Blindly Reverse Engineering a Wireless Protocol

Hackaday has brought to attention a document written by a Rory O’Hare which discusses the journey Rory took in trying a decode an unknown 433 MHz signal received from his SDR dongle.

If you are interested in manually decoding some unknown signals you may be interested in this write up as it discusses his entire journey including the failures he encountered along the way. Basically he records some packets using his SDR dongle, works out their bit patterns manually and then attempts to find correlations between the packets in an attempt to discover their structure. In the end his efforts are successful as he discovers that he is receiving a temperature sensor and is able to decode the temperature readings.

Discovering Correlations in the Received Packets
Discovering Correlations in the Received Packets

Hak5: Autonomous Boats, Hacker Printers And RTL-SDR Plugins

This week on the popular YouTube show Hak5, SDRSharp plugins are discussed once more amongst other topics. This time at around the 17 minute mark, Shannon discusses how to install plugins that do not have automated installers. For an example she shows how to install the Level Meter plugin.

Autonomous Boats, Hacker Printers And RTL-SDR Plugins, Hak5 1623

Decoding NXDN using DSD+ and an RTL-SDR

Over on YouTube user John Miller has uploaded a video showing an example of DSD+ decoding an NXDN96 voice signal. NXDN is a digital voice protocol by developed by Kenwood that is often used by public safety organizations.

John uses SDR# to receive the NXDN signal and then pipes the audio to DSD+ using Virtual Audio Cable for decoding.

DSD+ Decoding NXDN

Simulating Estimote’s iBeacon using a HackRF

Over on YouTube user Jiao Xianjun has uploaded a video showing a HackRF simulating an Estimote iBeacon which is being received by an iPhone. An Estimote iBeacon is a wireless beacon that uses Bluetooth Low Energy (BLE) and can be use to notify nearby mobile devices of the beacons presence. This can be used for many things like indoor positioning or by retail shops to for example alert owners of special coupons.

Jiao used this tutorial to help clone an iBeacon on his HackRF.

hackrf tx to simulate Estimote' iBeacon, and detected by iPhone successfully

Fundraising for RTL-SDR Development

Kyle Keen, the primary author of the well known and highly used rtl_fm, rtl_power, rtl_adsb and recently released rtl_sdl tools has started an indiegogo fundraiser to help raise funds to pay salary for ideally at least one month of dedicated RTL-SDR software coding. Kyle is hoping for $3,000 USD per month of coding. The time he codes for will scale proportionally to the amount of funds raised.

There are several levels to contribute at but the ideal contribution is the ‘Voter’ level at $50 USD. By contributing to the fundraiser at the ‘Voter’ level you will be able to have a vote on what features are to prioritized. It is also possible to contribute at a lower level of $10 USD and forego the voting perk.

The list of features to be implemented and the voting system can be found at igg.kmkeen.com. Important improvements will be made to the librtlsdr library, rtl_sdl, rtl_adsb, rtl_tcp, rtl_power and rtl_fm..

We hope that if you have enjoyed the RTL-SDR in some form you will contribute to this developer and help make this hobby an overall better experience.

Using RTL-SDR in Cognitive Radio Energy Detector MATLAB Experiments

Over on YouTube user Guilherme Dattoli Cirigliano Cortes has uploaded a video showing his use of the RTL-SDR in some MATLAB based cognitive radio experiments. Cognitive radio is a upcoming technology which aims to increase radio spectrum use efficiency by finding and using the intermittent periods of unoccupied frequency space.

The uploader explains his task below.

The fundamental task of each Cognitive Radio (CR) user in CR networks, in the most primitive sense is to detect the licenced users, also known as primary users, if they are present and identify the available spectrum if they are absent. This is usually achieved by sensing the RF environment, a process called spectrum sensing. Here we use one of the technique of spectrum sensing called energy detection.

Energy Detector with Matlab/Simulink and RTL-SDR

Hak5: The NSA Playset and SDRSharp Plugins

Hak5 a popular YouTube hacking and electronics enthusiast channel has uploaded a new video interviewing Micheal Ossman, the creator of the HackRF about the NSA’s ‘Playset’. The NSA playset describes the set of tools the NSA has access to for spying which was leaked by the documents released by Edward Snowden. Previously we posted how the HackRF was used to help reverse engineer some NSA spy tools called retro reflectors.

In the second part of the episode presenter Shannon also shows off the SDRSharp frequency manager and scanner plugin that can be used with the RTL-SDR.

The NSA Playset and SDRSharp Plugins, Hak5 1622

Assembling the Chinese RTL-SDR Direct Sampling Kit

A few months ago we posted about a Chinese individual who had begun selling RTL-SDR dongle kits for receiving HF frequencies. Back then it wasn’t entirely clear what these kits where. Now over on Reddit, poster SidJenkins has bought one of these kits and assembled it. He has uploaded images of the construction which can be found here and the Reddit discussion can be found here. The kit is essentially an RTL-SDR extension PCB board that aids in building a direct sampling RTL-SDR with good performance by including filters and impedance matching.

SidJenkins notes that the kit came with no instructions, so he used this thread in Chinese (use Google translate) to help put the kit together.

Chinese RTL-SDR Kit
Chinese RTL-SDR Kit

Rebooting the ISEE-3 with USRP Software Defined Radios

The ISEE-3 is a exploratory spacecraft that was launched in 1978 and placed in an orbit around the sun. It was mission was to study the interaction between solar wind and the earth’s magnetic field and was later the first spacecraft to pass through the tail of a comet. NASA suspended communications with the spacecraft in 1997 and it was last heard of in 2008.

Recently there has been interest in rebooting the spacecraft and bringing it back into an earth orbit. Once safely in orbit the spacecraft’s science instruments would be made publicly available for educational purposes. Unfortunately, the RF communications hardware and knowledge that was used to interface with the spacecraft has long been lost.

Luckily, the scientists and engineers at Ettus were able to devise a plan that would use the world’s largest single dish radio telescope at Arecibo connected to some of their USRP N210 SDR radios to contact the probe. The USRP N210 is an advanced software defined radio that sells for around $1700 USD. Using their setup together with GNU Radio and the spacecraft’s documentation from NASA they were able to make contact with the spacecraft and fire the thrusters. They have yet to actually correct the trajectory which will bring it back to earth, but they hope to be able to do that soon.

The ISEE-3
The ISEE-3
USRP at the Arecibo Dish
USRP at the Arecibo Dish

Low Cost Hydrogen Line Telescope using the RTL-SDR

Amateur radio astronomer Y1PWE has uploaded a pdf document describing how he created a low cost hydrogen line telescope using an RTL-SDR dongle. Hydrogen atoms randomly emit photons at a wavelength of 21cm (1420.4058 MHz). Normally a single hydrogen atom will rarely emit a photon, but since space and the galaxy is filled with many hydrogen atoms the average effect is an observable RF power spike at 1420.4058 MHz. By pointing a radio telescope at the night sky, a power spike indicating the hydrogen line can be observed in a frequency spectrum plot.

Y1PWE created a radio telescope using a quad 22 element yagi antenna, several LNA’s and filters and an RTL-SDR dongle and laptop. Using this setup he can capture some raw IQ data from the RTL-SDR and then use an FFT averaging program to produce some plots. In his plots the hydrogen line is clearly visible.

Radio Telescope Overview
Radio Telescope Overview

Hydrogen Line Plots
Hydrogen Line Plots

Quad Yagi Array
Quad Yagi Array