Some people collect tiny transistor radios. I don’t have enough of them to call it a collection but I guess I’m working on it.

The Ross Electronics Corporation imported transistor radios from Japan from 1955 to about 1970. They were located at 589 East Illinois Street and later (I think) 2834 South Lock Street, Chicago. As far as I can tell, there’s no relation to the Ross Radio Company of Youngstown, Ohio.

Here’s a better image of the schematic on the inside of the back cover (yes, there was a time when radios came with schematics).

It would be a mistake to expect good performance from a 1965-ish design running on one 1.5V cell, but the performance of my one is beyond mediocre. But then again, I didn’t really buy it to use it.

Mike has a nicer one, in a box nogal.

Ah yes, New Years’ resolutions. Gotta love ’em.

However, I have too much stuff. There. I said it. I mean, I firmly believe in the William Morris quote,  however, times have changed.

This collection of Elektor magazines I grew up with — obsolete.
A collection of GE Ham News that someone spent money on to have nicely bound — obsolete.

Byte magazines? Obsolete.

Creative Computing? Not quite yet obsolete.

And even if I can’t find it online, scanning and dumping* is better than storing the originals until my container is auctioned off one day.

Don’t get me wrong — I’m still keeping mountains of stuff. Just not… this stuff.


* Yes, Jason doesn’t like dumping. I’m not dumping anything that’s even slightly rare, so chill.

A tale of how not to do it, with a happy ending.

Our hunting club has eight Kenwood TK-2000 walkie-talkies. This is hardly ever enough, even when I take my Baofeng UV-B5* with.

So when a fellow ham had two TK-2000s for sale, I bought them. The programming cable is easy, and the software (KPG-137D) is not hard to find.

The first radio programmed fine, the second one… is password protected. I’m sure there’s a trick to resetting the password, I just don’t know what it is. So out comes the schematic from the service manual, and there’s an EX24016 hanging off the side of the R5F2136A microcontroller. EX24016 being another way of saying 24C16 which is an EEPROM. Memory. Where things get stored.

And while my favourite programming language is not solder, I’m not half bad at it.

And one universal programmer and one of my favourite tools later we have (the bits not shown are all just FF).

OK, so what does this mean? Stumped me too. The stuff at the end is self-explanatory, it’s a TK-2000 and the serial number of this one is B1104749. I’m pretty sure it’s on the same frequency as the other one, that would be one channel only, 169.43750 with a 103.5 Hz subtone, high power, narrow band. Oh look, right at the start there’s a sequence of bytes, 50 37 94 16 repeated twice. Back to front, transmit and receive frequencies. Given enough time one could decipher the whole thing, but that’s not important right now. We need the password.

The KPG-137D help file tells me that there are two passwords, one to allow you to read the data and the other for writing.  The password is a number from zero to 999999 (six digits). This eliminates a whole bunch of hopefuls like “PTK-2000” or one of those long strings at 1824/1840.

So I stuck the EEPROM back into the radio, wired the cable up, and started guessing. I had some hope for “222222”, for example. But no, it wasn’t going to be that easy.

So I thought, maybe the KPG-137D software “knows” what the password is. In other words, is the password sent to the transceiver, or checked on the local machine? I’m not expecting strong security here. I wired a second serial port to eavesdrop on the datastream (19200 N81) and saw that there’s no traffic on the line while I’m guessing passwords. So I tried looking on the heap of the KPG-137D but I suspect the password is stored as a number, not as text, no joy there either. There’s a lot of data on the heap and anything could be the password. Someone who knows Windows better than I do would be able to trap this thing at the right place and get the password.

Next I hauled out my working transceiver, and eavesdropped the datastream with different passwords set (I started with 000000, 000001, 000002). I noticed that the first 52 bytes of a read are the same and that after that things change.

Password Bytes 53-56 Binary
000000   AC B3 AF AD 1010 1100 1011 0011 1010 1111 1010 1101
000001   B8 A7 BB B9 1011 1000 1010 0111 1011 1011 1011 1001
000002   A9 B6 AA A8 1010 1001 1011 0110 1010 1010 1010 1000
                     ^^^  ^ ^  ^^^  ^ ^  ^^^  ^ ^  ^^^  ^ ^

Note the columns that stay the same in the binary. This suggests that old favourite, XOR encryption. The only problem is that I’m changing two bits in the password and three bits are changing in the data, which suggests some other nefarious seekrit manipulation.

With enough sample cases, I can figure it out, I’m sure.

Time to try something else. I didn’t really want to potentially break my working transceiver, but desperate times. Yup, I ripped the EEPROM out of that sucker and read it as well.

Byte 16 is “0A” instead of “FF” and bytes 22/23 and 25/26 is “FF FF” instead of “56 91”. That’s the first difference in the EEPROM, might as well start there. I first converted 0x5691 and 0x9156 to decimal, that didn’t work, but plain old “5691” did. I would have put money on “9156” being more likely to work than “5691”, based on the frequency being stored arse-endian, but no.

So there you have it. If I’d tried enough numbers from the EEPROM instead of giving up after not finding the password in plain text, I would have been there a lot earlier.

* A cheap and nasty, but extremely versatile little radio. Does VHF and UHF amateur bands, PMR and FRS, marine… you can get yourself into all kinds of trouble with this thing.


Stellenbosch, 1987. I built this 68000 computer, with 64 kilobytes of RAM and space for three times that much ROM. That’s infinitesimal in today’s terms, but at the time my “personal computer” was an Apple ][ with 64 kilobytes of RAM and 16 kilobytes of ROM, running at 1 MHz. The Apple ][ is an 8-bit computer and my 68000 is a full 16-bit computer, which runs at 8 MHz. Also, I had plans to expand my RAM by at least 256 kilobytes or so.

I’m typing this on a 64-bit computer with 8 gigabytes of RAM running at Idunno, 3 1/2 GHz or so.

The 68000 is more fun.

Here’s a picture of it. The picture itself is about 43 kilobytes in size, so it would take up about two thirds of my 64 kilobytes of RAM. But there would be no way to display it because I never implemented graphics (and state-of-the-art graphics at the time was VGA at 640×480 in 16 colors).

Here’s a picture of the three boards — processor at the top left (note the huge 64-pin DIP package that is the 68000), memory at the bottom, I/O on the right. It’s pretty close to 64 kilobytes. Here’s what it would have looked like in 16 colour VGA.

The first set of ROMs is a monitor, the second set of ROMs is almost empty — it has a copy of Gordon Brandly’s Tiny Basic as published by Dr Dobbs and typed in by yours truly. I can transfer it to RAM and run it from there. I had great plans but that’s as far as I got…

This memory brought to me by the guys over at Hack A Day, who are building something very similar but with some very modern twists.

You can learn a whole lot more on how to build 68000 systems by going through Peter Stark’s 68000 Hardware Course, as well as from this S-100 68000 board project.


* One of my favourite songs, from 1972.


So I recently retrieved my Argonaut 505 Amateur Radio Transceiver from storage. Turned it on, no hiss from the speaker. That’s… unusual, points to a dead audio amplifier.

Geek line, do not cross. Geek line, do not cross. (TLDR: I solved the problem)

More »


My parents bought this Avometer for me at a boot sale when I was most likely still in primary school. It didn’t work, of course. But it’s a neat piece of kit.

I remembered about it again the other day and went to find it in the attic where I do quite a bit of stowing.

A few decades worth of dirt.

Some cleaning and some googling and…

Hey! It’s a year older than I am (366 = March 1966).

I’ve never even seen one of the 15V batteries for sale anywhere, so these batteries have been in here since before I got the meter. And most of the time I’ve had it was spent in a hot attic. The batteries are flat, of course, but I would have expected things to look a whole lot worse.

Now I distinctly remember that I tried to find out what’s wrong with this meter, and at the time I concluded that the movement was not working. Well, it turns out that there’s nothing wrong with the movement. This is great news. Anything else is easier to fix than a d’Arsonval movement.

Here’s the damage. This is the 42.2 ohm resistor between the 10mA and 100mA taps on the DC switch (see the schematic at the end of the user manual) and I would say that it’s maximum power rating was exceeded…

I will see whether I can find or make or devise a replacement*, and I’ll clean up the outside.

Please, if you have one of these, be nice to it, don’t gut the insides like this poepol did.

* Believe it or not, 42.2 Ohm is an E96 value, but I might need a higher wattage and I’d probably end up putting ten 422 Ohm 1% resistors in parallel. Edit: Six 470 ohm, six 560 ohm, and one 4k7 in parallel makes 42.2065 which is good enough for me.

(Edit: link to balancing the movement)


This is the 6871W1S113E control board from our LG MG-604W microwave. The transformer primary went open circuit when the supply hit 300V or thereabouts. I know that these things often incorporate some kind of protection circuitry, so I desoldered the transformer.

Sure enough, it’s a 1A 130C fuse.

Fixed (yea, this solution doesn’t have thermal protection. I can live with it).

Of course, now that I know the layout I know that one can add a fuse or a jumper to the PCB without having to desolder the transformer. Again, you’ll lose thermal protection.

The transformer primary is between the left and middle pins, and the fuse runs from the righthand pin to the lefthand pin.

I was not so lucky with the Sakyno SK-1000 clock radio. In this case the transformer primary was the protection device, and the magic smoke leaked out.

The Philips AJ3121 clock radio transformer has a fuse as well, the wire leading down on the right hand side goes over to the other side, where there’s a square  125C thermal fuse wrapped up against the winding.

It’s at the left hand side under the red tape under the plastic.

Unfortunately I stuffed it up, I jiggled the wire too much and the primary winding, which is cat-hair-thin, broke off from the fuse lead. I tried resoldering it but it’s just too finicky.

So we bought two new clock radios. But at least the microwave works.


Long story short, my Father in Law ended up with Marconi Instruments Ltd No 1 Mark II* signal generator and a dozen boxes of assorted parts. I’d guess it was an Elmer‘s Junkbox.

Can’t find any information on this on the web. Marked IN 2631 and SI 7545, my best guess is that it might be a solid-state rectifier intended to replace a vacuum tube.

So if Google brings you here and you know more… that’s what the comments are for.

Edit: It’s a ONE N 2631.

    Next Articles »