has anyone managed to hack into their V1 and do their own firmware update

DanDaMan

Learning to Drive
General User
Joined
Oct 19, 2019
Messages
16
Reaction score
8
I have an older V1 (~15 years) old which was stored for the last 8 years but now I want to start using it again. I checked the version and it is 3.825 which means it is on the latest hardware version of 1.8. Being an update then means just new firmware, it sounds rather easy with the right instructions. I do firmware updates all the time on my android tv boxes, my laptops, phones, etc. Doing a firmware update should be easy on these too.

Has anyone managed to figure out how to do it?
 

codesplice

Professional amateur
Advanced User
Premium Member
Joined
Mar 21, 2013
Messages
778
Reaction score
424
Location
AL

BlueV1

We are all in this together.
Advanced User
Lifetime Premium Member
Joined
Feb 8, 2016
Messages
3,809
Reaction score
7,278
Location
Western NC
It's my understanding that the data channel for updates is on the third pair of the RJ-12 jack.

That would be a good starting point if anyone wants to explore.
 

DanDaMan

Learning to Drive
General User
Joined
Oct 19, 2019
Messages
16
Reaction score
8
It's my understanding that the data channel for updates is on the third pair of the RJ-12 jack.

That would be a good starting point if anyone wants to explore.
so a RJ12 has 6 wires as shown here (https://www.google.com/url?sa=i&source=images&cd=&ved=2ahUKEwiB_oupva3lAhUJY6wKHd9iDewQjRx6BAgBEAQ&url=http://7.oak.feuerwehr-lengede.de/rj12-connector-diagram.html&psig=AOvVaw0UCPV1QV4ykY8BsiboFO3T&ust=1571751652276557) - when you say the 3rd pair is the data channel, does that mean the yellow and blue are the 2 wires for data transfer? I assume one is to read from V1 and the other to write - does anyone know which color does it?

The next thing needed would be a copy of newer firmware - anyone know if this can be found anywhere on internet to download? If not, then if we can figure out how to 'talk' to the V1 it would be easy for someone to copy their firmware and make available.

I'm gonna start looking into it seriously - I can understand needing to pay for an update if hardware is outdated and needs replacement, but for a firmware update it makes no sense. Most companies offer free firmware for their electronics. Buy an brand computer and the company has firmware for it for free - buy any phone same - I've never heard of a company charging for firmware
 

Vancity23

Advanced User
Lifetime Premium Member
Joined
Jun 11, 2017
Messages
3,906
Reaction score
4,557
Location
Vancouver, B.C.
I dont know anything about it, but someone on here was able to get connected into a Uniden R1 or 3, and do some interesting things...
 

Mushin

Chillax
Advanced User
Lifetime Premium Member
Joined
Jan 2, 2012
Messages
1,369
Reaction score
3,493
Location
Neither Here or There
Buy an brand computer and the company has firmware for it for free - buy any phone same - I've never heard of a company charging for firmware
I guess you've been lucky enough not having to deal with Cisco, HP (servers), or Obihai. Those are 3 off the top of my head. I'm sure there are more. I can think of a lot more companies that "obsolete" their hardware by not providing firmware/OS updates after a couple of years (Apple/Android ...).
 

BlueV1

We are all in this together.
Advanced User
Lifetime Premium Member
Joined
Feb 8, 2016
Messages
3,809
Reaction score
7,278
Location
Western NC
when you say the 3rd pair is the data channel, does that mean the yellow and blue are the 2 wires for data transfer? I assume one is to read from V1 and the other to write
Phone jack pairs start at the center. 3 & 4 are the primary pair. 2 & 5 are the secondary pair, 1 & 6 are there tertiary pair.

Current devices for the V1 only use pairs 1 and 2. The factory data channel should be on pins 1 and 6 with either 3 or 4 as the common.
 

DanDaMan

Learning to Drive
General User
Joined
Oct 19, 2019
Messages
16
Reaction score
8
Phone jack pairs start at the center. 3 & 4 are the primary pair. 2 & 5 are the secondary pair, 1 & 6 are there tertiary pair.

Current devices for the V1 only use pairs 1 and 2. The factory data channel should be on pins 1 and 6 with either 3 or 4 as the common.
Confused - you say V1 only uses pairs 1 and 2, so basically it is a RJ11 which doesn't use pins 1 and 6 (the 3rd pair). But then you say the data channel is on pins 1 and 6 - so does it use all 6 wires (basically a rj12) or is the V1 a 4 wire unit (rj11).

Does anyone have a wiring schematic? Thanks
 

InsipidMonkey

Premium Monkey
Advanced User
Premium Member
Joined
Mar 22, 2017
Messages
6,102
Reaction score
12,501
Location
New England
Confused - you say V1 only uses pairs 1 and 2, so basically it is a RJ11 which doesn't use pins 1 and 6 (the 3rd pair). But then you say the data channel is on pins 1 and 6 - so does it use all 6 wires (basically a rj12) or is the V1 a 4 wire unit (rj11).

Does anyone have a wiring schematic? Thanks
The jack on the V1 has 6 pins - the center two are power, the next pair out are mute and ESP data, and the outer pins are "reserved for factory use" and possibly what they use for firmware updates at the factory.
 

SquirrelMaster

Do as I say, not as I do.
SysOp
Advanced User
Lifetime Premium Member
Joined
Dec 3, 2015
Messages
2,996
Reaction score
5,992
Location
Liberal California
The mcu inside has two lines used for programming; reset and data. (and common/gnd).

The rj12 has two extra lines reserved for factory use (plus a common/ground).

I wonder if there's any connection there (pun intended)


Yeah this is something I've been wondering recently too and started looking into two days ago. If you want to play along at home, the part number of the mcu is freescale mc9s08jm32.

And here are some pictures of the v1's guts should you feel the need to reverse engineer it and draw a schematic. (yes I was doing this on my bed for certain reasons)
IMG_20191019_221857.jpg
IMG_20191019_221655.jpg
IMG_20191019_221422.jpg
IMG_20191019_220912.jpg
IMG_20191019_220746.jpg
 

Transporter

ModWight Transporter
Advanced User
Lifetime Premium Member
Joined
Jul 3, 2018
Messages
3,048
Reaction score
4,583
Location
In front of you but behind a Rabbit
Bigger question, where are going to get the updated firmware from to do an update even if you figure it out?

And if your unit is 15 years old, new firmware wouldn't work on yours anyway because the V1 was completely replaced by a new unit during one of the updates.
 

InsipidMonkey

Premium Monkey
Advanced User
Premium Member
Joined
Mar 22, 2017
Messages
6,102
Reaction score
12,501
Location
New England
1571680919796.png
 

DanDaMan

Learning to Drive
General User
Joined
Oct 19, 2019
Messages
16
Reaction score
8
Bigger question, where are going to get the updated firmware from to do an update even if you figure it out?

And if your unit is 15 years old, new firmware wouldn't work on yours anyway because the V1 was completely replaced by a new unit during one of the updates.
Yes, but mine is the 1.8 hardware which went up to 3.873 where mine is currently 3.825 - if I then can find and load 3.873 I'd have all the newer features except ESP and K Fighter. I don't care for ESP (phone connection) and really don't care much for K Fighter). But I'll then have the crystal tuning, traffic monitor, along with whatever improvements came.

Making a USB cable to connect to V1 is easy. Basically take spare USB and any 12V 1AMP power supply, and spare RJ12 plug. Then connect the 2 center RJ12 plugs (pos and neg - power) to the 12V power supply (use multimeter to ensure you have polarity right). Then take 2 outer wires and connect to the white and green USB plug (the data wires). Then you plug 12V power into wall socket (which will already turn on V1) and plug USB to computer - you now have the data wires ready to talk. I'm researching different software, as there are lots of custom tools for reading and writing firmware from EEPROM using this method. Also research I2C Bus as there are small boards made to talk to RJ12 devices. Also research Lego NXT which is a device made by Lego to program RJ12 devices too (can be bought off ebay for <$20). Anyways, still in the early stages of research, but I'm sure with a little more time I'll be able to find a way to extract and save the firmware currently in the unit. Then all I'll need is a newer firmware from someone willing to extract their copy and share (for the benefit of all, as if we figure this out we can all share). FYI - from the little reading I've done, I did find that Uniden also have multiple and current firmwares - they don't charge for their upgraded copies.
 

SquirrelMaster

Do as I say, not as I do.
SysOp
Advanced User
Lifetime Premium Member
Joined
Dec 3, 2015
Messages
2,996
Reaction score
5,992
Location
Liberal California
Yes, but mine is the 1.8 hardware which went up to 3.873 where mine is currently 3.825 - if I then can find and load 3.873 I'd have all the newer features except ESP and K Fighter. I don't care for ESP (phone connection) and really don't care much for K Fighter). But I'll then have the crystal tuning, traffic monitor, along with whatever improvements came.

Making a USB cable to connect to V1 is easy. Basically take spare USB and any 12V 1AMP power supply, and spare RJ12 plug. Then connect the 2 center RJ12 plugs (pos and neg - power) to the 12V power supply (use multimeter to ensure you have polarity right). Then take 2 outer wires and connect to the white and green USB plug (the data wires). Then you plug 12V power into wall socket (which will already turn on V1) and plug USB to computer - you now have the data wires ready to talk. I'm researching different software, as there are lots of custom tools for reading and writing firmware from EEPROM using this method. Also research I2C Bus as there are small boards made to talk to RJ12 devices. Also research Lego NXT which is a device made by Lego to program RJ12 devices too (can be bought off ebay for <$20). Anyways, still in the early stages of research, but I'm sure with a little more time I'll be able to find a way to extract and save the firmware currently in the unit. Then all I'll need is a newer firmware from someone willing to extract their copy and share (for the benefit of all, as if we figure this out we can all share). FYI - from the little reading I've done, I did find that Uniden also have multiple and current firmwares - they don't charge for their upgraded copies.
This won't work for a multitude of reasons.

The outer two pins are actually serial ttl data. You need a serial converter.
They pass through the most simple input circuitry I have seen and then go to pins 13 and 14 on thecu which are UART1.

VR probably wrote a very basic bootloader for the v1. I ordered a programmer for the mcu inside. When it shows up, I'll dump the firmware and see if I can reverse engineer the bootloader so that we can update without needing any special hardware.

Input circuitry schematic attached:
IMG_20191021_112921.jpg
 

barry

PSL +5
Intermediate User
Joined
Mar 4, 2012
Messages
223
Reaction score
234
Location
Alabama
Yes, but mine is the 1.8 hardware which went up to 3.873 where mine is currently 3.825 - if I then can find and load 3.873 I'd have all the newer features except ESP and K Fighter. I don't care for ESP (phone connection) and really don't care much for K Fighter). But I'll then have the crystal tuning, traffic monitor, along with whatever improvements came. …...
I believe crystal tuning would require a hardware change.
 

InsipidMonkey

Premium Monkey
Advanced User
Premium Member
Joined
Mar 22, 2017
Messages
6,102
Reaction score
12,501
Location
New England
I don't care for ESP (phone connection) and really don't care much for K Fighter). But I'll then have the crystal tuning, traffic monitor, along with whatever improvements came.
Junk K fighter is part of traffic monitor filter, colloquially known as TMF2.

Crystal tuning is a hardware upgrade.

VR firmware upgrades are infrequent, but well worth the cost. The last upgrade to TMF2 added BSM filtering that took the rest of the industry 7 years to catch up with. They also check and calibrate your detector when you send it in for a firmware upgrade, and send it back with an additional one year warranty. No one else does that.
 

DanDaMan

Learning to Drive
General User
Joined
Oct 19, 2019
Messages
16
Reaction score
8
I believe crystal tuning would require a hardware change.
I took a 2nd look (copied below), and now I see that it does look like a hardware update occured for 3.851 (when crystal tuning added) - it confused me cause they are all under the hardware 1.8 version, but the comment beside does say that crystal tuning was actual 1.8A, which I didn't realize meant an actual hardware change (I was hoping this was just software related). So based on that, my hardware can only go to 3.826 (only 1 upgrade above my 3.825) which didn't even add anything. So I guess my unit is stuck as-is and not capable of upgrading. Too bad, cause I was looking forward to messing with this thing. Now my only option is to pay ~$300US (about $425 CDN) for an swap/upgrade which is not nearly worth it (at least for me). I'll either keep my unit, or just try to flip locally - likley will be able to get $200CDN for it, since in all of Canada there is only 1 V1 for sale on both craigslist and kijiji.


Hardware Version 1.85:
3.8945 - Junk K Fighter enabled by default
3.894 - TMF2 for blind spot vehicles, Improved Euro Mode with wider K band range to cover lower frequency photo radar in Europe
3.893 - ESP Programming, the changes were the V1 ID went from a '9' to 'A', checksums went to all packets
3.892 - Added ESP
3.891 - Traffic Monitor Filter added

Hardware Version 1.8: This platform with Crystal Tuning became identified as "1.8A" beginning with 3.851 thru 3.873
3.873 - Traffic Monitor Filter Beta
3.872
3.871
3.868
3.864 - Added Euro X band (may have been Beta tested on 3.863)
3.863
3.861
3.858
3.857
3.851 - Crystal Tuning added, Digital Temp Control ('A' Designation on the FCC ID)
3.826
3.825
 

Discord Server

Forum statistics

Threads
79,104
Messages
1,204,497
Members
20,083
Latest member
AlexP1401
Top