Off the Map
The latest expedition into my Uniden SDS150 was a cartography job: open every screen behind the MENU key and write down what it holds, working from the radio itself rather than the owner’s manual, so that anything the radio draws gets recorded even when Uniden’s own reference skips it. The finished map is menu-tree.md, every screen with its entries, where each one leads, and whether I actually opened it. The walk was strictly read-only: E/YES to go in, MENU to back out, and never E/YES on a value or on an entry that acts the moment it’s chosen. That discipline works because of how the firmware commits. The write happens on E/YES and MENU discards, which I checked by moving highlights, backing out, and reading the settings again. When it was over, the radio was verified back to where it started: scanning, volume, squelch, location, favorites and priority all unchanged.
I expected to come back with a tree. I came back with a tree full of holes, and the holes are the story: twelve entries the radio draws on its glass that its own protocol insists do not exist.
The protocol answers in three shapes
The scanner’s MSI command describes the menu the radio is showing: the screen’s title, a numeric id, its type, and the list of items on it. Ask it about most screens and you get all of that, untruncated and complete. Ask it about certain screens and you get the second shape, a refusal carrying no name, no id, no items, and one fixed sentence:
The scanner is in state that you can’t remote control. Please goto scan mode to remote control.
The protocol labels that shape TypeError, and the label is wrong twice over. Nothing has gone wrong, and on most of these screens nothing is even being refused: the radio draws them perfectly well, takes key presses, navigates in and out. The firmware is declaring them outside the part of the menu system it will describe or drive remotely. The third shape is emptier still. A handful of readout screens answer with a blank document, no identity, no error, no explanation, and the only thing identifying them is what they draw.
The rule hiding in the holes
An entry missing from its parent’s item list turned out to be the same fact seen from the other side. Bottom line: MSI omits the entries whose screens it will not describe, and nothing else: twelve of them across the tree, and the rule never failed once. These screens are not missing from the radio; they are off the map on purpose, and you can even see the hole in the numbering, because the root menu’s item indices skip from 7 to 9 around Analyze, which is drawn on screen at index 8. Ten of the twelve I opened and confirmed. Two I left alone, because choosing them does something. The worst case is the weather menu, where three of the seven entries on the glass are invisible to the protocol, and the cost is not trivia: the entire band plan table and the whole display customization menu, the one behind every layout in screen-map.md, are undescribable. Customize is unreachable from the wire in both directions, since the command set has no menu id for jumping to it either.
Where MSI does agree to answer, it answers better than the display, full names where the screen truncates and true counts where the screen windows, and the refusal, badly named as it is, comes back identical every single time. A machine that says no the same way every time is a machine you can map, and that consistency is to its credit.
The industry has walked off the edge of official documentation before. Undocumented DOS, the 1990 book by Andrew Schulman and company, mapped the interfaces Microsoft’s manuals left out by interrogating the running system, and Ralf Brown’s Interrupt List spent that decade cataloging every x86 interrupt call the same way, documented or not. Those projects ran on one conviction: the documentation is a claim about the machine, and the machine outranks it.
My own tool believed the map
Standing on one of the omitted screens, my tool contradicts itself:
$ radiocli menu The scanner is not in a menu. $ radiocli screen Freq Avoids > Stop All Avoiding Rvw Search Avoid
screen is right and menu is wrong, because menu believes MSI. The radio is in a menu; the protocol has declined to describe it, and anything navigating by MSI alone will conclude these screens do not exist. So every screen in the map was read twice, once with a raw MSI for the identity and the true item list, once with STS for what is actually drawn, and every disagreement between the two is recorded in the screen’s own section. Readers of “Ask the Screen” know where this lands. The glass drew all of them correctly.
Nine rows, recounted
The first pass produced errors, and every one traces to the same cause. The display windows nine rows onto a longer list, and stepping past the end wraps to the top, so a walk that stops at the ninth row records the wrong length. That is how thirty-two tone-out slots got recorded as ten, how a ten-value delay list became nine, and how a favorites list menu lost two entries. The second pass re-walked every screen with MSI in hand and corrected each one, and the map marks every correction instead of hiding it.
Names carry the same trap: the display truncates and MSI does not, so Quick Save Favorites List draws as Quick Save Favorit. Titles carry another, because all over the tree the screen’s title is not the entry that opened it. Manage Favorites opens Select Favorites, Edit Location opens Select Location, Set Alert Light opens Set Color. And the ids read as firmware addresses, the root being 4293093020, which is 0xFFD6BFDC, stable within a session and shaped exactly like a pointer, so the tool matches screens by name and treats the numbers as scenery.
The one physical hazard: on the operating screen the knob steps channels while the radio is parked, changes volume while it’s stopped on a live transmission, and flips the scan direction while it’s stepping, so any walk driving that knob moves something no matter what. Both passes lost volume this way and had to put it back.
Souvenirs from the territory
Restore Settings, at the bottom of the customization menu, turned out to be an ordinary menu rather than an entry that acts, with a confirmation screen per layout, and it produced the check that “Ask the Screen” cited: restoring All Screens put 31 of Simple Conventional’s 40 areas back to white on black, with the name and option rows returning Orangered, matching the recorded colors exactly. That was the first confirmation that those color assignments really are the factory defaults, at least for that layout.
The search keys settle a design question. They can bind fourteen things: a lone dot, the ten Custom ranges, Tone Out, Close Call and Waterfall. No CB, no Public Safety, no Aircraft. The band-by-band service searches of Uniden’s older scanners are gone, and on an SDS the database is the product, so searching any particular band starts with defining a Custom range for it.
And the waterfall’s color editors draw bytes above 0x7E, the pictures from “Not ASCII”, which my tool’s text output passed through raw and handed downstream as invalid UTF-8. The JSON output escapes each byte and survives. My bug, found by walking.
The map is not the territory. This radio’s map denies the territory exists.