Apollo AL-A26 (Pager) - Revision history

Trevor229: /* Software Startup */

2023-03-09T06:14:54Z

Software Startup

Show changes

Trevor229: Change one word to test new edit perms

2022-09-03T02:18:12Z

Change one word to test new edit perms

Trevor229: Reword some sections, add new info about hand programming procedure with pictures.

2022-08-09T00:47:45Z

Reword some sections, add new info about hand programming procedure with pictures.

Trevor229: Update IARU link

2022-07-21T03:09:47Z

Update IARU link

Trevor229: Add discovery of software startup word

2022-04-30T00:45:29Z

Add discovery of software startup word

Trevor229: remove dupe reference section

2022-04-24T05:02:36Z

remove dupe reference section

Trevor229: /* Software & Programming */

2022-04-24T04:58:42Z

Software & Programming

Trevor229: /* Software & Programming */

2022-04-24T04:58:02Z

Software & Programming

Trevor229: /* Photos */

2022-04-24T04:56:47Z

Photos

Trevor229: /* Disassembly */

2022-04-24T04:56:17Z

Disassembly

@@ Line 7: / Line 7: @@
 The Apollo Pilot A26 (Model number AL-A26) is an alphanumeric POCSAG-enabled paging reciever manufactured by Apollo Digital Paging Company Inc. It can be found on second-hand auction sites such as eBay inexpensively.
-It is worth noting however, that there is also a similar model (AF-A26) which is identical, except for supporting the FLEX paging protocol instead.
+It is worth noting however, that there is also a similar model (AF-A26) which is identical, but supporting the FLEX paging protocol instead.
 This wiki will focus on the POCSAG model as it's utility pertains to amateur radio and [https://hampager.de/dokuwiki/doku.php DAPNET] use.

@@ Line 71: / Line 71: @@
 ==Physical Hardware==
-*'''CPU:''' GAPOLLO AL-A26-1 (Proprietary/Custom?)
+*'''CPU:''' GAPOLLO ALA26-1 (Proprietary/Custom?)
 *'''RAM:''' Utron UT62L2568 (256x8bit) Low Power CMOS SRAM<ref>https://www.semiee.com/file/EOL/UTRON%20-UT62L2568BS-55L.pdf</ref>
 *'''ROM:''' Catalyst 24WC16J (16kB, 2048x8bit) I2C EEPROM<ref>https://pdf1.alldatasheet.com/datasheet-pdf/view/57364/CATALYST/24WC16.html</ref>
 *'''FSK Decoder IC:''' NPC SM8212B POCSAG decoder for multiframe pagers<ref>https://www.semiee.com/file/EOL2/NPC-SM8212BM.pdf</ref>
@@ Line 88: / Line 89: @@
 # Work around the left hand side to ensure it is completely free.
 # Now that the pager case is unsnapped, hinge the back half upward along the top and pull the back half off of the rest of the pager.
@@ Line 99: / Line 105: @@
 File:Left_side_spudger_insert_pager.jpg|thumb|Spudger under left side
 File:Completely_free_back_pager.jpg|thumb|Left side unsnapped and back half free. Hinge upward as shown.
 File:Back_laid_flat_pager.jpg|thumb|Rear cover laying flat
 </gallery>
@@ Line 123: / Line 130: @@
 ==Software & Programming==
-The initial start-up password for the software is '''AC5678''' <ref>https://www.apollopagers.com/support/</ref>
+The initial start-up password for the software is '''AC5678''' <ref>https://www.apollopagers.com/support/</ref>. Not necessarily related to programming per se, but holding down the triangular power/function button on startup will initiate a lamp/motor/RAM test mode. You can step through the various tests with the buttons, but the battery will need to be pulled to reset it.
 ===Programming Interface - Pager===
-Peel back the lefthand sticker to reveal three holes that expose three gold pads on the RF reciever PCB. These pads directly connect to the EEPROM SCL and SDA lines as well as common ground in that order from left to right.
+Peel back the lefthand sticker to reveal three holes that expose three gold pads on the RF receiver PCB. These pads directly connect to the EEPROM SCL and SDA lines as well as common ground in that order from left to right.
 [[File:Programming_interface_pinout_pager.png|thumb|Pinout of the back programming interface]]
@@ Line 144: / Line 212: @@
 According to the manual for the programming software made by the manufacturer, the passcode is only used to lock out hand programming of the pager. This in theory means that if one has access to a pager, interface, and the software, it may be freely reprogrammed without needing anything other than the software password.
-===Direct EEPROM readout===
+===Direct EEPROM readout?===
-The main EEPROM, a CAT24WC16, which is located on the top right of the board contains configuration information as well as the hand programming passcode. This chip is a standard I2C EEPROM which can easily be read and written with several different tools. The passcode is not encrypted or obscured in any context. The passcode is 4 bytes long and begins at hex address '''0x37C.''' The bytes are directly written to memory, so for example if the passcode set is '''1234''', the bytes read in order will read as '''0x01, 0x02, 0x03, 0x04.'''
+The main EEPROM, a CAT24WC16, which is located on the top right of the board contains configuration information. It may or may not contain the passcode, this is still unknown at this time. This chip is a standard I2C EEPROM which can easily be read and written with several different tools.
 <br />
@@ Line 154: / Line 222: @@
 =====EEPROM Dumping=====
-The 24WC16J EEPROM is a standard I2C memory device. As such, it's contents can easily be read out using any I2C capable debug device or microcontroller such as the Bus Pirate or Arduino respectively.
+The 24WC16J EEPROM is a standard I2C memory device. As such, it's contents can easily be read out using any I2C capable debug device or microcontroller such as the Bus Pirate or Arduino respectively. A CH341A programmer has also been used successfully to dump the contents.
 ===Software===
@@ Line 166: / Line 234: @@
 *'''csins.dat:''' The same exact installer of the program (setup.exe) but renamed with a .dat file extension (For uninstallation purposes?). File hashes match.
 *'''default.tbl:''' The default pager configuration settings which are loaded at startup
 *'''inpout32.dll:''' Standard Windows driver for hardware access to serial ports
 *'''pager.dat:''' Unknown purpose. Apparently contains the software password AC5678 somewhere within. When removed or renamed and attempting to enter the password to unlock the software, it reports "No password table!Program will be end!". Same file hash as the pager.dat included with setup.exe.
@@ Line 180: / Line 249: @@
 <pre>47 6f 6c 64 41 70 6f 6c 6c 6f 35 52 03 00 00 00 00 8a</pre>
-I have tried replaying the same byte sequence in response, as well as sending just "Apollo" with no luck. There is definitely some reply word sent by the programmer itself, similar to the [http://n3ujj.com/TripMate_Self_Start_Modification.html DeLorme TripMate GPS which needs the word "ASTRAL" sent on it's RX pin to enable the GPS.]
+I have tried replaying the same byte sequence in response, as well as sending just "Apollo" with no luck. My assumption is there must be some reply word sent by the programmer itself, similar to the [http://n3ujj.com/TripMate_Self_Start_Modification.html DeLorme TripMate GPS which needs the word "ASTRAL" sent on it's RX pin to enable the GPS.]
@@ Line 192: / Line 261: @@
 ==Caveats==
 *Channel spacing seems to commonly be set to 25 kHz, making the common DAPNET frequency of 439.9875 MHz<ref>https://hampager.de/dokuwiki/doku.php?id=dapnetfrq</ref> unable to be set without an error message. The pager can be set to use 12.5 kHz channel spacing, but requires the programming software to accomplish. The easiest solution without software access is to choose a different frequency while minding the amateur satellite band (435 - 438 MHz)<ref>https://www.iaru-r1.org/wiki/UHF</ref>
 <br />

@@ Line 191: / Line 191: @@
 ==Caveats==
-*Channel spacing seems to commonly be set to 25 kHz, making the common DAPNET frequency of 439.9875 MHz<ref>https://hampager.de/dokuwiki/doku.php?id=dapnetfrq</ref> unable to be set without an error message. The pager can be set to use 12.5 kHz channel spacing, but requires the programming software to accomplish. The easiest solution without software access is to choose a different frequency while minding the amateur satellite band (435 - 438 MHz)<ref>https://www.iaru-r1.org/wiki/Amateur_satellites#:~:text=2%20meter%20band-,70%20cm%20band,maximum%20bandwidth%20is%20100%20kHz</ref>
+*Channel spacing seems to commonly be set to 25 kHz, making the common DAPNET frequency of 439.9875 MHz<ref>https://hampager.de/dokuwiki/doku.php?id=dapnetfrq</ref> unable to be set without an error message. The pager can be set to use 12.5 kHz channel spacing, but requires the programming software to accomplish. The easiest solution without software access is to choose a different frequency while minding the amateur satellite band (435 - 438 MHz)<ref>https://www.iaru-r1.org/wiki/UHF</ref>
 <br />

← Older revision		Revision as of 00:45, 30 April 2022
Line 170:		Line 170:
	*'''PL2303_Prolific_DriverInstaller_10311.exe:''' Self explanitory. Appears to be a normal installer. Unknown if modified in any way, most likely not.		*'''PL2303_Prolific_DriverInstaller_10311.exe:''' Self explanitory. Appears to be a normal installer. Unknown if modified in any way, most likely not.
	*'''Uninstall.exe:''' Also self explanitory. Seems to be a standard Windows uninstaller.		*'''Uninstall.exe:''' Also self explanitory. Seems to be a standard Windows uninstaller.
		+
		+
		+	====Software Startup====
		+	Upon startup and entry of the software password, the program looks for a PL2303 Prolific based serial device attached to the computer. If found, the COM port is set in a registry key located in '''HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\SERIALCOMM'''
		+
		+	The software then outputs the following on the serial port before giving the "The Programmed Board not responding!" error:
		+	<pre>GoldApollo5R </pre>
		+	Which is the following in raw serial bytes
		+	<pre>47 6f 6c 64 41 70 6f 6c 6c 6f 35 52 03 00 00 00 00 8a</pre>
		+
		+	I have tried replaying the same byte sequence in response, as well as sending just "Apollo" with no luck. There is definitely some reply word sent by the programmer itself, similar to the [http://n3ujj.com/TripMate_Self_Start_Modification.html DeLorme TripMate GPS which needs the word "ASTRAL" sent on it's RX pin to enable the GPS.]

← Older revision		Revision as of 05:02, 24 April 2022
Line 182:		Line 182:
	*Channel spacing seems to commonly be set to 25 kHz, making the common DAPNET frequency of 439.9875 MHz<ref>https://hampager.de/dokuwiki/doku.php?id=dapnetfrq</ref> unable to be set without an error message. The pager can be set to use 12.5 kHz channel spacing, but requires the programming software to accomplish. The easiest solution without software access is to choose a different frequency while minding the amateur satellite band (435 - 438 MHz)<ref>https://www.iaru-r1.org/wiki/Amateur_satellites#:~:text=2%20meter%20band-,70%20cm%20band,maximum%20bandwidth%20is%20100%20kHz</ref>		*Channel spacing seems to commonly be set to 25 kHz, making the common DAPNET frequency of 439.9875 MHz<ref>https://hampager.de/dokuwiki/doku.php?id=dapnetfrq</ref> unable to be set without an error message. The pager can be set to use 12.5 kHz channel spacing, but requires the programming software to accomplish. The easiest solution without software access is to choose a different frequency while minding the amateur satellite band (435 - 438 MHz)<ref>https://www.iaru-r1.org/wiki/Amateur_satellites#:~:text=2%20meter%20band-,70%20cm%20band,maximum%20bandwidth%20is%20100%20kHz</ref>
	<br />		<br />
−
−	~~==References==~~
−	~~<references />~~

@@ Line 128: / Line 128: @@
 Peel back the lefthand sticker to reveal three holes that expose three gold pads on the RF reciever PCB. These pads directly connect to the EEPROM SCL and SDA lines as well as common ground in that order from left to right.
-[[File:Programming_interface_pinout_pager.jpg|thumb|Pinout of the back programming interface]]
+[[File:Programming_interface_pinout_pager.png|thumb|Pinout of the back programming interface]]
 ===Programming Interface - Programmer===

@@ Line 61: / Line 61: @@
 File:Front_pager.jpg|thumb|Front of the AL-A26
 File:Back_pager.jpg|thumb|Back of the AL-A26
-File:RF_board_back.jpg|thumb|RF reciever board from the back. (UHF version)
+File:RF_board_back_pager.jpg|thumb|RF reciever board from the back. (UHF version)
-File:RF_board_front.jpg|thumb|RF reciever board from the front. (UHF version)
+File:RF_board_front_pager.jpg|thumb|RF reciever board from the front. (UHF version)
 File:Mainboard_back_pager.jpg|thumb|Main board from the back.
 File:Mainboard_front_pager.jpg|thumb|Main board from the front.