Re: Ailunce HS2/Radioddity QR20/Q900 SDR Transceiver
Posted: 20 Feb 2026 15:36
A firmware versoin 3.7.2 is available on the GUOHETEC Download Page
Firmware 3.7.2 did not receive it's own tab like 3.6.3 did, and it is not listed in the previous log files, so I may have missed this one when I checked earlier this year.
Firmware 3.7.2 is only mentioned within a Chinese-only Log inside the 3.7.2 zip file. It is dated 2025.11.21. This log mentions 2025.06.24 as the previous entry date, but does not include Firmware versions. The point being that while it seems Guohetec has a rather disorganized way to post firmware versions, it does not appear that we have missed any firmware releases.
The Google Translated log entry for Firmware 3.7.2 follows:
Date: November 21, 2025
1. Fixed the issue of intermittent calls and occasional crashes when frequency hopping was enabled; frequency hopping will disable spectrum and waterfall charts after being enabled to avoid affecting frequency hopping interruptions.
2. Added product signal setting protocol commands to enhance product control capabilities.
3. Fixed the issue of occasional false errors when entering the correct IP address when modifying the IP address.
4. Fixed the issue of the device failing to boot after an upgrade due to a FLASH ECC error.
5. Fixed the issue of the programming software failing to initialize channels; frequency limiting is now enabled by default with OUT_BAND_EN enabled.
6. Fixed the issue of UI freezing when adjusting PA during NFM transmission.
7. Fixed the issue of the last option on the BAND page going out of bounds.
8. Optimized memory management.
I'll also note that the download for Firmware 3.7.2 is provided as a .zip file, when most previous firmwares (and other files such as logs and apps) were provided as .rar files. I certainly hope that their internal version control system is run better than their Download page.
Inside Firmware3_7_2.zip are two more nested folders labeled Firmware 3.7.2,
and we finally get to folders for the PMR-171, the Q900, and the TBR-119 radios, along with the afore-mentioned Chinese-only log file provided as a Word file. Inside the Q900 folder is the FW-NEW.bin file. I am not aware of an MD5 being provided for this file, so download, copy, burn, and hope.
Firmware 3.7.2 installed on my radio in the normal fashion, and the radio seems to work much as before, as I have not noticed any specific issues mentioned in the log entry.
I will point out a few things:
-- All programmed frequencies were lost when my radio rebooted.
-- Notice the comment (Number 5) about "...frequency limiting is now enabled by default with OUT_BAND_EN enabled." While the radio still appears to have full coverage receive, Out of band transmit is turned off, and since the "factory" menu password is not known for recent firmware versions, it cannot be re-enabled. I am assuming they did this for some regulatory reason.
-- AM squelch still (4 Years) does not work.
-- I also downloaded the QRadioBLEV0.8.apk, and installed it on a phone that I do not use for other purposes. When entering a frequency into a Channel (memory) the entered name does not seem to appear on the radio. It seems that saved channels in the app are completely seperate from channels programmed into the radio. 4 years with no way to enter channels in a user-friendly way, and no way to preserve channels.
-- This will be updated if I find anything new that is of note.
Will the Q900 be supported in CHIRP?
In separate, but related news, please reference this Issue on the CHIRP Radio Programming site:
A contributor, Jean-Philippe Piers has posted that he has submitted a a module for the Guohetec PMR-171. He wrote:
File pmr171.py pmr171.py added
i made a module for Guohetec PMR-171 maybe it will work for Q900
Neither the Guohetec PMR-171, Guohetec Q900 or other branding such as Ailunce HS2 appear in the "Supported Radio Models" list.
Hacking the Guohetec Q900 "Factory" Menu password.
2 comments about the "Factory" Menu password:
1. The previous password was determined buy disassembling the Q900 firmware. I believe that reading the firmware from the radio is relatively easy using dfu-tools or dfu-util or other STM-32 tools. If anyone has experience reading the FW in proper format (.dfu, .bin?), and then reverse compiling it, the Q900 user community (as small as it is) would appreciate the help.
2. I have also noted that both the previous "Factory" password and the "Agent" pin followed the format of having 2 consecutive repeated numbers. While this could just be coincidental over the 2 passwords we know, this is a technique for a secure PIN, as this set is larger than most other sets of possible PINs (such as keyboard patterns, and just common sequential patterns, or even PINs with no repeated digits.) If we assume that this is intentional, there are "only" about 10,000 possible PINS. If 500 Q900 owners try even just 20 PINs, (or 20 users try 500 PINs, or ...). Just in case some search engine finds this, I want to be clear that we are only attempting to access our own, purchased radios. With or without the "Factory" PIN, a radio such as the Q900 must be operated legally by licensed Radio Operators.
Please contact me at john at this domain if you can help.
Lastly, I will call once again on Guohetec to release the source code for this radio firmware under an appropriate Open Source license. Your website organization and the fact that basic issues with this radio (such as AM squelch) have not been fixed over several years show that you need the help. It is equally obvious that this radio would become extremely popular if the existing source code were released.
Firmware 3.7.2 did not receive it's own tab like 3.6.3 did, and it is not listed in the previous log files, so I may have missed this one when I checked earlier this year.
Firmware 3.7.2 is only mentioned within a Chinese-only Log inside the 3.7.2 zip file. It is dated 2025.11.21. This log mentions 2025.06.24 as the previous entry date, but does not include Firmware versions. The point being that while it seems Guohetec has a rather disorganized way to post firmware versions, it does not appear that we have missed any firmware releases.
The Google Translated log entry for Firmware 3.7.2 follows:
Date: November 21, 2025
1. Fixed the issue of intermittent calls and occasional crashes when frequency hopping was enabled; frequency hopping will disable spectrum and waterfall charts after being enabled to avoid affecting frequency hopping interruptions.
2. Added product signal setting protocol commands to enhance product control capabilities.
3. Fixed the issue of occasional false errors when entering the correct IP address when modifying the IP address.
4. Fixed the issue of the device failing to boot after an upgrade due to a FLASH ECC error.
5. Fixed the issue of the programming software failing to initialize channels; frequency limiting is now enabled by default with OUT_BAND_EN enabled.
6. Fixed the issue of UI freezing when adjusting PA during NFM transmission.
7. Fixed the issue of the last option on the BAND page going out of bounds.
8. Optimized memory management.
I'll also note that the download for Firmware 3.7.2 is provided as a .zip file, when most previous firmwares (and other files such as logs and apps) were provided as .rar files. I certainly hope that their internal version control system is run better than their Download page.
Inside Firmware3_7_2.zip are two more nested folders labeled Firmware 3.7.2,
and we finally get to folders for the PMR-171, the Q900, and the TBR-119 radios, along with the afore-mentioned Chinese-only log file provided as a Word file. Inside the Q900 folder is the FW-NEW.bin file. I am not aware of an MD5 being provided for this file, so download, copy, burn, and hope.Firmware 3.7.2 installed on my radio in the normal fashion, and the radio seems to work much as before, as I have not noticed any specific issues mentioned in the log entry.
I will point out a few things:
-- All programmed frequencies were lost when my radio rebooted.
-- Notice the comment (Number 5) about "...frequency limiting is now enabled by default with OUT_BAND_EN enabled." While the radio still appears to have full coverage receive, Out of band transmit is turned off, and since the "factory" menu password is not known for recent firmware versions, it cannot be re-enabled. I am assuming they did this for some regulatory reason.
-- AM squelch still (4 Years) does not work.
-- I also downloaded the QRadioBLEV0.8.apk, and installed it on a phone that I do not use for other purposes. When entering a frequency into a Channel (memory) the entered name does not seem to appear on the radio. It seems that saved channels in the app are completely seperate from channels programmed into the radio. 4 years with no way to enter channels in a user-friendly way, and no way to preserve channels.
-- This will be updated if I find anything new that is of note.
Will the Q900 be supported in CHIRP?
In separate, but related news, please reference this Issue on the CHIRP Radio Programming site:
A contributor, Jean-Philippe Piers has posted that he has submitted a a module for the Guohetec PMR-171. He wrote:
File pmr171.py pmr171.py added
i made a module for Guohetec PMR-171 maybe it will work for Q900
Neither the Guohetec PMR-171, Guohetec Q900 or other branding such as Ailunce HS2 appear in the "Supported Radio Models" list.
Hacking the Guohetec Q900 "Factory" Menu password.
2 comments about the "Factory" Menu password:
1. The previous password was determined buy disassembling the Q900 firmware. I believe that reading the firmware from the radio is relatively easy using dfu-tools or dfu-util or other STM-32 tools. If anyone has experience reading the FW in proper format (.dfu, .bin?), and then reverse compiling it, the Q900 user community (as small as it is) would appreciate the help.
2. I have also noted that both the previous "Factory" password and the "Agent" pin followed the format of having 2 consecutive repeated numbers. While this could just be coincidental over the 2 passwords we know, this is a technique for a secure PIN, as this set is larger than most other sets of possible PINs (such as keyboard patterns, and just common sequential patterns, or even PINs with no repeated digits.) If we assume that this is intentional, there are "only" about 10,000 possible PINS. If 500 Q900 owners try even just 20 PINs, (or 20 users try 500 PINs, or ...). Just in case some search engine finds this, I want to be clear that we are only attempting to access our own, purchased radios. With or without the "Factory" PIN, a radio such as the Q900 must be operated legally by licensed Radio Operators.
Please contact me at john at this domain if you can help.
Lastly, I will call once again on Guohetec to release the source code for this radio firmware under an appropriate Open Source license. Your website organization and the fact that basic issues with this radio (such as AM squelch) have not been fixed over several years show that you need the help. It is equally obvious that this radio would become extremely popular if the existing source code were released.