pub enum Command {
Show 118 variants
GetFrequency {
band: Band,
},
SetFrequency {
band: Band,
channel: ChannelMemory,
},
GetFrequencyFull {
band: Band,
},
SetFrequencyFull {
band: Band,
channel: ChannelMemory,
},
GetFirmwareVersion,
SetFirmwareVersion {
version: String,
},
GetPowerStatus,
GetRadioId,
SetRadioId {
model: String,
},
GetBeep,
SetBeep {
enabled: bool,
},
GetPowerLevel {
band: Band,
},
SetPowerLevel {
band: Band,
level: PowerLevel,
},
GetBand,
SetBand {
band: Band,
},
GetVfoMemoryMode {
band: Band,
},
SetVfoMemoryMode {
band: Band,
mode: VfoMemoryMode,
},
GetFmRadio,
SetFmRadio {
enabled: bool,
},
GetAfGain,
SetAfGain {
band: Band,
level: AfGainLevel,
},
GetSquelch {
band: Band,
},
SetSquelch {
band: Band,
level: SquelchLevel,
},
GetSmeter {
band: Band,
},
SetSmeter {
band: Band,
level: SMeterReading,
},
GetMode {
band: Band,
},
SetMode {
band: Band,
mode: Mode,
},
GetFineStep,
SetFineStep {
band: Band,
step: FineStep,
},
GetFunctionType,
SetFunctionType {
enabled: bool,
},
GetFilterWidth {
mode: FilterMode,
},
SetFilterWidth {
mode: FilterMode,
width: FilterWidthIndex,
},
FrequencyUp {
band: Band,
},
FrequencyDown {
band: Band,
},
GetAttenuator {
band: Band,
},
SetAttenuator {
band: Band,
enabled: bool,
},
SetAutoInfo {
enabled: bool,
},
GetBusy {
band: Band,
},
SetBusy {
band: Band,
busy: bool,
},
GetDualBand,
SetDualBand {
enabled: bool,
},
Receive {
band: Band,
},
Transmit {
band: Band,
},
GetLock,
SetLock {
locked: bool,
},
SetLockFull {
locked: bool,
lock_type: KeyLockType,
lock_a: bool,
lock_b: bool,
lock_c: bool,
lock_ptt: bool,
},
GetIoPort,
SetIoPort {
value: DetectOutputMode,
},
GetBatteryLevel,
SetBatteryLevel {
display: u8,
level: u8,
},
GetVoxDelay,
SetVoxDelay {
delay: VoxDelay,
},
GetVoxGain,
SetVoxGain {
gain: VoxGain,
},
GetVox,
SetVox {
enabled: bool,
},
GetCurrentChannel {
band: Band,
},
GetMemoryChannel {
channel: u16,
},
SetMemoryChannel {
channel: u16,
data: ChannelMemory,
},
RecallMemoryChannel {
band: Band,
channel: u16,
},
EnterProgrammingMode,
GetTncMode,
SetTncMode {
mode: TncMode,
setting: TncBaud,
},
GetDstarCallsign {
slot: DstarSlot,
},
SetDstarCallsign {
slot: DstarSlot,
callsign: String,
suffix: String,
},
GetRealTimeClock,
SetScanResume {
mode: ScanResumeMethod,
},
GetStepSize {
band: Band,
},
SetStepSize {
band: Band,
step: StepSize,
},
GetBandScope {
band: Band,
},
SetBandScope {
band: Band,
value: u8,
},
GetTncBaud,
SetTncBaud {
rate: TncBaud,
},
GetSerialInfo,
GetBeaconType,
SetBeaconType {
mode: BeaconMode,
},
GetPositionSource,
SendMessage {
text: String,
},
GetDstarSlot,
SetDstarSlot {
slot: DstarSlot,
},
GetActiveCallsignSlot,
SetActiveCallsignSlot {
slot: CallsignSlot,
},
GetGateway,
SetGateway {
value: DvGatewayMode,
},
GetGpsConfig,
SetGpsConfig {
gps_enabled: bool,
pc_output: bool,
},
GetGpsMode,
GetGpsSentences,
SetGpsSentences {
gga: bool,
gll: bool,
gsa: bool,
gsv: bool,
rmc: bool,
vtg: bool,
},
GetBluetooth,
SetBluetooth {
enabled: bool,
},
GetSdCard,
GetUserSettings,
GetRadioType,
GetMcpStatus,
EnterServiceMode,
ExitServiceMode,
ReadCalibrationData,
WriteCalibrationData {
data: String,
},
GetServiceStatus,
ServiceCalibrate1A,
ServiceCalibrate1D,
ServiceCalibrate1E {
value: Option<String>,
},
ServiceCalibrate1N,
ServiceCalibrate1V {
value: Option<String>,
},
ServiceCalibrate1W {
value: String,
},
ServiceWriteId {
id: String,
code: String,
},
ServiceFlashRead,
ServiceFlashWrite {
address: String,
data: String,
},
ServiceWriteConfig,
ServiceBandSelect {
band: u8,
},
ServiceReadEeprom {
address: String,
length: String,
},
ServiceReadEepromAddr,
ServiceGetVersion {
param1: String,
param2: String,
},
ServiceGetHardware,
ServiceCalibrateNew {
value: String,
},
ServiceDynamicParam {
data: Option<String>,
},
}Expand description
A CAT command to send to the radio.
Variants§
GetFrequency
Get frequency (FQ read).
Returns the current frequency data for the target band. Works in any mode.
SetFrequency
Set frequency (FQ write) – takes full channel data.
§Hardware note
FQ write may be rejected by the TH-D75 (returns ?). Prefer
SetFrequencyFull (FO write) for
reliable VFO frequency changes, or use
Radio::tune_frequency
which handles mode switching and uses FO write internally.
§Mode requirement
Radio must be in VFO mode on the target band.
GetFrequencyFull
Get full frequency and settings (FO read).
Returns full channel data including tone, shift, and step settings. Works in any mode.
SetFrequencyFull
Set full frequency and settings (FO write).
§Mode requirement
Radio must be in VFO mode on the target band.
Use Radio::tune_frequency
for automatic mode handling.
GetFirmwareVersion
Get firmware version (FV).
SetFirmwareVersion
Set firmware version (FV write) – factory programming command.
Wire format: FV version\r.
§Safety
DANGEROUS FACTORY COMMAND. This is intended for factory programming only. Writing an incorrect firmware version string may brick the radio, cause firmware validation failures, or void your warranty. Do not use unless you fully understand the consequences.
GetPowerStatus
Get power on/off status (PS read).
GetRadioId
Get radio model ID (ID).
SetRadioId
Set radio model ID (ID write) – factory programming command.
Wire format: ID model\r.
§Safety
DANGEROUS FACTORY COMMAND. This is intended for factory programming only. Writing an incorrect model ID may cause the radio to behave as a different model, disable features, or brick the device. Do not use unless you fully understand the consequences.
GetBeep
Get beep setting (BE read).
D75 RE: BE x (x: 0=off, 1=on).
Sends bare BE\r.
§Mode requirement
Hardware-verified: returns N (not available) in certain modes.
The beep setting may not be readable depending on the radio’s
current operating state.
SetBeep
Set beep on/off (BE write).
D75 RE: BE x (x: 0=off, 1=on).
Sends BE 0\r or BE 1\r.
§D75 firmware note
The D75 cat_be_handler is a stub that always returns ? for writes.
The beep setting can only be changed via MCP programming mode (direct
memory writes) or the radio’s menu. The read (BE\r) works normally.
The handler copies a model string on bare read but immediately calls
cat_send_error_response() for all other lengths.
GetPowerLevel
Get power level (PC read).
SetPowerLevel
Set power level (PC write).
GetBand
Get the current active band (BC bare read).
SetBand
Set the active band (BC write).
§Warning
This is an ACTION command that switches the radio’s active band.
GetVfoMemoryMode
Get VFO/Memory mode (VM read).
Mode values: 0 = VFO, 1 = Memory, 2 = Call, 3 = WX.
Works in any mode. The response is used to update the
Radio cached mode state.
SetVfoMemoryMode
Set VFO/Memory mode (VM write).
Mode values: 0 = VFO, 1 = Memory, 2 = Call, 3 = WX. This is an ACTION command that changes the radio’s operating mode. Prefer the safe tuning methods which handle mode switching automatically.
GetFmRadio
Get FM radio on/off state (FR read).
SetFmRadio
Set FM radio on/off state (FR write).
GetAfGain
Get AF gain level for a band (AG read).
Per KI4LAX CAT reference: AG returns gain level 000-099.
Hardware observation: bare AG\r returns global gain. Band-indexed
AG band\r returns ?. Read is bare only.
SetAfGain
Set AF gain level (AG write).
Per KI4LAX CAT reference: AG AAA (AAA: 000-099, 3-digit zero-padded).
Sends bare AG level\r (no band parameter — firmware rejects band-indexed writes).
Important: the band field is ignored by the firmware. The AG
command on the TH-D75 is a global (non-band-specific) control.
Attempting to send a band-indexed write (AG band,level) results
in a ? error response from the radio. The band field is
retained in this variant solely for API symmetry with other
band-indexed commands (e.g., Command::SetSquelch,
Command::SetMode) so that callers can use a uniform
band+value pattern. The serializer discards it.
Fields
band: BandTarget band. Ignored by firmware — AF gain is a global
control on the TH-D75. This field exists for API symmetry
with other band-indexed commands; the serializer discards it
and sends a bare AG level\r.
level: AfGainLevelGain level (0-99).
GetSquelch
Get squelch level (SQ read).
SetSquelch
Set squelch level (SQ write).
Per KI4LAX CAT reference: SQ x,yy (x: band, yy: squelch level 0-6).
Sends SQ band,level\r.
GetSmeter
Get S-meter reading (SM read).
SetSmeter
Set S-meter value (SM write) – calibration/test interface.
Wire format: SM band,level\r (band 0-1, level is a hex nibble value).
§Warning
This is likely a calibration or test/debug interface. Setting the S-meter value directly may interfere with normal signal strength readings. The exact behavior and persistence of written values is undocumented.
GetMode
Get operating mode (MD read).
SetMode
Set operating mode (MD write).
§Mode requirement
Radio must be in VFO mode on the target band. Setting the operating mode (FM/DV/NFM/AM) only applies to the current VFO.
GetFineStep
Get fine step (FS bare read).
Firmware-verified: FS = Fine Step. Bare FS\r returns FS value
(single value, no band). Band-indexed reads are not supported.
SetFineStep
Set fine step for a band (FS write).
Firmware-verified: FS band,step\r (band 0-1, step 0-3).
§Firmware bug (v1.03)
FS write is broken on firmware 1.03 — the radio returns N
(not available) for all write attempts.
GetFunctionType
Get function type (FT bare read, no band parameter).
Sends FT\r (bare). The radio returns the current function type.
SetFunctionType
Set fine tune on/off (FT write).
Wire format: FT band,value\r (band 0-1, value 0=off, 1=on).
Per Operating Tips section 5.10.6: Fine Tune only works with AM modulation and Band B. The write form takes a band parameter unlike the bare read. Set fine tune on/off (FT write).
Wire format: FT value\r (bare, no band parameter per ARFC-D75 RE).
ARFC sends FT 0\r (off) or FT 1\r (on).
GetFilterWidth
Get filter width by mode index (SH read).
Per Operating Tips §5.10: SSB high-cut 2.2–3.0 kHz (Menu 120),
CW bandwidth 0.3–2.0 kHz (Menu 121), AM high-cut 3.0–7.5 kHz
(Menu 122). mode_index: 0 = SSB, 1 = CW, 2 = AM.
Fields
mode: FilterModeReceiver filter mode.
SetFilterWidth
Set filter width by mode index (SH write).
Sets the IF receive filter width for the specified mode. The width
value maps to the filter selection index for that mode (see
GetFilterWidth for mode descriptions).
Fields
mode: FilterModeReceiver filter mode.
width: FilterWidthIndexFilter width index (0-4 for SSB/CW, 0-3 for AM).
FrequencyUp
Step frequency up by one increment (UP action).
§Mode requirement
Radio should be in VFO mode for frequency stepping. In Memory mode, this steps through memory channels instead.
§Warning
This is an ACTION command that changes the radio’s active frequency. There is no undo – the previous frequency is not preserved.
FrequencyDown
Tune frequency down by one step (DW action).
Per KI4LAX CAT reference: DW tunes the current band’s frequency down by the current step size. This is a write-only action command (like UP). The band parameter selects which band to step.
GetAttenuator
Get attenuator state (RA read).
SetAttenuator
Set attenuator on/off (RA write).
SetAutoInfo
Set auto-info notification mode (AI write).
The firmware accepts values 0-200 (not just 0/1). Values beyond 1 may control notification verbosity or filter settings. The exact semantics of values 2-200 are undocumented.
GetBusy
Get busy state (BY read).
SetBusy
Set busy/squelch state (BY write) – test/debug interface.
Wire format: BY band,state\r (band 0-1, state 0=not busy, 1=busy).
§Warning
This is likely a test or debug interface. Setting the busy state directly may interfere with normal squelch operation. Use with caution.
GetDualBand
Get dual-band mode (DL read).
SetDualBand
Set dual-band mode (DL write).
Receive
Switch to receive mode (RX action).
Transmit
Key the transmitter (TX action).
§Safety
This transmits on air. Ensure you are authorized to transmit on
the current frequency, have proper identification, and comply with
all applicable regulations. Use Command::Receive to return to receive mode.
GetLock
Get lock/control settings (LC read).
Returns the primary lock state as a boolean. For reading all lock fields, use MCP memory offsets 0x1060–0x1065.
SetLock
Set lock/control state — simple boolean form (LC write).
Sends LC 0 or LC 1. The locked field uses wire semantics:
on the D75 the wire value is inverted (true on the wire means
unlocked). The high-level Radio::set_lock() method handles
this inversion so callers can pass logical lock state.
For full lock configuration, use
SetLockFull.
SetLockFull
Set all lock/control fields (LC 6-field write).
Sends LC a,b,c,d,e,f where each field is a control flag:
a: Key lock (0=off, 1=on) — MCP 0x1060b: Key lock type (0=key, 1=PTT, 2=key+PTT) — MCP 0x1061c: Lock key A (0=off, 1=on) — MCP 0x1062d: Lock key B (0=off, 1=on) — MCP 0x1063e: Lock key C (0=off, 1=on) — MCP 0x1064f: Lock PTT (0=off, 1=on) — MCP 0x1065
Fields
lock_type: KeyLockTypeKey lock type (key-only, key+PTT, key+PTT+dial).
GetIoPort
Get AF/IF/Detect output mode (IO read).
SetIoPort
Set AF/IF/Detect output mode (IO write).
Fields
value: DetectOutputModeOutput mode (AF/IF/Detect).
GetBatteryLevel
Get battery level (BL read).
Per KI4LAX CAT reference: BL returns battery charge state. 0=Empty (Red), 1=1/3 (Yellow), 2=2/3 (Green), 3=Full (Green), 4=Charging (observed on hardware when USB power is connected).
SetBatteryLevel
Set battery level display (BL write).
Wire format: BL display,level\r (7 bytes with comma).
§Warning
The exact purpose of this command is unclear. It may control the battery
display indicator or be a calibration/test interface. The display and
level parameter semantics are undocumented.
Fields
GetVoxDelay
Get VOX delay (VD read).
§Mode requirement
VOX must be enabled (VX 1) for VD read/write to succeed.
Returns N (not available) when VOX is off.
SetVoxDelay
Set VOX delay (VD write).
§Mode requirement
VOX must be enabled (VX 1) for VD writes to succeed.
Returns N (not available) when VOX is off. Enable VOX first
with SetVox, then set the delay, then
optionally disable VOX again.
GetVoxGain
Get VOX gain (VG read).
§Mode requirement
VOX must be enabled (VX 1) for VG read/write to succeed.
Returns N (not available) when VOX is off.
SetVoxGain
Set VOX gain (VG write).
§Mode requirement
VOX must be enabled (VX 1) for VG writes to succeed.
Returns N (not available) when VOX is off.
GetVox
Get VOX state (VX read).
SetVox
Set VOX on/off (VX write).
GetCurrentChannel
Get the current memory channel number for a band (MR read).
Hardware-verified: MR band\r returns MR bandCCC where CCC is
the 3-digit channel number (no comma separator in the response).
Example: MR 0\r returns MR 021 meaning band A, channel 21.
This is a READ that queries which channel is active, not an action.
GetMemoryChannel
Get memory channel data (ME read).
SetMemoryChannel
Set memory channel data (ME write).
RecallMemoryChannel
Recall memory channel — switches the radio’s active channel (MR write).
§Mode requirement
Radio must be in Memory mode on the target band.
Use Radio::tune_channel
for automatic mode handling.
§Warning
This is an ACTION command that changes the radio’s active channel.
Format is MR band,channel. Despite the “get” in the name of the
Kenwood documentation, this command changes radio state.
EnterProgrammingMode
Enter MCP programming mode (0M action).
§Safety
DANGEROUS: This puts the radio into programming mode where it stops responding to normal CAT commands. The radio must be manually restarted to recover. Do not use unless implementing a full MCP programming interface.
GetTncMode
Get TNC mode (TN bare read).
Hardware-verified: bare TN\r returns TN mode,setting.
Band-indexed TN band\r returns ? (rejected).
The D75 RE misidentified this as CTCSS tone. On hardware, TN
returns TNC mode data (e.g., TN 0,0).
Valid mode values per firmware validation: 0, 1, 2, 3. Mode 3 may correspond to MMDVM or Reflector Terminal mode.
SetTncMode
Set TNC mode (TN write).
Wire format: TN mode,setting\r.
Valid mode values per firmware validation: 0, 1, 2, 3. Mode 3 may correspond to MMDVM or Reflector Terminal mode.
Fields
GetDstarCallsign
Get D-STAR callsign data for a slot (DC read).
Hardware-verified: DC slot\r where slot is 1-6.
DC 0 returns N (not available). Slots 1-6 return callsign
data in format DC slot,callsign,suffix.
The D75 RE misidentified this as DCS code. On hardware, DC is the D-STAR callsign command.
SetDstarCallsign
Set D-STAR callsign for a slot (DC write).
Wire format: DC slot,callsign,suffix\r where slot is 1-6,
callsign is 8 characters (space-padded), and suffix is up to
4 characters.
Fields
GetRealTimeClock
Get real-time clock (RT bare read).
Hardware-verified: bare RT\r returns RT YYMMDDHHmmss.
Band-indexed RT band\r returns ? (rejected).
The D75 RE misidentified this as repeater tone. On hardware, RT returns the radio’s real-time clock.
SetScanResume
Set scan resume mode (SR write-only).
Hardware-verified: bare SR\r returns ? (no read form).
SR is write-only. Sends SR mode\r.
§Safety warning
On hardware, SR 0 was observed to reboot the radio. The D75 RE
identifies this as scan resume, but the behavior may coincide with
a reset action. Use with caution.
Fields
mode: ScanResumeMethodScan resume method.
GetStepSize
Get step size for a band (SF read, band-indexed).
Firmware-verified: SF = Step Size. SF band\r returns SF band,step.
Both SF 0 and SF 1 confirmed working.
SetStepSize
Set step size for a band (SF write).
Firmware-verified: SF band,step\r (band 0-1, step index 0-11).
GetBandScope
Get band scope data (BS read).
SetBandScope
Set band scope configuration (BS write).
Wire format: BS band,value\r (band 0-1, value meaning unknown).
GetTncBaud
Get TNC baud rate (AS read).
Returns 0 = 1200 baud, 1 = 9600 baud.
SetTncBaud
Set TNC baud rate (AS write).
Values: 0 = 1200 baud, 1 = 9600 baud.
GetSerialInfo
Get serial number and model code (AE read).
Despite the AE mnemonic (historically “APRS Extended”), this command returns the radio’s serial number and model code.
GetBeaconType
Get beacon TX control mode (PT read).
SetBeaconType
Set beacon TX control mode (PT write).
Fields
mode: BeaconModeBeacon transmission mode.
GetPositionSource
Get APRS position source (MS read).
SendMessage
Send message (MS write).
GetDstarSlot
Get active D-STAR callsign slot (DS read).
SetDstarSlot
Set active D-STAR callsign slot (DS write).
GetActiveCallsignSlot
Get the active callsign slot number (CS bare read).
CS returns a slot number (0-10), NOT the callsign text itself. The actual callsign text is read via DC (D-STAR callsign) slots 1-6.
SetActiveCallsignSlot
Set the active callsign slot (CS write).
Selects which callsign slot is active. Format: CS N where N is
the slot number. The callsign text itself is read via DC slots.
Fields
slot: CallsignSlotCallsign slot to select (0-10).
GetGateway
Get gateway (GW read).
SetGateway
Set DV Gateway mode (GW write).
Fields
value: DvGatewayModeDV Gateway mode (Off or Reflector Terminal).
GetGpsConfig
Get GPS configuration (GP read).
Returns GPS enabled and PC output enabled flags.
SetGpsConfig
Set GPS configuration (GP write).
Sets GPS enabled and PC output enabled flags.
GetGpsMode
Get GPS/Radio mode status (GM bare read).
§Warning
Only use bare GM\r (no parameter). Sending GM 1\r reboots the
radio into GPS-only mode. This command only supports the bare read.
GetGpsSentences
Get GPS NMEA sentence enable flags (GS read).
Returns 6 boolean flags for GGA, GLL, GSA, GSV, RMC, VTG.
SetGpsSentences
Set GPS NMEA sentence enable flags (GS write).
Sets 6 boolean flags for GGA, GLL, GSA, GSV, RMC, VTG.
Fields
GetBluetooth
Get Bluetooth state (BT read).
SetBluetooth
Set Bluetooth on/off (BT write).
GetSdCard
Query SD card / programming interface status (SD read).
Note: The firmware’s SD handler primarily checks for SD PROGRAM
to enter MCP programming mode. The bare SD read response (SD 0/1)
appears to indicate programming interface readiness, not SD card
presence. Do NOT send SD PROGRAM — it enters programming mode
and the radio stops responding to normal CAT commands.
GetUserSettings
Get user settings (US read).
§Hardware note
US returns ? on all tested formats on the TH-D75 and may not be
implemented. Both bare US and indexed US NN formats were rejected
during gap probe testing with firmware 1.03.
GetRadioType
Get radio type/region code (TY read).
Not in the firmware’s 53-command dispatch table — likely processed
by a separate code path. Returns a region string and variant number
(e.g., TY K,2 for US region, variant 2).
GetMcpStatus
Get MCP status (0E read).
Returns N (not available) in normal operating mode. This mnemonic
appears to be MCP-related. Its full behavior is unknown.
EnterServiceMode
Enter factory service mode (0G write).
Wire format: 0G KENWOOD\r. The radio validates the “KENWOOD”
password and switches from the standard 53-command CAT table to
the 34-entry service mode table. Normal commands will not work
until service mode is exited with ExitServiceMode.
Discovered via Ghidra RE of TH-D75 V1.03 firmware at 0xC006F464.
ExitServiceMode
Exit factory service mode (0G bare).
Wire format: 0G\r. Exits service mode and restores the standard
CAT command table. The 0G handler accepts both the bare form (exit)
and the 0G KENWOOD form (entry).
Discovered via Ghidra RE of TH-D75 V1.03 firmware at 0xC006F464.
ReadCalibrationData
Read factory calibration data (0S read).
Wire format: 0S\r. Reads 200 bytes of factory calibration data
(118 bytes from 0x4E000 + 82 bytes from a second address).
Response is hex-encoded calibration data.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F508.
WriteCalibrationData
Write factory calibration data (0R write).
Wire format: 0R data\r where data is 400 hex characters encoding
200 bytes. Total wire length is 404 bytes (2 mnemonic + 1 space +
400 hex + 1 CR). Writes to the same addresses as 0S.
§Safety
CRITICAL: Can corrupt factory calibration. Incorrect data will desynchronize RF calibration tables. Recovery may require professional recalibration with test equipment. Always read calibration first (0S) and keep a backup before writing.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F546.
GetServiceStatus
Get service/MCP status (0E service mode read).
Wire format: 0E\r. Reads 3 bytes from address 0x110 (hardware
status register). In service mode, 0E returns actual status data
rather than N (not available) as in normal mode.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F4B0.
ServiceCalibrate1A
Service calibration parameter read/write (1A).
Wire format: 1A\r (read, 3 bytes). Delegates to the firmware’s
command executor for calibration parameter access.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F5D0.
ServiceCalibrate1D
Service calibration parameter read/write (1D).
Wire format: 1D\r (read, 3 bytes). Same executor-based pattern
as 1A.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F5E4.
ServiceCalibrate1E
Service calibration parameter read/write (1E).
Wire format: 1E\r (read, 3 bytes) or 1E XXX\r (write, 6 bytes
= 2 mnemonic + 1 space + 3 value). The firmware accepts both forms.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F5F8.
ServiceCalibrate1N
Service calibration parameter read/write (1N).
Wire format: 1N\r (read, 3 bytes). Same executor-based pattern
as 1A.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F6D0.
ServiceCalibrate1V
Service calibration parameter read/write (1V).
Wire format: 1V\r (read, 3 bytes) or 1V XXX\r (write, 6 bytes).
Same dual-mode pattern as 1E.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F740.
ServiceCalibrate1W
Service calibration single parameter write (1W).
Wire format: 1W X\r (write only, 5 bytes total).
Single-character parameter, likely a mode or flag toggle.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F766.
ServiceWriteId
Write factory callsign/serial number (1I write).
Wire format: 1I XXXXXXXX,YYY\r (16 bytes total = 2 mnemonic +
1 space + 8 hex chars + 1 comma + 3 hex chars + 1 CR). The firmware
validates all characters are alphanumeric (0-9, A-Z, a-z).
§Safety
HIGH RISK: Changes the radio’s factory serial number / callsign. This may void the warranty and could cause regulatory issues. The original values should be backed up before any modification.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F61E.
Fields
ServiceFlashRead
Raw flash memory read/write (1F).
Wire format for write: 1F AAAAAA,data\r where AAAAAA is a 6-digit
hex address (max 0x4FFFF) and data is hex-encoded bytes. The firmware
validates that address + length does not exceed 0x50000. Read form
is context-dependent on the executor.
§Safety
CRITICAL: Can brick the radio. Raw flash writes can overwrite boot code, calibration data, or firmware. There is no recovery mechanism short of JTAG or factory repair. Never write to flash addresses without understanding the memory map.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F780.
ServiceFlashWrite
Raw flash memory write (1F write).
Wire format: 1F AAAAAA,data\r where AAAAAA is 6-digit hex address
and data is hex-encoded bytes.
§Safety
CRITICAL: Can brick the radio. See ServiceFlashRead.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F780.
Fields
ServiceWriteConfig
Generic write via executor (0W).
Wire format: 0W\r (3 bytes). Delegates to the firmware’s command
executor. The exact write operation depends on the executor’s
internal state.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F5BC.
ServiceBandSelect
Service mode band selection (0Y).
Wire format: 0Y band\r (5 bytes total). Band is 0 or 1.
Band 0 calls radio_caller_06ef1c(), band 1 calls
ipc_caller_06eef6() — different code paths for the two
receiver chains.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F4D0.
ServiceReadEeprom
Bulk EEPROM/calibration data export (9E read).
Wire format: 9E AAAAAA,LL\r (13 bytes = 2 mnemonic + 1 space +
6-digit hex address + 1 comma + 2-digit hex length + 1 CR).
Reads up to 256 bytes from the specified address. Length 0 means 256.
Address + length must not exceed 0x50000.
Response is 128-byte formatted hex data.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F826.
Fields
ServiceReadEepromAddr
Targeted calibration read at specific offset (9R read).
Wire format: 9R\r (3 bytes). Returns 4 bytes of formatted
calibration data at the current offset. The offset is determined
by internal firmware state.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F8CA.
ServiceGetVersion
Get internal version/variant information (2V).
Wire format: 2V XX,YYY\r (10 bytes = 2 mnemonic + 1 space +
2-digit hex param + 1 comma + 3-digit hex param + 1 CR).
Returns internal model code (e.g., EX-5210), build date, hardware
revision, and calibration date.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F910.
ServiceGetHardware
Get hardware register / GPIO status (1G read).
Wire format: 1G\r (3 bytes). Returns hex-encoded hardware
register values with a comma separator. Used for factory testing
of GPIO and peripheral status.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F9A8.
ServiceCalibrateNew
New calibration command in D75 (1C write).
Wire format: 1C XXX\r (7 bytes = 2 mnemonic + 1 space + 3-digit
hex value + 1 CR). Value must be less than 0x100 (256). Not present
in the D74 firmware — likely related to the 220 MHz band (D75A)
or enhanced DSP.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006FA08.
ServiceDynamicParam
Dynamic-length hardware configuration (1U).
Wire format: 1U\r (read, 3 bytes) or 1U data\r (write, dynamic
length determined by reading a hardware register). The firmware
calls os_disable_interrupts() in the error path — this is a
low-level hardware configuration command.
Requires service mode (0G KENWOOD first).
Discovered via Ghidra RE at 0xC006F6E4.