TYT/Tytera MD398 Reverse Engineering
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
xSmurf b4ac2774f3 Proper datasheet for the M25PE16 flash 4 years ago
codeplugs Added blank codeplugs from GD55 readout and MD398 CPS 4 years ago
datasheets Proper datasheet for the M25PE16 flash 4 years ago
teardown Added photo of GPS test screen... 4 years ago
README.md ... 4 years ago


MD398 Reverse Engineering

Resources for the Tytera (TYT) MD398 (aka Radioddity GD-55).

General Information

The radio uses a vastly different design than the familiar MD380/MD390. It uses the AT1846S radio SoC. It is a familiar chip used in many Wouxun/Baofeng model (?), however to the key difference that this newer S series provides an IQ baseband interface.

It appears to be using an integrated ARM M7 built into the HR-C3000?

The programming cable is actually a common USB to TTL serial interface (not an actual USB device). It's still not impossible the radio could appear as a DFU usb device for upgrades however.

There is an unused ribbon connector on the front side of the mainboard.


The connector used is called M328+ (as used on the Motorola GP388 and others), sometimes also called M7. It is 40mm in length. The audio pinout appears to be identical to other radios using this connector. Two more pins are used for the programming port. Four more pins are unknown (but appear to be unrouted passed the ribbon on the front panel board).

Time Slots

The radio CPS and firmware appear to only allow selecting Time Slot 1. It is possible to modify some xml to enable the CPS to program Time Slot 2. Doing that however, does not appear to change the behavior of the radio. The radio appears to transmit on both TDMA timeslots with duplicate packets, as a Tier I radio would (ie: ETSI 102 361-1 continuous transmission mode).

Boot Modes

Different boot modes seem to be available:

X X Flip + Mirror screen
X X ??? Black screen no chime, upgrade mode?
X X GPS Test mode