WaveConverter: An Open Source RF Reverse Engineering Tool

During the Schmoocon 2017 conference presenter Paul Clark introduced a new open source Linux tool called WaveConverter which he’s been working on for reverse engineering RF signals. Paul writes:

WaveConverter is a tool that helps you extract digital data from RF transmissions that have been captured via Software Defined Radio (SDR). After the user defines the modulation parameters, framing and encoding, WaveConverter will process a stored I-Q file and extract the data from any transmissions that match this definition. Using programmable timing tolerances and glitch filters, WaveConverter is able to extract data from signals that would otherwise appear corrupted.

This software will make the process of reverse engineering signals easier and more error-proof. Because WaveConverter includes the ability to store and retrieve signal protocols (modulation + encoding parameters), we have been generating a database of protocols that we can quickly use to iteratively attack unknown signals.

This tool should be very useful for reverse engineering digital signals, such as those found in keyfobs, wireless doorbells, wireless temperature sensors and any other simple RF device. Simply use an SDR device like an RTL-SDR to capture a sample of the signal of interest and then open it up in WaveConverter to first easily analyze the signal and determine it’s properties, then to automatically demodulate any subsequent signal into a binary string. For more information the documentation can be found here (pdf).

WaveConverter seems to be quite similar in purpose to Inspectrum and DSpectrum which are two Linux tools that are also designed for reverse engineering digital signals.

WaveConverter Screenshot
WaveConverter Screenshot
[First seen on Hackaday]

 

Receiving GOES Weather Satellite Images with a Small Grid Antenna and an Airspy Mini

GOES is an L-band geosynchronous weather satellite service that can be received typically with a satellite dish. It produces very nice full disk images of the earth. In the past we’ve posted about Lucas Teske’s work in building a GOES receiving system from scratch (including the software decoder for Airspy and RTL-SDR receivers), devnullings post about receiving GOES and also this talk by @usa_satcom on decoding GOES and similar satellites.

Over on Twitter @usa_satcom has been tweeting about his experiments where he has been successfully receiving GOES L-Band weather satellite images with a small grid antenna and an Airspy Mini. In a Tweet he writes that the antenna is an $85 USD Hyperlink 1.9 GHz 22 dBi Grid Antenna made by L-com. A grid antenna may be more suitable for outdoor mounting for many people as they are typically lighter, smaller and more suitable for windy and snowy conditions. As the GOES satellite is in geosynchronous orbit, no tracking motor or tracking mount is required.

An Update on the PatronX Titus II

Back in September 2016 we posted about the PatronX Titus II portable software defined radio which appears to currently be on its way to beginning production. It is a portable Android tablet based SDR, which we speculate is using similar chips to the SDRplay RSP with its 100 kHz to 2 GHz tuning range. The price goal is set to be under $100 USD.

Currently it is available for ‘pre-order’ on the HFCC website, although what they call a pre-order is actually just an expression of interest, and no payment is required.

Today over on the SWLing post blog we’ve seen an update. They write:

As you can imagine the response to Titus has almost been overwhelming! Pre-orders far exceeded our imagination and excitement from broadcasters has been very loud. DRM and digital broadcasting seems to be reinvigorated with Titus in 2017. I think we really broke the price barrier that most everyone has been dreaming of and provided the flexibility that has held back the cause.

As posted on http://hfcc.org/delivery/receivers.phtml

‘Update on availability received from PantronX: “We have been overwhelmed with the response to Titus with orders and request – coupled with an early Chinese New Year that the pre-production date has slipped a bit. Please be patient as we work with our suppliers and add more functions.” ‘

We are doing all we can to push – Chinese New Year is a crazy time – the factories are shut down for 3 to 4 weeks and as you can imagine the stress prior to and the performance after.

Hopefully in the next couple of weeks our http://titusradio.com/ website will undergo a much needed update. So much to do – but we are making good headway.

The Titus II Portable SDR
The Titus II Portable SDR

Testing a Prototype of the SDRx: A Custom Outernet L-Band RTL-SDR

Recently the Outernet team sent us a prototype of their L-Band tuned RTL-SDR which is called the SDRx for testing. This is an RTL-SDR with RTL2832U and R820T2 chips together with an L-band LNA and filter on the same PCB. It is designed for their Outernet system which transmits from geostationary L-Band satellites. 

Outernet is an L-band satellite service that hopes to be a library in the sky. Currently it is broadcasting down about 20 MB of data a day, with data like weather updates, books, pictures, wikipedia pages, APRS repeats and more.

For their DIY Outernet kit they have been using E4000 or our RTL-SDR V3 dongles, so we speculate that this SDRx is going to be used in the “Lantern” which will be their fully assembled Outernet receiver product. The Lantern looks like it will be a single unit, with patch antenna, battery pack, solar panel, RTL-SDR radio and CHIP built into a plastic enclosure.

The upcoming RTL-SDR base Lantern Outernet Receiver.
The upcoming RTL-SDR base Lantern Outernet Receiver.

The SDRx connects to the computer via a micro USB port. It also has a USB repeater and two USB expansion ports on board. This is useful as Outernet is designed to be used with the CHIP portable computer which only has one USB port. The expansion USB ports can be used for plugging in a portable hard drive which can be used as the storage for downloaded Outernet files.

We’ve been running a version of the SDRx prototype on an Outernet receiver for a number of weeks without issue. The SNR on Outernet signals is about identical to the V3 dongles combined with the external Outernet LNA and no L-band heat problems are observed.

The SDRx Prototype
The SDRx Prototype
Under the shield. SAW Filter, R820T2. LNA top left.
Under the shield. SAW Filter, R820T2. LNA top left.

Ships: New RTL-SDR Compatible Android App for AIS Reception and Plotting

Today an Android app programmer sent a message to let us know about his new open source RTL-SDR compatible AIS app called Ships.  This is a free app that allows you to decode AIS signals, and plot them directly onto an OpenStreetMap/OpenSeaMap or output the data via UDP to another mapping program.

Ships also has another interesting feature which is that it will automatically determine the PPM offset of a dongle, meaning that generic dongles without TCXO’s can be easily used for AIS. It appears to do this by using the AIS signals themselves, so you will need sufficient AIS traffic in your area for the calibration to work.

AIS stands for Automatic Identification System, and is a system used to track the locations of marine vessels. It is similar to ADS-B in that nearby ships can be plotted and tracked on a map by using an RTL-SDR as the receiver. We have a tutorial for PC available here.

The app can be downloaded for free on Google Play, and the open source code is available on GitHub.

Ships RTL-SDR Android App Screenshot
Ships RTL-SDR Android App Screenshot

The PandwaRF RF Analysis Tool

Recently we heard about the PandwaRF Portable Analyzer (previously known as the GollumRF). This is not an SDR, but can probably be described as a programmable and computer controlled radio. It appears to be based on the Yardstick One design which is made by Micheal Ossmann, the creator of the HackRF. Both the Yardstick One and PandwaRF are based on the CC1111 sub-1 GHz RF transceiver chip. These types of pseudo-sdr’s can be very useful for reverse engineerin, analyzing and experimenting with simple digital signals.

For example it could be used to capture data from any ASK/OOK/MSK/2-FSK/GFSK modulation in the 300 – 928 MHz band. You can then easily analyze the data, and the restransmit the same or a modified signal. The same could be done with a TX capable SDR like the HackRF, but doing so tends to require a lot more work.

The difference between the Yardstick One and PandwaRF appears to be mainly in the connection interface. The PandwaRF is essentially the Yardstick One with a Bluetooth LE connectivity and an Android/iOS smartphone app. USB connectivity for Linux still exists. It also has an internal battery whereas the Yardstick One does not. They wrote a post comparing the RTL-SDR, Yardstick One and PandwaRF here.

The device seems to be new, as it just starting shipping in November and the first batch is still being sold. It costs 145 euros and appears to originate from the EU. There is also a ‘mini’ version in pre-order which also costs 145 euros. In comparison the Yardstick One costs about $99 – $145 USD depending on the shop you choose.

The PandwaRF
The PandwaRF
PandwaRF Android App
PandwaRF Android App

SDR-Console V3 Preview Updated to Support the SDRplay RSP2

Recently Jon from the SDRplay team wrote in to let us know that SDR-Console V3 (preview version) has just been updated and it now supports the RSP2. The RSP2 is the successor to the popular RSP1 software defined radio. It has improved filtering, more input ports, improved LNA, and just overall improved performance. See our initial RSP2 review here. They write:

Many thanks to Simon Brown for updating SDR-Console V3 Preview to fully support both the RSP1 and the RSP2- you can download the software from http://sdr-radio.com/v3_preview_downloads (be sure to click on the software link under where it says ‘Downloads’ unless you want to download the software from the advertisers who support Simon’s work!)

As new YouTube demo videos of SDR-Console V3 in action become available, we will add them to the playlists on our YouTube Channel: www.youtube.com/c/SDRplayRSP

The RSP2 now supports its native SDRUno software, HDSDR through an extIO module, CubicSDR and now SDR-Console V3.

The RSP2
The RSP2

Cloud-SDR Releases New Client and Server Software for the RTL-SDR

Cloud-SDR is a company that aims to make using SDR over the cloud/network/internet easier. It allows you to set up a remote SDR server that you can access from anywhere. Previously Cloud-SDR was still in development, but now we recently received mail from Cloud-SDR programmer Sylvain that the client and server software has just been released for the RTL-SDR. It appears that it also currently supports the Airspy, BladeRF, SDRplay and PerseusSDR.

The email reads:

I am pleased to inform you that we have just released two softwares compatible with your devices :

  • The Cloud-SDR free client, a windows + Linux (to be released soon) client able to run locally RTL-SDR devices (check the news/turorials, we have featured several times dongles from your blog)
  • The Cloud-SDR streaming server (codenamed SDRNode) , a windows + Linux (to be released soon) multi-user configurable streaming server.

SDRNode is a commercial software but an evaluation version is already available. Both softwares can be downloaded from our store after registration.

Source code for the drivers are already released as open source software through our GitHub repo: https://github.com/cloud-sdr

You can find more details here :

The Cloud-SDR Network
The Cloud-SDR Network

To download the software you must register an account with them at https://store.cloud-sdr.com/my-account. The client is free but the server costs 110 euros for personal and hobby usage, although a 30 day trial version is available. Currently only the Windows Client and Server are available, but they write that Linux should be available soon.

We tested the software out with an RTL-SDR V3. The client installation process was a simple wizard and after installation we launched the Cloud-SDR client by opening the shortcut “cSDRc” in the Start Menu. We found that the hardware needed to be plugged in first for the client to recognize it. The client is basic, but can already demodulate USB/LSB/CW/AM/FMN without trouble. It also has some interesting features:

  1. Dual channel receiver: RXA and RXB are two totally independent receivers;
  2. Geographic integration: Display on map beacons, ADS-B reported airliners, known HF broadcast stations or any geo-localized information coming from the SDRNode server;
  3. GPS compatibility: plug a GPS receiver to your computer and track your location on the map, record signals with your position for later processing (coverage mapping etc.); display the UTC time;
  4. Digital Terrain Elevation: See the terrain elevation around your position, or in the direction of the antenna directly on the map (requires to download the free SRTM3 files from NASA, with 90m resolution);
  5. MP3 audio recording: record to mp3 the demodulated streams to reduce disk requirements;
  6. Chat with other users connected to the SDRNode Group: when used as a remote client for the SDRNode streaming server, you can interact with other users with messages or station spotting;
  7. Time-domain analysis: the MSR mode enables analysis of any sub-band and displays in real time the time domain signals of the selected spectrum portion. This sub-band can also be recorded (with geographic position if GPS is connected) and processed with provided MATLAB®.
The Cloud-SDR Client Software
The Cloud-SDR Client Software

Next we tested the evaluation version of the SDR-Node server software on a remote laptop with an RTL-SDR connected. Again installation was easy, just follow the wizard after ordering the evaluation version. SDR-Node installs itself as a Windows service which starts up automatically on boot. To set up the Node we followed the guide shown in the video below. To connect with the client you need to know the IP address of the remote computer, the port is 8080, and the certificate is displayed on the server PC SDR-Node dashboard. We note that we also had to disable the Windows firewall to get it to connect, but it should be possible to also add SDR-Node to the firewall whitelist.

https://www.youtube.com/watch?v=waRP7PIcOBc

When streaming it appears that only 1/4 of the SDR sample rate can only be sent over the network. There are also compression options which can be used on slower networks or the internet to reduce bandwidth. Using the interface while in network mode was slightly laggy, but the waterfall and audio was smooth.

Overall everything worked as expected and it looks to be a very useful tool. More information is available at cloud-sdr.com. Some already existing alternative remote SDR streaming software that supports the RTL-SDR includes rtl_tcp, the SDR Console V2 server, OpenWebRX and ShinySDR.