's discretion
  Download via Sabercat host
  To enter the SCT update mode, hold down the dial knob and MENU keys while turning the radio on. From there, follow the instructions included in the download to write the latest baseband file V2.01.07BF to the SCT3258.

Once you have managed to regain control of the radio, the first thing to do is re-build your ’codeplug’ to remove any hidden corruption that caused the freeze in the first place. 99.9% of problems encountered are usually the result of poor ’codeplug’ practices. Using other people’s codeplugs, originating from several CPS versions back, and then added to piecemeal, is almost certain to cause problems. The solution to this is to ensure your codeplug is rebuilt which ensures the underlying data that your codeplug is built upon is fresh and consistent with the CPS and firmware version in use. Do not take any shortcuts in the following process!

1. In CPS, load your old saved codeplug and export everything (Tool > Export > Export All)
2. Go through all your Optional Setting and write them down or take screen shots of all the settings there. If you are using encryption, also record all your encryption keys. These settings and encryption keys are not saved by the Export All process.
3. RESET the radio - this step is very important! If you do not do this, the old & possibly problematic data in the radio is not removed.
4. In CPS, read from the freshly reset radio (yes, you are reading a ’blank’ radio, that is OK)
5. Import everything saved from step 1
6. Finish off your codeplug by attending to the Optional Setting & encryption keys if applicable and confirm all is correct
7. Send the freshly rebuilt codeplug to the radio
8. If you had a custom start up picture or background pictures, send those to the radio now
9. Finally, save the rebuilt codeplug and ensure you use this saved file as the basis for any further changes you may make, and make sure you delete your old problematic codeplug file.

If these steps have not worked, there is a procedure that may help un-freeze your radio and get you going again. Note that this defroster will only work if the freezing is caused by memory corruption. If the problem is a hardware failure, then this will not work.

Quick defroster
Credit to Francesco IK8JHL & Andres CD2KDT and thanks to Jason Alexander for assistance with the Alinco models
This process is quick and simple, forcing the radio to undergo a reset. You will loose your codeplug, so make sure you have a saved copy first.

Download the AnyTone 578 fast defroster (1 kb):

• Download from this webpage here
• Download via Mega
• Download via Google Drive
• Download via Sabercat host

Download the Alinco DR-MD500 fast defroster (1 kb):

• Download from this webpage here
• Download via Mega
• Download via Google Drive
• Download via Sabercat host

Download the Alinco DR-MD520 fast defroster (1 kb):

• Download from this webpage here
• Download via Mega
• Download via Google Drive
• Download via Sabercat host

1. Unzip the contents of the fast defroster for your model radio
2. Confirm that your frozen radio can power up in the Icon Update mode: turn the radio off, hold the P1 and dial knob down while powering on the radio. You should see a screen with "UPDATE MODE" displayed. If you do not see this screen, this process will not work for you and the radio will have to go back to the supplier for repair or replacement.
3. Start up the CPS, preferably using the latest version you can get. Go to menu Set > Set Com. Select the Com Port you normally use to program your radio.
4. In the CPS, go to menu Tool > Firmware Upgrade. Click on the Open Update File button, navigate to the directory where you have unzipped the files and select the 578-Fast-defrost.spi file and click Open. Click on OK below the File Open Succesed! message.
5. Ensure Duplex box is ticked, and that Com Speed is set to 921600. Click on Write. The data only takes a fraction of a second to be written to the radio.
6. Turn off the radio, wait ten seconds, then turn it back on again. The radio should immediately go through a reset.
7. You may need to set the time & date. The radio might also power up in Chinese language mode, this is OK, after writing your codeplug to the radio that will be corrected. You may need to power up the radio in test mode to change the band (MODE) or set the band with AT Options software to match the band you were using before, if you get Band Error when sending your codeplug back to the radio.
8. You are now done!

Full defroster
If the above quick defroster didn’t work, then you can try using this more comprehensive process to un-freeze your radio. Follow the steps carefully and exactly.
This process will completely erase & over-write your radio flash memory, and you proceed at your own risk. While it has helped un-freeze a couple of 578s, it can not be absolutely guaranteed to work for you. This will also wipe your codeplug, so make sure you have a saved copy somewhere.

Test that your frozen radio can power up in the Icon Update mode: turn the radio off, hold the dial knob and P1 buttons down together while powering on the radio. You should see a blank screen with "UPDATE MODE" displayed. If you do not see this screen, this process will not work for you.

Download the AnyTone 578 full defroster pack (2.1 Mb) from:

• Download via Mega
• Download via Google Drive
• Download via Sabercat host

Download the Alinco DR-MD500 full defroster pack (2.3 Mb) (Note: not suitable for DR-MD520) from:

• Download via Mega
• Download via Google Drive
• Download via Sabercat host

(There is no full defrost pack for the DR-MD520 as yet)

1. Unzip the contents into a new directory
2. Plug in your programming cable to the radio and your computers USB port, hold down dial knob & P1 while powering on the radio, and confirm the display shows "UPDATE MODE"
3. Start AT_Flash_Utility_v3.exe In the Start Address (Hex) box type 2F00000 [ 2F and five zeros ] and in the Length (Hex) box type E0000 [ E and four zeros ]. Then click the Select File button, and navigate to the directory you have unzipped the defrosting files into. Enter a file name of "myvital.bin" then select Save.
4. Select your usual Com Port, and then click the Read button. You will get two error messages, this is fine, just click on OK. AT Flash Utility will then read some vital flash memory and save it to a file called myvital.bin and takes about 55 seconds to complete.
5. After the read is complete, click on the OK button. Confirm that your myvital.bin file is in the working directory and that its size is 896kb. If not, go back to step 6 again, making absolutely sure you have given the correct Hex address and length values.
6. Close down AT Flash Utility.
7. Rename the file myvital.bin to myvital.CDD (i.e. change the file extension from .bin to .CDD) This step is very important, do not skip this step


8. Turn off your radio, and again hold down the dial knob & P1 while powering on the radio, and confirm the display shows "UPDATE MODE"
9. Start up the CPS, preferably using the most current version CPS available for your model. Go to menu Set > Set Com. Select the Com Port you normally use to program your radio.
10. In the CPS, go to menu Tool > Firmware Upgrade. Click on the Open Update File button, navigate to the working directory and select the flash fresh reset .spi file and click Open. Click on OK below the File Open Succesed! message.
11. Ensure Duplex box is ticked, and that Com Speed is set to 921600. Click on Write. This step will wipe your flash memory clean, and takes quite some time (an hour or more) to complete.


12. Turn off your radio, and again hold down the dial knob & P1 while powering on the radio, and confirm the display shows "UPDATE MODE"
13. In the CPS, go to menu Tool > Firmware Upgrade. Click on the Open Update File button, navigate to the working directory and select the icon .spi file and click Open. Click on OK below the File Open Succesed! message.
14. Ensure Duplex box is ticked, and that Com Speed is set to 921600. Click on Write. This step will rebuild icons and text bitmaps in flash memory, and takes a minute or two to complete.


15. Turn off your radio, and yet again hold down the dial knob & P1 while powering on the radio, and confirm the display shows "UPDATE MODE"
16. In the CPS, go to menu Tool > Firmware Upgrade. Click on the Open Update File button, navigate to the working directory and select the myvital.spi file and click Open. Click on OK below the File Open Succesed! message.
17. Ensure Duplex box is ticked, and that Com Speed is set to 921600. Click on Write. This step will restore vital RF tuning data that is unique to your radio back in flash memory, and takes 25 seconds to complete. This is another very important step that you should not skip, otherwise your radio will not properly transmit on DMR.


18. Power cycle the radio normally this time, without holding any buttons. It should boot up somewhat normally this time. You may need to set the time & date. The radio might also power up in Chinese language mode, this is OK, after writing your codeplug to the radio that will be corrected. You may need to power up the radio in test mode to change the band (MODE) or set the band with AT Options software to match the band you were using before, if you get Band Error when sending your codeplug back to the radio.
19. You are now done!

I recommend updating to the latest firmware version available for your model after doing this process, if you have not already done so. You MUST reset the radio by holding down the dial knob and P2 while powering on the radio after doing a firmware update, this is extremely important.
If these suggestions still do not un-freeze your radio then, sadly, it it likely the problem is a hardware fault, and no amount of resets, reloading of firmware or codeplugs, or performing any special procedure will fix that. You should get in touch with the seller of the radio to discuss repair.

Preventing your 578 or MD500 / MD520 from freezing or locking up and how to cure many problems

There are some things that can help prevent your radio from freezing or locking up in the first place.
The same ideas can also cure many strange problems eg: scan speed slowing down, unattended transmit, laggy behaviour, features not working as they should etc.
Follow these suggestions, in this order:

• Rule 1: Rebuild your codeplug
99.9% of problems are caused by residual data in a codeplug file. Rebuilding your codeplug with clean data can help with many miscellaneous problems and eliminate lock ups or freezing. Do not take any shortcuts with this process! Yes, it does take a little bit of effort on your part, but as mentioned, the vast majority of issues are fixed with a rebuilt codeplug.

1. First make sure your CPS software version matches the firmware version presently in your radio
2. In CPS, load your existing configuration codeplug and export everything (Tool > Export > Export All)
3. Go through all your Optional Setting and write them down or take screen shots of all the settings there. If you are using encryption, also record all your encryption keys. These settings and encryption keys are not saved by the Export All process.
4. RESET the radio - this step is very important! If you do not do this, the old & possibly problematic data in the radio is not removed.
5. In CPS, read from the freshly reset radio (yes, you are reading a ’blank’ radio, that is OK)
6. Import everything saved from step 1
7. Finish off your codeplug by attending to the Optional Setting & encryption keys if applicable and confirm all is correct
8. Send the freshly rebuilt codeplug to the radio
9. If you had a custom start up picture or background pictures, send those to the radio now
10. Save the rebuilt codeplug and ensure you use this saved file as the basis for any further changes you may make, and make sure you delete your old problematic codeplug file.
11. Ensure you rebuild your codeplug using these steps EVERY time a firmware update is made.

A codeplug built using last version’s CPS will sort of work with a new firmware version, but this mis-match in versions is frequently the cause of many problems. Always ensure you rebuild your codeplug with a CPS version that matches with the firmware version you are using in the radio!

• Rule 2: Turn off GPS
If you are not using GPS to send your location via APRS, turn it off. Even with GPS on just in the background but not sending any APRS positioning, the GPS positioning data being sent to the radio processor adds to it’s processing load.

• Rule 3: Turn off Roaming
Roaming adds significant load to the radio processor, and if you really don’t need it, turn it off. Also, never turn on GPS and roaming at the same time - that is just too much for the processor to handle at the same time.

• Rule 4: Make use of the Data ACK disable feature
If you find the radio locks up when ever it is on a certain channel or frequency, it could be reception of non-standard DMR TierII data that is the cause. When the baseband processor encounters this non-standard data, it doesn’t know how to handle it, and can cause the radio to lock up as a result. This can be set in CPS for your problem channels (including the VFOs all the way down the bottom of the channel list), or can also be set by the radio menu selections: Menu > Settings > Chan Set > DataAck Forbid > On.

If you follow these four golden rules, you should never have a lockup or freeze of your radio, and most other problems can be avoided. I’ve been using my 578 from the very beginning, and have never once had a freeze.

Writing your own .CDD files Advanced

Reading data out of the radio flash memory is easy using Colin’s AT Flash Manager software, but if you want to write data, especially to ’critical’ areas of flash memory such as anywhere between 0x02F00000 and 0x02FDFFFF, you will need to use a special technique to do this. This involves creating a CDD file and supporting SPI and CDI files, and sending this to the radio in the ’icon update’ mode (holding PTT & PF2 buttons on power up). This ensures the radio CPU is halted from normal execution while data is being written, and places the radio in a safe mode to permit data to be written. The CDD file is simply a binary image of the data you wish to write - nothing out of the ordinary there. There are three rules you need to follow:

• You must ensure your CDD file is 256kbyte or some multiple of that size
• You must ensure that your data to be written starts at a 256kbyte page eg: hex addresses 00040000, 00080000, 000C0000, 00100000, 00140000 etc.
• And then lastly, you will write this data with an offset of (hex) 20000 bytes above the intended actual location you wish to write to.

Example: you wish to write 256kbytes of data to 0x02F40000. First determine if this is the start of a 256k page. 0x02F40000 is evenly divisible by 040000 (256k) so that is good. Then specify for data to be written with a 128k (hex 20000) offset, so writing should begin at address 0x02F60000, and the data you write will actually go to 0x02F40000.

It is the SPI and CDI support files that tell the radio where to write this data, and how that should be done that is the slightly tricky bit.

SPI format:
20 00 00 00
(number of sections to load in hex)
00
(4 bytes of CDD file length in bytes, little endian)
00 00 00 00


CDI format:
(name of original .bin file followed by 00 then padded out to 256 bytes with 20)
(4 bytes of the starting write address to the radio, little endian - note you need to apply a 0x020000 offset as detailed just above)
(4 bytes of number of bytes to write, little endian)
(4 bytes of the starting point address in the CDD file to begin writing from, little endian)
00 00 01 00
00 00 00 00 00 00
[next record of another section to write, if applicable]
[and so on...]

French text help file

By default, the CPS programming software comes with an English.HPT file that provides the help guidance text in the bottom window. This English.HPT file can be found in subdirectory called Help in your CPS installation folder. Replacing the English.HPT with the following download will give that help text in French. Note the file name must remain as English.HPT, so don’t let that confuse you. This is updated for v1.15
I do not have any other help text files other than French, sorry.

• Download via Mega
• Download via Google Drive
• Download via Sabercat host

Updating the SCT3258 baseband / DMR codec firmware

The ’baseband’ SCT3258 DMR codec IC can have it’s own firmware updated with .hex files. Later releases aimed to improve DMR decoding performance with weak signals, improve stability etc. Provided here is an installer that will send the hex firmware files to the SCT3258 (uninstall any earlier versions you may have, this is v1.4.0.1, earlier versions will no longer work), instructions, and four different version hex files which are the firmware images for the SCT3258. Versions included are: V2.01.05NJ, V2.01.06PN, V2.01.07B5, V2.01.07BA and the latest V2.01.07BF. These are suitable for the 578 of all types, 868, 878, Btech 6X2, Alinco DJ-MD5 & DJ-MD5X and Alinco DR-MD500/MD520 too. To enter the SCT update mode, hold MENU and dial buttons down while powering on the 578, until you get "WARNING This is Boot Mode for Sct!!!" displayed - it can take several seconds of holding the buttons down for this display to appear.
You can check what version your radio is by using menus: Menu > Settings > Device Info > scroll all the way down to see Sct 3258 Ver.
Download the SCT3258 software, instructions and baseband files (3.18 Mb) from:

• Download via Mega
• Download via Google Drive Note Google has recently tightened security for downloads and this file may or may not be available to download by you entirely at Google's discretion
• Download via Sabercat host

Future developments & ideas

• Exploiting the capabilities of the TLV320AIC3204 audio codec chip. This is a very powerful chip with the possible scope to facilitate DSP noise reduction, equalisation, tone control and digital AGC audio.
• Explore some new fonts, perhaps some screen colour changes and icon customisation
• Investigate if the display unit could be remote mounted by use of a longer 40 pin ribbon cable and a custom 3D printed backing plate for physically mounting the head
• Patching the vocoder in the SCT3258 for something else entirely. There is a very strong resemblance between AnyTone’s SCT3258TD_UpdateFlash_v2_01_05NJ.hex and Hytera’s PD36x series SCT3928_UpdateFlash_V2_01_05PD.hex - both in name and hex content. The Hytera can already load different hex files for AMBE, SELP, NVOC & COMM vocoders, but this is slightly dependant on the different hardware installed in the Hytera radios. It would be very interesting to experiment with an open source ham vocoder like FreeDV’s Codec2, and see if this could be used to replace the AMBE2+ vocoder in the SCT3258. Sadly the SiComm hex code that gets sent to the SCT3258 is encrypted, so for the moment any patching is unlikely

© Copyright Jason Reilly, 2018-2022

Except as permitted by the copyright law applicable to you, you may not reproduce or communicate any of the content on this website, including files downloadable from this website, without the permission of the copyright owner.

A huge thank you to Jason Reilly (VK7ZJA) who passed away on 01/17/2023

He allowed me to create this "mirror pages" of his collection of

mods and information.

The original Page was located at

http://members.optuszoo.com.au/jason.reilly1/868mods.htm