Cannot factory reset or overwrite password protected DM32

[V0LD3M0R7]

Being honest I did this to myself by writing the pin wrong (maybe) and not enabling reset without password in CPS.

what I tried already:

• searching for reset option in GUI menu (does not exist)
• factory reset using SK1+SK2+PowerOn requests password as well
• overwriting the device using CPS requires password as well

I need to:

• either brute force the radio using CPS and mouse/keyboard macro which will probably be time consuming
• or flash the firmware in a way that doesn't require password to be accepted.

If you know how to fix this problem by mentioned or different way, your help would be much appreciated!
If there is no way to fix this problem, the radio is still usable but will not allow me to edit it using CPS.

Below is an image of my radio after attempting SK1+SK2+PowerOn factory reset:

[didotb]

I'm guessing you didn't have the binary file of the flash chip using the UV008 app before you installed the pin. (If you did, just flash that using UV008)

Sadly I don't think anyone has tried brute forcing that before?
The radio has an ALPU chip, it contains encrypted data, so I have a feeling the data's also encrypted with your pin.

What I can suggest you are:

1. Try out the very early build of OpenDM32
2. Try out the custom firmware which disables ALPU check
3. Read the flash chip using UV008 and read the binary file with HxD and start learning the structure of the data, you might be able to either blank out or replace the pin from there.

Although, all of those suggestions are quite scary if you don't have a back up, so before doing any of those, do make sure to read the flash chip and save it. Make multiple copies offline and online, just in-case.

Lastly, I remember having to read the memory (using HxD) of the CPS after a successful radio read of a certain motorola radio. It contained the password on it, and that's how I recovered a friend's radio. Not sure if it'll work with the Baofeng but still worth a try. Took quite a lot of time browsing it though. There should be a guide about it online, I just forgot which website I read that on, will update if ever I find it again.

[didotb]

Update:
Didn't really find the original one, but I did find this which is basically what I did
https://forums.radioreference.com/threads/cps-lock.197839/

Hope this helps

[V0LD3M0R7]

Thank you for your comment.
I didn't use it and fixed it a different way but this maybe helpful for others in my place.
Here is what I did:

1. I tried to reprogram my radio last week and the radio refused my password which I really believed is the right one. We have spend minimum of 30 minutes trying the same should-be-correct password and then we went to trying potential numpad misclicks.
2. I went back to it 2 days ago. I tried different methods of starting a reset sequence but if was more like hoping for a magic chants to work. Finally I tried to just flash new firmware on the device using PTT+Sk1+powerOn. The radio did flash the firmware but didn't also flash it's memory as I hoped. It also didn't require password PIN before reset, as I have shown in post. Instead it just stated: Not allowed to reset and then booted normally. All of this was done through CPS running from Bottles on my Linux notebook. That may or may not be the issue. I'll get to it.
3. Yesterday I started up my linux server/gaming console and brainstormed with my friend how to brute force our way into my radio using CPS and combination of ydotool in a shell script. I had an issue connecting with COM port 33 which was weird. I installed CHIRP and ydotool. One of them requested sudo usermod -aG uucp $USER which enabled the COM ports to be accessed by the bottle running the CPS as well. So I tried my connection and voilà, it communicated with my radio. So out of hope I just tried my should-be-correct password and... what... IT STARTED READING? WHY?

This is great news but why is it working just now?
Well...

• either the hardware of my laptop is not collaborating with the CPS when the data stream is sending my password
• or the firmware update v1.47 fixed something that was breaking the password system inside the DM-32UV (by the way, the firmware update has a version mistype DM32. 01.L01.048)

For those of you who may arrive here seeking help:

1. Try updating your radio's firmware and inputing your correct-password
2. Switch to a different computer and input correct-password

If everything fails you may have to try Didotb's method from comment above.
If that fails as well... you may have to write the brute force script.

I hope this helped. Have a good one.