Baofeng DM-32

Try this version...

Try this version...

Thank you.
I flashed 040_check_point_no_ser.bin.
As a result, it still won't start up, just like before.
When I select reset, eight "_" characters appear.
I can enter numbers, but nothing changes.
When I turn the frequency dial at the top, the startup screen appears and the device freezes.

I flashed 040_check_point_no_ser.bin.

Read the data using the CPS and enable reset permission.
And factory reset. SK1+SK2+PowerOn

I flashed 040_check_point_no_ser.bin.

Read the data using the CPS and enable reset permission.
And factory reset. SK1+SK2+PowerOn

I selected "Startup Reset" in the CPS options.
The normal reset screen appeared on the SK1 + SK2.
The screen then returned to normal.
I will flash the standard firmware later.

Thank you very much for your help in recovering my device over such a long period of time.

You are a god. Thank you.

Thank you.

Now I know one more nuance with firmware dump

You guy's are very good at what you do is there any chance of editing firmware 49 posted on this group , so when scanning the display switches off? and comes back on when a signal breaks the squelch , that would make it a far better radio

I flashed 040_check_point_no_ser.bin.

Read the data using the CPS and enable reset permission.
And factory reset. SK1+SK2+PowerOn

I selected "Startup Reset" in the CPS options.
The normal reset screen appeared on the SK1 + SK2.
The screen then returned to normal.
I will flash the standard firmware later.

Thank you very much for your help in recovering my device over such a long period of time.

You are a god. Thank you.

after that.

after that.

I need to think...

I can only assume that the radio's software compares the flash memory contents with the processor ID and, if there's a mismatch, displays a message about invalid hardware. This is just me thinking out loud...

Incorrect model

I figured out how firmware protection is implemented in the Baofeng DM-32. The ALPU-MP chip, connected to the processor's I2C bus, protects the firmware from unauthorized copying and use. The private key is stored in flash memory; if the flash memory is damaged or a memory image from another radio is used, the radio will not function correctly! The backup flash memory will only work with the radio from which the image was obtained! Currently, I cannot bypass this protection...
If anyone is planning to experiment with firmware, be sure to have a backup copy of your radio's flash memory!!!





In the attachment, exchange via the CPU<-> ALPU-MP and datasheet

MGayR7, Can you open the radio and see the chip number?

I figured out how firmware protection is implemented in the Baofeng DM-32. The ALPU-MP chip, connected to the processor's I2C bus, protects the firmware from unauthorized copying and use. The private key is stored in flash memory; if the flash memory is damaged or a memory image from another radio is used, the radio will not function correctly! The backup flash memory will only work with the radio from which the image was obtained! Currently, I cannot bypass this protection...
If anyone is planning to experiment with firmware, be sure to have a backup copy of your radio's flash memory!!!





In the attachment, exchange via the CPU<-> ALPU-MP and datasheet

Interesting. So how is this backup made? Is it through the normal CPS, or would I need a special software?

Interesting. So how is this backup made? Is it through the normal CPS, or would I need a special software?

Use OpenUV008_Flasher or Dahua SOC Tools

Interesting. So how is this backup made? Is it through the normal CPS, or would I need a special software?

Use OpenUV008_Flasher or Dahua SOC Tools

I've tried, but it seems I don't know how to do it.
I opened the app, set the correct COM port, then enabled (?) the Debug Mode button, then pressed on Memory. (I've left other things alone, like "Target" in DH5000 setting)
After that, I set "TargetAddr" to 03000000 and "TargetLen" to 262144. I then pressed "Dump Mem", gave a filename, but after a short while it says "Dump Mem Error!" I tried doing it with the radio in normal mode and in DFU mode, to no avail.