I recently bought a pair of Retevis RT622P walkie, and while reading the manual I discovered that they have a software for configuration.
It is very simple, in fact it works decently on wine. The communication is thought the com ports and in fact the software comes with driver for the PL23xx serial to usb. Silly me I thought the walkie had this converter integrate and you only need to connect them to the PC with the USB C cable. NO, they sell to you an "programming cable" for $28.99 on the official store or 5 € on Aliexpress. This cable is the same for the RT20 RT65 RT665 RB19 RB619 RT622P RT22P.
Making a custom cable
I didn't want to buy yet another USB to serial adapter, so after a little teardown, I traced back where they connected the serial lines.
They connected TX and RX to USB D+ and D- directly, so after a little bit of getting "creative"(doing shoddy work), I managed to connect the walkie to the software.
Also, if you are using wine, you should do this to map your serial port.
Unlocking
The software let you change every config for the channels except the frequency, TX power and wideband. This I believe it is for legal reasons (Those devices are unlicensed legal PMR446). But if you go to About->Setup and in password you put "retevis" these settings become editable.
Communication protocol
The serial port is opened at 9600 bauds 8N1 parity.
For describing the communication, I will put in italics the hexadecimals values, SW send when the software sends out a data to the serial port and walk respond when the walkie send data to the software.
Start
The following sequence is followed each time the software is going to write or read from the walkie.
SW send: 02 43 31 36 30 52 41 4d (.C160RAM)
walk respond: 06
SW send: 02
walk respond: 06 00 00 00 00 00 00 00
SW send: 06
walk respond: 06
SW send: 05
walk respond: ff ff ff ff ff ff (This possibly is the RW password)
SW send: 06
walk respond: 06
Write to the walkie
When write to walkie is selected, the software start to send sequences like 57 00 1a 0d f5 96 a8 02 f5 96 a8 02 48 11 48 11 ef (the same as the Dat files) and receiving 06. Finally, the software send 62 (Reset?).
Read from the walkie
When read from walkie is selected, the software start to send sequences like 52 00 XX 0d and receiving 57 ... sequences like the Dat files). XX is the 3rd value of the 57 ... sequences, it is basically an index value.
Dat files
They contain all the channels and other configs in a sort of tabular storage. You can see where each parameter is by saving two of these files with different values for that parameter. There are for sure some "hidden" parameters the software cannot change but I don't have the time to play around with them right now.
Top comments (0)