Lost password for NX-320 Kenwood

[G4RMT]

Done something rather stupid. Hired a radio to somebody I knew years ago, and as I know he's a fiddler, I password protected it - it only had a single channel in it. I've had a big clearout and threw away the piece of paper. I've tried the obvious ones I used, but I seem to remember three months ago deliberately picking a random one, and sticking the paper with it on to a monitor.

I now can't even read it, let alone write to it. The software that programmes it is KPG-141D, but that isn't the engineering version that has the password reset menu items.

Anyone got any suggestions as to where to go next?

Paul

[Mark5R]

I managed to find the password for a Moto radio using wireshark. It gets the password from the cable data.

[G4RMT]

A little info from a friend sorted it. The leaked engineer codes that start with the model, in this case 141, then the E for Europe, K for the US etc then have 44 for the standard dealer CPS and had 45 for the engineer versions. The CPS evolution means most available widely are the later versions, in my case up to V4.7. So on the net you can source the CPS and the serials - BUT - the engineer serials only work on older versions, V4.4 being the highest one the KPG-141D will unlock with an engineer code. I can't find any data at all on how Kenwood are managing engineer access, but I assume they now use a different serial form to unlock the password removal and other tweaking parameters, and are keeping it VERY quiet. Don't blame them really.

So the upshot is that this will also apply to any Kenwood CPS where there is an engineering version, and while you can look for '45' serial codes on the net - just be aware that the serial will come up as not valid with a version too new.

I've now zapped my pesky password, and have found a new one that I really will remember for next time.

[moj]

I had the same problem as you with my kenwood nx-320 mate but luckily like you I have most the kenwood engineered cps file's , I just wish icom were so easy and had the option to reset there password's cause I have a few icom ic-f4102D handset's where if you don't have the read/write password then basically your really stuck and as far as I know they have to be sent back to icom and reset and then you are charged stupid money to have the password reset to default , I tried every method possible and got nowhere !

Also wireshark only worked on early version's of Motorola firmware so that backdoor has been stopped in the newer radio's aswell .

[G4RMT]

I do sort of understand it. I was looking at some Hytera kit and sent an enquiry to the manufacturer. I got two UK dealers contact me who were struggling to get close to the price I was quoted by a Chinese source. Building in some chargeable redundancy to a product is now sound business practice - like the fuel filters used in some Ford cards, where only the main dealer can reset the computer after doing the replacement - for a HUGE amount of money. Making these kinds of codes available on the internet costs them money.

When you spend £400 on a radio, I guess £70 to unlock it is sort of ok, and for a business of course a tax allowable expense, but not if you bought one for £50 on ebay!