Demodulating the Outernet signal with leandvb and an RTL-SDR

Leandvb is command line based lightweight DVB-S decoder designed for receiving Digital Amateur TV, including signals like HamTV from the International Space Station. The RTL-SDR can be used together with leandvb and it turns out that leandvb can also be used to decode the Outernet signal. If you were unaware, Outernet is a free L-band based satellite service that provides content such as news, weather data, APRS repeats and more. Currently you can get about 20MB of data a day. Outernet receivers are also all based around the RTL-SDR, allowing for very cheap receivers to be built. At the moment you’ll need a C.H.I.P or their specialized Dreamcatcher hardware to run their special Skylark OS with software decoder, but a general Armbian decoder is in the works.

Alternatively leandvb can be used, and over on their website the folks behind the leandvb software have uploaded a tutorial showing how to use leandvb to decode Outernet. Thanks to some reverse engineering attempts by Daniel Estévez, it was discovered that the Outernet modulation is very similar to DVB-S so the standard decoder can be used with some custom flags. Leandvb only outputs raw frames, not decoded data. They haven’t tested it, but it may be possible to feed the frames into Daniel Estevez’s free-outernet project for obtaining the final files.

During the testing they also discovered some interesting notes about the E4000 and R820T RTL-SDRs. For example by patching the R820T2 drivers to add some additional VGA gain they were able to make the R820T2 chips more sensitive at the Outernet frequency compared to the E4000 chip by bringing the signal further out of the quantization noise. They also tested a 60cm dish vs a patch antenna and found that the dish works significantly better.

Patch vs Dish Antenna for Outernet
Patch vs Dish Antenna for Outernet

HamRadio360 Podcast: ADS-B Aircraft Tracking with an RTL-SDR

HamRadio360 is a bi-weekly podcast all about ham radio and related topics. On their June 13 podcast Nick, KK6LHR came on to discuss his experiences with decoding ADS-B with cheap SDR radio like the RTL-SDR. In the podcast they talk about the history of ADS-B, what it is, the difference between the 1090 MHz and 978 MHz frequencies, what all of the terms and acronyms mean, feeding sites like flightaware and flightradar24 and of course how to decode it with various forms of software packages.

Part of Nick's ADS-B Setup
Part of Nick’s ADS-B Setup

Outernet: Patch antenna now sold seperately + other products

Back in June we tested Outernet’s new Dreamcatcher which is an ARM based computing board with RTL-SDR and L-band LNA built in. The $99 USD kit also included an external active L-band patch antenna. The Dreamcatcher full kit has now been reduced to $89 USD, and the active L-band patch antenna can also now be purchased by itself for $29 USD. The active patch antenna is also compatible with the bias tee on our V3 dongles and is a good low cost option for exploring most L-band satellite signals like Outernet, Inmarsat STD-C and AERO around 1542 MHz. The filter does unfortunately cut off the higher Iridium frequencies though.

They are also selling off their older L-band SDRx RTL-SDR boards at a reduced price of $20 USD. The SDRx is a RTL-SDR PCB with a built in L-band LNA and filter, but unlike the Dreamcatcher does not have built in computing hardware. They also have a limited $25 USD edition version of their active patch antenna which includes a built in RTL-SDR. This version is a bit more noisy compared to the standard active patch, but may be an interesting experimental antenna for some.

Current Outernet Products
Current Outernet Products

CyberSpectrum Melbourne: Building a Cheap FSQ Transceiver with Arduino, Raspberry Pi and RTL-SDR

FSQ (Fast Simple QSO) is a relatively new ham band mode for making text QSO’s (contact or exchange of information with another ham) over HF frequencies. It is a low data rate mode similar to PSK31 but with some interesting features like relaying which allows signals to be relayed further via other FSQ stations.

Over at in Melbourne, Australia a Cyberspectrum SDR meetup is held every few weeks. At this weeks meetup @faulteh discusses the FSQ mode and some of it’s interesting features. He also shows how he can transmit FSQ using a Si5351 clock generator and Arduino (with filtering). In the future he hopes to also create a fully automated receive station using a Raspberry Pi and RTL-SDR dongle.

The Arduino FSQ code is available on GitHub, and more information is available on his hackaday.io page.

Tutorial: Replay Attacks with an RTL-SDR, Raspberry Pi and RPiTX

With an RTL-SDR dongle, Raspberry Pi, piece of wire and literally no other hardware it is possible to perform replay attacks on simple digital signals like those used in 433 MHz ISM band devices. This can be used for example to control wireless home automation devices like alarms and switches.

In this tutorial we will show you how to perform a simple capture and replay using an RTL-SDR and RPiTX.  With this method there is no need to analyze the signal, extract the data and replay using a 433 MHz transmitter. RPiTX can replay the recorded signal directly without further reverse engineering just like if you were using a TX capable SDR like a HackRF to record and TX an IQ file.

Note that we’ve only tested this replay attack with simple OOK 433 MHz devices. Devices with more complex modulation schemes may not work with this method. But the vast majority of 433 MHz ISM band devices are using simple modulation schemes that will work. Also replay attacks will not work on things like car keys, and most garage door openers as those have rolling code security.

A video demo is shown below:

Hardware used and wireless ISM band devices tested with RPiTX
Hardware used and wireless ISM band devices tested with RPiTX

RpiTX

RPiTX is open source software which allows you to turn your Raspberry Pi into a general purpose transmitter for any frequency between 5 kHz to 500 MHz. It works by using square waves to modulate a signal on the GPIO pins of the Pi. If controlled in just the right way, FM/AM/SSB or other modulations can be created. By attaching a simple wire antenna to the GPIO pin these signals become RF signals transmitted into the air.

Of course this creates an extremely noisy output which has a significant number of harmonics. So to be legal and safe you must always use bandpass filtering. Harmonics could interfere with important life critical systems (e.g. police/EMS radio, aircraft transponders etc).

For testing, a short wire antenna shouldn’t radiate much further than a few meters past the room you’re in, so in this case you should be fine without a filter. But if you ever connect up to an outdoor antenna or amplify the signal then you absolutely must use adequate filtering, or you could find yourself in huge trouble with the law. Currently there are no commercially made 433 MHz filters for RPiTX available that we know of, so you would need to make your own. Also remember that you are still only allowed to transmit in bands that you are licensed to which for most people will be the ISM bands.

In the past we’ve seen RPiTX used for things like controlling an RC car, building a home made FM repeater, creating a ham transceiver and transmitting WSPR (via a well made filter). We’ve also seen people perform replay attacks using the cleaner but harder way by reverse engineering a 433 MHz signal, and then generating the RPiTX OOK modulation manually.

Continue reading

DailyMail Article about the YARD Stick One

Back in May of this year the DailyMail ran an article discussing how the HackRF by Great Scott Gadgets could be used to break into cars. The DailyMail is a British tabloid magazine well known for its low credibility and alarmist articles. This week they ran a new article about Great Scott Gadgets other product, the Yard Stick One. In the article they discuss how the £109 Yard Stick One tool can be used to disable wireless burglar alarms. The YARD Stick One is not an SDR, but rather a computer controlled radio which can be used to transmit and receive wireless digital signals below 1 GHz. It is useful for wireless security research and reverse engineering digital signals in a way that is a bit easier than with using an SDR like the HackRF.

In the experiment performed in the article they use the YARD Stick one to jam a wireless home alarm for a few seconds allowing entry to the property without setting off the alarm. All in all the article is a good advert for the YARD Stick One, and does do a decent job at drawing attention to the lack of security provided by many wireless security devices.

DailyMail shows how a YS1 can be used to jam a wireless burglar alarm.
DailyMail shows how a YS1 can be used to jam a wireless burglar alarm.

Installing OpenWRT and RTL-SDR on a Used $20 Router

Over on his YouTube channel GusGorman402 has uploaded a video tutorial showing how to take an old internet router and install OpenWRT and the RTL-SDR drivers on it. OpenWRT is a third party Linux based router firmware which can greatly expand the usefulness of a standard router. As it is Linux based it is possible to install the RTL-SDR Linux drivers on the router and use the router as a cheap RTL-SDR streaming or decoding platform.

Gus’s tutorial takes us from the beginning where he first shows how to install OpenWRT firmware over the stock firmware on the router and how to configure the settings. He then shows how to install the RTL-SDR drivers and run software like rtl_tcp and dump1090 with opkg and luci. 

New Nano 3 RTL-SDR Available from NooElec

NooElec have just released their new NESDR Nano 3 RTL-SDR dongle for $27.95 USD. This is a new iteration in their line of ‘nano’ sized dongles, which are very small and suitable for use on small devices like Raspberry Pi’s and mobile phones. These nano form factor RTL-SDR dongles are also commonly used with the Stratux project which aims to bring lost cost ADS-B and UAT capabilities to small airplane pilots.

The Nano 3 appears to have a standard nano sized RTL-SDR PCB with TCXO inside, but comes with a new fully enclosed metal case with internal thermal coupling pads for cooling. A small external heatsink is also provided for optional use with the dongle. The dongle also uses a standard MCX connector, but the kit comes with an MCX to SMA F adapter. We’re not sure if the cooling from the small metal case will be enough to solve the L-band PLL lock problem, but perhaps when combined with the modified L-band driver tweak it might be enough. Failing that the external heatsink combined with slight airflow from a fan should be enough.

The NESDR Nano 3 small form factor RTL-SDR
The NESDR Nano 3 small form factor RTL-SDR

The previous model called the Nano 2, was also redesigned from the generic nano models for better cooling and to be able to use a TCXO. However, some tests by Chris of the Stratux project seem to show that the Nano 2 is quite a bit noisier than the cheaper generic nano dongles, and actually runs about 40 degrees F hotter. Noise is a problem with these small dongles as the noisy digital and switch mode sections are much closer to the RF sensitive parts. Heat is also an issue due to the lack of PCB space for heat dissipation. Hopefully the Nano 3 resolves these issues with the metal case and improved cooling.

There are now several generations and models of these ‘nano’ RTL-SDRs available. All briefly described below:

  1. Generic Nano Dongles:
    1. $16.99 USD + shipping costs.
    2. First nano dongles designed originally for DVB-T TV use. Difficult to find now, no longer seems to be sold apart from one US seller on eBay.
    3. Still a good choice, but the lack of TCXO limits the usefulness for many applications.
  2. NooElec Nano 2:
    1.  $21.95 USD without TCXO, $23.95 with TCXO.
    2. Slight redesign of the generic dongles for better cooling and TCXO. Although cooling and noise benefits are debated.
    3. Good choice if you like the Nano form factor and want a dongle with accurate TCXO clock.
  3. Stratux Dongle (with ADS-B/UAT Antennas):
    1. Two dongles for $40 USD with antennas, or two for $35 USD without antennas. We also wholesaled a few from them and sell them on our store for intl. buyers @ 16.95 USD each incl. shipping.
    2. Redesigned for low power usage and less noise. Uses a switch mode power supply for less power wastage, but designed to be unaffected by any additional switch mode noise. Runs about 60 degrees F cooler than the Nano 2 and 16F cooler than the generic. Does not have an enclosure so is a bit more fragile. Also does not have a TCXO.
    3. Good choice for Stratux or similar projects might struggle with the power requirements of multiple dongles on a Pi3. Doesn’t have a TCXO so mainly useful for frequency insensitive applications like ADS-B.
  4. NooElec Nano 3:
    1. $27.95 USD
    2. Redesigned enclosure with thermal pad coupling and heatsinks. Comes with TCXO.
    3. Untested by us, but we think it’s probably better than the Nano 2. So a good choice if you like the Nano form factor and want a TCXO dongle.