lwvmobile
commented
1 year ago In the last batch of updates, I rearranged the message for Site Status to include the LCN for convenience and to break it up evenly so that its not an odd division of LSN per line and make it easier to see what's going on in the TLC Call Alert LCN Channel vs what's happening in the Site Status CSBK
13:50:03 Sync: +DMR slot1 [slot2] | Color Code=01 | CSBK
Hytera XPT Site Status - Free LCN: 2 SN: 0
LCN 1 - LSN 01: ST-3 054; LSN 02: ST-0 Idle;
LCN 2 - LSN 03: ST-0 Idle; LSN 04: ST-0 Idle;
LCN 3 - LSN 05: ST-3 Null; LSN 06: ST-3 Null;
DMR PDU Payload [0A][68][2C][0F][36][00][00][00][00][00][5D][1A]
13:50:03 Sync: +DMR [slot1] slot2 | Color Code=01 | TLC
SLOT 1 FLCO=0x09 FID=0x68 TGT=54 SRC=12016 Hytera XPT Group Call Alert
HSK=0; Handshake - Ordinary; Call on LCN 1; Free LCN 2;
DMR PDU Payload [49][68][17][20][00][36][00][2E][F0][2D][2F][22]
13:50:03 Sync: +DMR slot1 [slot2] | Color Code=01 | CSBK
Hytera XPT CSBK 0x0B - SN: 0
XPT Adjacent Site:1 Free:2; Site:3 Free:1; Site:4 Free:2; Site:5 Free:1;
DMR PDU Payload [0B][68][08][20][18][10][20][20][28][10][3F][42]
13:50:03 Sync: +DMR [slot1] slot2 | Color Code=01 | TLC
SLOT 1 Hytera FLCO=0x13 FID=0x68
DMR PDU Payload [13][68][20][08][21][18][20][21][28][D1][3B][E8]
SLCO Hytera XPT - Free LCN 2 - PRI LCN 0 - PRI HASH: 00
SLCO Completed Block [86][82][00][08][A0]
I'd also like to point out that I am also now seeing the Hytera FLCO=0x13 in the TLC as well, before a voice call during the Call Alert phase. Previously I had thought this was only seen as an embedded link control, but seem that its also in the TLC. Currently, I have no idea how to decode this.
13:50:03 Sync: +DMR [slot1] slot2 | Color Code=01 | TLC
SLOT 1 Hytera FLCO=0x13 FID=0x68
DMR PDU Payload [13][68][20][08][21][18][20][21][28][D1][3B][E8]Another thing that was added into link control was user indication when a call is considered an Emergency or All Call by using its group ID. In XPT, Group ID ranges from 1 to 240; emergency group call ID ranges from 250 to 254; all call ID is 255.
if (reserved == 1)
{
fprintf (stderr, "Group ");
if (target > 248 && target < 255) fprintf (stderr, "Emergency ");
if (target == 255) fprintf (stderr, "All ");
} 
francisuk1989
This Issue Thread will be a general synopsis of ongoing work for Hytera XPT System decoding and trunking. Currently, I have remote access to a few small Hytera XPT systems, none of which are very busy at all so changes and testing is a game of make a small change/tweak, and wait for a while to see if it behaves properly, so progress is slow. I also have a few small IQ samples of multiple super busy XPT systems, which makes things a bit more diffucult as its hard to figure out the seperation between systems, but has a lot of things going on so its easy to test some changes, but not trunking related changes.
Also, note, most of the decoding is from observation and attempts to reverse engineer what is believed to be happening on these systems, there is no published spec on this, and the patent doesn't really seem to directly line up with any information observed on the CSBK/LC/etc. There are also some user manuals that give information, but not on how to decode these systems, just their capabilities, so those are used to infer bit lengths, etc and try to finding matching bits of information in the data, and making regions of link control, csbk, and data header src and tgt values match up.
Current work in progress includes refining the Hytera XPT Site Status CSBK to fix some minor code issues (index plus 1 issues) that may have prevented it from tuning to the correct LSN channel. I have also changed the 'Ch:' nomenclature to 'LSN:' to mean the logical slot number the activity is occurring on to differentiate it from an LCN 'RF' Channel numbering that is found in Hytera XPT Full Link Control. For example, LCN 1 would contain LSN 1 and LSN 2; LCN 2 would contain LSN 3 and LSN 4, and so on.
Furthermore, I have also been working on refining the main Link Control method used by XPT systems to be 'more correct' or more in line with what is found in the Site Status CSBK, along with more observation that I believe may include the LCN the call is taking place on. Note: LCN, not LSN:
Above, we can see Hash 187 (a CRC8 hash of the 16-bit TGT value to make it fit within an 8-bit value), and this call occurring on LCN 3, which is LSN 5 or LSN 6. The Site Status CSBK above shows it as on LSN 5. I've done some extensive testing on this one, and this seems to always line up, so i feel pretty confident in this addition. The 'Handshake' is purely per the patent, and it always is zero on the samples and systems I have access to, so can't say for certain this is accurate, but it is included for now. Free LCN refers to the current designation of the 'free repeater channel', or which RF frequency is next in line for a call to occur on.
Another thing to mention, I've discovered that along with LC, that other elements that use the SRC/TGT values, such as the Preamble CSBK, and Data Headers, also use a 16-bit version of both SRC and TGT, and that those values need to be truncated to 16-bit as well in order to properly line up with the link control, and in the case of private/individual data, a CRC8 Hash is also required for all elements to correlate to its proper placement in the Site Status CSBK. I've made changes to the code in relevant areas to truncate and hash as required so all elements of TG/TGT and SRC line up in TLC Call set ups, Preamble CSBK, Data Headers, and the Site Status CSBK.
Some elements below were trimmed out to avoid repetitiveness and highlight each part.
I have yet to find a way to differentiate a 'data' call from a 'voice' call in the TLC Call Setup, if it exists at all in there. There are a few small groups of bits left over, and some of those could designate different 'call' types.
I'll slowly be chipping away at XPT, and will push some updates to it from time to time, and attempt to document any finding and updates here, but until I'm feeling confident about these updates, I most likely will not issue any precompiled releases soley for them.