Initial investigation of the COTRE CO01D shows that it contains an all in one transceiver IC, the Auctus A6. According to the marketing materials, this transceiver IC is capable of an extended range of 100MHz to 1000MHz. These are the results of my attempts at unlocking this larger range.
Comparisons of codeplugs with two different frequencies in the first channel show that the frequency data is stored at 0x219C and 0x21A0 offset as a little endian UInt32 value. After changing the values, loading the edited codeplug showed the new value and this value could be transferred to the radio using the CPS software.
Using a second transceiver tuned to this frequency, the COTRE CO01D was able to receive a transmission from the other radio. I have successfully tested 2 meters and 1.25 meters this way.
I did not attempt to transmit for two reasons. First, in this radio, the T/R switch is PIN diode switch. I have no idea what the specifications are for the diodes in this radio. Some are only effective switches above 300MHz meaning that at lower frequencies the receiver LNA would get blasted by the transmitter. The other problem is the amplifier circuit and filter are not tuned for this expanded range of frequencies and there could be significant impedence mismatches within the transmitter and amplifier.
How does the CPS software determine the frequency range? Setting a value outside of the normal range is fine, but if you try to edit the edited channel, the frequency will reset to the nearest bound. This makes updating a file with multiple extended range channels tedious. It would be easier if the CPS software itself allowed for an expanded range, so where is the software getting these bounds from?
The Auctus CPS software seems to be universal, adding or removing configuration sections as needed for the codeplug currently loaded. Because of this it seemed reasonable that the codeplug itself might have the frequency range stored within.
The codeplug seems to have multiple sections within it. There is a early section which contains information for setting up the options within the CPS software while the later contains the values that are programmed into the radio.
After mapping out the offsets for most of the codeplug information, there is a section of values read from the radio which cannot be edited inside the CPS software. These include the serial number, the radio type, frequency range etc.
In this section, there is a frequency range at offset 0x364 to 0x370, but it is in string format. I thought this range must only be cosmetic, but what the heck, lets change it for fun. And that does it, this string is source of the bounds checking for the CPS software. Any range you want can be set by altering this string.