This tool transmits Motorola MDC-1200 signaling bursts using a HackRF software-defined radio. It can send a variety of MDC message types (PTT ID, Radio Check, Stun, etc.) as properly formatted FM bursts.
Syntax
hackmdc -freq <MHz> -type <message> -myid <HEX> [-targetid <HEX>] [-arg <value>] [other options]
Options
| Option | Description |
|---|---|
-freq |
Transmit frequency in MHz |
-gain |
TX gain (0–47 dB) |
-amp |
Enable HackRF amplifier |
-dev |
Frequency deviation in Hz |
-myid |
Source MDC ID (hex) |
-targetid |
Target MDC ID (hex) |
-arg |
Optional message argument |
-type |
Message type (see below) |
Each command below shows how to transmit one MDC-1200 message type. Replace the IDs and frequency as needed.
Send your push-to-talk identification burst.
hackmdc -freq 145.100 -type ptt -myid 1234
Remotely disable another radio.
hackmdc -freq 145.100 -type stun -myid 1234 -targetid 5678
Re-enable a previously stunned radio.
hackmdc -freq 145.100 -type unstun -myid 1234 -targetid 5678
Query a radio to confirm it is powered on and reachable.
hackmdc -freq 145.100 -type check -myid 1234 -targetid 5678
Send an alert or page to another unit.
hackmdc -freq 145.100 -type page -myid 1234 -targetid 5678
Initiate a directed selective call to a single radio.
hackmdc -freq 145.100 -type selcall -myid 1234 -targetid 5678
Request the current status value from a remote unit.
hackmdc -freq 145.100 -type status -myid 1234 -targetid 5678
Send a short status or message code (argument 0–15).
hackmdc -freq 145.100 -type msg -myid 1234 -targetid 5678 -arg 3
Acknowledge receipt of an emergency alarm.
hackmdc -freq 145.100 -type eack -myid 1234 -targetid 5678
- All transmissions include MDC-1200 preamble, bit sync, data, and CRC.
- The output is frequency-modulated and sent directly via HackRF.
- Use only within authorized frequency ranges.
- Intended for controlled, legal testing and educational use.