Project_Detail
All_Projects

KG-Q10H_CPS_Patch

Documented IL patch for the Wouxun KG-Q10H CPS so 220 MHz channels can start at channel 001

View on GitHub
README.md

KG-Q10H CPS Patch

A minimal, documented patch for the Wouxun KG-Q10H programming software (KG-Q10H.exe) that lets the CPS program a channel plan with 1.25 m (220 MHz) channels starting at channel 001 without aborting on its own band-limit validation.

No proprietary binaries are distributed here. patch.ps1 modifies your own legally obtained copy of the CPS in place (and keeps a backup).

Tested build

CPS installer KG-Q10H setup V2[1].02.02(20231115).exe
File C:\Program Files (x86)\KG-Q10H\KG-Q10H.exe
Size 253440 bytes
SHA-256 (unpatched) 2314CA128659C470AB4A8CA592D0751CB4F8B1E9F48FC8418871CD055A194ED6
Runtime .NET Framework 4 (WinForms, no strong-name signature)

Offsets may differ on other CPS versions. The patcher verifies the expected hash/bytes and refuses to run on an unknown build unless -Force is used.

Symptoms

After importing a channel CSV whose first channel is a 220 MHz repeater, the CPS refuses to read/write and shows one or more of:

CH No.001  Out Of Range.: B RX Freq
B Selected Channel 001 : Out Of Range.
800M(A): Current Freq Out Of Range

Root cause

Form1.Read_SerNumSet_CheckData() validates the radio's serial-number / scan configuration (and the currently loaded channel list) against the radio's band tables before allowing a read.

  • Band A defines six groups: 150M(A), 400M(A), 200M(A), 66M(A), 800M(A), 300M(A).
  • Band B defines only two groups: 150M(B), 400M(B) (2 m / 70 cm).

Two separate checks fire:

  1. It runs Form1.B_RxFreq_Check() on channel 001 and on the Band B selected channel. A 220 MHz channel 001 is not inside Band B's limits, so the CPS reports "Out Of Range" and aborts.
  2. It then validates each Band A scan-group VFO against its stored limit. The radio's 800M(A) VFO value was outside its range, producing the second message even after the Band B check was bypassed.

The radio hardware itself still enforces its own limits; this is only a conservative CPS-side check.

Patch

Only two bytes are changed in the IL of Form1.Read_SerNumSet_CheckData, at the point immediately after its power/step normalization and before the band/VFO validation.

Method Form1.Read_SerNumSet_CheckData
IL offset IL_0179
File offset 0xCC79
RVA 0xEA79
Before 1E 8D — ldc.i4.8 ; newarr Byte
After 17 2A — ldc.i4.1 ; ret

The method returns true early, skipping all of the band/VFO range warnings while preserving the power/step fixups that run before IL_0179.

Because the early return is inside the method (not at its entry), the radio is still written with the normal channel data. The only behavior lost is the CPS's own range warnings and its VFO AM auto-correction (channel AM flags are already set explicitly in the CSV).

Verification

  • Original SHA-256: 2314CA128659C470AB4A8CA592D0751CB4F8B1E9F48FC8418871CD055A194ED6
  • Patched SHA-256: B24928AD44C99496DF6741952B824A12E5E969D3228EA2DECABF5ED6F71A451B
  • The patched assembly loads, JITs, and Read_SerNumSet_CheckData returns true for the test case.

Usage

  1. Close the CPS.

  2. Run PowerShell as Administrator (the script can self-elevate):

    .\patch.ps1

    Or point it at a specific copy:

    .\patch.ps1 -Exe 'C:\Program Files (x86)\KG-Q10H\KG-Q10H.exe'
  3. The patcher:

    • verifies the file hash and the original bytes at 0xCC79,
    • writes KG-Q10H.exe.bak if a backup does not already exist,
    • replaces the two bytes with 17 2A,
    • prints the before/after hashes.
  4. Reopen the CPS and read/write as usual.

If the CPS is running, the file is locked; close it first.

Notes

  • 1.25 m is a Band A band on this radio (Band B is 2 m / 70 cm only). Use the A side of the radio for 220 MHz channels.
  • The patched CPS no longer warns when a stored VFO/scan-group value is outside its configured range. That is intentional.
  • Reinstalling or updating the CPS restores the original executable; re-run patch.ps1 afterwards.
  • This repository contains documentation and a patcher only. It does not contain the Wouxun executable or any other proprietary file.

Disclaimer

Use at your own risk. This patch only relaxes a validation performed by the vendor's PC software; it does not modify radio firmware, transmit limits, or regulatory restrictions. You are responsible for operating within your license and local regulations.

License

MIT — see LICENSE. Applies to the contents of this repository only, not to the vendor software it patches.