Over on the Reddit discussion boards user gat3way has posted about his newly released software project called swscan. Swscan is a Linux console based program that can be used to scan and listen to shortwave broadcast stations. It has a built in database of shortwave station frequencies as well as their broadcast schedules and it will even show you the stations power level and distance you are from the transmitter. Swscan is based on GNU Radio 3.7, so you will need to have that installed first.
As shortwave stations exist at frequencies below the normal tuning range of the RTL-SDR, you will need an upconverter or be using the latest R820T experimental driver which can tune down to around 1 MHz.
There is a war going on between game console designers and the console modding community. Modders hack the console system so that they can jailbreak it and then install their own custom firmware while console designers are constantly finding new ways to prevent unauthorized modding. Custom firmware allows a console to run homebrew applications like media players and emulators that use the console in ways that is was not intended to be used in.
One PlayStation 3 modder has recently been using an RTL-SDR to help jailbreak a PlayStation 3 Super Slim (4K) console, whose current official firmware appears to not yet have been jailbroken. It’s important to note that so far no actual jailbreaking has been done with this method, but the modder is currently working on it. His idea is to receive leaked RF signals from the PS3 and then use methods similar to Acoustic Cryptoanalysis to decode the data and find out what opcode operations the processors are performing. The modder writes about his method in the following.
My idea was to hook up a rtl-sdr device to the PS3 4k between chassis and real ground (yes, I actually have a two meter copper rod buried in my lawn) using the antenna leads. First I had to make sure the PS3 4k chassis wasn’t grounded in the outlet, and that no video out or USB connector was hooked up to ground indirectly via other hardware. If you want to try this, make sure that the rtl-sdr antenna leads are the only lead between the PS3 mobo/chassis and real ground. Before connecting the rtl-sdr antenna leads I measured the voltage on the PS3 chassis which peaked at around 1.8V which was safe enough, didn’t want to blow it up on the first try.
This method will effectively turn your console into an “active antenna” leaking all kind of interesting data on the rtl-sdrfrequency spectrum (between 24 – 1766 MHz). After hooking it up, I started using gqrx on my laptop to look for signal peaks while the PS3 4k was turned on, after finding a peak I just powered off the PS3 completely and turned it back on, using the waterfall plot you’ve seen in my first post I can see if there is something interesting happening during boot and verify that the signal is indeed coming from the PS3. In a similar way I learned to distinguish between the PS3 BD drive, GPU and CPU which pops up at different frequencies. Then I dumped the data (I/Q recording) that looked interesting and made a note of the frequency.
It’s hard to describe the incredible feeling when you tune into a good signal and start watching the waterfall plot revealing opcodes, register bits and what might be stack contents. The Acoustic Cryptoanalysis paper (PDF) has a lot of good info how to interpret the output from various window functions in the plot.
What I’m coding right now is a gnuradio-companion block which will filter and test the dumped data for decryption keys against encrypted PS3 data.
The military air communications monitoring enthusiasts over at milaircomms.com have been using a system involving RTL-SDRs to monitor military air traffic through ADS-B. While military aircraft generally do not transmit GPS position information like commercial aircraft do, they are still able to record live information such as the aircraft’s hex code, registration number, aircraft type, the base station location and a graph of recorded altitudes. They also log all this data showing where military aircraft have been spotted over time.
To receive this information they so far have a network of about 30 volunteers running RTL-SDR based ground stations that use their custom MilAirComms1090 software. If you want to contribute, the software is available for Windows and for Linux/Raspberry Pi.
Wireless wall outlets are electrical outlets that can be turned on or off by a wireless remote. Fabien is an experimenter who was looking for a way to control the power of his home devices from a remote location using HTTP. He thought of building his own from scratch, but quickly realized that the device would need to be certified for insurance purposes. Instead he bought a cheap commercially made certified wireless wall outlet and reverse engineered the protocol using an RTL-SDR.
To do that he used the existing OOK-Decoder software available on GitHub. From the analysis provided by OOK-Decoder, Fabien was able to successfully reimplement the transmission using an AVR microcontroller and 433 MHz transceiver circuit from Sparkfun.
Back in June we posted about DE8MSH’s rtl_power based heatmap viewer which was automatically generated every day from a Raspberry Pi. The browser based heatmap display provides a way to view the frequency and time of where the mouse pointer is allowing you to easily identify signals.
To do this he set up a laptop in his car with RTLSDR-Scanner installed and connected his RTL-SDR with stock antenna and a GPS receiver. After driving around for only 15 minutes he was able to get a triangulation heat map of reasonable accuracy.
Radio-Sky Spectrograph displays a waterfall spectrum. It is not so different from other programs that produce these displays except that it saves the spectra at a manageable data rate and provides channel widths that are consistent with many natural radio signal bandwidths. For terrestrial , solar flare, Jupiter decametric, or emission/absorption observations you might want to use RSS.
Radio-SkyPipe is a souped-up strip chart program which plots signal strength over time. When getting its data from RTL Bridge, RSP is plotting the total power in the spectrum covered by the RTL receiver centered around its set frequency. While the raw values are proportional to power, you will have to apply a function via the RSP Equations feature to apply a calibration if you want absolute values. For signals that do not have significant spectral structure of interest, this would be the preferred way to plot the data.