Page 2 of 3
Re: Password for CDM1550LS
Posted: Wed Nov 28, 2007 2:41 pm
by Batwings21
The hack listed by HLA in the other thread does not work for me. It allows reading, and show blank password, but when I go to write it it will not write.
Re: Password for CDM1550LS
Posted: Thu Nov 29, 2007 9:32 pm
by HLA
it reads and writes for me.
Re: Password for CDM1550LS
Posted: Wed Dec 19, 2007 2:07 pm
by com501
This method does not work for me, either, using 6.09.06. Any help other than "it works for me"??
Even the active memory hack does not appear to produce any usable results.
Re: Password for CDM1550LS
Posted: Thu May 15, 2008 1:46 pm
by n7maq
bchbumn wrote:For R06.08.05 I found it at offset: 02380650
change 741C to EB1C
that should take care of the problem!
Has anyone found the address/offset for R06.10.02 ? I tried the other day for over an hour, and I went form top to bottom of the file changing from to 74 to EB where I saw it. No luck, ether it does not work with this rev or I screwed up along the line and did not get the file saved before I tried to open the test CP.
Thanks,
Jim
Re: Password for CDM1550LS
Posted: Thu May 15, 2008 2:42 pm
by tetrapack
Download portmon is very easy
capture and show txt archive from radio
Florencio
Re: Password for HT1550LS
Posted: Sun Jul 13, 2008 10:50 am
by n2meg
Hi
Anyone have the hex value for version RSS Pro R06.09.06, I can't read the cps on this radio it's password protected.
Re: Password for CDM1550LS
Posted: Mon Jul 14, 2008 4:35 pm
by n2meg
HT1550 CPS 6.09.06 CRACK
well offset 1E9FF8 will read and bypass the password, reading no problem!
writing back to radio it will ask for password even if you change the password
it will state it's the wrong password!
I could not find offset 1E9FF8, but I found 741C in that area
Please help!
thanks
R06.09.06 right?
Pablo n2meg...
Re: Password for CDM1550LS
Posted: Mon Jul 14, 2008 7:52 pm
by The Pager Geek
Where is super-haxor HLA? "it works for him"
Re: Password for CDM1550LS
Posted: Mon Jul 14, 2008 10:09 pm
by Hightower
The Pager Geek wrote:Where is super-haxor HLA? "it works for him"
No super haxor here, but my notes for R06.09.06 with reguards to passwords......
Try this:
CPS R06.09.06 @00248699h there should be 74. Change this 74 to EB and save.
This should allow ya to read and write radio, just press enter when the P/W screen comes up.
Re: Password for CDM1550LS
Posted: Tue Jul 15, 2008 5:42 am
by n2meg
Hightower wrote:The Pager Geek wrote:Where is super-haxor HLA? "it works for him"
No super haxor here, but my notes for R06.09.06 with reguards to passwords......
Try this:
CPS R06.09.06 @00248699h there should be 74. Change this 74 to EB and save.
This should allow ya to read and write radio, just press enter when the P/W screen comes up.
Thanks for the response! That worked great !
Thanks again
Pablo n2meg...
Re: Password for GP300/GM300 Series CPS
Posted: Sat Jul 19, 2008 1:09 am
by benwell
Hi, I have the Professional Series GP300/GM300 CPS - version R03.08.03_EN
does anyone know where i need to make the change in hex to remove the password checking?
Re: Password for CDM1550LS
Posted: Mon Nov 03, 2008 1:30 pm
by elkbow
n7maq wrote:bchbumn wrote:For R06.08.05 I found it at offset: 02380650
change 741C to EB1C
that should take care of the problem!
Has anyone found the address/offset for R06.10.02 ? I tried the other day for over an hour, and I went form top to bottom of the file changing from to 74 to EB where I saw it. No luck, ether it does not work with this rev or I screwed up along the line and did not get the file saved before I tried to open the test CP.
Thanks,
Jim
I need this also, anyone know the change for R06.10.02?
Re: Password for CDM1550LS
Posted: Mon Nov 03, 2008 2:17 pm
by The Pager Geek
Re: Password for CDM1550LS
Posted: Mon Nov 03, 2008 2:26 pm
by elkbow
thanks Tim, all that searching I did I could not find that, i had already fixed the lock by modding and older version of the CPS and eliminating the password, but this will be helpful
Re: Password for CDM1550LS
Posted: Wed Dec 31, 2008 12:37 pm
by bandaidken
I know I'm dredging up an old thread...
I have a Moto EX600 XLS
CPS 6.10.04
I tried the hex trick, but I don't have another ex600xls codeplug or radio to experiment with.
I tried this trick using my cdm1250 and I can find the password then. However, the lines, etc do not translate to the ex600xls.
Anyone know what offset I would find the password on?
Thanks
Re: Password for CDM1550LS
Posted: Fri Jan 02, 2009 6:01 pm
by eurecomx
CPS R06.10.04 LA LatinoAmerica
offset 00249189
742B to EB2B
eurecomx
Re: Password for CDM1550LS
Posted: Sun Jun 21, 2009 5:19 am
by OCSD117
I bought a CDM1250 recently and it has a password. I a using R06.09.06 CPS and have tried the below method but can't find the right line 00248699h. I know nothing about hex editing and would love to be able to program this radio. any help would be greatly appreciated!
Hightower wrote:The Pager Geek wrote:Where is super-haxor HLA? "it works for him"
No super haxor here, but my notes for R06.09.06 with reguards to passwords......
Try this:
CPS R06.09.06 @00248699h there should be 74. Change this 74 to EB and save.
This should allow ya to read and write radio, just press enter when the P/W screen comes up.
Re: Password for CDM1550LS
Posted: Sun Jun 21, 2009 10:33 am
by OCSD117
Nevermind a friend helped me figure it out!
Re: Password for CDM1550LS
Posted: Fri Jun 26, 2009 9:28 am
by eurecomx
CPS R06.11.05 AA = US
OFFSET 0024AD79 (h)
742B to EB2B
and to region check off: Flatbush97
http://batboard.batlabs.com/viewtopic.p ... 32#p127632
eulalio
Password hack
Posted: Sun Nov 22, 2009 12:53 pm
by hqradio
I cant find it.
i'm using R06-11-05
HELP
Re: Password for CDM1550LS-R06.11.07
Posted: Mon Jan 25, 2010 10:59 pm
by N6LAU
Does anyone know the address and mod for R06.11.07?
Re: Password for CDM1550LS-R06.11.07
Posted: Tue Jan 26, 2010 7:59 am
by eurecomx
N6LAU wrote:Does anyone know the address and mod for R06.11.07?
Find Hex Values... 5B85C0742B and change to 5B85C0
EB2B
this is for many versions
eulalio
Re: Password for CDM1550LS
Posted: Tue Jan 26, 2010 6:00 pm
by N6LAU
Okay, I'll give it a shot. Thanks.
Re: Password for CDM1550LS
Posted: Mon Feb 15, 2010 8:59 pm
by haddenharley
Hello Friends.
I have several codeplug.
I use HexWorkshop v4.23 to edit CPS Password.
How to convert *.cpg to S Record format?
Re: Password for CDM1550LS
Posted: Sat May 07, 2011 6:33 am
by firefighter77
i have changed it, I am using cps ver r06.12.02, and it still asks fo the password, any ideas, i used win hex to change it
Re: Password for CDM1550LS
Posted: Sat May 07, 2011 4:56 pm
by jmr061
You have to use the cps version they say when they give the hack. If you use a different version chances are the item that needs to be changed has moved locations.
Jason
Re: Password for CDM1550LS
Posted: Sat May 07, 2011 5:18 pm
by firefighter77
I don't know how, lol, but somehow I was able to find the coding and openned it up. I want to thank all of you the previously posted on here, I wouldnt have been able to do it if I didnt have you guys, thank you all very much!
Re: Password for CDM1550LS-R06.11.07
Posted: Sat May 07, 2011 9:15 pm
by eurecomx
eurecomx wrote:N6LAU wrote:Does anyone know the address and mod for R06.11.07?
Find Hex Values... 5B85C0742B and change to 5B85C0
EB2B
this is for many versions
eulalio
Tool : Winhex
Edit: ProRadio.exe
In : C:\Program Files\Motorola\Professional Radio CPS R06.12.02
Offset : 24DDC9(h) ... 74 to EB and Save.
Now no need password ... only Enter
eulalio
Re: Password for CDM1550LS
Posted: Tue Oct 25, 2011 4:27 pm
by john1158
Any clue for doing this with an XTS5000? I'm using ver 15.0 and I can't find the info in my hex editor. I even used another XTS5000 and enabled it searched and found the password. The problem is it is in a different place every time I search. I will settle for the file from another radio because I don't need the old info anyway. H18QDH9PW7AN Thanks.
Re: Password for CDM1550LS-R06.11.07
Posted: Sun Jan 01, 2012 1:10 am
by radioeng462
eurecomx wrote:eurecomx wrote:N6LAU wrote:Does anyone know the address and mod for R06.11.07?
Find Hex Values... 5B85C0742B and change to 5B85C0
EB2B
this is for many versions
eulalio
Tool : Winhex
Edit: ProRadio.exe
In : C:\Program Files\Motorola\Professional Radio CPS R06.12.02
Offset : 24DDC9(h) ... 74 to EB and Save.
Now no need password ... only Enter
eulalio
I cannot find this string with Winhex using 6.12.02. Any other advice?
Re: Password for CDM1550LS
Posted: Mon Jan 02, 2012 10:37 pm
by radioeng462
Got it working!!. Thanks for the information.
Re: Password for CDM1550LS
Posted: Sat Apr 21, 2012 9:05 pm
by scannersurf104
I am running CPS R06.04.00 and am trying to unlock the CPS password on a used HT1550 (portable version of the cdm) that I recently purchased.
I am looking for the code to edit using Hex Workshop Hex Editor for CPS versions R06.04.00 and R06.12.02 ...
Thank you.
Re: Password for CDM1550LS
Posted: Wed May 02, 2012 5:08 am
by SD70MAC
Anyone found the password fix for CPS 6.12.05 yet ?
Re: Password for CDM1550LS
Posted: Wed May 02, 2012 12:21 pm
by SteveC0625
SD70MAC wrote:Anyone found the password fix for CPS 6.12.05 yet ?
Change 24DD69 from 74 to EB
Re: Password for CDM1550LS
Posted: Wed May 02, 2012 1:03 pm
by SD70MAC
Thanks Steve !
Re: Password for CDM1550LS
Posted: Mon May 21, 2012 4:42 am
by secki
Hi all am trying to get this to work for 6.09.06, none of the above mentioned Hex values can be found in my .exe file.
Re: Password for CDM1550LS
Posted: Tue May 22, 2012 4:06 am
by SD70MAC
Try this:
CPS R06.09.06 @00248699h there should be 74. Change this 74 to EB and save.
This is from an old tread.
Re: Password for CDM1550LS-R06.11.07
Posted: Tue May 22, 2012 7:25 pm
by Johnno
There seems to be multiple posts concerning the inability to find the necessary string at started locations. Big issue here is different versions have the values in different locations.
May I suggest users enter the hex value in search in their hex editor, then do the change.
By only looking in the stated offset of the posts above is not a good way of locating the value.
Some posts have given a clear indication that the user isn't familiar with using hex editor, not so much software problems.
Find Hex Values... 5B85C0742B and change to 5B85C0EB2B
this is for many versions
eulalio[/quote]
Happy hexing
Re: Password for CDM1550LS
Posted: Fri Jun 08, 2012 6:02 am
by bushman33
This worked great.
Thanks
Re: Password for HT1250
Posted: Fri Jul 20, 2012 8:52 pm
by radios4bill
Hi Group; I have version R06.10.04 and am having problems finding the address to edit. I have done this with older versions but this one is giving me problems. Can anyone help? Thanks, Bill
Re: Password for CDM1550LS
Posted: Sat Jul 21, 2012 6:30 pm
by HLA
Read back a few posts, it's already on here
CPS 6.09.06
Posted: Fri Dec 28, 2012 11:04 pm
by wmbowser
I have a EX600 XLS and CPS 06.09.06, I downloaded HxD Edit. My question is I am trying to access the database and can't because i lost the password and need to by-pass can anyone help
Re: Password for CDM1550LS
Posted: Mon Dec 31, 2012 7:24 pm
by HLA
try posting your location and see if anyone is local to you and can help you out
Re: Password for CDM1550LS
Posted: Mon Apr 15, 2013 11:01 am
by cifd64
Sorry to bring up really old stuff, but using R06.12.06. Using the new WinHex but only shows a portion of regions and deos not allow editting. Does HexWorkshop work and how do I do it? Just got a PW protected CDM1250 into the shop and 'nobody seems to know' where my flash cable went.
Thanks and appologies for the old post revival.
Sean
Re: Password for CDM1550LS
Posted: Tue Apr 23, 2013 4:59 am
by SteveC0625
cifd64 wrote:Sorry to bring up really old stuff, but using R06.12.06. Using the new WinHex but only shows a portion of regions and deos not allow editting. Does HexWorkshop work and how do I do it? Just got a PW protected CDM1250 into the shop and 'nobody seems to know' where my flash cable went.
Thanks and appologies for the old post revival.
Sean
Get xvi32, it will work fine.
Re: Password for CDM1550LS
Posted: Thu Sep 19, 2013 1:03 pm
by cifd64
Just an update to the thread. XVI32 has worked swimmingly for this and the Commercial version of the CPS. Just a few tips:
1) XVI32 is free and will let you edit and save
2) Open XVI32 ONLY, not the cps you are trying to bypass
3)When you have XVI32 open, you have to open the actual .exe file, not a desktop shortcut or other shortcut.
4) When searching for the Hex String, search the entire string, not the last four bits
Ex: Search for 5B 65 CO 74 2B, NOT 74 2B, You will find multiple occurrences of this abbreviated string.
5) Be sure to save the editted string and file.
6) Open CPS as usual and try. You will still be prompted to enter a password, but none will be needed. Press Enter.
Re: Password for CDM1550LS
Posted: Sat Sep 21, 2013 1:16 pm
by SteveC0625
cifd64 wrote:Just an update to the thread. XVI32 has worked swimmingly for this and the Commercial version of the CPS. Just a few tips:
1) XVI32 is free and will let you edit and save
2) Open XVI32 ONLY, not the cps you are trying to bypass
3)When you have XVI32 open, you have to open the actual .exe file, not a desktop shortcut or other shortcut.
4) When searching for the Hex String, search the entire string, not the last four bits
Ex: Search for 5B 65 CO 74 2B, NOT 74 2B, You will find multiple occurrences of this abbreviated string.
5) Be sure to save the editted string and file.
6) Open CPS as usual and try. You will still be prompted to enter a password, but none will be needed. Press Enter.
Great tips, and I'm glad it worked well for you.
One other suggestion: Before starting, write down the name of the .exe, then go into the program folder and rename the .exe. Anything is OK, but I like to keep the name plus add something like BU so you know it's the original. If things get messed up, you can always dump your hex edited copy and rename the back up back to the original.
Then open up XVI32 and open the renamed .exe. When you are done editing, do a "SAVE AS" (instead of a Save) and name it back to the correct name of the .exe.
You end up with two .exe files in the program folder; the renamed one which actually the Motorola original, and the edited one. Since you've renamed the edited one as the original name, all of your shortcuts should continue to work just fine.
Re: Password for CDM1550LS
Posted: Thu Sep 26, 2013 4:38 am
by cifd64
Absolutely. It is especially important to back up the original file if you dont have constant access to MOL like most techs do. Best of luck, now onto XPR cpgs...
Re: Password for CDM1550LS
Posted: Tue Feb 25, 2020 11:46 am
by peterfnet
Ancient thread, but I came here needing to unlock two I bought off eBay.
To help others that come here, I compiled a master list of each posted version with the address and value to change from->to
I cannot claim each are working, just a compiled list.
Code: Select all
ELP R02.01.02-AZ (Entry-level)
0x1316B1
Replace 741C with EB1C
R06.01.00
0x239F2A
Replace 741C with EB1C
R06.02.05
0x24029A
Replace 741C with EB1C
R06.03.02
0x240EEA
Replace 741C with EB1C
R06.04.00
0x2412AA
Replace 741C with EB1C
R06.05.00:
0x452ABC
Replace 75xx with FDxx
R06.05.03
0x24429A
Replace 741C with EB1C
R06.06.00
0x36ABCA
Replace BDxx with 75xx
R06.07.04
0x244CF0
Replace 741C with EB1C
R06.08.05
0x02380650
Replace 741C with EB1C
R06.09.06
0x248699h
Replace this 74 with EB
R06.10.02
0x2490F9
Replace 74 with EB [OP: Just looked at it. It's 742B, not 741C]
R06.10.04 LA LatinoAmerica
0x249189
Replace 742B with EB2B
R06.11.05 AA = US
0x24AD79
Replace 742B with EB2B
R06.12.02
0x24DDC9
Replace 74 with EB
Re: Password for CDM1550LS
Posted: Mon Mar 07, 2022 11:27 am
by surgepgh
Using Professional Radio CPS R06.12.02 OR R06.12.09 I open Hex Workshop. I then open ProRadio.exe in the case of R.06.12.02 I use the search function to look for 0x24DDC9 and it doesn't find anything. What am I missing? What am I doing wrong?