AubsUK is a fork of EGZUMER for our beloved Quansheng K5(8)/K6(buy link) where some interesting changes have been made:

• The two scan lists have been replaced by 10 of them (0-9).
• The display no longer shows on the right which scan list the channels belong to.
• The currently scanning list is now shown at the top of the screen.
• Enabling/Disabling a scan list is as simple as pressing the list number.
• Channels can be excluded from the lists.
• Channels can be temporarily excluded from a list by pressing *, and this change will persist until the next reboot of the radio.
• It is possible to automatically start scanning when the radio powers on.
• All changes can be made from CHIRP.
• When a factory reset is performed, only one channel will be created instead of five.

If you are new to the world of ham radio, I recommend this previous article where the basics are explained.

In this article, we will first explain all the functions common with EGZUMMER , and then the specific functions of this particular firmware.

Common functions:

• Reflashing
• Spectrum analyzer
• Scan frequency range function
• Battery calibration
• Functions
• Buttons and functions
• Unlocking frequencies
• DTMF calls
• Frequency scanner
• Scrambling
• Remote kill
• CHIRP

Specific functions:

• Add a channel to a scan list
• List scanning
• Lockouts
• Scan on start
• ScanList members

Other:

• Bugs

Reflashing:

Before starting, we need to install Mono on Wine-Linux and then back up the configuration and calibration files as indicated in this previous article.

It is also recommended to save the current radio configuration, as this will be useful later to load the channels into the new firmware.

To create the backup, just follow these steps in CHIRP :

• Radio -> Download from radio
• File -> Save As ...

We can now proceed with the reflashing by following the steps in this previous article , obviously selecting the firmware file corresponding to AubsUK.

From the AubsUK GitHub , they recommend performing a reset once the radio is reflashed:

Perform a factory reset (hold PTT + SIDE BUTTON 1 while turning on the radio, after 'RELEASE ALL KEYS' navigate to Menu 68 Reset then select ALL)
to clear some EEPROM locations that other firmware configures slightly differently

You can see the procedure in this video:

Spectrum Analyzer:

You can consult a quick guide on EGZUMMER’s GitHub or download the PDF guide .

To access the spectrum analyzer, press: F+5(NOAA). The display should look something like this:

To make it easier to understand, here is a table where each row represents a line of information on the display. Each parameter is accompanied by an image from the previous example:

First display column	Display	Second display column	Display	Third display column	Display
Y-axis zoom: Max/current value. 3(VFO/MR)/9(Call)				Battery
Number of channels to scan: How many channels (with the specified bandwidth) should be monitored starting from the initial frequency. 4(FC)		Frequency with the strongest detected signal in that range		Modulation type. 0(FM)
Bandwidth per channel. 1(Band)/7(VOX)				Channel analysis bandwidth; depending on the signal emission, one bandwidth may perform better than another. 6(H/M/L)
Squelch line. *(Scan)/F(#)		Squelch line		Squelch line
Spectrum: The bottom triangle shows the frequency of highest intensity, which is also displayed numerically at the top		Spectrum		Spectrum
Initial frequency. 5(NOAA)		Scroll shift: How much to shift the frequency range start when pressing the Up(B)/Down(C) arrows. 2(A/B)/8(R)		Final frequency

• In the example, we see 32 channels being monitored, each 25kHz wide: 32*25 = 800kHz.
• The start frequency is 145.00000, so the end frequency is 145.00000+800 = 145.80000kHz.
• Pressing the Up(B)/Down(C) arrows moves the spectrum view by 400.00kHz. For example, pressing Up(B) shifts the start frequency to 145.40000, making the end frequency: 145.40000+800=146.20000kHz.
• Y-axis zoom is set to -50, and channels are being analyzed using 12.5kHz bandwidth — the optimal bandwidth depends on the signal’s characteristics.

In addition to the functions above, more are accessible via these buttons:

Detailed Monitoring: To access this mode, press PTT.

In this example, we see a level 6 signal equivalent to -86dBm, barely exceeding the squelch threshold.

In this menu, you can also make adjustments:

To access the parameters below, press M(A) and navigate using Up(B)/Down(C):

Below is the general signal processing diagram with elements adjustable in AubsUK (LNA/IF/PGA).

Incoming Signal Diagram:
According to the BK4819 datasheet , the signal enters via the antenna, passes through the LNA (amplified), then through the mixer, enters the IF where it is filtered, further amplified via VGA, and finally digitized.
Bear in mind the datasheet uses IF for the entire chain Filter+VGA+ADC, while AubsUK firmware separates them (IF = Filter, VGA = PGA). These are labeled in red in the diagram.

LNA: Low Noise Amplifier
Weak signals need amplification with minimal added noise. When amplifying, we increase both the signal and the existing noise, plus some from the amplifier circuit.

Controlled by RF module register: REG_10<9:8>/<7:5> ( BK4819V3Registers_List ).

• LNA Gain Short is 2 bits, offering 4 values:

• LNA Gain is 3 bits, offering 8 values:

Total gain = LNA Gain Short + LNA Gain.
Example:

• LNA Gain Short: 0 → 00 → -19 dB
• LNA Gain: 2 → 010 → -14 dB
  Final gain: -19 -14 = -33 dB

IF: Image Rejection Architecture
According to the datasheet , IF includes a low-pass filter (LPF), VGA, and ADC. In the firmware, IF seems to control only LPF bandwidth, via RF register REG_3D<15:0> ( BK4819V3Registers_List ):

IF Selection.
0 = Zero IF;
0x2aab ≈ 8.46kHz IF;
0x4924 ≈ 7.25kHz IF;
0x6800 ≈ 6.35kHz IF;
0x871c ≈ 5.64kHz IF;
0xa666 ≈ 5.08kHz IF;
0xc5d1 ≈ 4.62kHz IF;
0xe555 ≈ 4.23kHz IF;

In AubsUK firmware, the IF values appear as a list without units, assumed to correspond as follows:

0=Zero IF;            NOT A MENU OPTION
0x2aab~=8.46kHz IF;   1
0x4924~=7.25kHz IF;   10923
0x6800~=6.35kHz IF;   21845
0x871c~=5.64kHz IF;   32767
0xa666~=5.08kHz IF;   43689
0xc5d1~=4.62kHz IF;   54611
0xe555~=4.23kHz IF;   65533

PGA: Programmable Gain Amplifier
This is a configurable signal amplifier. Gain is set via RF register REG_10<2:0> ( BK4819V3Registers_List ).

• PGA is a 3-bit value, providing 8 options:

Scan Frequency Range Function

This firmware allows scanning a frequency range without needing to switch bands. You simply use the first row of the display to set the scan start frequency and the second row to set the end frequency. This makes scanning much more convenient.

Battery Calibration

To configure battery settings, you must access the extended menu:

SideKey1 + PTT + Power On

You can calibrate the battery in two ways:

As shown, when returning to the main menu, the displayed value may change. This appears to be a firmware bug. I assume the final value is the one set inside the option itself, not what is shown in the menu.

Functions:

To access the options, press the M(A) button and navigate using the arrow keys. You can also access options directly if you know their ID—for example, if you know that the VOX option is number 56, you can press M(A)+56.

The following table lists all the functions supported by AubsUK, with bold indicating features added compared to the stock firmware , and underlined indicating features added compared to EGZUMMER .

Extended Menu Access

To access the extended configuration menu, hold:

SideKey1 + PTT + Power On

Buttons and Functions:

All keypad buttons have a special function triggered by either combining with the F(#) key or holding the corresponding function button:

Unlock Frequencies:

As noted by the original EGZUMMER developer , unlocking frequencies only allows listening—not transmitting—and transmitting outside the amateur radio bands could damage the device:

This option won't give you ability to transmit in any other modulation than FM, this is a hardware limitation. Switching to AM or SSB only switches
AF audio output mode of a RF IC. It doesn't switch the whole IC into AM/SSB mode.
This is for listening only. This firmware is also built with additional lock that blocks TX when AM or SSB is on.

Supported bands by the radio:

FM:            F1 50∽76 MHz
FM:            F2 108∽135.9975 MHz
FM:            F3 136∽173.9975 MHz
FM:            F4 174∽349.9975 MHz
FM:            F5 350∽399.9975 MHz
FM:            F6 400∽469.9975 MHz
FM:            F7 470∽599.9975 MHz
FM:            F7+ XXXXX-XXXXX MHz
AM:            F2 108∽135.9975 MHz

To configure this, you must access the extended menu:

SideKey1 + PTT + Power On

From there, you can access various options .

Keep in mind:

• By default, all bands can be received, except F5, which is controlled via the 350 En option.
• The rest of the options control transmission for each band.
• F Lock enables typical ranges by geographic region.
• The special DEFAULT option under F Lock allows extra ranges like 137-174, 400-470 via Tx 200, Tx 350, Tx 500.
• Tx XXX enables additional bands only if DEFAULT is selected.

F Lock(60) - Assigns permitted transmission bands.
    DEFAULT + (137-174, 400-470) - Enables TX in F3 and F6 with optional expansion via Tx 200, Tx 350, Tx 500.
    FCC HAM (144-148, 420-450)
    CE HAM (144-146, 430-440)
    GB HAM (144-148, 430-440)
    (137-174, 400-430)
    (137-174, 400-438)
    DISABLE ALL - Disables all transmission.
    UNLOCK ALL - Enables transmission on all frequencies.

Tx 200 - Enables TX in 200MHz F4.
Tx 350 - Enables TX in 350MHz F5.
Tx 500 - Enables TX in 500MHz F7.

350 En - Enables RX in 350MHz F5.

If you insist on enabling TX in all bands, you must follow a very specific procedure : access the extended menu and activate F Lock(60) -> UNLOCK ALL 10 times in a row.

In my case, I’m enabling only the typical amateur radio frequencies. The relevant configuration is:

F Lock(60): DEFAULT + (137-174, 400-470)
Tx 200 - OFF
Tx 350 - OFF
Tx 500 - OFF
350 En - ON

As shown, this setup allows receiving all bands but only transmitting on amateur radio bands:

Note: Even with unlocked frequencies, TX is only in FM. You cannot transmit in AM, and transmission power outside ham bands is very poor, since the hardware was not designed for those ranges.

DTMF Calls:

The basic idea is to have a group of walkies all on the same frequency and be able to call one or more of them using DTMF codes. Each walkie must have a unique identifier called ANI ID (44), which can only be configured via the PC software .

If you transmit on the channel without dialing an ANI ID (44), no one with D Decd (52) enabled will hear you. The green LED will light up, indicating that a signal is being received, but no audio will be played. However, if you dial an ANI ID (44) that matches one of the walkies, it will immediately receive the audio—no need to “answer” the call.

The D Resp (49) configuration parameters apply only to the receiving walkie:

• DO NOTHING: If the walkie receives its ANI ID (44), the audio is played through the speaker. Think of it as an auto-answer phone.
• RING: Works the same as DO NOTHING, but also plays a ringtone, which only stops when the receiver transmits something.
• REPLY: Works the same as DO NOTHING, but the receiving walkie also responds, so the caller knows the other side is active and ready to receive audio. When calling from stock firmware to AubsUK, the receiver responds but the caller doesn’t detect it. Flashing both with AubsUK resolves the issue.
• BOTH: Enables both RING and REPLY. It suffers the same issue as REPLY when using mixed firmware.

If transmission stops, the call remains “auto-answered” for the time configured in D Hold (50). To cancel a call, press the Exit (D) key. To delete a character in DTMF dial mode, press SideKey1.

You can place calls in several ways:

• Manually: Hold PTT, dial receiver's ANI ID * your ANI ID. Example: if your ID is 666 and you’re calling 100, you would dial 100 * 666. In my tests, only the receiver could hear the audio, even with REPLY enabled.
• Automatically: Press *, then dial the receiver's ANI ID, then PTT. In this mode, your ANI ID is sent automatically.

To call a group, set the Local Code via the PC software . Assuming it’s #, calling 12# reaches IDs 120–129, 1## reaches 100–199, and ### reaches 000–999 (all possible users). The REPLY function does not work with group calls; the caller speaks blindly.

Keep in mind this is still an open channel: anyone can transmit or receive on your frequency once a call is auto-answered. If someone calls a walkie, that walkie opens communications. At that moment, any third party transmitting on the same frequency can be heard by both “friendly” walkies, and that third party could always hear the audio from them as well.

Here’s a demo video using DTMF contacts and D Resp (49) set to BOTH. You can see the firmware compatibility issues:

• Stock firmware → AubsUK: Caller doesn’t detect receiver’s response, but squelch opens on both devices.
• AubsUK → Stock firmware: Signal is received (green LED), receiver doesn’t respond, squelch opens only on the caller.
• AubsUK → AubsUK: Works flawlessly.

Depending on whether the walkie is calling or receiving, the display lines will show different info:

Changing D Hold (50) / D Prel (51) doesn’t seem to make a difference.

NOTE: If two devices are set with the same ANI ID (44), both will respond to the call, and all three (caller + two receivers) can hear and talk to each other.

Frequency Scanner

This walkie has a very useful function called Frequency Scanner: FC. It allows you to detect the frequency and tone/code another walkie is using. Just activate the function: F+4 (FC) / long-press 4 (FC) and wait for the other walkie to transmit.
You can save the configuration to a memory slot by pressing M(A). This is especially helpful when working with inexperienced users who don’t know their settings.

Another related feature is the Tone/Code Scanner. If you know the frequency but not the tone/code , press: F+* (Scan), and it will automatically detect it. Then you can save it to a channel using M(A).

Scrambling

You can “encrypt” conversations using scrambling Scramb (10). It just distorts the signal with a scrambling code. Walkies without this setting will hear garbled audio.

Here’s a video showing the effect:

Note that in Spain, encrypting radio communications is illegal, so be cautious with this option. If you want to ensure scrambling can’t be accidentally activated, you can disable it via the extended menu:

SideKey1 + PTT + Power On  
ScraEn: OFF

When disabled, the SCR option appears in the menu but does nothing, and the SCR label doesn’t show below the frequency:

Remote Kill

You can disable a walkie remotely by sending a DTMF tone sequence(Kill code). This is called Remote Kill. If the lost walkie is later found, you can restore it using a Revive code. For this to work, D Decd (52) must be enabled on the active channel.

We can see on the left the configuration of the walkie-talkie on the left in the video, and on the right the configuration of the walkie-talkie on the right in the video.

Left Walkie	Right Walkie

To kill walkie 666: ANI ID * Kill code, e.g., 666 * 66066
To revive it: ANI ID * Revive code, e.g., 666 * 66166

In the demo, neither code seems to have any effect. The device interprets it as a DTMF call , but oddly: only the receiver hears the audio and the origin of the call is displayed as 660:

If you enable DTMF kill lock:

The walkie will lock up without needing to receive any code, and can only be unlocked by receiving the Revive code or by reprogramming it from CHIRP with the option disabled:

NOTE: This might be useful if you want to restrict someone’s use of the walkie until a certain time/date. You could give it to them locked and unlock it when needed—but once unlocked, it stays that way.

After receiving the Revive code, if you read the configuration in CHIRP , you’ll see the option has been turned off:

CHIRP:

CHIRP is a widely used configuration software that supports a large number of devices. To proceed with its installation, we must first create a Python virtual environment and install the latest version of the software .

Venv and CHIRP installation:

We activate the venv and run the software:

We can create an alias to start CHIRP directly in the venv like this:

alias chirp='~/chirp/bin/python ~/chirp/bin/chirp'

To interpret the new data structure of the EPROM used by AubsUK, it is necessary to start CHIRP in developer mode and load the driver.

Enable developer mode:

Help -> Developer mode

After restarting, we can load the driver:

File -> Load Module...

NOTE: CHIRP is quite a clunky software, for example, if we select a value from a dropdown but do not remove focus from the parameter, it will NOT be applied, meaning if we upload the configuration to the radio, it will not have been applied.

Extra fields:
The first step before configuring anything is to enable Extra fields so we can see all the configuration parameters of AubsUK.

View -> Show extra fields

Connect to the radio:

Radio -> Download from radio

Channel list:
It will show us the channels. In my opinion, the interface leaves much to be desired since it is very complicated to understand what each field means; it would have been much simpler to map one column for each menu option on the walkie like CPS does. Despite its lack of intuitiveness, I will try to explain what each parameter does:

The DTCS Polarity option specifies the polarity of the output/input tone/code . The tones only allow positive polarity (N) while digital codes allow positive (N) and negative (R) polarity:

The Tone Mode option can take one of the following values:

NOTE: Cross: This mode must be set when we want to do mixed configurations, i.e., not only codes or only tones, but to be able to choose for input whether we will use codes or tones and similarly for output. This field depends on another column: Cross Mode.

The Cross Mode column determines whether codes or tones will be used; the first field indicates transmission and the second reception:

NOTE: For some reason the option Tone -> is missing, a CHIRP quirk; hopefully, they will fix these kinds of issues over time, remember support for Quansheng is still experimental.

Some modes are more restrictive than others; for example, if we configure only digital code as output, it makes no sense to have an input tone configured. These restrictions are detected but not very well, so you have to click on more fields even if you are not changing anything for them to apply.

Band list:
Similarly to how we did it with CPS , from CHIRP it is also possible to define the start and end of each band:

FM:            F1 50∽76 MHz  
FM:            F2 108∽135.9975 MHz  
FM:            F3 136∽173.9975 MHz  
FM:            F4 174∽349.9975 MHz  
FM:            F5 350∽399.9975 MHz  
FM:            F6 400∽469.9975 MHz  
FM:            F7 470∽599.9975 MHz  
FM:            F7+ XXXXX-XXXXX MHz  
AM:            F2 108∽135.9975 MHz  

To modify the parameters, we must scroll down to the bottom of the channel list:

By modifying these parameters, we will alter the frequency limits when scanning a band and default band parameters such as tones/codes , bandwidth, output power, and other parameters. Of course, we can always modify these parameters on the fly from the walkie menu.

Settings:
In the Settings tab, we can find the rest of the configuration.

Basic Settings:
As we can see, AubsUK thoughtfully indicates which walkie parameter corresponds to each option.

Advanced Settings:

Programmable keys: SideKeys configuration.

DTMF Settings: Configuration of DTMF parameters.

NOTE: Keep in mind that the DTMF remote kill function does not work properly on AubsUK.

DTMF Contacts: DTMF contacts configuration.

Scan Lists: From here, we can configure if we want the radio to start scanning on boot and which lists to scan when scanning is active.

Unlock Settings: Allows us to unlock transmission on frequencies outside the amateur radio range and enable/disable the use of scrambling , just like from the extended menu.

FM Radio: Allows editing of saved radio channels.

Driver information: Shows firmware version.

Calibration: Allows adjustment of calibration parameters. As indicated on the EGZUMER website , CHIRP saves radio calibration parameters in the files it generates when saving, so if someone shares their CHIRP file with us and this option is enabled, we will be loading their calibration.
The best way to back up our calibration is through k5prog-win. Some parameters that the AubsUK (EGZUMER) firmware does not use at all are shown by CHIRP as values in the EPROM but are unused.

Calibration-Squelch: Allows adjustment of squelch parameters per level (59). Only two configurations are allowed, one for the first three bands and one for the next four. These values are read and multiplied by two by the firmware.

Calibration-RSSI levels: We can define signal quality thresholds to show X or Y bars, only two configurations allowed, one for the first three bands and one for the next four. Only used if the firmware was compiled with ENABLE_RSSI_BAR=0 option.

Calibration-TX power: Allows defining transmit power per band. If firmware is compiled with the ENABLE_REDUCE_LOW_MID_TX_POWER option enabled, medium power value is divided by 3 and low power by 5.

You can see Lower/Center/Upper values; this is because bands are divided into regions of X MHz, according to the band region we are operating in, a different power will be applied. For example, if we are in band F1 with the walkie configured to Low power, while in the lower region we transmit at: Band 1 -> Low -> Lower, but with the same setting in the upper region of band F1, it would be: Band 1 -> Low -> Upper.

Calibration-Battery: Only level 3 is used. This value is configured through the battery calibration procedure.

Calibration-VOX: Allows defining activation thresholds for VOX at each level.

Calibration-Microphone sensitivity: Not used.

Calibration-Other: Configuration of crystal frequency and gain of volume and DAC.

According to the radio chip datasheet , the walkie comes with a 26MHz crystal and there is a variable capacitor used for crystal frequency calibration:

Cvar is an adjustable capacitor for frequency calibration.

I imagine that a 26MHz crystal is considered low frequency and for this reason, Xtal frequency low receives a default value of 1; I don’t think this parameter needs to be touched unless hardware modifications are made to the walkie.

Specific Functions:

Now let’s move on to the specific functions of AubsUK firmware. Some of these were already explored in the functions section . Features in bold indicate additional functionalities compared to the stock firmware , and those underlined are additional compared to EGZUMMER’s firmware .

Adding a channel to a scan list:

In channel mode , access the menu M(A) -> ScnAdd(14). Inside, you can enable or disable the channel in different scan lists using the numeric buttons.

In this video, channels Test1/2 are added to scanlist8, and Test3/4 to scanlist9:

In CHIRP, manage this via Memories -> Scanlists:

Scan lists scanning:

To scan lists, hold down the *(Scan) button while in channel mode . The top display shows the scan lists enabled (0-9).

To enable/disable lists, press the number key corresponding to the list. Depending on the scan and list status, the display shows:

• Number: List enabled and currently being scanned.
• *: List enabled but not currently scanned.
• -: List disabled.

The LED indicates your action:

• Green: Scan list enabled.
• Red: Scan list disabled.

This video shows enabling/disabling scan lists:

In CHIRP, configure via Settings -> Scan List Settings:

Lockouts:

Channels can be excluded from scans in two ways.

Permanent exclusion:
To permanently exclude a channel from scanning, go to menu M(A) -> ScnLkO(15):

In CHIRP, access Memories -> Skip:

Temporary exclusion:
You can temporarily exclude a channel from scanning until the next radio reboot — useful if a busy channel constantly interrupts scanning. Press *(Scan); the LED blinks red twice and the channel is excluded.

Temporary exclusions cannot be managed from CHIRP because it requires rebooting the radio after loading settings.

Scan on start:

This firmware supports automatic scanning on power-up. Behavior depends on the mode the radio was in when powered off:

• Channel mode : resumes scanning as it was last used.
• VFO mode : scans from the last VFO frequency.

Enable this in menu M(A) -> ScnSrt(16):

In CHIRP, use Settings -> Scan List Settings:

ScanList members:

To see which channels belong to each scan list, go to menu M(A) -> SLists(17). Press the list number to jump directly to its members:

In CHIRP, just view Memories -> Scanlists:

Bugs:

This firmware has some bugs to keep in mind:

• DTMF calls between different firmware versions have issues, detailed in the DTMF calls section .
• The kill code feature appears completely broken, see Remote kill section .

Additionally, CHIRP currently has many bugs with this radio model — for example, channel 25 shows only one analog output tone configured, but in Properties digital tones and others appear:

As a final note, thanks to my friend Manhattan for kindly lending me his radio to perform all the tests in this article.