GP300/P110/GP350/GP280/GP88

GP300/P110/GP350/GP280/GP88

General Information

The model breakdown table for the GP300 series of radios (and a general guide for lots of others):

Type of Unit	TX Power	Freq.	Model Series	Channel Spacing	Channel Signalling	Channel Capacity	Frequency Sub-band	Version	Unique Model Variation
P Portable	2 1W VHF 1W UHF 2W VHF (P110) 2W UHF (P110) 10W VHF (Desk) 10W UHF (Desk)	3 VHF (136-368MHz)	YPC GP300	0 12.5 kHz	0 PL/DPL	A 2 Channels	1 Low Split 136-162 MHZ 403-433 MHz	A	A
D Desk	3 3W VHF (P110) 5W VHF 4W UHF	4 UHF (403-520MHz)	MGC GP350	2 20/25 kHz	9 Select-5 (5-Tone)	B 6 Channels	2 High Split 146-174 MHz 438-470 MHz
E ???	4 5W VHF (P110) 5W UHF (P110)		QLC P110			C 16 Channels	3 "T"-Band 465-495 MHz
	9 5W VHF 4W UHF		YPJ GP300gs GP300km GS300gs GS300km			D 8 Channels	4 192-208 MHz 490-520 MHz
			PFL People Finder			E 4 Channels	5 403-470 MHz 403-433 MHz TX 438-470 MHz RX
			PFP People Finder			G 10 Channels (8+2)	6 403-470 MHz 438-470 MHz TX 403-433 MHz RX
			VMC GP88				8 336-368 MHz

The P in the Type field stands for Portable, the A in the unique model package means the radio was included in a package with Battery, Antenna, etc. The "8+2" model is a unique model that has 8 normal channels and 2 scan list channels (the scan list channels can be programmed normally as well but on the escutcheon they are labeled as scan).

You will find there are a number of the newer series of radios with model number based on this system. Therefore, you can use this as a guideline when trying to figure out what a radio does.

The HKN9755A is the stand-alone cloning box that can be used with the GP300/P110. It is a microprocessor based device that will read a target radio and dump the codeplug to a target radio.

If you want to make up your own remote accessory for these radios you will want to look at the service cable schematic as well as this schematic of a GP300 speaker microphone.

You can find the programming cable for the GP300/P110/GP280/GP88 here.

If you want to see the programming cable for the GP350, look here.

In order to use your GP300 accessories with your GP350, you will want to order the HLN9482A GP300/350 accessory adapter.

If you want to build a nice little programmer for the GP300 radios, one that does not require a RIB, check out this link.

This is the service cable for the GP300 series radios. It is used for tuning the radio with RSS.

FYI, there is a program out there that "fell" out of a Motorola LAB that allows you to read and edit the GP300 codeplug directly. We do not know where it is, just that it does exist. It is generally called GP Utility or GP Tools or something like that. It looks similar to RSS but its only function is bit banging.

You need this codeplug editor if you are going to increase the number of channels in a Select-5, Select-V, 5-Tone, GP300. Refer to this page for more information on the procedure.

The GP88 is basically a GP300 in a slightly different case (like a P110 is). If you TK one you should be able to make it a GP300 with all the GP300 features.

Are you curious about what is inside your GP300 battery pack?

If you have one of the GP300 5-tone models with a display, it shows an error something like 053, and it doesn't want to accept a codeplug, you can try turning on the radio with all the side buttons pressed including PTT. This will put the the unit radio into test mode and it will accept the codeplug, if it�s the right model.

Fuse Location

Yes these radios have a fuse. To access it, first pull off the top knobs. Turn the radio so that you are looking at the battery connection side. At the bottom of the metal chassis, gently insert a flat-blade screwdriver between it and the housing, and pry up.

After you have the chassis out of the housing, carefully remove the speaker/microphone header plug. Note that there are four retainer clips holding the chassis together. With your screwdriver, gently pry off the clips. Hold your finger down on them as you do this so you don't shoot them across the room.

Once you've done this, you should have the main circuit board, the metal chassis and a large shield apart. On the metal chassis, on the opposite side of the battery contacts, you will see a small circuit board. On this board is the fuse, it's usually a square white fuse. Sometimes it's round. The Motorola part number is 6580561D02, four amps.

If you are not a technician and are not experienced at disassembling radios, you must exercise caution, people have been known to wreck the housing, RF board or both just trying to get it apart, believe me it's easy to do if not careful.

Also, it is VERY rare that this fuse blows, so chances are that there is something else wrong with the radio if it will not power up.

Low Audio With GP300

If you have a radio that has low or distorted audio output, there is a good chance that you need to check and probably replace one of the small little SMC components right next to the volume control.

The Hoffis Pages

You will want to check out the pages below for some very important hacking information on the GP300. Some of the codeplug structure, disabling the encryption, cloning, etc., it can all be found in these two pages.

Check out page 1.

Check out page 2.

220MHz Radios

More and more 220MHz capable GP series radios are starting to show up on the market.

Generally these are GP280's, however, GP300's are around as well.

The GP280's usually need GP280 RSS, while the GP300's can usually be programmed with regular GP300 RSS.

The standard bandsplits that may be found are 216-223MHz, 222-223MHz, and 205-225MHz. All of them use the same RF section, hence, all of them are capable of 205-225MHz, and possibly a little more.

In order to program out of band frequencies into the first two bandsplits (to facillitate use in the Ham Band), follow any of the out of band instructions listed above. The software is set up all the same way and the existing modifications will work.

Converting VHF to 220MHz

The following is from http://home.teleport.com/~n3eg/gp300_220.htm in regards to converting a 146-174MHz GP300 to the 220MHz band:

You will need to take some brass slugs from UHF VCO coils and replace the VHF ferrite slugs with them. Tweak them down all the way inside the coils, and they will lock on 220. Change the 3 low pass filter coils near the antenna from 7 turns to 3 turns and the 4 capacitors to 12pF. At this point you will have 1 watt output.

02/26/03 - Update: Removing C115 and putting it in place of C114 gives 2.2 watts output. Leave all the other capacitors alone.

Modify the RSS with the changes available on this page to be able to program up to at least 230Mhz.

You will also need to modify the front end module (still working on that - as of 1/21, it's down to 1 microvolt.) You will also need to jumper around or modify the VCO low pass filter on the receive side. Deviation and power set do NOT work outside the original calibration points, and may need to be set manually with component changes. You will need to either buy or cut an antenna for 220.

03/07/02 - Update: I have removed all passive components from the input/output Chebyshev filters in the RF module and replaced them with single tuned circuits. Sensitivity is now about 0.4 microvolts, but front end noise is lower than it should be, and the squelch is still tight even at a setting of 1. Deviation is weird - about 7kHz with no encode tone, and 5kHz with PL encode.

The latest on the receiver is I have it down to .4 microvolts for 20 dbQ with my 2 single tuned input/output circuits on the front end transistor and the entire RX VCO lowpass filter out.

Out of Band Information

To program frequencies outside of the rated bandsplit in the GP300/P110/GP350 is very simple, follow the listed steps:

Hold the shift key down while entering the frequency you want
You must release the shift key when you enter the decimal point
You must fill the entire field-use zeros(while holding down shift)
When you are done hit enter like normal and the frequency you entered will appear in regular decimal like any other frequency.

Out of Band Information, Alternate Method

In the GP300.MDF file make a Checksum-16 of the whole file (the F12 option in Hex Workshop), in our case we ended up with 0xF2D3 (RSS V 05.00), write this down, you might need it later.

Look starting at about offset 0x402, you should see something like:

00000402 02 00 94 11 5C 12 94 11 5C 12 94 11 5C 12 05 00 50 05 ....\...\...\...P.

05 00 = Bandsplit identifier (Note: it is at the end of the frequency assignments)

94 11 = 4500 in decimal, ie 450.0000 MHz

5C 12 = 4700 in decimal, ie 470.0000 MHz

Note there are 3 occurances of the strings 94 11 and 5C 12, the first set is the limits displayed in the Radio Wide menu (F4-F2). The second set are the TX limits for the radio. The third set are the RX limits for the radio (note that if the TX and RX limits are not set the same the RX limits are screwed up).

To figure out what hex to enter for your bandsplits you can either use the Base Convertor (in Hex Workshop), or use a calculator with a HEX --> DECIMAL conversion function. If you are using a calculator enter your limit (ie 1440 for 144.000 MHz) and convert it to hex, you should get 0x05A0. When you enter the data into the .mdf file you have to reverse the bits such that you would actually enter 0xA005 in the field you are changing.

Some of the RSS packages (We don't have codeplugs for everything, so We can't check them all) check the checksum of the .mdf file when you try and load a codeplug and return an error if the checksum of the .mdf file doesn't match the one stored in the program. If you don't get an error when you run the RSS with the new .mdf and try and load a codeplug then you don't have to worry about the next step.

If you get a corrupt .mdf file error then you will have to go back and correct the checksum in youredited .mdf file. Load the file back in your hex editor and make a Checksum-16 of the file. If you compare the new checksum with the original one for the file they probably will be different.

The only way we have to correct the checksum of the file at this time is to keep editing bits and making Checksum-16 calculations until the edited file's checksum and the original match. You can either edit the Copyright statement or some of the model descriptions in the file. Just take one or a few of these insignificant bytes (some experimentation may be required depending on by how much the cheksum is out) and add or subtract a few bits of the numbers make a Checksum-16 of the file. You should notice the checksum has changed by the number of bits you added or subtracted. Keep going until the checksum's match.

Once the checksum's of the files match you should be able to run the RSS, load the codeplug, and enter the frequencies within your new bandsplits with ease.

Out of Band Information, Alternate Method 2

First, make a backup copy of the GP300.MDF file.

The, using your Hex Editor, perform the following:

Knowing your radio's model number in advance, look into the gp300.mdf for the model number (use a text search)
You want to write down the hex byte two places to the left side of the first letter of the radio model number you found ie. (xx xx P94YPCXXXXX)
Then do a text search of the model number you want to convert this radio to, lets say you want to go from 403-470 to 465-495. Once again, write down the hex byte two places from the left of the first letter of the model number (xx xx P94YPCXXXXX), just like above
Now, since you are here, replace this hex byte you just found with the one you first wrote down (make sure you are in overwrite mode and not insert)
Then, do a text search again for the original radio model (you may have to start at the top of the file) and replace the hex byte you first found with the one belonging to the model you want to convert to
Save the changes and you are done!

That's it. Now, when you run the RSS and read the radio via the RIB, the program thinks you have the 465-495 model and you can input the frequencies in this range with out any limitation, and still have the extra out of band with the shift key. BUT, remember, you haven't changed the RF section in the radio, so you will only be able to get the radio to work up to +/-10MHz outside of its original split, if you are lucky.

You don't have to worry about the checksum of the .mdf file because you only moved hex bytes within the same file, not adding or subtracting anything. The RSS shouldn't crash.

Expand the radio to 16 channels

There are several ways you can add channels to a 2 or 8 channel GP300/P110 radio. The easiest is to use a program called TK (Took Kit). This programs plugs into the normal cables and RIB and does all the work for you. TK won't work with the GP350 so don't try it. The hex method may work but has not been tested.

NOTE: I do not have any sources for TK, so don't bother asking, you're on your own.

Expand the radio to 16 channels, Alternate Method

A much slower but just as effective way of doing it is to use Hex Workshop to edit the saved file. The saved file from the GP300/P110 uses some form of encryption that changes the look of the file each time it is saved in RSS. This can sometimes make the below process long and boring.

First, make a backup of the codeplug file you want to edit (copy it to a .bak or something). In the event you loose track of which bit you are editing and get a Error 58, its easy to start over again.

Next, load your codeplug file into your hex editor. You want to edit the byte right after the end of the serial number. Make a note of it's original value and increment it or decrement it by one and save the file.

Exit the hex editor and start up the GP300 RSS. Try loading the file you just edited, you will either get an Error 21 (Radio not supported) or the codeplug will load okay (once in a while you may get an Error 58, but this isn't very common).

Note the model number that the codeplug has loaded as, and compare it to the original model number of the radio. If the nineth character of the model number is a "C" (ie. P93YPC20C1__) you have a 16 channel codeplug. Also, make sure that the rest of the model number is the same, otherwise you may have made a 16 channel codeplug on some other band!

If the RSS won't load the codeplug, go back to the hex editor and change the bit again, save the file in the hex editor and try loading it again. Keep repeating this until a) you get tired and give up, b) you are successfull, or c) you edit that byte all 255 times. If you have come to point c), edit the byte to something you know that works, load it in RSS and re-save it in RSS. This will re-encrypt the file and you can continue editing.

If you want to do this faster, you should check out the Hoffis pages (above) and disable the encryption for the codeplug. Heck, if you can manage to do that, you should be able to make the 16 channel modification easily then. :)

Tips:

run the RSS in one DOS window of Windows 3.1x and the hex editor in another to make swapping between the programs less painfull
try editing the byte up and down a ways and see how many "good" loads you get, you will probably find that the "good" loads will be somewhat grouped together
if you aren't having much success finding many combinations which will load, re-save a good codeplug in RSS to scramble the codeplug and keep trying.

Note: Sometime in 1994 Motorola changed the 2 channel radios such that if you were to hack the radio into an 8 channel model, you still get 2 channels. The change was the microprocessor to a new unit that only recognizes the common and 1 line of the channel selector. The channel switch is the same regardless of which radio you have. Only by changing the CPU can you then change the number of channels to more than 2. To tell if you can convert your radio, pop the knob off and turn the selector. If the 2 channels programmed in the radio come up in the order 1,2,2,2,2,2... it will work. If they come up 1,2,1,2,1,2,1,2... forget it, you'd probably have to change the microprocessor to get it to work.

Expand the radio to 16 channels, Alternate Method 2

Depending on which firmware is in your radio, this may or may not work (see Note above).

Open the GP300.MDF in your Hex editor and make a Checksum-16 of the whole file. You will need this later, so write it down. For RSS version 5.00 I got a checksum of 0xF2D3.

Search for your model number in the file, you probably will come accross more than one entry so you can either change them all or change them one by one until it works.

Once you find your model entry you should see something like this:

0000086C 50 39 34 59 50 43 32 30 43 33 5F 5F 06 1F 10 04 27 40 14 20 19 50 P94YPC20C3__....'@..P

If you look at this model entry, the third byte after the model number (offset 0x87A) is a 10. This is the hex representation for the number of channels in the radio, in this case 16ch. Most of the time you will see a 0x02 or 0x08 in this position for 2 or 8 channel radios respectively. Try changing the field to 0x10 to make a 16 channel radio and see what happens. Also note the 06 at offset 0x878, this is the bandsplit for this model number and corresponds with the bandsplit entry in the table at the top of the .mdf file.

The .mdf file for these radios is checksum protected and every time the RSS loads it calculates the checksum for the file and compares it to an internal reference to see if it matches. If the checksums do not match you will get an error message.

To find out if you picked the correct model number to edit, save the .mdf file and load your radio's codeplug into the RSS. Try adding channels with the Mode Utility and see what happens.

Some other RSS modification tips for the GP300

GP300 RSS ver.R07.00.00 31-Oct-94.

If you would like to program any GP300 radio with the codeplug information previously got from another GP300 (serial number, model, freq. range etc. doesn't matter), do the following:

In the file gp_2.ovl. look for signature C6 46 FC 00 9A E3 08 at offset 10949 (2AC5h) and modify three bytes from ** into 90h:

Old string = C6-46-FC-00-9A-E3-08-XX-XX-**-**-**

New one = C6-46-FC-00-9A-E3-08-XX-XX-90-90-90

XX means the value doesn't matter, leave old values (these bytes contain segment address and may vary).

Run gp300.exe and load archive file with the codeplug info previously saved on disc.

Press (F8) and program any target GP300. Model number, serial and features will be copied into it.

If you want to disable frequency checking for entering out of band frequencies in RSS, try doing the following modifications:

Search for 77 10 around location 3E80 and replace with 90 90
Search for 77 03 around location 3E8D and replace with 90 90

One disables frequency checking on tx, the other on rx. Note that the locations will vary depending on the version of RSS.

Out of band for 5-tone radios

This seems to work on 5-tone version 2 RSS.

Program your out of band frequency into either the TX or RX field, then use [shift]-F2 to leave the field. This only seems to work for +/-2MHz or so.

Another thing to try is using the shift key to enter the frequencies into the field remembering to release it for the decimal point, ie. 146.9400 would be !$^.($)) just make just you are using a standard English keyboard layout.

If this doesn't work, then try the method below.

You will have to make modifications to the gp300-5t.gdt file. �

This modification makes the following changes: �

403-433 expanded to 403-520
438-470 expanded to 403-520

To make the changes, open the gp300-5t.gdt file in a Hex editor. �

Use "EDIT" and "REPLACE" and search for 433000000 (400ECF19h). You should probably find an entry at addresses 0064h and 006Ch, replace with 520000000 (0092FEIEh) (TX and RX HI freq Range for 403-433). �

Use "EDIT" and "REPLACE" and search for 470000000 (80A1031Ch). You should probably find an entry at addresses 0094h and 009Ch, replace with 520000000 (0092FEIEh) (TX and RX HI freq Range for 438-470). �

Use "EDIT" and "REPLACE" and search for 438000000 (80591B1Ah). You should probably find an entry at addresses 0090h and 0098h, replace with 4030000000 (C04A0518h) (TX and RX LOW freq Range for 438-470). �

Use "EDIT" and "REPLACE" and search for 436000000 (00D5FC19h). You should probably find an entry at addresses 0610h, replace with 5200000000 (0092FE1Eh).

Use "EDIT" and "REPLACE" and search for 475000000 (C0EC4F1Ch). You should probably find an entry at addresses 06D0h, replace with 5200000000 (0092FE1Eh).

Use "EDIT" and "REPLACE" and search for 434000000 (8050DE19h). You should probably find an entry at addresses 0678h, replace with 4030000000 (C04A0518h).

This should be all that is required. For a VHF version, the process is similar.

All you have to do is convert the edge of the bandsplit you are looking for from decimal to hex using Hex Workshop'd Base Converter (make sure the byte order is "Intel") and search in the file for it. Remember to put all the trailing zeros in when you do the decimal to hex conversion.

Disable Codeplug Check for 5-tone radios

If you have managed to get a mangled codeplug crammed into your GP300 5-tone radio and would like to get your old codeplug back in, you've probably found that the RSS will not let you. When it checks the radio prior to programming, it gives you an error (because it doesn't think you have the proper radio connected).

In order for you to be able to program your backup original codeplug back into the radio, you must disable the check. This can be done as follows:

For each version, you will open the GP300-5T.EXE file with your Hex Editor.
Go to the offset listed and change the bytes 0x7506 to 0x9090. This changes the JNZ instruction to a NOP (no operation) and effectively bypasses the routine that checks the radio before programming.

Version R01.02.03 Offset 0x1137E
Version R02.03.00 Offset 0x129D1
Version R02.04.00 Offset 0x11FFE

If you have any questions, email us and we'll try to help.

Top

Home