I got my hands on two W31D and have been decompiling the manufacturer's messy Electron app (version v1.4.4 to be specific). I'm documenting it here in case me or someone else more familiar with CHIRP can implement them.
When reading the memory, first it sends a fixed "0270724f4752414d" (b'\x02prOGRAM'). The radio will reply with four bytes which represent the region (first byte), model (second byte), major software version in BCD (third byte) and minor software version in BCD (fourth byte).
The region indicates the built-in voices for the channel indication voices, and are as follows:
- 00: English + Chinese
- 01: Chinese + Russian
- 02: Russian + English
- 03: Arabic + English
- 04: Arabic + Chinese
- 05: Arabic + Russian
- 06: Chinese + Portuguese
- 07: English + Portuguese
- 08: Chinese + Spanish
- 09: English + Spanish
- 0A: Chinese + German
- 0B: English + German
- 0C: Chinese + French
- 0D: English + French
The application has seemingly support for five different programming protocols (called A through E), which are seemingly pretty similar between them. The full list of models and protocol versions are:
The registry of radios and protocols list:
- 00: Baofeng V1D, protocol A
- 01: 888SD, protocol A
- 02: 1901D, protocol C
- 03: 889D, protocol B
- 04: W31D(GMRS), protocol D (that "GMRS" bit is actually in their code)
- 05: T20, protocol D
- 06: V4D, protocol B
- 07: 1904D, protocol A
- 08: 1909D, protocol B
- 09: UV8D, protocol E
- 0A: V12D, protocol A
Then it sends a follow-up message that depends on the protocol:
- A, B or D: 0280824F4752414D
- C: 0220224F4752414D
- E: 02A0A24F4752414D
The radio will reply with a 06 byte (ACK?)
Then the PC sends some hardcoded values and checks them against other hardcoded values:
- Sends 02, expects 5033313037f70000
- Sends 06, expects 06
- Sends 52013008, expects 57013008ffffffffffffffff
- Sends 06, expects 06
Now it begins the actual read loop. It reads them in chunks of eight bytes, like so:
- Sends 52 ("R" in ASCII for read?) + two bytes representing the address in big endian + 08 (length?)
- Receives 08 (length? not checked) + two bytes representing the address in little endian (also not checked) + 52 ("R", not checked) + 8 bytes of data
- For all but protocol E, sends 06, expects 06
- For protocol E no idea yet what it's doing
Note the addresses are not read linearly - it seems it jumps forward multiple times, and depending on the address it pushes data to one array or the other.
Finally, it issues one final 45 command which is probably to exit programming mode. It does not expect any reply.
Attached is the entire read process for my walkie.
