Earlier I wrote that I like to play airsoft and that I made a gun case here. Naturally when doing something competitive, with time, a need for more/better accessories grows, and one is the UHF radio (or walkie-talkie for some) which is really handy when communicating with your teammates in the field.
At work a long time ago I found a pair of Kenwood TK-3101E radios that were long forgotten in an abandoned room gathering dust in the dark – one was missing a battery pack and one had a dead battery pack, but I didn’t have a need for them at the time so I didn’t do anything. Now I thought I could revive these radios for a second life and use it for myself, so I took them out and tried to use.
By them I mean just one that still had a battery pack. Seems that Kenwood has a model name for anything they make (or made, not sure how it is these days), so the battery pack has a model name KNB-14, which originally is a 600mAh Ni-Cd. Needless to say that Ni-Cd is shit and battery was dead – didn’t hold a charge of 5 hours for more than 30 minutes while being turned off.
But that didn’t surprise me, since this model was released around 1999…
Fixing the battery pack
I decided to pry open the battery pack to see if I can fix this issue. Of course it was sealed tight but I managed to open it up without breaking it into pieces and saw that Kenwood were making some quality battery packs back in the day, although one cell was leaking already and inside there were components that protect against overheating, short-circuit, had a fuse for over-voltage.
The idea here is to replace these cells with better Ni-MH cells, because Ni-MH is basically a greatly improved Ni-Cd – in a nutshell they don’t have a memory effect, holds a charge longer, has a bigger capacity, is more durable, has the same (1.2v) voltage, etc., etc. and the most important thing – I can use the same charger, so I don’t have to get a different one or modify somehow the original. Just that this charger is designed for low capacity Ni-Cd batteries and therefore is a low amp charger, and therefore it takes about 30 hours (theoretically) to charge it from 0 to 100. Even more shitty is that the charger doesn’t have a status indicator light – only one red light that shows if it’s working at all.
A friend of mine had some spare Ni-MH 3000mAh (or so the AliExpress sellers claim, I’m lucky to even get like 30% of declared capacity, if it’s even Ni-MH lol) batteries for me (they cost 4.80€), I started with salvaging connectors from Ni-Cd and soldering them up to Ni-MH cells and then added all the protective components.
After connecting everything, I noticed that Ni-MH cells are a tad longer, like 1-2mm, while this sounds very small, it is a big deal when trying to assemble something into a tight space, so putting everything together didn’t go as easy as I wanted, but eventually I compressed it all enough to make a solid battery pack – or a bomb, I guess we’ll see. Putting it back into the radio required some force and now it won’t come off easily.
Programming
After charging for a couple of hours, I was eager to test this radio to see if it works properly. Since I can use only one of them, I had a friend bring his Baofeng UV-5R, after skimming through the instruction manual of my Kenwood and seeing what frequencies are on what channels, I noticed that Kenwood uses PMR446 standard, but for some unknown reason the radio channel list is not in line with a PMR channel list – meaning that a 5th channel from the PMR list is for example 7th on Kenwood and etc.
So anyway, here I encountered another problem – a friend could hear me speak, but I couldn’t hear my friend speak, even though the green LED would light up showing that it’s receiving.
Apparently that, in Kenwood’s lingo, is called “Quiet Talk” or QT for short, but in a wider sense it’s known by CTCSS name and it’s programmed on every channel as a different tone.
Obviously the Baofeng is much more capable and allows to set any CTCSS or DCS tone you like and anyway you like. I wanted to have the PMR446 without any tones, so I can send and receive freely. Without anything to filter the transmissions, I can listen to anyone on a set frequency. The solution was to remove the tones, but apparently it isn’t as easy as pressing a button.
I searched the interwebs for any kind of information about this radio and its hackabilities. To my surprise I found a couple of digitized manuals here and here, some forum posts and some old-looking websites in different languages (here, here and here) with plenty of information to let me understand what I need to do.
Kenwood had released a few different variations (labeled with different letters, probably T, E and E2 as shown on a service manual) of this model and it’s unclear how they differ, I only gathered that either newer or older versions (not sure which ones) than mine allowed turning off QT when in PROG mode, my (E version) model doesn’t allow that and I had to find a different way.
The only way left was to get a programming cable and turn QT off that way, so I ordered one (1.75€) and it seems that same cable can be used with Kenwood and Baofeng radios. For this specific model the programming software is called “kpg54d”, it’s a DOS piece of software and it can be easily found around the internet. There is another one for similar models called “kpg48d”.
“kpg54d” can read and write my specific model, but doesn’t allow to specify custom frequencies and turn off QT.
“kpg48d” cannot read my device, but allows what can’t be done with the first one.
They both use the same DAT file format, so they can be used together. But before opening a file from another program, the file header needs to match the program name you’re trying to open it in, therefore before opening the file with a Kenwood program, open it with NP++ or any hex editor (I was using HxD which is pretty cool) and change it.
Since they are DOS softwares, to use it on a modern computer you need a VM with WinXP or older (but that will probably do) or just use DOSBox.
Using DOSBox is the easiest way, so I installed that and went on to it’s configuration to set up a serial interface.
Kenwood programming software can only see COM1 or COM2, so the programming cable needs to emulate either one of those – it can be changed in “Device Manager”. When that was done, I opened up the dosbox config and under [serial] I modified serial1 to be: serial1=directserial realport:COM2
Then disabled all other ports.
Connecting procedure for this to work normally is as follows: connect the cable, turn on the radio, start up dosbox, start up software.
Now all should be good and time to start DOSBox. When it started, I mounted both “kpg54d” and “kpg48d” folders and ran the 54d one first. It’s pretty straightforward from thereon if no serial errors appeared in a DOSBox console – read data from device and save it to a file.
Then copy that file to where 48d is, go to where it’s mounted and load the file. I changed the frequencies to be in the same order as PMR446 list is and set all of QT lines to the same first frequency and didn’t select Off, simply because that would somehow mess things up for my radio and it would think that the config is incomplete, so when I would try to talk it would beep constantly. Those frequencies need to be zeroed and not disabled completely. Anyway, after that is done, save it and now you can leave the program.
Before loading this modified file into 54d software and writing it back to the radio, we need to remove those QT tones. This can be done with a hex editor I mentioned above, but any will do. Since I set all frequencies to be the same, it’s now very easy to identify them – more information about this file format and everything else can be found on those 3 sites I linked.
When all that is done, save it, and now it can be loaded into 54d program.
Here we don’t need to do anything else, just write it to the radio and that is pretty much it. Disconnect and try.
This procedure is simple once you understand, but tedious if some non-PMR frequencies need to be programmed in.
Another thing I had to do is set the squelch level to 7 instead of 5 (default, and it can be simply changed in settings – no hacking needed), for a simple reason that it would pick up noise from radios close-by that were talking on a different but close to mine frequency (a different but close channel) – so if I’m on a 5th channel, my radio would pick up static if someone was talking near me on 4th or 6th channels.
For some reason I would hear just static, while the Baofeng radios can hear the transmission clearly. Same thing with squelch applies to Baofengs as well – setting it to 7 seems to cut off receiving transmission of other channels, but it would for some reason make the radio transmit more silently.
Transmission power
I couldn’t find a definitive answer about the power output of this radio, but many forum posts say it’s max 2W. I can check that with a kpg54d program and it’s measured between 0 and 255 (it’s an unsigned byte). I don’t know how much truth is in there, but I’ll assume it’s true because all that data is from the device itself and mine is set to 164 (which is probably default), and that is ~65% (or ~1.3w) of what it can produce.
With such a power output I can speak clearly for up to ~500m with concrete walls in the way. So in a (sort of) open field it could probably go even further and with very good conditions even reach to a kilometer (though probably a bigger antenna is needed).
Second radio
Now about that second radio – it doesn’t have a battery pack to fix, but lucky for me these Kenwood models were pretty popular it seems, and probably still are to this day, because there are spare parts to buy everywhere and one of them is a battery shell case for 6 AA batteries (4.40€). The shell even has all the contacts for charging, so I ordered that along with 6 Ni-MH cells (4.50€).
After nearly 2 damn months of waiting, I got the batteries and a shell, we’ll see how they will hold.
Batteries – can’t comment on their quality at the moment, however the battery shell case looks ok, has the same look as original, even has the same information sticker on the back, though the plastic feels cheap and fragile compared to the Kenwood plastic, I don’t expect it to be robust too, but for such a price it’s good and everything fit together nicely.
Conclusion
IMO it’s totally not worth fixing these radios today, because:
- New genuine battery costs as much as a new simple but modern radio. Assembling the battery pack with a shell and branded Ni-MH cells (6xAA) like GP, Duracell, etc. also costs as much as a new modern radio (~20€)
- For 20-25€ you get a Baofeng UV-5R which has much better battery life, don’t need a cable to change frequencies or any of the settings, is much more powerful (like 5W) and many more stuff
I only fixed these to see how they perform and it was also fun to do it. But it seems that unless you do short distances and have access to a charging dock frequently (at least to leave it overnight if you use them a lot during the day), these radios are not practical anymore. I guess they never were very practical (especially with Ni-Cd cells), but back in 2000’s it was one of the few solutions and Kenwood was probably the shit. So I’ll be using them in games until I buy a more capable radio, then I’ll use these mostly at work. Total cost fixing these for me was 15.45€.
It seems to be working great in games like airsoft, battery lasts about 4-5 hours of frequent talking with my team after charging overnight, play area is usually not so large for this radio to go out of range. Just have to remember to charge it overnight before the game :P