My method for reverse engineering this config file is very simple:
- save configuration.
- change something.
- save configuration.
- hexdump both files. compare.
- repeat
Until now I've been swapping the SD card back and forth, but silly me, I can enable USB mass storage mode in the radio and just get at things directly. So much easier.