TIDRADIO TD-H9 Experimental Firmware: Pushing the 10W APRS Handheld Toward 928 MHz

TL;DR: The TIDRADIO TD-H9 (official product page, from $69.98) is a 10W VHF/UHF handheld with built-in GPS APRS tracking, Bluetooth 5.1, a spectrum analyzer, SMS texting, 128MB memory, and a customizable color screen. Community developer mjwgeek has published an experimental firmware project (GitHub) based on official v1.0.33 that extends the UHF tuning range to 928 MHz and bypasses the stock PTT validator rejection above roughly 599 MHz, using four surgical patches documented down to the byte. This post tours the stock radio, explains exactly what the patches do, and lays out how to experiment lawfully and safely with a dummy load, test gear, and strict respect for band plans.

Budget handhelds keep getting more interesting. A few years ago a $70 radio meant 5W, two bands, and a cryptic menu. The TIDRADIO TD-H9 ships 10W, GPS APRS, a spectrum scope, Bluetooth, and roomy memory at that price, then adds USB-C upgradable firmware that invites community work. The mjwgeek experimental firmware is the first public deep patch for this platform: real reverse engineering on the JieLi-based firmware with honest documentation of both the working patch and the failed attempts. For licensed amateurs who enjoy bench testing and pushing hardware understanding forward, it is worth knowing about, with eyes wide open about legality and RF safety.

What Is the TIDRADIO TD-H9 Experimental Firmware Project?

The TIDRADIO TD-H9 experimental firmware project is an independent community reverse-engineering effort that patches official v1.0.33 firmware to extend UHF tuning to 928 MHz and bypass final PTT rejection above the stock ceiling while preserving normal transmit setup, flashed with the unmodified factory updater.

+-----------------------------------------------------------------------------------+
|                    TD-H9 EXPERIMENTAL FIRMWARE PATCH ARCHITECTURE                 |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|   +---------------------------+       +---------------------------------------+   |
|   |   RANGE LOGIC PATCHES (3) |       |   TRANSMIT PATH PATCH (1)             |   |
|   |   UHF limit 520->928 MHz  |       |   Validator call KEPT intact          |   |
|   |   Classifier span widened |       |   Final jz reject -> Pi32v2 NOP       |   |
|   |   Range table 520->928    |       |   TX setup + side effects preserved   |   |
|   +---------------------------+       +---------------------------------------+   |
|               |                                       |                         |
|   +---------------------------------------------------------------------------------+ |
|   |              JIELI UFW CONTAINER REBUILD (7-STEP CRC CHAIN)                     | |
|   |   Stock USB-C updater accepts package • No patched updater needed              | |
|   +---------------------------------------------------------------------------------+ |
|               |                                       |                         |
|   +---------------------------+       +---------------------------------------+   |
|   |   SAFETY DISCIPLINE       |       |   RECOVERY PATH                       |   |
|   |   Dummy load first • PLL  |       |   Official v1.0.33 re-flash with      |   |
|   |   power, harmonics, spur  |       |   original updater restores stock     |   |
|   +---------------------------+       +---------------------------------------+   |
|                                                                                   |
+-----------------------------------------------------------------------------------+

The repository is small and focused: one experimental .fw image, byte-level PATCH_NOTES.md, a version-locked patcher under tools/, four commits, and prominent regulatory warnings. It isn’t affiliated with or endorsed by TIDRADIO.

Part 1: The Stock TD-H9 Is Already a Lot of Radio

Before the patches, understand the base hardware. The TD-H9 sits at the top of TIDRADIO’s current handheld line, above the TD-H8 and TD-H3 families.

Stock Specification Table

TD-H9 Versus Its Siblings

For APRS operators the comparison ends quickly: only the H9 has GPS and APRS, which makes it the natural pick for trackers, SOTA beacons, and event logistics. The spectrum scope and 128MB memory are bonuses that matter every time you arrive at a new site and wonder which simplex channel is actually quiet.

Why Hams Like the Stock Radio

• APRS tracker in the hand: GPS position reports onto the APRS-IS network via RF, viewable on aprs.fi, with no phone or external TNC. Perfect for hikes, bike events, and summit activations.
• Spectrum scope on arrival: Check 2m and 70cm calling channels and repeater inputs before calling CQ from a new grid.
• Bluetooth freedom: Wireless PTT and mic accessories plus app-based programming cut the cable clutter that plagues field kits.
• SMS for quiet coordination: Short radio-to-radio texts handle frequency changes and logistics without voice traffic.
• Morse emergency mode: A last-resort beacon when voice won’t get through.

Part 2: What the Experimental Firmware Changes

Stock firmware caps UHF tuning at 520 MHz in the range logic and rejects PTT above roughly 599 MHz. The experimental build TD-H9-V1.0.33-928-PTT-VALIDATOR-BYPASS.fw (base v1.0.33, SHA-256 0fe4ef04...73c7f published in the README) makes four targeted changes to app.bin, with frequencies stored in 10 Hz units.

The Four Patches

Why the NOP Approach Matters

The transmit path at app+0x5B608 calls the validator at app+0x56D46, then conditionally jumps to rejection. Earlier experiments tried bolder surgery and broke things:

• Forcing a return value at app+0x5B50E killed normal TX entirely, proving that routine does required setup work beyond returning a boolean.
• Changing the 600 MHz executable value at app+0x57232 to 928 MHz disabled TX globally, showing it feeds a required RF setup calculation.
• Changing the 600 MHz RF-table value at app+0xCF598 didn’t unlock anything above 599 MHz.

The working insight is elegant: leave the validator and all setup routines untouched, and NOP out only the two-byte conditional rejection that follows. Normal 2m and 70cm transmit behavior is preserved, and the radio can enter transmit above the old ceiling. The patcher is version-locked and refuses inputs whose embedded flash image SHA-256 doesn’t match stock v1.0.33 (d0df6074...18dc0), which prevents patching the wrong base.

The JieLi Container Chain

The factory USB-C .fw file is a JieLi UFW package. A modified image is rejected by the stock updater unless every checksum is rebuilt, so the patcher regenerates a seven-step chain: app.bin data CRC, app.bin header CRC, app MD5 record plus its CRC and header CRC, parent app-area CRC and header CRC, outer flash.bin CRC, encrypted UFW entry-list CRC, and UFW header CRC. The payoff is convenience and safety: you flash with the original, unmodified TIDRADIO updater, and no patched updater executable ever touches your PC.

Part 3: Flashing and Recovery

1. Save a recovery copy of official v1.0.33 firmware first.
2. Load the experimental .fw in the original TIDRADIO USB-C updater. No patched updater needed.
3. Flash normally over USB-C.
4. Verify ordinary 2m and 70cm operation first: receive, transmit into a dummy load, repeater access, APRS beacon.
5. Bench-test newly unlocked frequencies into a dummy load before any antenna connection.

If anything misbehaves, re-flash official v1.0.33 with the original updater to return to stock. Keep that recovery image on your PC and on a USB stick in the go-bag.

Part 4: The Lawful Playground and the Bench Discipline

This section is the price of admission. A selectable frequency isn’t authorization to transmit, and unlocking a software check says nothing about PA matching, filtering, spectral purity, or synthesizer lock outside the design range.

Know Your Band Plan First

The 600-928 MHz span crosses many services. Rules differ by country and ITU region, and your license class adds further limits:

• Amateur allocations vary sharply by region. In ITU Region 2 (the Americas), 902-928 MHz is the 33cm amateur band, the most plausible lawful TX playground for this experiment. In ITU Region 3 (including Malaysia), 902-928 MHz is generally not amateur spectrum, so transmitting there with any power is off limits regardless of firmware.
• Shared and primary users exist. Broadcasting, cellular, navigation, military, and ISM users occupy parts of this span depending on jurisdiction. Never assume a quiet frequency is an available frequency.
• Equipment rules apply. Some administrations require type-approved or standard-compliant equipment. Modified firmware can void that status.
• Power, bandwidth, and emission rules still bind. Even where a band is amateur, your license sets the ceiling.

Practical rule: look up your national band plan before flashing, write down the exact segments where you may transmit, and treat everything else as receive-and-dummy-load only.

Bench Test Protocol for Unlocked Ranges

1. Dummy load first, always. Every new frequency gets first key-down into a rated dummy load, never an antenna.
2. Confirm PLL lock. Check the radio indicates lock and the carrier is on frequency with a counter or SDR.
3. Measure output power. Record watts across the unlocked span. Expect folds, dropouts, and surprises where the PA network was never designed to work.
4. Inspect harmonics and spurious. A spectrum analyzer or SDR with attenuators shows whether the second harmonic or spurs exceed acceptable limits. Fail here means no antenna, ever, on that frequency.
5. Check the stock bands again. Confirm 2m and 70cm behavior is unchanged after the patch.
6. Log everything. Frequency, power, SWR into the load, spur levels, firmware version, date. Good notes are what separate experimentation from guessing.

What the New Range Is Genuinely Good For

• Receive exploration: Scanning, spectrum scope surveys, and signal identification across the extended tuning range are lawful receive activities in most places.
• 33cm amateur work where allocated: In Region 2, 902-928 MHz SSB, FM, and mesh experimentation with proper antennas is real amateur radio. Verify performance first.
• Lab and education: Demonstrating PLL behavior, PA roll-off, and spurious products on the bench teaches more RF engineering than a semester of slides.
• Firmware research: Tracing validators and classifiers builds reverse-engineering skill applicable to many embedded platforms.

Part 5: How This Compares to Other Firmware Hacking Projects

The TD-H9 project is at the careful beginning: minimal diff, maximal documentation, failed paths preserved. That conservatism is a feature. Compared with the sprawling UV-K5 scene, there is more room here for contributors who test methodically and write up results.

Credits and Prior Art

Reverse engineering stands on public tooling. The README credits kagaimiq/jl-misctools, quarkslab/ghidra-jieli, nicsure/TD-H8-Engineering, and yobabyte/tid_umod. Original firmware and trademarks belong to their owners, and the repo is an independent community project with no TIDRADIO affiliation. If the project helps your bench work, star the repo and consider contributing measurements back.

Frequently Asked Questions

What does the experimental firmware actually unlock?

It extends UHF tuning to 928 MHz and removes final PTT rejection above the stock ceiling via four documented patches, while keeping normal 2m and 70cm transmit behavior intact.

Can I flash it with the factory updater?

Yes. The patcher rebuilds the full JieLi UFW checksum chain, so the original unmodified TIDRADIO USB-C updater accepts and flashes the image normally.

Is transmitting on the new frequencies legal?

Only where your license and band plan allow. In Region 2, 902-928 MHz is amateur 33cm; in Region 3 including Malaysia it generally isn’t. Verify locally first.

Will it damage my radio or void warranty?

Flashing can brick the radio and likely voids warranty. Keep official v1.0.33 for recovery, and bench-test new ranges into a dummy load before any antenna use.

How do I return to stock firmware?

Re-flash official TD-H9 v1.0.33 with the original updater. Always verify normal 2m and 70cm operation after recovery.

Conclusion

The stock TD-H9 is already one of the strongest value handhelds in its class: 10W, APRS with GPS, spectrum scope, Bluetooth, SMS, and 128MB memory near $70. The mjwgeek experimental firmware adds something rarer: careful, documented, hardware-tested reverse engineering that opens the UHF range toward 928 MHz with a minimal four-patch diff and a clean stock-updater install path. Treat it as what it is, a bench and research project for licensed amateurs with a dummy load, a spectrum display, and a current band plan on the desk. Do that, and it repays the effort with real RF knowledge and a better-understood radio.

Star the repo, read the patch notes twice, test methodically, and share lawful measurements back to the community.

73, and keep it clean on the spectrum.

Sources and Further Reading

• mjwgeek TIDRADIO_TD-H9 Experimental Firmware (GitHub): https://github.com/mjwgeek/TIDRADIO_TD-H9
• Patch Notes with Byte-Level Details: https://github.com/mjwgeek/TIDRADIO_TD-H9/blob/main/PATCH_NOTES.md
• TIDRADIO TD-H9 Official Product Page: https://tidradio.com/products/td-h9-10w-bluetooth-aprs-radio-handheld
• TIDRADIO Official Firmware Page: https://tidradio.com/pages/tidradio-firmware
• TD-H8 Engineering by nicsure (Prior Art): https://github.com/nicsure/TD-H8-Engineering
• tid_umod by yobabyte (Prior Art): https://github.com/yobabyte/tid_umod
• jl-misctools by kagaimiq (JieLi Tooling): https://github.com/kagaimiq/jl-misctools
• ghidra-jieli by Quarkslab (Processor Support): https://github.com/quarkslab/ghidra-jieli
• APRS Live Map (aprs.fi): http://aprs.fi
• Odmaster Web Portal: https://web.odmaster.net/login
• HamRadio.my Open Source Tools and Tech Guides: https://hamradio.my/
• About 9M2PJU Station Profile and Software Projects: https://hamradio.my/about/