92
edits
Changes
Jump to navigation
Jump to search
m
→Software Startup
===Physical===
*'''Weight:''' 56.6g (without battery)
*'''Size (approximate, LxWxH):'''
**79 x 51 x 28 mm (bare pager itself, width measured to edge of battery compartment hump)
**80 x 53 x 20 mm (bare pager according to manufacturer specifications)
===Technical===
*'''Power Supply:''' 1x AA Battery
*'''Operational Frequencies:'''
*'''Supported Bandwidth:''' 12.5 or 25 kHz
*'''Alert Loudness:''' 85dB @ 10cm
===Paging Features===
*'''CAPCODE/RIC addresses:''' 8 for POCSAG, 16 for FLEX
*'''Total Message Character Capacity:'''
==Photos==
<gallery>
File:Front_pagerFront pager.jpg|thumb|Front of the AL-A26File:Back_pagerBack pager.jpg|thumb|Back of the AL-A26File:RF_board_back_pagerRF board back pager.jpg|thumb|RF reciever board from the back. (UHF version)File:RF_board_front_pagerRF board front pager.jpg|thumb|RF reciever board from the front. (UHF version)File:Mainboard_back_pagerMainboard back pager.jpg|thumb|Main board from the back.File:Mainboard_front_pagerMainboard front pager.jpg|thumb|Main board from the front.
</gallery>
*'''RAM:''' Utron UT62L2568 (256x8bit) Low Power CMOS SRAM<ref>https://www.semiee.com/file/EOL/UTRON%20-UT62L2568BS-55L.pdf</ref>
*'''ROM:''' Catalyst 24WC16J (16kB, 2048x8bit) I2C EEPROM<ref>https://pdf1.alldatasheet.com/datasheet-pdf/view/57364/CATALYST/24WC16.html</ref>
** Note: I have a second unit now and this one has a chip marked '''L16 5M52W'''. Reads out the same way apparently...
*'''FSK Decoder IC:''' NPC SM8212B POCSAG decoder for multiframe pagers<ref>https://www.semiee.com/file/EOL2/NPC-SM8212BM.pdf</ref>
==Disassembly==
# Remove battery cover.# Unscrew 2x phillips screws, located in left side recess and near the top of the positive battery contact.# Using a spudger, insert the tip into the edge of the back case where the positive battery contact is located.# Pry upward with a bit of a clockwise twisting motion. The right half of the pager should begin to unsnap.# Work your way around the right side, making sure it is completely free.# Move over to the left hand side and insert your spudger at the edge of the case seam near the negative battery terminal. Repeat the same prying action.# Work around the left hand side to ensure it is completely free.# Now that the pager case is unsnapped, hinge the back half upward along the top and pull the back half off of the rest of the pager.
<gallery>
File:Screw_locations_pagerScrew locations pager.jpg|thumb|Screw locationsFile:Insert_spudger_right_side_pagerInsert spudger right side pager.jpg|thumb|Spudger inbetween case halvesFile:Right_side_unsnapped_pagerRight side unsnapped pager.jpg|thumb|Right side unsnappedFile:Left_side_spudger_insert_pagerLeft side spudger insert pager.jpg|thumb|Spudger under left sideFile:Completely_free_back_pagerCompletely free back pager.jpg|thumb|Left side unsnapped and back half free. Hinge upward as shown.File:Sticky_padsSticky pads.jpg|thumb|The aforementioned sticky pads that hold the RX board in place.File:Back_laid_flat_pagerBack laid flat pager.jpg|thumb|Rear cover laying flat
</gallery>
<br />
==Reassembly==
* First thing's first, wipe down the LCD and inside of the clear window with a soft cloth to remove any fingerprints or debris before reassembly. Last thing you want to see is a speck of something on the inside of your screen after you just reassembled the whole thing!
# Insert the top edge of the rear half of the pager into the front.# Hinge the rear half downwards in the same way as disassembly.# Make sure the halves are aligned and press down on each side until they snap back together. The side near the negative battery terminal and power button may take some more force to snap shut than the positive side. It helps to push inward towards the positive terminal.# Screw in the 2x phillips screws from the recess and near the positive battery terminal.# Replace battery cover.
<gallery>
File:Align_top_tabs_pagerAlign top tabs pager.jpg|thumb|Re-inserting the top half tabsFile:Top_edge_flush_reassembly_pagerTop edge flush reassembly pager.jpg|thumb|Fully inserted tabs aligned and ready to hinge downFile:Not_fully_snapped_left_pagerNot fully snapped left pager.jpg|thumb|Incorrect/not snapped in negative sideFile:Correctly_snapped_left_pagerCorrectly snapped left pager.jpg|thumb|Correct/snapped in negative side
</gallery>
<br />
<gallery>
File:Pass_word_promptPass word prompt.jpg|thumb|Passcode promptFile:Frequency_menuFrequency menu.jpg|thumb|Frequency settingFile:Capcode_menuCapcode menu.jpg|thumb|RIC/CAPCODE settingFile:Baud_menuBaud menu.jpg|thumb|Baudrate settingFile:Contrast_menuContrast menu.jpg|thumb|Contrast settingFile:Modify_password_menuModify password menu.jpg|thumb|Modify password settingFile:Pass_screenPass screen.jpg|thumb|Pass! screen
</gallery>
*'''csins.dat:''' The same exact installer of the program (setup.exe) but renamed with a .dat file extension (For uninstallation purposes?). File hashes match.
*'''default.tbl:''' The default pager configuration settings which are loaded at startup
** <u>You can find the hand programming passcode in this file. The passcode is not encrypted or obscured in any context. The passcode is 4 bytes long and begins at hex address '''0x37C.''' The bytes are directly written to memory, so for example if the passcode set is '''1234''', the bytes read in order will read as '''0x01, 0x02, 0x03, 0x04.'''</u>
*'''inpout32.dll:''' Standard Windows driver for hardware access to serial ports
*'''pager.dat:''' Unknown purpose. Apparently contains the software password AC5678 somewhere within. When removed or renamed and attempting to enter the password to unlock the software, it reports "No password table!Program will be end!". Same file hash as the pager.dat included with setup.exe.
====Software Startup====
Upon startup and entry of the software password, the program looks for a PL2303 Prolific based serial device attached to the computer. If found, the COM port is set in a registry key located in '''HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SERIALCOMM,'''though it seems to want it on COM1?
The software then outputs the following on the serial port (9600 8N1) before giving the "The Programmed Board not responding!" error:
<pre>GoldApollo5R </pre>
Which is the following in raw serial bytes
==Caveats==
*Channel spacing seems to commonly be set to 25 kHz, making the common DAPNET frequency of 439.9875 MHz<ref>https://hampager.de/dokuwiki/doku.php?id=dapnetfrq</ref> unable to be set without an error message. The pager can be set to use 12.5 kHz channel spacing, but requires the programming software to accomplish. The easiest solution without software access is to choose a different frequency while minding the amateur satellite band (435 - 438 MHz)<ref>https://www.iaru-r1.org/wiki/UHF</ref>
*Currently, we do not know how to reset the hand programming password without a programmer. The passcode is clearly visible in the .tbl files, but not in any EEPROM dumps done thus far.
<br />
<references />
