Bricked radio: firmware recovery (DFU/bootloader) by model

You were reflashing the radio, the power flickered mid-process or the utility crashed — and now the radio won't boot: a black screen, no response to the buttons, or it hangs on the logo. This is a "brick": the hardware is fine, but the firmware is corrupted and won't start normally. It sounds like a death sentence, but in the overwhelming majority of cases it isn't. Inside handheld DMR radios, alongside the main firmware, lives a separate emergency bootloader, which is invoked by a special button combination at power-on and lets you reflash the firmware from scratch. Let's go model by model: how to enter that mode, what to flash with, and in which rare cases a brick really does need a programmer or a service shop.

What a "brick" is and why it's curable

The memory of a modern DMR radio is roughly split into two parts. A small bootloader runs first at power-on, checks which buttons are pressed, and decides: load the main firmware or enter flash mode (DFU / recovery / update mode). The main firmware lives separately and takes up most of the flash. When people say "the radio bricked," in 95% of cases they mean exactly that — corrupted main firmware, with the bootloader still intact and accessible.

Signs of a "curable" brick:

• the radio doesn't respond to a normal power-on, the screen is black or shows garbage;
• but a special button combination (see the per-model sections below) puts it into flash mode — the LED blinks or stays lit;
• and the computer then sees it as a DFU device or a COM port.

If at least one of those last two conditions holds — congratulations, the bootloader works, and the brick can almost certainly be removed by reflashing. But if no combination revives the unit and the computer doesn't see it at all — then suspicion falls on the bootloader itself, and that's a different conversation (final section).

First — a backup, always

Before flashing anything (whether for the first time or during recovery), take a dump. Reviving a brick is only half the job; it would be a shame to lose your calibration and channels in the process.

• Codeplug — your channels, zones, contacts. Read out with the stock CPS ("Read radio"). Details are in the codeplug article.
• Calibration / factory calibration — the frequency, power, and deviation trim specific to your unit. It lives in a separate area of flash. Losing it won't kill the radio, but it will start "lying" on frequency and power until you recalibrate. On the TYT MD-380, md380tools can dump/restore the calibration (SPI flash read commands); on AnyTone it's the vendor utility.
• Full flash dump — if your tool allows it, capture the entire image. That's insurance against any kind of trouble.

TYT MD-380 / MD-390 (and the RT3/RT8 clones)

A single-band classic built on the STM32F405 processor (1 MB flash, 192 KB RAM) with the HR-C5000 DMR baseband. It has no separate vocoder chip — the AMBE codec is emulated in software right on the STM32F405, so the "brain" and the "voice" are the same die. The radio has the standard STM32 bootloader in DFU mode — the most recovery-friendly one in our whole lineup.

Entering DFU:

1. Turn the radio off with the volume knob. Remove the cover from the headset/microphone jack and connect the programming cable.
2. Hold down both the PTT and the button above the PTT (the upper side button, not the one marked with an "M").
3. While holding both buttons, turn the radio on with the volume knob, then release the buttons.
4. The LED should flash alternately red and green — you are in flash (DFU) mode.

What to flash with: the vendor's Tytera Upgrade.exe ("Open Update File" → pick the .bin → "Download Update File"), or cross-platform via dfu-util / the md380-dfu wrapper from the md380tools kit. Note: TYT uses a slightly non-standard DFU variant (a fork of the STMicro example), so the easiest thing is precisely their utility or the purpose-built md380-dfu. For details about firmware and tweaks, see the md380tools article.

GD-77, DM-1801, RD-5R on OpenGD77

Completely different hardware: NXP MK22 + AT1846S + HR-C6000. The OpenGD77 firmware and its native bootloader. The dual-band TYT MD-UV380/UV390 and the Retevis RT-3S belong here too in terms of flashing method — but note that inside they use an STM32F405 (like the MD-380), not the MK22, so both their entry combination and their LED indication are different (see below and the table).

Entering bootloader mode (GD-77/DM-1801/RD-5R): hold SK1 + SK2 (on the GD-77 these are the two buttons under the PTT: black SK1 and blue SK2) and, while holding them, turn the radio on. On the MD-UV380/UV390/RT-3S the combination is different — SK1 (upper side button) + PTT at power-on.

• GD-77/DM-1801/RD-5R (MK22): the green LED stays steadily lit, the screen is dark — the bootloader is ready, you can flash. On the MD-UV380/UV390/RT-3S (STM32), instead, the end LED flashes red↔green and an STM DFU device appears in the system — that's the normal sign their bootloader is ready.
• In both cases you launch OpenGD77 CPS, open "Firmware loader", select the correct model from the list, choose the .bin — and the write starts right after you pick the file.
• On the GD-77 family, the green LED flashing (rather than steady) and going out when you release SK1/SK2 is a warning sign: the signature bytes at address 0x7F800 are damaged, and the bootloader refuses to flash, launching the main firmware instead. This is fixed with a patched bootloader from the OpenGD77 site (the patched_bootloaders section), which removes the signature check.

AnyTone (AT-D878UV and relatives)

AnyTone has its own update mode and its own firmware format. There are two noticeably different hardware revisions on the market (V1 and V2/UVII), and firmware is not interchangeable between them — that's a common cause of bricking: loading a file from the wrong revision. Always verify the hardware version.

Entering update (rescue) mode: hold the PTT and the top PF3 button (blue, on the end, also the Alarm button) and turn the radio on. The red LED will start blinking — you are in flash mode.

Format specifics: AnyTone firmware is a set of several files (.spi, .CDI, .CDD) with the same base name; all of them must be in the same folder. It's flashed with the vendor's update utility over the chosen COM port; there are also third-party flash-tools that take the .spi file and the port as arguments.

Reflashing: step by step

The universal recovery procedure when the bootloader is alive:

1. Charge the battery, take a reliable USB cable straight into the computer's port (not through a hub and not through a "charging" cord without data lines).
2. Prepare a recovery image: a known-good stock build for your model/revision or a verified alternative firmware. The file must exactly match the hardware.
3. Put the radio into flash mode with the right combination, confirm via the LED and that the PC sees it.
4. Launch the utility, select the file, start the write — and don't touch anything until an explicit "Done/Success".
5. Turn the radio off with the volume knob, disconnect the cable, power it on normally.
6. Load the calibration from the backup (if needed) and rebuild/restore the codeplug.

Example dfu-util invocation for an STM32 radio of the MD-380 family (the device name and address are for illustration; check against your own utility):

# check whether the system sees the DFU device
dfu-util --list

# flash the firmware (md380-dfu does it with the correct offsets)
md380-dfu upgrade firmware.bin

When the bootloader is dead: a programmer or a service shop

There's a rare but genuine brick: the radio won't enter any flash mode, the LED doesn't react, and the computer doesn't see the device as either DFU or a COM port. That means the bootloader itself is damaged — a simple failed flash almost never causes this; more often the culprit is an ESD discharge, a power surge, a botched attempt to flash a wrong/corrupted bootloader, or a hardware defect.

This can only be fixed in hardware, through the processor's service pins:

• STM32 radios (MD-380/390 and MD-UV380/390/RT-3S) — connect an ST-Link programmer over the SWD interface (SWDIO, SWCLK, GND, 3.3V lines) or JTAG to the pads on the board. In STM32CubeProgrammer, erase the flash and load a known-good bootloader image + firmware. Note: on these radios the flash is usually read-protected (RDP) — removing the protection erases the die, so you must have your unit's native calibration backed up in advance.
• The RESET trick. If the core won't let you connect (the firmware reconfigures the pins right after boot), while the programmer tries to attach, briefly press the hardware RESET — that gives a window to latch on before the "bad" code seizes control.
• NXP MK22 (GD-77/DM-1801/RD-5R) and AnyTone — similarly through their own debug interfaces with the appropriate programmer; but access to the processor and a bootloader image for these platforms are harder to find.

If you don't solder and don't work with SWD/JTAG — that's a clear reason to take the unit to a service shop or to an experienced ham with a programmer. Bootloader recovery is a delicate operation, and damaging the processor in the process is a real risk.