Hak5: Reverse Engineering Radio Protocols with SDR and the Yardstick One

Over on YouTube the popular security and hacking themed channel Hak5 have created two videos together with Mike Ossmann (creator of the HackRF and Yardstick One) that give a good introduction and overview on reverse engineering unknown radio protocols. In the video they show how to use a SDR like the RTL-SDR or HackRF to initially capture the radio signal, and then how to use the Yardstick One to reverse engineer and recreate the signal. Using this process they reverse engineer the radio protocol for a wireless liquor cabinet lock.

The Yardstick One is a computer controlled wireless transceiver (but it is not an SDR). The Yardstick One understands many radio protocols by default and can be programmed in Python, lowering the learning barrier for reverse engineering signals.

Mike Ossmann has also been slowly releasing very detailed video tutorials about DSP and radio related topics. If you are interested in reverse engineering radio signals it is a very helpful series to watch.

Using the RTL-SDR as a Panadapter for a Kenwood TS-570D

Over on YouTube user SA6 HAM has uploaded a video showing how to modify a Kenwood TS-570D so that an RTL-SDR dongle can be connected to its first IF stage in order to create a low cost panadapter. A panadapter is a device that allows you to visually view RF signals with an FFT or waterfall display on a regular analogue hardware radio. Some radios have IF output ports on the case, but older radios tend to need internal modification to expose the IF as a port.

In the video SA6 HAM opens up his Kenwood TS-570D radio and shows exactly where to connect the RTL-SDR dongle’s antenna connector on the inside.

ARM Radio: A Cheap SDR built out of an ARM Processor and not much more

A software defined radio can theoretically be made out of little more than a microprocessor with an onboard ADC and some DSP code. This is exactly what Alberto di Bene (I2PHD) achieved by connecting an antenna directly to the on board 12-bit ADC on a STM32F429 Discovery board.

To make it actually work as an SDR he also wrote some code to utilize the development board’s ARM processor which processes the ADC input into a radio signal, demodulates it and then turns it into audio via the boards DAC and speaker. The radio can tune from DC up till about 8 kHz.

The only real extra hardware in Alberto’s system is a low pass filter for anti-aliasing and impedance transformation, and a reconstruction filter to get sound to the speakers from the DAC. He also used the boards LCD screen to implement a full GUI tuning system.

A PDF document detailing his work can be downloaded here.

ARM Radio and its GUI interface.
ARM Radio and its GUI interface.
The ARM Radio with the low pass filter and reconstruction filter shown.
The ARM Radio with the low pass filter and reconstruction filter shown.

Raspberry Pi Docker Images for ADS-B and ACARS with the RTL-SDR

Docker is a Linux based platform which allows you to build and deploy complex applications into a self contained “container” package that contains all the needed applications and dependencies. The container is completely preconfigured to just work as soon as you install the application without the need for any extra configuration.

Over on his blog SysRun has been developing an ADS-B ready docker image for use with the RTL-SDR on a Raspberry Pi embedded computer. His post shows how he prepared and built the docker image on the Pi and how to run the docker image.

In addition he has also uploaded another post showing how to prepare, build and run an ACARS decoding based docker image on the Raspberry Pi.

In the future SysRun also hopes to upload an AIS Docker tutorial.

Raspberry Pi + Docker + RTL-SDR
Raspberry Pi + Docker + RTL-SDR

SDR Presentations Requested for FOSDEM

The Free and Open Source Developers Meeting (FOSDEM) is looking for SDR presentations to give at this years conference in Brussels, Belgium which will be held on January the 80th & 31st of January.

Software Radio has become an important tool to allow anyone access the EM spectrum. Using free software radio libraries and applications and cheap hardware, anyone can now start hacking on wireless communications, remote sensing, radar or other applications. At FOSDEM, we hope to network all these projects and improve collaboration, bring new ideas forward and get more people involved.

The track’s web site resides at: http://gnuradio.org/redmine/projects/gnuradio/wiki/FOSDEM

Here, we will publish updates and announcements. The final schedule will be available through Pentabarf and the official FOSDEM website.

To suggest a talk, go to https://penta.fosdem.org/submission/FOSDEM16 and follow the instructions (you need an account, but can use your account from last year if you have one). You need to create an ‘Event'; make sure it’s in the Software Defined Radio track! Lengths aren’t fixed, but give a realistic estimate and please don’t exceed 30 minutes unless you have something special planned (in that case, contact one of us). Also, don’t forget to include time for Q&A. Typical slot lengths would be 30 Minutes including QA.

You aren’t limited to slide presentations, of course. Be creative. However, FOSDEM is an open source conference, therefore we ask you to stay clear of marketing presentations. Of course, we like nitty-gritty technical stuff.

We will reserve time for interactiveness, it won’t all be talks.

If you are qualified and interested in giving a talk the submission deadline is December 4th 2015.


SpyVerter Upconverter now for sale

The team behind the Airspy software defined radio (as well has the popular SDR# software package) have just released the SpyVerter upconverter for sale. Upconverters shift HF frequencies (0 – 30 MHz) “up” by a fixed amount, giving receivers that can’t tune that low like the RTL-SDR and the Airspy the ability to receive HF signals.

The SpyVerter extends reception all the way down to DC and has a 60 MHz low pass filter. Its main selling point is its H-Mode architecture which provides excellent IIP3 performance. This basically means that strong HF signals are unlikely to cause overloading in the up-conversion stage. The good IIP3 performance should improve HF reception when compared to other upconverters even with lower end SDR’s like the RTL-SDR. The reason is that when hit by strong HF signals many other upconverters will overload in the upconversion mixing stage, before even reaching the SDR, thus requiring the need for attenuators or antennas with less gain.

Another selling point is its good performance down to DC, making it ideal for VLF reception.

SpyVerter is designed for optimal performance with the Airspy and can be powered directly by the Airspy’s bias tee. However, RTL-SDR users can also use the SpyVerter by powering it through the micro USB connector, or by using it with one of our RTL-SDR Blog units with the activatable bias tee. 

The SpyVerter sells for $59 USD and comes in a metal enclosure with three bonus SMA adapters. There is a $9 USD discount for Airspy owners.

At these prices combined with its claimed performance and metal enclosure we now generally recommend the SpyVerter over any other upconverter. The designers of the SpyVerter have sent us a sample unit and we will review it after testing it out over the next few weeks, but our initial tests already show good performance.

The SpyVerter upconverter.
The SpyVerter upconverter.

Using the GPIO Ports on the RTL2832U Chip

The RTL-SDR uses the RTL2832U chip as its ADC and USB interface processing chip. It also has 8 GPIO (General Purpose IO) ports available which are by default unused by the original DVB-T dongle application. However, which the right modifications to the SDR drivers, these GPIO ports can be activated and potentially used for applications such as antenna, filter, pre-amplifier and attenuator switching.

Over on his web site S57UUU has been experimenting with these GPIO ports and has put up a short tutorial/set of notes on how to connect to the ports and how to modify the RTL-SDR drivers to set the state of each pin. You will need basic programming and compilation knowledge to understand how to activate these pins in the drivers, as well as good surface mount soldering skills to be able to connect wires to the pins.

Connecting to the GPIO ports requires good SMT soldering skills.
Connecting to the GPIO ports requires good SMT soldering skills.

Using an RTL-SDR and Broadcast FM Radio RDS Signals to improve WiFi Networking

The performance of WiFi networks can depend heavily on how crowded the WiFi channels are in your area. For example when your neighbours start streaming a movie over their own separate WiFi network, it can cause your own WiFi connection to slow down. This happens because generally separate WiFi networks do not collaborate with one another, and when two packets are sent on the same channel at the same time, they collide causing no packets to get through.

There are several methods that attempt to stop collisions, but none are very efficient because WiFi nodes are not synchronized to one another. If each WiFi node could be synchronized to a common reference time, then avoiding collisions is made easier.

Marcel Flores, Uri Klarman, and Aleksandar Kuzmanovic from Northwestern University have been working on this idea and have come up with a system they have termed Wi-FM which is based on FM RDS signals. Many FM radio stations transmit a digital Radio Data System (RDS) subcarrier on their broadcast frequency. This RDS signal is often used to simply display information on the radio such as the station name and current song playing.

Since each nearby WiFi node should be able to receive the same RDS signal at the exact same time, it can be used as a common synchronization signal. Then once synchronized each WiFi node can listen to the other nodes and work out what their transmit scheduling is like and then optimize their own transmit schedule.

In their prototyping they used an RTL-SDR dongle connected to a PC running GNU Radio. The GNU Radio program decodes the RDS signal and the resulting information is sent to the Linux kernel which handles the WiFi transmit schedule processing.

This story was also covered on Hackaday.

WiFM radio processing path.
WiFM radio processing path.