Contents

Frequency unlocker for the COTRE CO01D

Radio 672 words 4 minutes
The COTRE CO01D uses the Auctus A6 transceiver IC which can operate from 100MHz-1000MHz. It is possible to edit the codeplug to unlock this expanded range. A simple tool for unlocking is provided.

Initial investigation of the COTRE CO01D shows that it contains an all in one transceiver IC, the Auctus A6. According to the marketing materials, this transceiver IC is capable of an extended range of 100MHz to 1000MHz. These are the results of my attempts at unlocking this larger range.

Comparisons of codeplugs with two different frequencies in the first channel show that the frequency data is stored at 0x219C and 0x21A0 offset as a little endian UInt32 value. After changing the values, loading the edited codeplug showed the new value and this value could be transferred to the radio using the CPS software.

Using a second transceiver tuned to this frequency, the COTRE CO01D was able to receive a transmission from the other radio. I have successfully tested 2 meters and 1.25 meters this way.

I did not attempt to transmit for two reasons. First, in this radio, the T/R switch is PIN diode switch. I have no idea what the specifications are for the diodes in this radio. Some are only effective switches above 300MHz meaning that at lower frequencies the receiver LNA would get blasted by the transmitter. The other problem is the amplifier circuit and filter are not tuned for this expanded range of frequencies and there could be significant impedence mismatches within the transmitter and amplifier.

It is not recommended to transmit outside of the rated 400-480MHz range. I am not responsible for damage your radio might sustain while transmitting outside of the normal frequency range.
Using this method it is possible to transmit on frequencies you might not be licensed for. Keep your transmissions to frequencies for which you have a license.

How does the CPS software determine the frequency range? Setting a value outside of the normal range is fine, but if you try to edit the edited channel, the frequency will reset to the nearest bound. This makes updating a file with multiple extended range channels tedious. It would be easier if the CPS software itself allowed for an expanded range, so where is the software getting these bounds from?

The Auctus CPS software seems to be universal, adding or removing configuration sections as needed for the codeplug currently loaded. Because of this it seemed reasonable that the codeplug itself might have the frequency range stored within.

The codeplug seems to have multiple sections within it. There is a early section which contains information for setting up the options within the CPS software while the later contains the values that are programmed into the radio.

After mapping out the offsets for most of the codeplug information, there is a section of values read from the radio which cannot be edited inside the CPS software. These include the serial number, the radio type, frequency range etc.

In this section, there is a frequency range at offset 0x364 to 0x370, but it is in string format. I thought this range must only be cosmetic, but what the heck, lets change it for fun. And that does it, this string is source of the bounds checking for the CPS software. Any range you want can be set by altering this string.

While I have not experienced any problems so far, it might be possible to set a frequency that the IC or firmware cannot handle and which might cause your radio to crash. Be careful about putting in things like 0 or -1 or 999999999 MHz. Pushing the boundries might lead to neat ways to brick your radio.

To make it easier for the wider community to experiment with this, I am providing this utility to unlock your codeplug. This utility is javascript and runs within your own browser returning the codeplug with the expanded range modification. Your codeplug is not shared with me and no files are uploaded or downloaded.