[oetiker]

Summary

Promotes the codeplug reverse-engineering analysis into a permanent in-repo reference, docs/codeplug-format.md, and links it from the README alongside PROTOCOL.md (which covers the serial wire protocol; this covers the memory layout).

Until now this knowledge lived only in ephemeral scratch notes. The document is the field↔offset map that the decode/apply code implements.

Contents

• Region frame — the framed serial reply format (magic, lengths, payload, trailer).
• The 13 regions — purpose, size, and record layout of each.
• Storage model & offset conventions — the CPS record-relative vs p64tool offset systems, and the verified translation (channel record = CPS + 1; base_ww=16 tables = shift 0).
• Channel record (72 B) — the full per-offset field map, with digital/analog aliasing and the reserved-byte set; plus the CTCSS/DCS sub-tone encoding.
• Other tables — contacts, RX-groups, zones, scan lists, emergency/alarm systems, encryption keys, quick-text messages.
• Scalar regions — the bound offsets in r02/r03/r0A/r05.
• Unknown/reserved regions — why r32/rKL/rFF hold nothing on a stock codeplug.
• Firmware notes — the IAP container / AT32 image, and why it is not a source of offsets.
• RE sources & method — what to trust in the decompiled CPS, and how it was verified against hardware.

Docs-only; no code changes.

🤖 Generated with Claude Code