10.1 About this Volume

The UV-K5’s hacking appeal is also its legal hazard: the same custom firmware that unlocks a spectrum analyzer and wide receive (Volume 5) will, with one more menu toggle, let the radio transmit anywhere its synthesizer reaches. The hardware does not know or care whether a frequency is a licensed amateur band, an aircraft tower, or a public-safety dispatch channel — and neither does the firmware. The responsibility is entirely the operator’s. This closing volume sets the regulatory posture plainly, then places the UV-K5 against the three tools it is most often confused with (Flipper Zero sub-GHz, HackRF One SDR, and a dedicated scanner), and ends with a laminate-ready cheatsheet and an A–Z glossary for the whole dive.

The lab-discipline rules that apply to every tool in this hub live in ../_shared/legal_ethics.md; this volume is the UV-K5-specific reading of them. For the operational side of lawful amateur use — band plans, licensing classes, nets, repeater etiquette — the peer Scanners project (../Scanners/) is the depth reference, and this volume cross-references it rather than restating it.

10.2 Transmit is license and region gated

Transmitting is the regulated act. Receiving is comparatively permissive (§4); keying up is where law applies hardest. The core facts:

Table 1 — Transmitting is the regulated act. Receiving is comparatively permissive (§4); keying up is where law applies hardest. The core facts

Point	Reality
Amateur TX needs a license	Transmitting on the amateur (ham) 2 m / 70 cm bands requires an amateur-radio license in essentially every jurisdiction
Out-of-band TX is illegal	Transmitting outside the bands your licence authorises — public-safety, aircraft, marine, business, broadcast — is illegal in most regions, often a serious offence on protected services
The UV-K5 isn’t type-accepted for licence-free services	It is not an FRS/GMRS/MURS (or regional equivalent) type-accepted device; it is an amateur/commercial handheld, so using it on those consumer services is itself non-compliant
Region rules vary	Band allocations, power limits, and what is even legal to own/operate differ by country; the operator must know their own regulator’s rules

The practical posture for a licensed amateur: transmit only inside the amateur bands your licence covers, at legal power, with a clean signal — and note that a front-end mod (Volume 9 §6) can compromise that signal cleanliness and is a transmit-legality issue, not just an RX one. The practical posture for an unlicensed owner: do not transmit at all; use the radio receive-only (§4).

Hard rule — the firmware’s ability is not the law’s permission. Custom firmware can enable TX across the entire tunable range. That it can is a fact about software; whether you may is a fact about your licence and your regulator. The two are unrelated, and conflating them is how people get fined. When in doubt, do not transmit.

10.3 The wide-RX-unlock does not make TX legal

A specific and common confusion deserves its own section. The custom firmware’s wide-RX unlock (Volume 5) and its out-of-band TX unlock are two different switches, and unlocking the first implies nothing about the second:

   ┌─────────────────────────┐        ┌─────────────────────────┐
   │  WIDE-RX UNLOCK          │        │  OUT-OF-BAND TX UNLOCK   │
   │  "tune/receive anywhere  │   ≠    │  "transmit anywhere the  │
   │   the front-end allows"  │        │   synthesizer reaches"   │
   │                          │        │                          │
   │  Mostly lawful to listen │        │  Illegal outside your    │
   │  (region caveats, §4)    │        │  licensed bands (§2)     │
   └─────────────────────────┘        └─────────────────────────┘
          Enabling this  ──────✗──────▶  does NOT authorise this

Receiving a frequency and transmitting on it are governed by entirely different law. A wide-RX radio that can hear an aircraft tower, a marine channel, or a public-safety dispatch has not thereby acquired any right to transmit on them — doing so is illegal and, on safety-of-life services, dangerous. The unlock that lets you listen is not a licence to talk.

Callout — the one-sentence version. Listening wide is mostly fine (with the caveats in §4); talking out of band is not fine; and the firmware offering both as adjacent menu items does not make them legally adjacent. Treat the TX unlock as “off” unless you hold a licence for the exact band you are about to use.

10.4 Receive-only caution

Receiving is more permissive than transmitting, but “more permissive” is not “unlimited.” The caveats that matter:

Table 2 — Receiving is more permissive than transmitting, but "more permissive" is not "unlimited." The caveats that matter

Caveat	Detail
Interception law	Some jurisdictions restrict intercepting certain communications (e.g. cellular, encrypted, or non-broadcast services) even if your hardware can tune them
Divulgence / use	Even where monitoring is legal, acting on, recording, or retransmitting what you hear can be separately illegal
Scanning bans	A few jurisdictions restrict or license scanner ownership/use outright, or ban monitoring specific services
Encrypted ≠ listenable	Much modern public-safety traffic is digital/encrypted (P25, DMR, TETRA); an analog FM/AM handheld like the UV-K5 cannot decode it regardless of legality — see the Scanners peer for the digital-modes landscape

The defensible posture is monitor only what is lawful to monitor where you are, and never act on, record, or retransmit protected traffic. The UV-K5’s honest receive role is analog voice and signals on and around the amateur/commercial VHF-UHF bands (Volume 9 §3 sets the sensitivity expectations); it is not a public-safety scanner, both because of the front-end’s limits and because modern public-safety is digital and encrypted.

Note — know your own regulator. This volume cannot enumerate every country’s rules; it can only flag that they exist and differ. Before relying on the radio to monitor anything beyond the amateur bands, confirm what your regulator permits. The hub’s ../_shared/legal_ethics.md is the standing rule set.

10.5 Comparison — UV-K5 vs Flipper vs HackRF vs a dedicated scanner

Four tools get conflated because all four “do RF.” They occupy different niches. The UV-K5’s niche is specifically a cheap, licensed VHF/UHF voice handheld with a bonus RX-triage display — not an SDR, not a sub-GHz hacking multitool, not a true scanner.

Table 3 — 5. Comparison — UV-K5 vs Flipper vs HackRF vs a dedicated scanner

Axis	UV-K5 (modded)	Flipper Zero sub-GHz	HackRF One + PortaPack	Dedicated scanner
Frequency range	~18–1300 MHz tunable; usable mainly 2 m/70 cm + nearby (front-end, Vol 9 §3)	~300–928 MHz (CC1101, regional sub-bands)	1 MHz – 6 GHz (true wideband SDR)	Wide RX across scanner bands incl. 700/800 MHz
TX?	Yes — ham bands with a licence (§2); illegal out of band	Yes — sub-GHz OOK/limited protocols	Yes — wideband TX (most-regulated capability in the hub)	No — receive-only by design
Modulation	FM/NFM, AM (+AM-fix), SSB on some forks — analog voice	OOK/ASK/FSK sub-GHz data; not voice	Anything you can write in DSP (GNU Radio)	FM/AM + digital decode (P25/DMR) on capable models
Form factor	Belt handheld with mic/speaker/PTT	Pocket multitool	Board(s); handheld only with PortaPack	Handheld or base; purpose-built UI
Price	~$30	~$170	~$150–350+ with PortaPack	~$100–600+
On-device spectrum	Crude sweep view (Vol 5) — triage only	Limited frequency analyzer	Full waterfall (PortaPack / host)	Some models; search modes
Wins when…	You need licensed VHF/UHF voice on a belt, cheaply, plus crude RX triage	You need a sub-GHz data multitool (remotes, OOK) you carry everywhere	You need real wideband SDR RX/TX and DSP flexibility	You need turnkey multi-band + digital-mode scanning with a good UI
Loses when…	True wide coverage, digital decode, fine spectrum work	Voice; anything outside sub-GHz	Belt-carry voice convenience; low cost	Any TX; hackability; price

Where each hands off to the next:

• UV-K5 → HackRF/RTL-SDR when you need real wide-coverage receive, a proper waterfall, or any modulation the handheld can’t do. The K5’s spectrum mode is triage (“is anything on this MHz?”); the SDR is the analysis tool.
• UV-K5 → Flipper for sub-GHz data (garage remotes, OOK devices) — the K5 is a voice radio, not a protocol multitool.
• UV-K5 → dedicated scanner / the Scanners peer for digital-mode (P25/DMR) monitoring and turnkey multi-band scanning — see ../Scanners/, the hub’s depth reference for radios, scanners, and DMR. Cross-tool view: ../_shared/comparison.md and the sortable capability matrix.

Callout — the UV-K5’s real value proposition. It is the ~$30 answer to “I need a licensed voice handheld that is also fun to hack,” not the answer to “I need a scanner” or “I need an SDR.” Buy it for cheap VHF/UHF voice + RF tinkering; reach for the SDR, the Flipper, or a real scanner when the task is wide RX, sub-GHz data, or digital-mode scanning respectively.

10.6 The laminate-ready cheatsheet

╔══════════════════════════════════════════════════════════════════════════╗
║  QUANSHENG UV-K5 — FIELD CHEATSHEET                                         ║
╠══════════════════════════════════════════════════════════════════════════╣
║  HARDWARE GENERATION (decide firmware — Vol 2, 6)                           ║
║    V1  DP32G030   (older, smallest flash)  → egzumer v0.22 / F4HWN v4.3 /   ║
║                                               VUURWERK v1.5.0               ║
║    V2  PY32F030   (transitional)           → fork's V2 asset only           ║
║    V3  PY32F071   (current, most flash)    → F4HWN "Fusion" v5.9.0 (+UV-K1) ║
║    RULE: a binary for the WRONG gen soft-bricks (recoverable). Label radio. ║
╠══════════════════════════════════════════════════════════════════════════╣
║  FLASH (Vol 6)                                                              ║
║    1. Charge >50%.  2. Verify gen:  k5prog -p /dev/ttyUSB0 -F               ║
║    3. BACK UP EEPROM:  k5prog -p /dev/ttyUSB0 -r -b backup.raw              ║
║    4. Bootloader mode: power OFF → hold PTT → power ON → dark screen+light  ║
║    5. Flash PACKED image:  k5prog -p /dev/ttyUSB0 -F firmware.packed.bin    ║
║       (or Chromium web-flasher: Connect → pick THIS-gen build → Flash)      ║
║    6. Power-cycle → confirm boot version string == what you flashed         ║
║    UNBRICK: re-verify gen → bootloader mode → flash CORRECT image (custom   ║
║             or Quansheng stock). The bootloader is never overwritten.       ║
╠══════════════════════════════════════════════════════════════════════════╣
║  CHANNELS (Vol 7)                                                           ║
║    CHIRP-next → Download From Radio → edit grid → Upload To Radio           ║
║    Fork settings: load the fork's CHIRP module (Help → Load Module)         ║
║    Backup/restore raw:  k5prog -r / -w  (-r FIRST, always)                  ║
║    NEVER overwrite the calibration region (top of EEPROM) — per-radio only  ║
╠══════════════════════════════════════════════════════════════════════════╣
║  BUILD (Vol 8)                                                              ║
║    apt install gcc-arm-none-eabi binutils-arm-none-eabi make python3 git    ║
║    git clone <fork> ; git checkout <tag>                                    ║
║    make ENABLE_SPECTRUM=1 ENABLE_AM_FIX=1 ENABLE_FMRADIO=1 ...              ║
║    → firmware.bin (raw) + firmware.packed.bin (flash THIS one)              ║
║    Flash-budget: small V1 image can't hold every feature — overflow = trim  ║
╠══════════════════════════════════════════════════════════════════════════╣
║  BANDS (usable RX, Vol 9 §3)                                                ║
║    2 m  144–148 MHz  FM   | 70 cm 430–450 MHz FM  → design-grade (best)     ║
║    Airband 118–137 MHz AM (needs AM-fix)          → usable, strong signals  ║
║    Commercial VHF/UHF near ham bands              → good                     ║
║    FM broadcast / HF / 800 MHz+                   → poor (front-end limits) ║
╠══════════════════════════════════════════════════════════════════════════╣
║  ANTENNA (Vol 9)   stock duck = mediocre.  NA-771 (~15") = best dual-band.  ║
║                    Beware counterfeit NA-771s — VNA-check if unsure.        ║
╠══════════════════════════════════════════════════════════════════════════╣
║  LEGAL (Vol 10 §2–4)                                                        ║
║    TX only in licensed ham bands. Out-of-band TX = ILLEGAL.                 ║
║    Wide-RX unlock ≠ permission to TX. Unlicensed? RX-only.                  ║
║    Don't act on / record / retransmit protected traffic. Know your region. ║
╚══════════════════════════════════════════════════════════════════════════╝

(Exact k5prog flags per its README; fork hotkeys/menus per each fork’s README.)

10.7 A-Z glossary

Table 4 — 7. A-Z glossary

Term	Meaning
AM	Amplitude modulation; used by the aircraft (air) band. Stock UV-K5 firmware is FM-only; custom firmware adds AM RX (Vol 5).
AM-fix	A firmware workaround for the BK4819’s AGC overloading in AM mode and distorting; near-essential for usable airband AM (Vol 5, Vol 8).
Band-pass filter	Front-end filtering that passes the design bands (2 m/70 cm region) and attenuates everything else — the reason wide-RX is uneven (Vol 9 §2–§3).
BK4819	The Beken RF system-on-chip at the heart of the radio; the modifiable part the whole ecosystem unlocks (Vol 2).
Bootloader	The small, factory-programmed, un-overwritten boot region that accepts firmware over the cable; the permanent recovery path (Vol 6).
CHIRP / CHIRP-next	Open-source cross-platform channel programmer; CHIRP-next is the current Python-3 line with the UV-K5 driver (Vol 7).
CTCSS / DCS	Sub-audible tone (CTCSS) / digital (DCS) squelch codes that gate a channel’s audio to the intended group (Vol 7).
DP32G030	The V1 (first-generation) MCU; smallest flash; the classic egzumer/fagci target (Vol 2, Vol 6).
Duplex / offset	A repeater channel’s TX-vs-RX frequency split (e.g. −0.6 MHz on 2 m); a channel-plan field (Vol 7).
EEPROM	The external I²C memory holding channels, settings, and factory calibration — separate from MCU firmware flash (Vol 7 §4).
egzumer	The frozen v0.22 (2024-01-28) fork; most-installed on V1; merges OneOfEleven’s refactor + fagci’s spectrum (Vol 4, Vol 8).
F4HWN “Fusion”	Armel’s actively-maintained fork; v5.9.0 (2026-08-14) targets V3/PY32F071 + the UV-K1; last V1 build was v4.3 (Vol 4, Vol 8).
fagci	Author of the original spectrum-analyzer mod and the reverse-engineering that started the ecosystem (Vol 4, Vol 8).
Front-end	The analog diplexer + band-pass + LNA stage between antenna and SoC; bounds real-world RX regardless of firmware (Vol 9 §2).
Generation (V1/V2/V3)	The three firmware-incompatible hardware revisions, distinguished by MCU; the central flashing concern (Vol 2, Vol 6).
Intermodulation	Spurious “phantom” signals created when strong off-band transmitters mix in the front-end; worse with wide-RX (Vol 9 §3).
k5prog	sq5bpf’s command-line tool for flashing firmware (-F) and reading/writing the EEPROM (-r/-w) over the serial cable (Vol 6, Vol 7).
LNA	Low-noise amplifier in the front-end; sets sensitivity (Vol 9 §2).
MCU	The ARM Cortex-M0+-class microcontroller that runs the firmware; its type (DP32G030/PY32F030/PY32F071) defines the generation (Vol 2).
NFM	Narrow FM; reduced-deviation FM used on many commercial/amateur channels (Vol 7).
Packed image	firmware.packed.bin — the obfuscated, version-stamped image the bootloader accepts; distinct from the raw firmware.bin (Vol 6 §2, Vol 8).
PY32F030 / PY32F071	The V2 and V3 MCUs (Puya); PY32F071 is the current, largest-flash target (Vol 2, Vol 6).
PTT	Push-to-talk; also the key held at power-on to enter bootloader/flash mode (Vol 6 §5).
RX / TX	Receive / transmit. RX is comparatively permissive; TX is licence- and region-gated (Vol 10 §2–§4).
SMA	The antenna connector standard; the radio body is SMA-female, antennas SMA-male (Vol 9 §4).
Soft-brick	A radio that won’t boot after a bad flash but still enters bootloader mode — recoverable by re-flashing (Vol 6 §8).
SSB	Single-sideband; an efficient voice mode some forks add as RX (flash-budget permitting) (Vol 5, Vol 8).
Spectrum analyzer (mod)	The firmware’s on-screen frequency-sweep view; crude triage, not an SDR waterfall (Vol 5, Vol 9).
VFO	Variable-frequency-oscillator mode — tuning a frequency directly vs recalling a stored channel (Vol 7).
VUURWERK	A V1 fork; v1.5.0 (2026-07-04) (Vol 4).
Web-flasher	A browser (Web Serial, Chromium-based) firmware flasher; the no-install alternative to k5prog (Vol 6 §7).
Wide-RX unlock	A firmware option extending the tunable RX range; a tuning unlock only, bounded by the front-end and never a TX authorisation (Vol 5, Vol 9 §3, Vol 10 §3).

This closes the 10-volume dive. See Volume 1 for the overview and decision tree, Volume 3 for the supported-radios-and-firmware table, and the peer Scanners project for amateur-radio operation and digital-mode scanning depth.