1.1 About this Volume

This is the first of a ten-volume deep dive on the Quansheng UV-K5 from the Hack Tools angle — not how to work a repeater net with it (the peer Scanners project owns radio operation), but what makes a mass-market $30 Chinese handheld into one of the most-hacked RF devices of the decade. The subject is the custom-firmware ecosystem that grew up around the radio after it was reverse-engineered in late 2023, the Beken BK4819 RF system-on-chip that the firmware reprograms, the spectrum-analyzer mod that became the project’s signature unlock, and the mechanics of flashing, building from source, and RF experimentation on a sub-$40 platform.

The reader is assumed to be an engineer comfortable with RF concepts, embedded toolchains, and the idea of flashing third-party firmware onto a device the vendor never intended to be open. This is a reference for the person deciding whether the UV-K5 earns a slot on the bench and how to think about what the custom firmware can and cannot do — not a getting-started card and not an operator’s manual.

The volume lays out the central claim, the difference between the stock and custom firmware worlds, the single most consequential fact a buyer must get right (the radio exists in three firmware-incompatible hardware generations, distinguished by their microcontroller), a decision tree that routes a prospective buyer to the correct firmware fork, and a frank accounting of the gap between the hype (“$30 SDR!”) and the reality (a narrowband superheterodyne voice radio with a clever analyzer bolted on). Where radio operation depth is needed — repeaters, nets, licensing, band plans — this series points at the Scanners peer rather than duplicating it.

Note. Two things in this ecosystem move independently and are easy to conflate: the hardware generation (set by which MCU the radio was built with — fixed for the life of the unit) and the firmware fork (the community project flashed onto it — changeable at will, within the limits of the hardware generation). A firmware binary is specific to one MCU generation. Getting the pairing wrong is the single most common first-time mistake, which is why §4 and Volume 3 both exist.

1.2 The one-sentence thesis: a $30 handheld with an open RF SoC

The whole project fits in one breath: a mass-produced dual-band VHF/UHF ham handheld happens to be built around an RF chip — the Beken BK4819 — whose capabilities vastly exceed what the stock firmware exposes, and a community has spent two years writing open firmware that unlocks the rest.

Out of the box the UV-K5 is an unremarkable ~$30 radio: narrowband FM voice on the 2-meter (144 MHz) and 70-centimeter (430 MHz) amateur bands, a wideband broadcast-FM receiver, a monochrome top-mounted LCD, and a stock firmware that is deliberately conservative about what it lets the chip do. The interesting part is underneath. The BK4819 is a software-defined narrowband transceiver SoC: a quadrature receiver with a programmable local oscillator, selectable demodulators, and a huge register map that the stock firmware only lightly touches. When fagci reverse-engineered that register map in late 2023, it became possible to drive the chip far past its factory settings — and the fork explosion followed.

What the custom firmware unlocks, at a glance:

• Wide receive coverage — roughly 18 MHz to 1300 MHz (with a hardware-imposed gap in the 630–840 MHz region the chip’s baseband cannot reach), versus the stock ~50–600 MHz.
• AM and SSB receive — the stock firmware is FM-only; the BK4819 can demodulate AM (airband, shortwave) and, with DSP tricks, a crude single-sideband.
• A spectrum analyzer / waterfall — the signature mod: the chip is swept across a band and the signal-strength readings are plotted on the little LCD in real time.
• A frequency counter and signal-strength / RSSI tools — point the radio at an unknown transmitter and read its frequency.
• A long tail of ergonomic and interface unlocks — custom channel handling, scanning behaviours, screen layouts, battery calibration, and more.

Tip. The anchoring idea for the whole series: the UV-K5 is not an SDR, and treating it like one leads to disappointment. It is a narrowband superheterodyne voice radio whose control chip is unusually programmable. The spectrum mode is a sweep of that narrowband receiver, not a wideband capture. Volume 5 is devoted to exactly where that distinction bites; the short version is that the analyzer is a triage tool, not an instrument — when real spectral depth is needed the bench reaches for the HackRF (see §6).

1.3 Stock versus custom — what flashing actually buys

The stock firmware and a mature custom firmware are the same hardware running wildly different software. The table below is the honest before/after.

Table 1 — 3. Stock versus custom — what flashing actually buys

Capability	Stock firmware	Custom firmware (e.g. egzumer / F4HWN)
RX coverage	~50–600 MHz	~18–1300 MHz (630–840 MHz gap; front-end rolls off at the band edges)
Demodulation	FM (+ WFM broadcast)	FM, WFM, AM, SSB (crude)
Spectrum view	None	Sweep analyzer + waterfall
Frequency counter	None	Yes (read an unknown nearby TX)
Channels	~200, vendor UI	More channels, named, scan lists, flexible UI
TX	144 / 430 MHz, region-limited	Unlocked in firmware (legally gated — see §7)
Battery / RSSI tools	Minimal	Calibratable, graphed
CHIRP support	Partial	Yes (dedicated CHIRP modules per fork)
Source available	No	Yes — build and modify

The two rows that generate the most excitement — wide RX and TX unlock — are also the two most misunderstood. Wide RX is real but front-end-limited: the radio’s input filtering and the BK4819’s baseband set hard edges, so “18–1300 MHz” means “tunable there,” not “sensitive and clean there.” TX unlock is a firmware setting, not a license: the chip will key up out of band, but doing so is illegal in most jurisdictions and can transmit into a front-end the antenna is not matched for. Volume 2 covers the front-end limits; §7 here and Volume 10 (sibling) cover the legal envelope.

What flashing reliably buys is the everyday upgrade: a far better UI, named channels and scan lists, AM airband and broadcast-FM receive done well, the frequency counter, and the analyzer for field triage. That is the honest value proposition — not “a $30 SDR,” but “a $30 scanner-plus-analyzer-plus-ham-handheld with open, inspectable firmware.”

1.4 The one decision that constrains everything: which hardware generation

Before any firmware discussion, one hardware fact governs everything: the UV-K5 family exists in three firmware-incompatible generations, distinguished by the microcontroller (MCU) that runs the radio. The RF chip — the BK4819 — is the same across all of them. The MCU is not, and the firmware binary is built for a specific MCU. Flash the wrong one and, at best, nothing happens; at worst the bootloader is at risk.

Table 2 — 4. The one decision that constrains everything: which hardware generation

Generation	MCU	Class	Firmware situation
V1	DP32G030	ARM Cortex-M0+	The original. The largest installed base; where the ecosystem matured. egzumer, F4HWN (to v4.3), VUURWERK all target it.
V2	PY32F030	ARM Cortex-M0+	A mid-run MCU change (community-reported). A transitional step; narrower fork support.
V3	PY32F071	ARM Cortex-M0+	The current generation, shared with the UV-K1. The actively-developed F4HWN “Fusion” line targets it.

Three practical consequences fall out of this:

1. You cannot pick a firmware until you know your MCU. The reliable way is to read the chip marking on the board (or the firmware/version string the stock radio reports), not to guess from the purchase date.
2. The most-installed custom firmware (egzumer) and the most-actively-developed one (F4HWN Fusion) are on different generations. egzumer dominates the V1 installed base but is frozen; Fusion is the live project but only on V3 / UV-K1. There is no single “latest and greatest” that covers everyone.
3. A V1 radio bought today is still an excellent buy — the frozen egzumer v0.22 is mature and complete — but it is a different ownership path from a V3.

         Quansheng UV-K5 family — the MCU fork
         (BK4819 RF SoC is identical across all three)

                 ┌─────────────────────────────┐
                 │   Which MCU is on the board? │
                 └──────────────┬──────────────┘
         ┌──────────────────────┼──────────────────────┐
         ▼                      ▼                      ▼
  ┌─────────────┐        ┌─────────────┐        ┌─────────────┐
  │     V1      │        │     V2      │        │     V3      │
  │  DP32G030   │        │  PY32F030   │        │  PY32F071   │
  │             │        │             │        │ (+ UV-K1)   │
  │ egzumer     │        │ transitional│        │ F4HWN       │
  │ F4HWN ≤v4.3 │        │ limited fork│        │ "Fusion"    │
  │ VUURWERK    │        │ support     │        │ v5.9.0      │
  └─────────────┘        └─────────────┘        └─────────────┘
   frozen-dominant        narrowest path         active line

The full row-per-radio breakdown — including the UV-K5(8), UV-K6, UV-5R Plus, UV-K1, and the Motorola-branded “K5(X8)” variant, with firmware repos and flashers — is the mandatory supported-hardware table in Volume 3. Anyone choosing a radio or a firmware should read that table before ordering; this section is the summary that frames the decision, and §5 is the routing graph.

1.5 The decision tree — which fork for which radio

START ── What MCU is on your board? ──────────────────────────────┐
                                                                   │
   ┌───────── V1 (DP32G030) ─────────┐   ┌─ V3 (PY32F071) / UV-K1 ─┘
   ▼                                 │   ▼
 Want the most-installed, most-      │  Want the actively-developed
 documented, "it just works" fork?   │  line with ongoing fixes?
   │                                 │   │
   YES                               │   YES
   ▼                                 │   ▼
 ┌────────────────────────────┐      │  ┌──────────────────────────────┐
 │ egzumer v0.22 (FROZEN)      │      │  │ F4HWN "Fusion" v5.9.0         │
 │ OneOfEleven + fagci spectrum│      │  │ armel/uv-k1-k5v3-firmware-...  │
 │ the V1 default              │      │  │ the V3 / UV-K1 default         │
 └────────────────────────────┘      │  └──────────────────────────────┘
   │                                  │
   ├── Want an actively-maintained    │
   │   V1 build instead of a frozen   │
   │   one? ── F4HWN v4.3 (last V1    │
   │           release) or VUURWERK   │
   │           v1.5.0 (newer V1)      │
   │                                  │
   └── Want maximum features / willing │
       to tinker? ── IJV (feature-heavy),│
                     or build from source │
                     (Volume 7, sibling)  │
                                          │
  ─── V2 (PY32F030)? ──────────────────────┘
      Narrowest path — confirm current fork support before buying;
      V1 and V3 are the well-trodden routes.

The tree resolves to a few common outcomes. On a V1 radio the default is egzumer v0.22 — frozen since 2024-01-28 but complete, stable, and the most-documented build in the ecosystem, merging OneOfEleven’s firmware base with fagci’s spectrum analyzer. A V1 owner who wants something still receiving updates instead reaches for F4HWN v4.3 (the last V1 release, 2025-12-02) or the newer VUURWERK v1.5.0 (2026-07-04). On a V3 or UV-K1 the answer is F4HWN “Fusion” v5.9.0 (2026-08-14), the actively-developed line. V2 (PY32F030) is the awkward middle — the narrowest fork support of the three, and a generation to confirm support for before buying rather than assume. The fork philosophies and the full feature comparison live in Volume 4; the per-radio hardware-and-firmware pairing table is Volume 3.

1.6 Where it sits: Flipper Zero, HackRF One, and the Scanners peer

The UV-K5’s niche is clearest by contrast with the other RF tools on the bench.

Table 3 — 6. Where it sits: Flipper Zero, HackRF One, and the Scanners peer

	UV-K5 + custom FW	Flipper Zero	HackRF One + PortaPack	RTL-SDR on a PC
Price	~$30	~$170	~$320+	~$30 + a computer
Role	VHF/UHF voice handheld + crude analyzer	Sub-GHz / RFID / IR multitool	Wideband TX+RX SDR	RX-only wideband SDR
Frequency span	~18 MHz – 1300 MHz (gaps)	~300–928 MHz sub-GHz + 13.56 MHz	1 MHz – 6 GHz	~24 MHz – 1.7 GHz
Transmit	Yes (voice; legally gated)	Sub-GHz OOK/FSK replay	Yes (wideband)	No
Voice RX/TX	Yes — its whole point	No	Possible but clumsy	RX only, via PC
Spectrum view	Crude sweep on the LCD	Narrow sub-GHz frequency analyzer	Real wideband waterfall	Full PC waterfall
Open firmware	Yes (several forks)	Yes	Yes (Mayhem)	N/A (host software)

Against the Flipper Zero (covered in depth in the hub), the overlap is thin. The Flipper is a sub-GHz/RFID/IR multitool with a weak, narrow frequency analyzer; the UV-K5 is a voice radio with a wider tunable receiver and a sweep analyzer. A bench with both uses the Flipper for sub-GHz capture/replay and NFC, and the UV-K5 for “listen to and talk on a VHF/UHF channel” plus a quick band sweep. See the Flipper Zero deep dive for the sub-GHz side.

Against the HackRF One + PortaPack (also covered in the hub), the UV-K5 is the cheap, pocketable complement. The HackRF is a 1 MHz–6 GHz transmit-and-receive SDR with a real waterfall; the UV-K5’s analyzer is a crude narrowband sweep by comparison. The correct mental model: use the UV-K5 in the field to notice that something is transmitting near a frequency, and reach for the HackRF when the task needs real spectral depth, capture, or wideband TX. Volume 5 draws that line precisely and points at the HackRF One deep dive.

Finally, the peer Scanners project is the conceptual neighbour, not a competitor. That project is the 25-volume reference on radios, scanners, and DMR hotspots proper — the right home for the operation of a VHF/UHF handheld: repeaters, nets, band plans, licensing, CTCSS/DCS planning, and the amateur-radio domain in general. This series keeps the hacker/firmware story — reverse engineering, forks, the BK4819 register map, flashing, building, the analyzer mod — and defers operation depth to the Scanners peer rather than duplicating it. Antenna questions go to the hub’s Antennas project.

1.7 The honesty ledger — what a $30 radio cannot do

The custom-firmware community is enthusiastic, and enthusiasm inflates claims. The ledger below collects the places where the reality is narrower than the headline, so a buyer forms the right expectations before spending even $30.

Table 4 — 7. The honesty ledger — what a $30 radio cannot do

Headline claim	The honest reality
”Turns a $30 radio into an SDR”	It is a narrowband superheterodyne receiver with a programmable control chip, not an SDR. The analyzer sweeps that narrowband receiver; it does not capture wideband IQ.
”18 MHz – 1300 MHz receive”	Tunable there, yes — but with a hard 630–840 MHz gap the BK4819 baseband cannot cross, and sensitivity that falls off sharply outside the design bands because the radio’s front-end filtering is fixed.
”Spectrum analyzer”	A step-and-measure sweep on a monochrome LCD. Useful for triage (“is something transmitting around here?”), not for measurement. Slow, coarse, and blind to anything faster than the sweep.
”SSB receive”	A DSP approximation on a chip never designed for SSB. Listenable, not clean; dependent on the fork.
”TX unlocked”	A firmware setting, not a license. Keying out of band is illegal in most regions, risks interference, and transmits into a front-end/antenna not matched for it.
”AM airband”	Genuinely useful and one of the better unlocks — but still a narrowband receiver with the same front-end-filtering caveats.

Warning — RF-legal. Unlocking wide receive does not unlock legal transmit. TX is license- and region-gated: in most jurisdictions you may transmit only on bands you are licensed for, within those bands’ rules. The custom firmware will happily let the BK4819 key up on frequencies where transmitting is illegal, dangerous to the hardware, or both. This series keeps the legal note brief and puts the detail in Volume 10 (sibling) and the hub’s shared legal/ethics note; the one-line rule is: wide RX unlock ≠ legal to TX out of band.

None of this is a knock on the project — it is why the project is worth trusting. A $30 radio that honestly delivers “a great scanner UI, AM airband, a frequency counter, and a triage analyzer, all open-source” is a genuinely good deal. A $30 radio sold as “an SDR that does everything” is a disappointment waiting to happen. Keep the distinction and the UV-K5 is one of the best-value tools on the bench.

1.8 Who it is for — and who should buy something else

A good fit is the engineer or hobbyist who wants a cheap, pocketable VHF/UHF voice handheld that doubles as a learning platform for RF and embedded work, who values open and inspectable firmware, and who finds it genuinely useful to carry a radio that can monitor airband AM, sweep a band for activity, and read an unknown nearby transmitter’s frequency. It suits someone willing to flash firmware, read a chip marking to identify their generation, and occasionally build from source. At $30, it is also the lowest-risk way in the whole hub to get hands-on with an open RF SoC.

A poor fit is the buyer expecting a wideband SDR — that is the HackRF’s or an RTL-SDR’s job, and it is no criticism of either to say the UV-K5 is not one. It is also a poor fit for anyone who will be frustrated by the generation/firmware pairing homework, or who wants a sealed, warrantied, guaranteed-compliant commercial radio. And it is the wrong tool for anyone tempted to treat the TX unlock as permission to transmit out of band — that is a licensing and safety problem, not a feature.

1.9 A note on dates, forks, and version churn

Before any version-specific claim: the UV-K5 firmware ecosystem is a moving target, and the forks move at different speeds. Pin every claim to a date. As of this writing (2026-10-17) the landscape is:

• egzumer v0.22 — the most-installed custom firmware on V1, frozen since its last update on 2024-01-28. Frozen does not mean abandoned-as-broken; it means complete and stable, and still the default recommendation for a V1 radio.
• F4HWN “Fusion” v5.9.0 — released 2026-08-14, the actively-developed line for V3 + UV-K1, from armel/uv-k1-k5v3-firmware-custom.
• F4HWN v4.3 — released 2025-12-02, the last release for V1 (DP32G030), from the original armel/uv-k5-firmware-custom repo.
• VUURWERK v1.5.0 — released 2026-07-04, a newer V1 option.

Note. “F4HWN” names two repositories, which is a common point of confusion. The original armel/uv-k5-firmware-custom is the V1 line (up to v4.3). The V3/UV-K1 “Fusion” line lives in the separate armel/uv-k1-k5v3-firmware-custom repo (v5.9.0). They share an author and a heritage but are different builds for different silicon. Volume 3’s table and Volume 4’s history keep the two straight.

The practical discipline: before flashing, confirm your MCU generation, then check the current release on the specific repo for that generation. This series dates every version-specific claim for exactly that reason; treat any undated capability claim found elsewhere with suspicion.

1.10 How this series is organized

Ten volumes. This Hack Tools dive owns Volumes 1–5 (overview, hardware, the supported-radios table, the firmware ecosystem, and the analyzer/receive unlocks); a sibling author writes Volumes 6–10 (flashing, building from source, CHIRP and channel plans, RF experimentation, and the legal/posture/cheatsheet wrap).

Table 5 — 10. How this series is organized

Vol	Title	What it covers
1	Overview & decision tree	This volume — thesis, stock vs custom, the MCU generations, the fork decision tree, placement, honesty ledger
2	The hardware	The BK4819 RF SoC, the three MCU generations and why they are firmware-incompatible, display, battery, USB-C vs micro-USB, the SMA-F antenna, stock band/TX limits
3	Where this firmware runs — supported radios & firmware	The mandatory per-radio table: every radio × fork combination, build dates, frozen-vs-active, where to get each
4	The custom-firmware ecosystem	History (fagci RE → the fork explosion), each fork’s philosophy, the feature-comparison table, the frozen-dominant-V1 / active-V3 split
5	The spectrum analyzer & receive unlocks	How the BK4819 is swept, the waterfall UX, AM/SSB receive, wideband RX coverage and front-end limits, the frequency counter — and the honest comparison to a real SDR
6	Flashing the radio (sibling)	k5prog, web-flashers, the bootloader, recovery
7	Building from source (sibling)	The ARM GCC / Make toolchain, compiling a fork, rolling custom mods
8	CHIRP & channel plans (sibling)	The CHIRP modules for F4HWN and egzumer, channel-plan workflow
9	RF experimentation (sibling)	Field workflows, pairing with HackRF/Flipper, antenna notes
10	Legal, posture & cheatsheet (sibling)	The TX/RX legal envelope in depth, operating posture, laminate quick-ref

A suggested reading order for a prospective buyer: this volume to decide whether and which generation; Volume 3 for the per-radio/firmware pairing table before ordering; Volume 2 for the hardware and why the generations differ; Volume 4 to choose a fork; Volume 5 to calibrate expectations of the analyzer. The sibling Volumes 6–10 are the hands-on build-flash-operate reference once the hardware is in hand.

The next volume opens the hood on the BK4819 RF SoC and the three MCU generations — what the chip can do, what the custom firmware unlocks, and precisely why a firmware binary built for a DP32G030 will not run on a PY32F071.

The Quansheng UV-K5 is a commercial product; the custom firmware discussed here is community open-source (egzumer and the V1 F4HWN line under their respective licenses; the V3 “Fusion” line is Apache-2.0). Facts in this volume are drawn from the fagci, egzumer, and F4HWN (armel) repositories and contemporaneous coverage as of 2026-10-17; version-specific claims are dated. Radio operation depth is deferred to the peer Scanners project.