r0f's NEWBE guide to ASTRO portable Radios

If you are just getting into radio, and have a lot of beginner questions, or just want to help someone new out, then this is the place to do it!
Post Reply
User avatar
Posts: 3
Joined: Sun Jun 06, 2004 1:03 am
Location: Running around looking for an 800MHz provoice radio and an ASTRO digital 800MHz radio! HELP!!!!

r0f's NEWBE guide to ASTRO portable Radios

Post by ROOFLIFECO » Sun Jun 06, 2004 1:13 am


- r0f's guide to ASTRO radios - What you need to know to have a clue -

Lately, there have been several Ebay ads, and other questions asked on the board,
that finally motivated me to write an ASTRO "guide" for newbies. When people ask
questions, we should be able to point them somewhere. The main site (batlabs) has
a lot of info, but not nearly enough to guide newbie/lamers through the woods

Let's start off with the basics.

Currently, there are 7 ASTRO portable models on the market.

- ASTRO Digital Saber (Models I, IR, II, IIR, and III)
- XTS3000 (Models I, IR, II, IIR, and III)
- XTS1500 (16ch only, no keypad/display)
- XTS2500 (Models I, IR, II, IIR, and III)
- XTS3500 (Models I, IR, II, IIR, and III)
- XTS5000 (Models I, IR, II, IIR, and III)
- SSE5000 (SP Radio, NYPD Only. Looks like a model I ASTRO Saber, but grey)

The lowest tier ASTRO portable is currently the XTS1500. This is an entry-level
portable, designed for utility companies and public works users. It is 16 channels
only, and does not support encryption. It supposedly is FLASHport upgradeable, but
there is no mention of this on Motorola's website. It is dual band, 700/800 MHz, and
supports ASTRO25 and APCO16 trunking. (3600/9600bps control channels)

The ASTRO Saber has long been a favorite of batlabbers. It is the last "real" radio
that Motorola released, before going to the XTS series radios, which just aren't
built the same. One could easily use the ASTRO Saber to beat down a bad prisoner,
or get revenge on a locker thief (personal story, I won't go there). There are 2
versions of the ASTRO Saber available -- One with a 512K flash memory, and one with
1-meg. The 512K ASTRO Sabers are the most popular, but do not support 9600bps
(ASTRO25) trunking, or firmware higher than Host R05.60.00 / DSP DSPN06.05.02. The
512K ASTRO Sabers support nearly every FLASHport option. Unfortunately, if the user
wishes to use one of the newer UCM Encryption modules with EMC R03.xx firmware, the
radio MUST be upgraded to a 1-meg vocoder board, as EMC R03.xx requires Host firmware
of R07.xx.xx to function. The ASTRO Saber comes in VHF, UHF-low, UHF-high, and 800
MHz flavors. The ASTRO Saber has 2 lines of 14 characters for the display.

The XTS3000. Released in 1996, it was Motorola's second ASTRO Portable to hit the
market, and is the most common ASTRO portable in use, to this day. It comes with a
1-meg vocoder board, and supports encryption. How could you go wrong with this? It's
shorter than the "HUGE" (As ASTROMODAT puts it) ASTRO Saber, but the XTS3000 is a
FATTER radio, even with the Lithium Ion battery. The XTS3000 supports 3600/9600bps
trunking, and any other FLASHport option you wish to have added in. It does not
require a vocoder upgrade. Like the ASTRO Saber model, certain features/hardware
are firmware dependant. The XTS3000 and ASTRO Saber share the same host/dsp firmware
releases. Example: R05.51.00 / DSPN06.04.11 can be found in both ASTRO Sabers, and
XTS3000's. The XTS3000 comes in VHF, UHF-low/UHF-hi, and 800 MHz.

The XTS2500 and XTS5000 were released in early 2002. While the XTS2500 is a nice
portable with 160 modes, it does not support encryption. It hasn't been hacked yet
either, meaning if you buy a "featureless" XTS2500 on ebay, it's going to stay that
way. It's a medium-tier radio, supporting 3600/9600bps trunking and conventional.
It's nice eye candy, but that's about it.

The XTS5000 is Motorola's "top of the line" digital portable. It supports 512 modes,
encryption, and 3600/9600bps trunking/conventional. It hasn't been hacked yet, and the
only portables floating around on Ebay at the moment, all appear to be alpha-series
developmental models. Their serial numbers are 123ABC1234. Keep away from them! They
require special Alpha CPS to program, and are not supported via "R" CPS. The XTS5000
supports 8-meg's of FLASHport memory, and supposedly IP-data features. The "r0f"
opinion of the XTS5000, is that it's a recased XTS3000 with a new display and more
memory. Motorola didn't put a lot of effort in to the XTS5000, and it is overpriced
and currently does not support anything that the XTS3000 or ASTRO Saber is capable
of. Do not be fooled in to purchasing an XTS5000 thinking it's "the bomb", because it's
just not!

The XTS2500, XTS5000, and SSE5000, are all programmed with the RVN4181 software

The XTS3500 is an XTS3000, with a faster CPU, and supposedly it supports higher
levels of encryption -- however this has never been confirmed. It looks identical
to the XTS3000, but it's only available in VHF and UHF models -- No 800 MHz. The
3500 is programmed with RSS. As far as I know, no CPS exists and the radio has
not been hacked.

The SSE5000 is an SP radio developed for the NYPD. It looks like a Model I ASTRO
Saber, in a grey case. It's exact features are unknown at the moment, and Motorola
does not list it on their website. It's most likely got 1-meg of FLASHport memory,
a faster CPU, and a few custom "one touch" buttons. Any information on this radio
would be greatly appreciated!

So now I've covered, in a somewhat brief way, all 7 portables, and what they are.
Now it's time to talk about what makes a radio worthy of an Ebay purchase, or just
flat out hacking. I will only cover the XTS3000 and ASTRO Saber, as they are the
most popular models, and are easily "reconfigured" for the intended use.

First, when looking at an Ebay auction, or making a deal with someone to buy an
ASTRO Portable, you MUST have the below information provided to you. If the seller
is too ignorant or clueless to give you this information, then DO NOT chance your
hard earned money! This information is obtained via 2 methods.

1. Via the F9 menu after reading the radio in RSS (or equiv in CPS)
2. Via SERVICE mode. To enter SERVICE mode, press the ".." button on the side
of the radio 5 times, within the first 10 seconds of powering up the radio. The
information will scroll across the screen. This process may have to be repeated
a few times to get everything.

First, ask the person selling the radio if it's IMBE or VSELP. If they don't know,
then they are just stupid and ignorant. I'd be tempted to just not deal with them
at this point, but sometimes you can "steal" the radio for under $500 from these
people simply because they're too stupid to know what it is they're selling.

VSELP = Vector Sum Excited Linear Prediction
IMBE = Improved Multi-band Excitation

VSELP was Motorola's first attempt at a digital voice codec. It's inferior to IMBE,
and is proprietary. The City of Baltimore uses VSELP on their 800 MHz trunked system.
Other than that, it's almost extinct. IMBE is made by DVSI, and is the APCO-25
codec. 99% of the time, you'll want an IMBE radio.

- What is the Model #? H04UCH9PW7AN is an ASTRO Saber III 800 MHz. You need this
to be sure of what you're getting. I've seen MONGOLIAN MORONS selling 800 MHz
radios as "VHF" on Ebay. These people are either retarded, or are selling something
they know nothing about. i.e. STOLEN.

To decode the model #, visit this page: http://www.batlabs.com/astromob.html#model

Next, you'll need the HOST and DSP firmware revisions installed in the radio. This
is probably the most important part. If the MONGOLIAN RETARD selling the radio
doesn't know if it's an IMBE or VSELP radio, you can obtain that information from
the firmware revisions. Here's the breakdown:

Host Firmware R0x.xx.xx R= Release. If it's anything but "R" here, it's a factory
test radio, and is probably stolen. Don't bother. Here is version information:

Less than HOST R04.xx.xx Less than DSP DSPx06.xx.xx = VSELP KEEP AWAY!!!
Higher than HOST R04.xx.xx Higher than DSP DSPx06.xx.xx = IMBE UNF UNF! YES!

The latest HOST/DSP firmware (as of this writing) is R07.10.xx / DSPN08.02.xx.

Now a few notes about the firmware that you need to know for certain features to

If you desire SmartZone Omnilink Q173/G173 in your radio, you'll need HOST firmware
higher than R05.xx.xx. it is not supported in R04.xx.xx.

If you're using an EMC or UCM Encryption module, with EMC firmware higher than
R03.xx, you'll require at the very least HOST firmware R07.xx.xx or the encryption
module will not work. R07.xx.xx HOST firmware supports older R02.xx EMC firmware,
just not the other way around.

The next thing you'll want to ask the seller is what the FLASHCODE is. This lists
what features are installed in the radio. This even determines whether or not your
radio will transmit/receive in ASTRO mode. This is VERY important. Flashcodes look
like this:

591008-4F1E00-9 (Whored out Nick flashcode)

They are 12 digits long, with a checksum at the end. You can decode the flashcode
by punching it in to Lindsay Blanton's flashcode decoder here:


To see a list of all available FLASHport options, type FFFFFF-FFFFFF-F in to his

Next, if the seller says "Radio has encryption installed", you'll need to ask what
algorithms are installed. Encryption comes in many flavors, and not all algorithms
are compatible with each other. An excellent write-up on encryption was made by
Batwing (Doug) and is available here:


The encryption algorithms you may see in ASTRO portables are as follows:


If you see FASCINATOR, your phones will be tapped and you better buy some
preperation H, because you'll have a date with Bubba. FASCINATOR is a
classified encryption algorithm used to carry US Government communications,
and is NOT available to the public. If you have it, chances are it'stolen, or
stolen. Could also be stolen. Get the picture?

DES - 56-bit
DVP - 32-bit
DVI - 24-bit
AES-256 - 256-bit

While AES-256 may look appealing, there is a massive back-door in this
algorithm so that big brother can listen in. Do you really think the boys would
release 256-bit encryption to the public to use, without a way of snooping?
DES was developed for the US Government in the late 1970's. It is still to this
day, considered "safe" from eavesdroppers. There are 72-quadrillion possible
keys, and the amount of computing power required to brute-force the prime
number the key is based upon, is not something joe-schmoe has access to. DES
is not "secure" in the sense you would pass classified communications over it,
but it's definitely a hell of a lot tighter than AES-256. There is no known
back-door for DES.

DVP was developed by Motorola for business users. It's weak, and most likely
is back-doored. Security companies and many police agencies in Canada use (or
did use) DVP in the past, due to tight licensing/export policies back in the
day. DES was restricted to the US only, but that's not the case any longer.

DVI was also developed for Motorola for use by business and law enforcement
users, overseas. It is 24-bit, has a back-door, and is weaker than George
Bushes self-esteem. The "I" in DVI, stands for "International".

Anyway enough of my encryption rant. The next thing you'll need to ask your
seller, is how big the vocoder board is. This is required when asking about
an ASTRO Saber. Is it 512K, or 1-meg? Read above for the differences.

Finally, I'll move on to "parts built radios". These radios are EVERYWHERE!
Originally they were sold by a mysterious man named "Nick", aka Watchbuddy,
but he has since disappeared in to the dark Motorola night. His radios were
supposedly built from "parts" that he or somebody else had ordered from M,
and then later constructed fully functional radios. They work fine, look fine,
and even smell fine (heh heh). They just have one fault; NO SERIAL NUMBER.
A parts radio is usually easy to identify. They all have the same host/dsp
firmware revisions, and usually the same flashcode.

2002 Nick Radios

Host Firmware: R05.51.00
DSP Fimrware: DSPN06.04.11
Flashcode: 591008-4F1E00-9

2003 Nick Radios

Host Firmware: R07.08.00
DSP Firmware: DSPN08.02.02
Flashcode: 548008-000480-9

The 591008-4F1E00-9 flashcode has become known as the "Whored Out"
flashcode. This is because it supports nearly every option Motorola offers,
except it has options that are not compatible with each other. Examples
are Software Encryption, and OTACS and OTACR -- which are proprietary to
the LAPD, UHF high band. Finding these in 800 MHz XTS3000's is messed up.

In early 2003, I started bitching on batboard that Nick's radios had old
firmware in them, and did not support new UCM modules, and described a noted
bug when used with speaker mics. I'm not sure if this is why Nick suddenly
started releasing newer host/dsp with his radios, but things changed a few
weeks after. His second flashcode (less whored out) comes with ASTRO25 9600bps
trunking installed. Unfortunately, it isn't supported by R07.08.00 host
firmware, and caused grief for 3600bps trunking users, as they could no longer
monitor without forced affiliation. After people started bitching, he went back
to the 591008-4F1E00-9 whored out flashcode. Then suddenly, Nick disappeared.
Nobody knows what really happened, but there are lots of stories.

If you come across a parts built radio on Ebay or elsewhere, don't be afraid
of it, just pay attention to host/dsp and FLASHport options. Also be aware that
if you send it in to the depot, it may not come back, due to the serial # issue.

I'm almost done, but I think I should continue ranting about KVL's (Key Variable

A few of us whores like running encryption on ASTRO. Doing so requires
encryption modules, AND.. a keyloader. There are a few keyloaders out there. I
will talk about DES, since they are the most common. The same applies to other

T3011DX -- Works fine for all ASTRO portables/mobiles. NEEDS to be "D". C will not
work. A T3011DX is a DES/DES-XL/DES-OFB capable keyloader. It has 16 key memories,
and 16 shadow-key (used for OTAR) memories. It's big and ghetto looking, but it
works just fine. Don't pay more than $600US for one, or else you're getting hosed.

KVL3000/KVL3000 PLUS. -- There have been a few of these on Ebay lately. The
sellers I've seen, have NOT listed what algorithm is installed! Can you believe
that? "DUh I have a KVL3000 for sale". And? When I've emailed them asking what
algorithm is installed, they rudely reply "THEY DO NOT KNOW". That's like putting
a car on Ebay. "Selling: a car". You need a little more info than that! Buyer
beware! These vary in price, but don't pay more than $1500-1600 for them. One just
went for $2100, and the dork selling it didn't even list the algorithm(s)! I hope
the buyer wasn't scammed.

Well it's been a slice writing all of this, I hope it proves entertaining and useful
to ASTRO lovers. Additions, comments, and arguments are all welcome. Remember,
it's just a hobby

- r0f

Please check Batlabs.com and radioreference.com for my items for sale.

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests