Messaging & mapping

BSS Protocol Support

Support for the proprietary short-message binary protocol from Baofeng / BTech — reverse-engineered and documented so HTCommander can decode messages, locations and requests from stock radios.

← All features

Two protocols, one app

HTCommander speaks both APRS and BSS. APRS is well documented, but BSS appears to be an undocumented proprietary protocol used by Baofeng / BTech radios. HTCommander includes an early, working effort to decode it so messages, locations and requests from stock radios show up alongside everything else.

How the wire format works

BSS is a simple length-encoded binary protocol carried in an AFSK frame. It always begins with 0x01, which makes it easy to tell apart from AX.25 frames. After that comes a series of length / type / data elements.

A typical packet looks like this:

0107204B4B37565A540121062468656C6C6F072514C72DC7CDF1

It decodes byte-by-byte as:

01                 // BSS protocol indicator
0720 4B4B37565A54  // Len 0x07, Type 0x20 (From), "KK7VZT"
0121               // Len 0x01, Type 0x21 (To), ""
0624 68656C6C6F    // Len 0x06, Type 0x24 (Message), "hello"
0725 xxxxxxxxxxxx  // Len 0x07, Type 0x25 (Location), Lat + Lng

That's a text message with a location where the "To" field is blank (which happens occasionally, though it's usually absent entirely). There's one exception to the encoding: if the length field is 0x85, the next two bytes are a message counter. The counter lets a receiver ignore a duplicate of the same message, and is typically used with requests such as asking for a location or a ring.

Known data types

TypeNameMeaning
0x20CallsignSource of the message, e.g. N0CALL or N0CALL-0
0x21DestinationMessage destination callsign
0x24MessageA UTF-8 encoded message
0x25LocationSender's position (latitude, longitude, altitude, speed, heading)
0x27LocationRequestRequests the location of a given station
0x28CallRequestRings the requested station, like a phone call
0x85Message counterLength marker followed by a 2-byte counter

A location element (0x25) is followed by latitude and longitude, and optionally altitude, speed and heading. A ring request (0x28) makes the target radio beep, a little like an incoming phone call.


Available on all platforms: Windows, macOS, Linux, iOS, Android and web.

← All features View source on GitHub →