Kong Radio Ops

Operating reference — Qalarc UV-K1 fleet (CHARLIE-01 / CHARLIE-02) · custom F4HWN Fusion firmware v5 · updated 2026-08-27

01Fleet

Radio	Hardware	Firmware	Boot logo	Role
CHARLIE-01	Quansheng UV-K1	F4HWN Fusion v5 (custom, scrambler enabled)	QALARC ADMIT	Primary handheld
CHARLIE-02	Quansheng UV-K1	F4HWN Fusion v5 (custom, scrambler enabled)	QALARC	Pair handheld

All 85 channels + all VFO records set to HIGH = 5W. RxMode = MAIN ONLY. VFO records parked at 477.500 MHz.

02Channel plan

Channels	Content	Notes
1–80 (CB01–CB80)	AU UHF CB 476.4125–477.4125 MHz	Clear voice. CB22/23 data-only, CB05/35 emergency, CB61–63 reserved
81 (EVT-1)	477.500 MHz	Private pair channel — scrambled 3000 Hz
82–85 (EVT-2/3, EVT-SEC, EVT-CMD)	477.525–477.600 MHz	Placeholders — outside CB band, confirm authorisation before TX

03Keypad controls

F-key shortcuts

Keys	Action
`F`+`2`	Swap channel slot A ↔ B (each slot remembers its own channel)
`F`+`3`	Toggle channel ↔ frequency (VFO) mode
`F`+`6`	Cycle TX power (USER → LOW1–5 → MID → HIGH)
`F`+`1`	Copy channel → VFO / cycle band (in freq mode)
`F`+`4`	CTCSS/DCS scanner
`F`+`5`	Spectrum analyzer (short) / scan list (long)
`F`+`▲/▼`	Squelch up/down

Everything else

▲/▼ cycle channels · type digits to jump (e.g. 81 → EVT-1)
In frequency mode, digits enter a frequency (e.g. 4775000)
Side key 1 short = MONITOR (default) · side key 2 short = SCAN (default)

Assignable side-key actions

Menu → F1Shrt / F1Long / F2Shrt / F2Long / M Long. Includes SCRAMB (scrambler on/off toggle — single beep ON, double beep OFF), POWER, MONITOR, SCAN, RX MODE, MUTE, keypad lock, VFO swap. Recommended: side key 1 long = SCRAMB (keeps MONITOR on short).

04Voice scrambler

Frequency-inversion scrambler (BK4819 chip): voice audio is flipped around a pivot tone. Same pivot = clear; different/none = garble. Analog privacy, not encryption.

Static pivots (Menu → Scramb, 10th item)

Group	Pivot	Members
charlie-pair	3000 Hz	CHARLIE-01 + CHARLIE-02 on CH-081
spare-alpha	2700 Hz	unassigned
spare-bravo	3300 Hz	unassigned

Scramb is per-channel — only channels with a pivot scramble. All CB channels stay clear. With dual watch on, each channel applies its own setting (mixed clear + scrambled monitoring works).

One-time setup per radio

Boot with PTT+upper side key held (unlocks hidden menus)
Menu → bottom → ScraEn → ON
CH-081 → Menu → Scramb → 3000Hz
Assign SCRAMB to a side key for daily toggling

Rolling scrambler (RollSc / ScrKey — hidden menu)

Pivot hops every 250 ms of airtime through a deterministic LCG walk (state = state×25173 + 13849 mod 65536; pivot = 2600 + 100×(state mod 8)), seeded by a shared 16-bit ScrKey. Self-syncing: both radios restart the sequence at every transmission start (TX: PTT keyup; RX: carrier onset) — no clocks, no simultaneous setup. Late joiners hear only garble. Requirements on both radios: same ScrKey, RollSc ON, ScraEn ON, Scramb non-OFF.

05Power & RxMode

Power level	Output
LOW 1–5	<20mW / 125mW / 250mW / 500mW / 1W
MID	2W
HIGH	5W (fleet default, AU CB legal max)

RxMode	RX	TX
MAIN ONLY	one slot	that slot
DUAL RX RESPOND	both	follows last reception
CROSS BAND	secondary	primary
MAIN TX DUAL RX	both	always main slot

MAIN TX DUAL RX = listen to both slots (e.g. CB29 clear + CH-081 scrambled), transmit stays on the main slot. F+2 swaps which is main.

06Boot combos (important!)

Combo at power-on	Mode
`PTT` only	DFU bootloader (firmware flash, USB-C)
`PTT` + `upper side key`	Hidden menus unlocked (ScraEn, RollSc, ScrKey, F Lock, BatCal) — session only

Nearly identical combos, very different outcomes. DFU screen stays dark; hidden-menu boot looks like a normal boot.

07Firmware

Custom build of F4HWN Fusion (Quansheng UV-K1) with the scrambler fully re-enabled. Stock F4HWN neuters the scrambler in six places; our patch (scrambler_enable.patch) restores all:

Fix	Site	Version
Menu items + global ScraEn persistence	ui/menu.c, settings.c	v2
Per-channel pivot save + load	settings.c, radio.c	v3
RX descramble (was: always disabled on RX)	radio.c	v4
SCRAMB side-key toggle action	action.c, settings.h, ui/menu.c	v5

Build & flash

cd ~/projects/hack_RF/kong_radios/firmware_build/uv-k1-k5v3-firmware-custom
cmake --build build/Basic          # -DENABLE_SCRAMBLER -DENABLE_SCRAMBLER_ROLLING
# radio in DFU (PTT at power-on, USB-C):
python3.11 tools/serialtool/cli.py flash --port /dev/ttyACM0 --bl-ver 7.03 \
    ../../firmware/f4hwn_K1_SCRAMBLER_enabled.bin

Or use the Radio Flash panel in the RFAI app (below). EEPROM (channels/settings) survives flashing.

Source of truth: ~/projects/hack_RF/kong_radios/ — docs/guides/, docs/PROCESS_LOG.md, firmware/, codeplugs/.

08RFAI signals-intel integration

Descramble: live/backend/descramble.py — static pivot, blind rolling (spectral hop detection), keyed rolling (exact LCG replay). Toggle in app Settings or POST /api/settings/descramble; modes: off / auto / 3000 / key:<n>. Descrambled audio flows to recordings, STT, fingerprinting; 🔓 badges shown per transmission.
Radio Flash panel: firmware picker, DFU detection, two-step confirm, live log.
CLI: python3 live/scripts/descramble_monitor.py --freq 477.5 --mode key:48879 --play

09Legal (Australia)

Scrambling is not permitted on AU UHF CB or amateur bands — CB channels must stay clear voice. 5W is the CB legal maximum. EVT channels (477.5+) are outside the CB band: confirm your own authorisation before transmitting there, especially scrambled.