Category: Applications

Reverse Engineering Radio Controlled Power Outlets with Help from the RTL-SDR

Radio controlled electricity power outlets are outlets that can be turned on or off using a wireless radio controlled remote. Over on the blog leetupload.com the author has written an article showing how he was able to reverse engineer the wireless power outlets radio protocol.

The author used an RTL-SDR and SDR# to listen to the outlets wireless AM transmissions at 434 MHz. He then recorded the signal audio and then used audacity to view the waveform. By analyzing the audio output he discovered that the signal was a Non-Return-To-Zero (NRZ), pulse width modulated (PWM), Amplitude Shift Keying / On Off Keying (ASK/OOK) signal.

Later he was also able to use the RFCat USB dongle to transmit an on off signal from his computer. RFCat is an USB dongle that is capable of transmitting on 433 MHz.

RTL-SDR Software Radio used to Reverse Engineer the Wireless Power Outlet
RTL-SDR RTL2832U Software Radio Audio output Analyzed in Audacity for Reverse Engineering a Wireless Power Outlet
Remote Control Outlet Replay With RFCat

Source Hackaday

Decoding APRS with SDR#, APRSISCE32 and an RTL-SDR

Over on YouTube user k2nccvids has posted a video showing how he was able to decode APRS signals and plot them on a map using APRSISCE32. APRSISCE32 is an advanced Automatic Packet Reporting System (APRS) decoder which has mapping capabilities and can also connect to the internet as an iGate.

APRS is used by amateur radio hobbyists to send data like messages, announcements and also GPS coordinates.

Decoding APRS using SDR#, APRSIS32, RTL-SDR

Real Time GPS Positioning with the BladeRF

Over on YouTube user taroz1461 shows real time GPS positioning done in software using a BladeRF. The BladeRF is a ~$400 software defined radio which similar specs to the HackRF and compared to the RTL-SDR is capable of receiving much larger bandwidths and transmitting.

To do this decoding he used RTKLIB and his own GNSS-SDRLIB software which is a Windows GUI program. We aren’t sure if this software will work with the RTL-SDR, but we note that other people have had success with GPS positioning and the RTL-SDR.

Real-time GPS positioning with bladeRF

Controlling a Remote Control Car with the HackRF

On YouTube user 王康 has been working with his HackRF One to create a computer keyboard controlled interface for his remote control car. The HackRF is a ~$300 software defined radio similar to the RTL-SDR, but with transmit capabilities.

To control the car he wrote a GNU Radio program to generate a control signal that is transmitted by the HackRF and a GUI to listen to keyboard presses on the PC.

HackRF One with gr-remotecar

TVSharp Updated to Version 1.2

The PAL/NTSC analogue TV viewer TVSharp has recently been updated to version 1.2. This new version features an updated GUI as well as automatic frequency correction and automatic position correction. This may correct some of the scrolling and slanting problems seen in previous versions.

The latest TVSharp can be downloaded from here.

Word of warning: Chrome recognizes the download as malicious, however I have downloaded the file using FireFox and scanned it with Microsoft Security Essentials which found it to be clean.

TVSharp v1.2
TVSharp v1.2

Receiving VDL Mode 2 with MultiPSK and the RTL-SDR

The VHF Data Link mode 2 (VDL2) is a new transmission mode used on aircraft for sending short messages, position data (similar to ADS-B) and also for allowing traffic controllers to communicate to pilots via text and data. VDL2 is intended to eventually replace the standard ACARS modes. It is found at 136.975 MHz.

Recently, a wiki page explaining how to decode VDL2 using MultiPSK, Planeplotter and the RTL-SDR has been put up. MultiPSK is a sophisticated software program that can decode a wide range of amateur radio digital signals as well as several professional modes like VDL2. To decode most professional modes like VDL2 however, the paid version of MultiPSK is required, but a 5 minute per use trial of VDL2 decoding can be used for testing. Newer versions of MultiPSK can now even directly connect to the RTL-SDR dongle.

The wiki page shows how to set up the RTL-SDR dongle on MultiPSK to receive VDL2 signals, and then shows how to connect it to PlanePlotter in order to plot the aircraft positions on a map.

MultiPSK with VDL2
MultiPSK with VDL2
PlanePlotter with VDL2 Data
PlanePlotter with VDL2 Data

Transmitting DVB-T with the BladeRF and Receiving it on a RTL-SDR

The BladeRF is a software defined radio that has transmit and receive capability. Over on his blog, Clayton Smith has recently posted about his experiments which involve using the BladeRF to transmit DVB-T digital TV on one laptop to another laptop running an RTL-SDR in DVB-T mode. This is one of the few applications where the RTL-SDR is used as a DVB-T receiver as it was originally intended. Clayton used GNU Radio, a DVB-T package for GNU Radio and some python scripts to create the BladeRF transmitter.

The newer Linux kernels have DVB-T support for the RTL2832U chip, so the latest version of Ubuntu 13.10 will be able to recognize the RTL-SDR stick as a DVB-T receiver easily. Clayton used VLC in Ubuntu 13.10 to receive the DVB-T signal transmitted by the BladeRF which was tested on the 70cm, 33cm and 23cm bands.

DVB-T Received by the RTL-SDR
Webcam DVB-T TX by a BladeRF and RX by the RTL-SDR

RTL-SDR Wrapper for Max/MSP

Max/MSP is a graphical programming tool for creating music, sound, video and interactive graphics applications. YouTube user Tom Zicarelli has recently posted a video showing his test of a Max wrapper for rtl_fm, allowing an FM audio stream to be received and controlled in Max. Tom is also working on an RTL-SDR wrapper for PureData, another visual programming language aimed at artists. These wrappers will be useful for artists who wish to utilize RF in their projects.

Video Tutorial: Hak5 on Decoding RDS with GNU Radio and GR-RDS

Hak5 has recently posted another video continuing their easy to follow series on GNU Radio and the RTL-SDR. In this video they talk about Radio Data System (RDS) and explain how it is a digital signal that is embedded in broadcast FM signals. They then download GR-RDS, a GNU Radio based RDS decoder program and use it to decode a local RDS signal.

Decoding Digital Subcarriers with a SDR, Hak5 1602

Analyzing TD-LTE with the RTL-SDR

TD-LTE is a mobile phone standard acronym for Time Division Long Term Evolution. It is one of two variants of LTE technology, with the other being FD-LTE (Frequency Division LTE).

Over in China where TD-LTE is commonly used, Jiao Xianjun discovered that the current LTE-Cell-Scanner Linux program did not support TD-LTE, so he made a fork which does support TD-LTE. LTE-Cell-Scanner is a program which can decode LTE cell tower data which contains information like the cell ID, transmit frequency and transmit strength. With his modified LTE-Cell-Scanner, some MATLAB scripts he wrote and an RTL-SDR, Jiao was able to decode the cell information from 10 TD-LTE signals and 2 FD-LTE signals. He has uploaded a video showing this too.

TD-LTE, LTE FDD, scanning/demodulation results in Beijing, China