130
edits
Changes
Reword some sections, add new info about hand programming procedure with pictures.
==Physical Hardware==
*'''CPU:''' GAPOLLO AL-A26ALA26-1 (Proprietary/Custom?)
*'''RAM:''' Utron UT62L2568 (256x8bit) Low Power CMOS SRAM<ref>https://www.semiee.com/file/EOL/UTRON%20-UT62L2568BS-55L.pdf</ref>
*'''ROM:''' Catalyst 24WC16J (16kB, 2048x8bit) I2C EEPROM<ref>https://pdf1.alldatasheet.com/datasheet-pdf/view/57364/CATALYST/24WC16.html</ref>
** Note: I have a second unit now and this one has a chip marked '''L16 5M52W'''. Reads out the same way apparently...
*'''FSK Decoder IC:''' NPC SM8212B POCSAG decoder for multiframe pagers<ref>https://www.semiee.com/file/EOL2/NPC-SM8212BM.pdf</ref>
# Work around the left hand side to ensure it is completely free.
# Now that the pager case is unsnapped, hinge the back half upward along the top and pull the back half off of the rest of the pager.
'''<u>Do note that the first time you disassemble your pager, you will have to use a concerning amount of force to separate the halves.</u>'''
'''This is due to sticky foam pads holding the receiver board to the back case. You may remove these when you fully open the unit and it will function fine, however you are probably opening yourself up to the RX board possibly becoming unplugged should you drop the pager at all. Use your own descretion here.'''
File:Left_side_spudger_insert_pager.jpg|thumb|Spudger under left side
File:Completely_free_back_pager.jpg|thumb|Left side unsnapped and back half free. Hinge upward as shown.
File:Sticky_pads.jpg|thumb|The aforementioned sticky pads that hold the RX board in place.
File:Back_laid_flat_pager.jpg|thumb|Rear cover laying flat
</gallery>
==Software & Programming==
The initial start-up password for the software is '''AC5678''' <ref>https://www.apollopagers.com/support/</ref>. Not necessarily related to programming per se, but holding down the triangular power/function button on startup will initiate a lamp/motor/RAM test mode. You can step through the various tests with the buttons, but the battery will need to be pulled to reset it. ===Hand Programming=== ====Password Menu==== Hold down the center oval shaped button and insert the battery. Keep holding it until this screen appears. Should take approximately 6 seconds. Hoping for the best, press the triangular power/function button. If the password is set to the default (0000) then you should see the frequency screen appear. If not, then your password is incorrect. Head on down to section 9, [https://wiki.recessim.com/view/Apollo_AL-A26_(Pager)#Bypassing_the_hand_programming_password Bypassing the hand programming password.] ====Frequency Menu==== Use the up/down/left/right buttons to enter your desired RX frequency here. Do keep in mind the common caveat of these being set to 25kHz channel spacing, so select your frequency accordingly. If an invalid frequency is entered (for example, the default DAPNET frequency of 439.9875) while the pager is in 25kHz spacing mode, it will not accept the frequency change and will beep once and reboot to the normal pager interface. ====RIC/CAPCODE Menus==== The next menu items after frequency are the RIC/CAPCODE settings. These can be enabled and disabled while retaining their values and function bits. More on the function bits below. =====Function Bits===== Still a WIP to make these fully understandable. More to come. <pre>The AAAA 4 position means different Function bit Features, A = Alpha Numeric I = IDEO N = Standard Numeric P = PRC Numeric - = Off T= Tone Only</pre> ====Baud==== Options are 512, 1200, and 2400 for the POCSAG version. Make sure it is set to 1200 for DAPNET use. ====Contrast==== Set the overall LCD contrast here. Seems to default to 4 and that should be good for most cases. ====Modify Password==== Here you can enter a new passcode for the pager which will take effect on next reboot. Be sure to remember this value if you change it from 0000 as it will be needed to access the programming interface again! ====Pass!==== Assuming everything you entered is valid and to the pager's liking, you should finish with this screen after hitting the triangular power/function button. The pager will now reboot to the main interface and your settings will be active. <gallery>File:Pass_word_prompt.jpg|thumb|Passcode promptFile:Frequency_menu.jpg|thumb|Frequency settingFile:Capcode_menu.jpg|thumb|RIC/CAPCODE settingFile:Baud_menu.jpg|thumb|Baudrate settingFile:Contrast_menu.jpg|thumb|Contrast settingFile:Modify_password_menu.jpg|thumb|Modify password settingFile:Pass_screen.jpg|thumb|Pass! screen</gallery> ==Physical Interfaces==
===Programming Interface - Pager===
Peel back the lefthand sticker to reveal three holes that expose three gold pads on the RF reciever receiver PCB. These pads directly connect to the EEPROM SCL and SDA lines as well as common ground in that order from left to right.
[[File:Programming_interface_pinout_pager.png|thumb|Pinout of the back programming interface]]
According to the manual for the programming software made by the manufacturer, the passcode is only used to lock out hand programming of the pager. This in theory means that if one has access to a pager, interface, and the software, it may be freely reprogrammed without needing anything other than the software password.
===Direct EEPROM readout?===The main EEPROM, a CAT24WC16, which is located on the top right of the board contains configuration information as well as . It may or may not contain the hand programming passcode, this is still unknown at this time. This chip is a standard I2C EEPROM which can easily be read and written with several different tools. The passcode is not encrypted or obscured in any context. The passcode is 4 bytes long and begins at hex address '''0x37C.''' The bytes are directly written to memory, so for example if the passcode set is '''1234''', the bytes read in order will read as '''0x01, 0x02, 0x03, 0x04.'''
<br />
=====EEPROM Dumping=====
The 24WC16J EEPROM is a standard I2C memory device. As such, it's contents can easily be read out using any I2C capable debug device or microcontroller such as the Bus Pirate or Arduino respectively. A CH341A programmer has also been used successfully to dump the contents.
===Software===
*'''csins.dat:''' The same exact installer of the program (setup.exe) but renamed with a .dat file extension (For uninstallation purposes?). File hashes match.
*'''default.tbl:''' The default pager configuration settings which are loaded at startup
** <u>You can find the hand programming passcode in this file. The passcode is not encrypted or obscured in any context. The passcode is 4 bytes long and begins at hex address '''0x37C.''' The bytes are directly written to memory, so for example if the passcode set is '''1234''', the bytes read in order will read as '''0x01, 0x02, 0x03, 0x04.'''</u>
*'''inpout32.dll:''' Standard Windows driver for hardware access to serial ports
*'''pager.dat:''' Unknown purpose. Apparently contains the software password AC5678 somewhere within. When removed or renamed and attempting to enter the password to unlock the software, it reports "No password table!Program will be end!". Same file hash as the pager.dat included with setup.exe.
<pre>47 6f 6c 64 41 70 6f 6c 6c 6f 35 52 03 00 00 00 00 8a</pre>
I have tried replaying the same byte sequence in response, as well as sending just "Apollo" with no luck. There My assumption is definitely there must be some reply word sent by the programmer itself, similar to the [http://n3ujj.com/TripMate_Self_Start_Modification.html DeLorme TripMate GPS which needs the word "ASTRAL" sent on it's RX pin to enable the GPS.]
==Caveats==
*Channel spacing seems to commonly be set to 25 kHz, making the common DAPNET frequency of 439.9875 MHz<ref>https://hampager.de/dokuwiki/doku.php?id=dapnetfrq</ref> unable to be set without an error message. The pager can be set to use 12.5 kHz channel spacing, but requires the programming software to accomplish. The easiest solution without software access is to choose a different frequency while minding the amateur satellite band (435 - 438 MHz)<ref>https://www.iaru-r1.org/wiki/UHF</ref>
*Currently, we do not know how to reset the hand programming password without a programmer. The passcode is clearly visible in the .tbl files, but not in any EEPROM dumps done thus far.
<br />