Projects

Technical documentation for all current projects. Source code and downloadable files are available on the Downloads page.

Saturn SC2 — DOHC 1.9L Engine Rebuild

A full rebuild guide of the Saturn SC2's 1.9L DOHC four-cylinder engine (engine code LL0). This log covers information and quick torque specs relating to the 2000–2002 Saturn S-Series twin cam engine.

Note on engine codes: the DOHC 16-valve 1.9L is the LL0. LK0 and L24 are the SOHC 8-valve engines used in the SC1/SL1/SW1, LK0 being the early throttle body injected (TBI) 85 hp version and L24 the later MPFI 100 hp version. If a parts catalog lists LK0 for an SC2, it is misfiled.

Engine Specifications

Spec	Value
Engine Code	LL0 (Twin Cam)
Displacement	1.9L — 1901 cc (116 cu in)
Configuration	Inline 4, DOHC, 16-valve
Bore × Stroke	82.0 mm × 90.0 mm (3.23 in × 3.54 in)
Block / Head Material	Aluminum block (319.1 alloy) with cast iron cylinder liners; aluminum head
Valvetrain (1999–2002)	Roller camshafts with rocker arms and hydraulic lash adjusters — NOT the direct-acting bucket lifters used 1991–1998
Cam Drive	Chain driven off the crankshaft sprocket
Crankshaft	5 main bearings, thrust at center main; 1999–2002 cranks use 8 counterweights (4 on 1991–1998)
Compression Ratio	9.5:1
Fuel System	Sequential MPFI
Output (stock)	124 hp @ 5600 rpm / 122 lb·ft @ 4800 rpm
Firing Order	1-3-4-2
Oil Capacity	4.0 qt w/ filter

Key Torque Values

Values below are for the DOHC LL0. Several published tables mix SOHC and DOHC columns together, which is the most common source of bad numbers for this engine. Always confirm against the factory service manual for your exact model year before final assembly.

Fastener	Torque
Cylinder head bolts (new bolts required)	Step 1: 22 lb·ft → Step 2: +90° → Step 3: +90°
Connecting rod bolts	Step 1: 18 lb·ft → Step 2: +75°
Main bearing caps	37 lb·ft
Camshaft sprocket bolt	75 lb·ft
Intake manifold	22 lb·ft
Exhaust manifold nuts (DOHC)	23 lb·ft — 16 lb·ft is the SOHC value
Spark plugs	20 lb·ft
Oil drain plug	26 lb·ft

Known Weak Points

Timing chain tensioner and guides, the classic LL0 wear item. Replace both on any rebuild rather than reusing them
Valve cover and oil pan gaskets weep with age; plan on replacing during teardown
The cracked-head problem widely reported on the S-Series affected SOHC engines only, the DOHC uses a different casting and does not share it

Motorola CPS — Customer Programming Software

Programming software (CPS) for legacy Motorola two-way radios. These utilities are increasingly difficult to find through official channels. All software listed here is for use with radios you own and is provided for archival and interoperability purposes.

Programming Cable Information

Most Radius and Maxtrac radios use a DB25 or DB9 RSS interface cable
RSS software requires a RIB (Radio Interface Box) or compatible USB adapter
All cable pinout diagrams available on the Downloads page
Software runs best under DOS or Windows 98/XP; use DOSBox for modern systems

► Go to Downloads Page

KE0WPC — 2 m CW Beacon Firmware for the Quansheng UV-K5

A purpose-built firmware that turns a UV-K5 into a locked-down CW beacon controller and transmitter. It is not a modified F4HWN build, it is a separate firmware that replaces the entire radio application. There is no receiver, no VFO, no menu, no keypad entry, and no way to change frequency or callsign without recompiling.

► Hardware warning: read before flashing. This builds for the DP32G030, the MCU in the original UV-K5, K5(8) and K6. The newer UV-K1 and UV-K5 V3 use a PY32F071 and are a completely different target. Flashing this to a V3 will brick it. If you are unsure, read your radio's existing firmware version with uvtools before flashing anything.

Station Parameters

Parameter	Value
Frequency	144.2770 MHz, fixed at compile time
Callsign	Fixed at compile time (default `KE0WPC` change this before you transmit)
Transmission	`YOURCALL/B EN14` in CW at 12 WPM, followed by a 10 s steady carrier
Emission	A1A
Target hardware	UV-K5 / K5(8) / K6 with the DP32G030 MCU
Image size	8748 bytes (14% of the 60 KB flash)
License	Apache License, Version 2.0

Source Files

File	What it is
`beacon_config.h`	Every tunable. Callsign, frequency, speed, timing, power.
`beacon.c`	Main loop, transmitter control, keying envelope, display.
`morse.c` / `morse.h`	ITU Morse encoder with correct element weighting.
`stubs.c`	Handful of globals the stock drivers expect.
`../Makefile.beacon`	Build target. Lives in the repo root.

The stock driver files are linked completely unmodified. Nothing outside beacon/ and Makefile.beacon is touched, so it is a matter of copying two things across.

Building

git clone https://github.com/armel/uv-k5-firmware-custom.git
cd uv-k5-firmware-custom
# drop in beacon/ and Makefile.beacon
sudo apt install gcc-arm-none-eabi python3-pip
pip3 install crcmod
make -f Makefile.beacon

This produces two images:

uvk5-beacon.bin — raw image
uvk5-beacon.packed.bin — obfuscated and CRC'd. This is the one you flash.

Flashing

Back up your calibration data first with uvtools. This firmware does not write to the calibration area, but a backup costs nothing and an unrecoverable radio costs a radio.
Power the radio off. Hold PTT and power on, the flashlight LED lights steady, indicating bootloader mode.
Flash uvk5-beacon.packed.bin with uvtools or k5prog.
To go back to a normal radio, flash any standard UV-K5 firmware the same way. Nothing here is permanent.

Operating Sequence

ARMING 10 ... 1     10 s countdown. Press any key to abort. Last chance
                    to notice a disconnected antenna.
ID                  KE0WPC/B EN14 in CW, 12 WPM, ~15.4 s
CARRIER 10          Steady unmodulated carrier, 10 s
WAIT 30 ... 1       Silent gap
                    (repeat forever)

The display shows state, cycle count and battery voltage. The backlight goes off after arming and the red LED follows the key. Pressing any key halts the beacon permanently until you power cycle, this is intentional, so a halt is permanent rather than something you might accidentally resume. It also refuses to transmit below 6.60 V and halts with Battery low.

How the CW Is Generated

The BK4819 has no CW mode. The transmitter is brought up in FM with the microphone path cut, GPIOC_PIN_AUDIO_PATH cleared plus BK4819_EnterTxMute(), which yields a clean unmodulated carrier. That carrier is then keyed by ramping the PA bias register (REG_36) up and down.

The result is true A1A (CW). A distant station hears it on a CW or SSB receiver as a tone at whatever offset they are tuned to. On an FM receiver it sounds like the squelch opening and closing, which is not useful, that is expected and correct for this part of the band. FM is way too wide for this part of the band.

The ramp matters. Slamming the bias from zero to full in a single register write gives a hard-edged envelope and audible key clicks spread either side of the carrier. Sixteen steps over 4 ms rounds the edges enough to be polite to the weak-signal operators who live in this segment. The 4 ms is charged against the element length rather than added to it, so dit/dah weighting stays correct.

PA bias is read from your radio's own factory calibration at EEPROM 0x1ED0 and interpolated across the band exactly as the stock firmware does, so output power is correct rather than guessed.

Duty Cycle

A UV-K5 is a handheld. Its PA is sized for the intermittent duty an operator produces, not for beacon service, and there is no meaningful heatsink.

Phase	Duration
CW identification	15.4 s, of which 8.6 s is key-down
Steady carrier	10.0 s key-down
Silent gap	30 s
Full cycle	55.4 s
Actual key-down duty	34%

At BEACON_POWER_LEVEL 0 (low) this is workable, but the radio will run noticeably warmer in sustained operation. Feel the back of the case after the first half hour. If it is too hot to hold comfortably, lengthen BEACON_GAP_SEC or add a heatsink before leaving it unattended.

If you raise power, lengthen the carrier or shorten the gap, you are into territory the radio was not designed for. In that case:

Bolt a heatsink to the back of the case
Run it from a bench supply or battery eliminator, not the pack
Put a thermometer on it and watch the first few hours

Before You Deploy

Frequency accuracy. The UV-K5 reference is a plain crystal, not a TCXO. Expect it to be a couple of ppm off at 144 MHz (that is a few hundred hertz) and to drift with temperature. For a propagation beacon that is usually tolerable, but measure against a known reference and correct with BEACON_FREQ_TRIM_10HZ (units of 10 Hz) if it matters to you.
No SWR protection. There is none in the radio and none added here. Do not key it into a bad load, and do not let the arming countdown run out before the antenna is connected.
Band plan. 144.275–144.300 MHz is the propagation beacon segment. The build refuses outright to compile a frequency outside it, a _Static_assert in beacon_config.h fails the build rather than producing an image that transmits somewhere it should not.
Regulatory. Under Part 97 a beacon may run under automatic control in this segment. The station still has to be identified, which the CW ID does every cycle, well inside the ten-minute requirement. Power is capped at 100 W for beacons and this radio does about 5 W at most, so that is not a concern. Worth confirming there is not already an active beacon on your chosen frequency within your coverage area before you leave it running.

Configuration

Everything lives in beacon_config.h. Edit, make -f Makefile.beacon, reflash. Some of the more useful knobs:

#define BEACON_ID_TEXT     "YOURCALL/B GRID"  // sent every cycle
#define BEACON_WPM         12                 // 12-15 is typical for a beacon
#define BEACON_CARRIER_SEC 10                 // 0 disables the steady carrier
#define BEACON_GAP_SEC     30                 // your duty cycle control
#define BEACON_POWER_LEVEL 0                  // 0 low, 1 mid, 2 high
#define BEACON_BIAS_CLAMP  255                // hard ceiling on PA bias

Grid square is part of BEACON_ID_TEXT.

Credits

Built on the driver layer from DualTachyon, egzumer and F4HWN. Released under the Apache License, Version 2.0.

► Download Beacon Firmware Source

SYS-DOS — Simple 16-Bit Real Mode Operating System

SYS-DOS is a minimal operating system targeting the x86 16-bit real mode environment. Written entirely in x86 assembly, it is designed as a learning platform for understanding how operating systems work at the lowest level. NOTE: This project is now deprecated.

Technical Overview

Component	Details
Architecture	x86 16-bit real mode
Memory Model	Segmented real mode; conventional memory below 640K
BIOS Services	INT 10h (video), INT 13h (disk), INT 16h (keyboard)

Features

Basic VGA text mode output (80×25)
Keyboard input via BIOS interrupt
Simple command shell with built-in commands

► Download SYS-DOS

433MHz RF Replay Attack

Documentation covering the capture and replay of 433MHz RF signals used by common remote controls including garage door openers, gate remotes, and wireless key fobs. Uses inexpensive SDR (Software Defined Radio) hardware and open-source tools.

Signal capture with RTL-SDR or similar hardware
Replay using a Raspberry Pi

► Download PDF Documentation