Tagged: usrp

WarDragon Passive Radar with Blah2 and ADS-B Delay-Doppler Truth

Over on his YouTube channel, Aaron, creator of DragonOS and the WarDragon kit has uploaded a video showing the Blah2 passive radar software working with an SDRplay RSPDuo. In the video Aaron shows some setup steps before showing the passive radar range-doppler graph.

Blah2 is passive radar software that appears to be inspired by the KrakenSDR passive software that was removed for regulatory reasons. We note that it is legal for others to publish open source passive radar software, but KrakenSDR cannot legally publish their own open source passive radar software because it would be tied to their own physical product. Providing code would mean they essentially sell an off the shelf passive radar product which is restricted.

The notes in Blah2 specifiy that it currently only supports the SDRplay RSPduo and USRP devices, but in the future they are looking to add support for the KrakenSDR and modified RTL-SDR and HackRF hardware.

Aaron also briefly demonstrated the related adsbdd software, from the same author as Blah2. This software allows a user to convert ADS-B data to delay-doppler truth. Essentially allowing you to confirm is an aircraft position determined via ADS-B is on the range-doppler ellipse determined via passive radar. In the future the author hopes to be able to plot all aircraft in a 2D delay-doppler space graph. 

WarDragon Passive Radar Setup + Test w/ Open Source Code (RSPDUO, RTLSDR, Blah2)

ANTSDR E200 set to begin Crowdfunding on CrowdSupply soon

The AntSDR E200 is a software defined radio from Microphase which will come in two flavors. The first is the 'AD9363" version with 2x2 RX/TX and a 325 - 3.8 GHz tuning range, 20 MHz bandwidth and 12-bit ADC. The second is their higher end 'AD9361' version with 2x2 RX/TX, 70 MHz - 6 GHz tuning range, 56 MHz bandwidth and 12-bit ADC.

It is currently in the prelaunch phase on CrowdSupply.

The AntSDR E200 is is based on the AD9363 / AD9361 RF SDR chips which are used in many existing mid-range software defined radios like the PlutoSDR, bladeRF and Ettus USRP's.

The design itself is very similar to the PlutoSDR and Errus B205mini, and in fact the developer has ported firmware from PlutoSDR and the Ettus UHD that allows the device to work just like those devices. It is not yet known if the AD9363 frequency range extension hack available on the PlutoSDR, and the bandwidth overclock hack on the bladeRF will be possible with the AntSDR E200 as well.

Pricing is yet to be displayed on CrowdSupply, however the the AD9363 version appears to already be available for purchase on Aliexpress for US$364.25. Update: Microphase have explained that the units on Aliexpress are not officially authorized units and the Aliexpress price is much higher than what they will charge during the crowdfunding phase.

The AntSDR E200
ANTSDR-E200 demo video

Also, over on YouTube DragonOS creator Aaron has already been testing his AntSDR with srsRAN, which is an open-source program that can create 4G and 5G basestations with compatible SDRs like the USRP. Using the modified UHD firmware, Aaron was able to get up and running with the AntSDR E200 very quickly.

DragonOS FocalX E200 w/ Osmo-Nitb-Scrips, srsRAN, and SDRAngel Preview (ANTSDR, b205mini, R29+)

Fissure: An Open Source RF Reverse Engineering Framework

FISSURE (Frequency Independent SDR-Based Signal Understanding and Reverse Engineering) is a recently released open source framework that runs on Linux, and includes a whole suite of previously existing software that is useful for analyzing and reverse engineering RF signals. On top of that it includes a custom GUI with a bunch of custom software that ties everything together in a full reverse engineering process.

Recently the developers spoke at this years Defcon conference, and the talk video is supplied at the end of this post. In their talk they explain the purpose of FISSURE, before going on to demonstrate it being used to reverse engineer a wireless X10 doorbell. FISSURE makes analyzing the signal easy, starting with spectrum analysis to find the signal, then signal recording, signal cropping, signal replay, crafting packets and crafting attacks.

News and developments about FISSURE can also be seen on their Twitter.

FISSURE is an open-source RF and reverse engineering framework designed for all skill levels with hooks for signal detection and classification, protocol discovery, attack execution, IQ manipulation, vulnerability analysis, automation, and AI/ML. The framework was built to promote the rapid integration of software modules, radios, protocols, signal data, scripts, flow graphs, reference material, and third-party tools. FISSURE is a workflow enabler that keeps software in one location and allows teams to effortlessly get up to speed while sharing the same proven baseline configuration for specific Linux distributions.

The framework and tools included with FISSURE are designed to detect the presence of RF energy, understand the characteristics of a signal, collect and analyze samples, develop transmit and/or injection techniques, and craft custom payloads or messages. FISSURE contains a growing library of protocol and signal information to assist in identification, packet crafting, and fuzzing. Online archive capabilities exist to download signal files and build playlists to simulate traffic and test systems.

The friendly Python codebase and user interface allows beginners to quickly learn about popular tools and techniques involving RF and reverse engineering. Educators in cybersecurity and engineering can take advantage of the built-in material or utilize the framework to demonstrate their own real-world applications. Developers and researchers can use FISSURE for their daily tasks or to expose their cutting-edge solutions to a wider audience. As awareness and usage of FISSURE grows in the community, so will the extent of its capabilities and the breadth of the technology it encompasses.

FISSURE RF Framework - Griffiss Institute & AIS Monthly Lecture + Education Series

Remoticon 2021: Smart Meter Hacking Talk

Remoticon 2021 was an online conference held in November 2021 and videos of presentations have recently been uploaded to the Hackaday YouTube channel this month. One very interesting talk was the presentation by Hash Salehi (RECESSIM) on reverse engineering electricity smart meters that are used to remotely monitor and bill home electricity usage in some neighborhoods.

In the past we've posted about Hash (RECESSIM)'s series on smart meter hacking a few times before. In this latest talk Hash summarizes his smart meter hacking experience, talking about how he went from reverse engineering the firmware, to using an SDR to capture and decode information from all the smart meters in his neighborhood, and finally to determining how to actually transmit data to his own smart meter network.

Hackaday have also posted a full writeup on his talk. This is a very in depth reverse engineering project so it is a great talk to learn from.

Remoticon 2021 // Hash Salehi Outsmarts His Smart Meter

Decoding and Logging GPS Coordinates From Wireless Smart Meters

Back in April we posted about "Hash's" RECESSIM YouTube series on hacking electricity smart meters using a software defined radio. Recently his series continues with a video on decoding and logging the GPS coordinates sent by the smart meters used in his area. Using a car, SDR and laptop he was able to drive down the freeway collecting smart meter data as he travelled, decode the data, and plot it on a map. In his video Hash explains why there is GPS data in the signal, and how he was able to reverse engineer and determine the GPS data.

Smart Meter Hacking - Decoding GPS Coordinates

Reverse Engineering Wireless Mesh Smart Meters with Software Defined Radio

Over on YouTube channel RECESSIM has uploaded a three part series on reverse engineering smart utility meters. In many locations wireless mesh smart electricity meters are installed in houses allowing for completely wireless monitoring. These mesh network devices pass the wireless data from meter to meter until the data reaches a router that is typically placed on a neighborhood power pole.

In the first video Recessim explains how a smart meter mesh network works, and demonstrates signal reception in the 900 MHz band with a USRP B200 software defined radio.

In the second video he demonstrates how he can see meter ID and power outage information from Oncor meters, explains his GNU Radio flowgraph setup and goes on to explain how he reverse engineered the data packets.

Finally in the third video he performs a few teardowns of smart meters he found on eBay, and shows his reverse engineering setup with a faraday cage. More videos are likely to be on the way, so you might want to consider subscribing to his channel for updates. Recessim is also diligently recording all the information he's discovered about the meters on his Wiki.

Playlist: Smart Meter Hacking

Notes on Observing Pulsars with an SDR from CCERA

A pulsar is a rotating neutron star that emits a beam of electromagnetic radiation. If this beam points towards the earth, it can then be observed with a large dish or directional antenna and a software defined radio. In the past we've posted a few times about Pulsars, and how the HawkRAO amateur radio telescope run by Steve Olney in Australia has observed Pulsar "Glitches" with his RTL-SDR based radio telescope.

Over in Canada, Marcus Leech has also set up a Pulsar radio telescope at the Canadian Centre for Experimental Radio Astronomy (CCERA). Marcus has been featured several times on this blog for his various amateur radio experiments involving SDRs like the RTL-SDR. In one of his latest memos Marcus documents his Pulsar observing capabilities at CCERA (pdf). His memo describes what Pulsars are and how observations are performed, explaining important concepts for observation like de-dispersion and epoch folding.

The rest of the memo shows the antenna dish and feed, the SDR hardware which is a USRP B210 SDR, the reference clock which is a laboratory 0.01PPB rubidium atomic clock and the GNU Radio software created called "stupid_simple_pulsar". The software DSP process is then explained in greater detail. If you're thinking about getting involved in more advanced amateur radio astronomy this document is a good starting point.

Dish Antenna + Feed used for receiving Pulsars

Setting up a GSM Basestation in minutes with a USRP and DragonOS

DragonOS is a ready to use Linux OS image that includes many SDR programs preinstalled and ready to use. The creator Aaron also runs a YouTube channel that has multiple tutorial videos demonstrating software built into DragonOS.

In a recent video Aaron shows how you can set up a GSM basestation within minutes by using the latest DragonOS version together with a USRP b205mini-i software defined radio. As the required software (osmo-BTS, osmo-bts, osmo-bts-trx) is all preinstalled, setting up the basestation is a simple matter of opening three terminal windows and running a few commands. We note that this latest DragonOS version is due to be released this Thursday.

In a previous video Aaron also shows a more detailed setup procedure showing how all the software was installed.

DragonOS Focal Running a GSM network in minutes (osmo-bts, osmo-bsc, osmo-bts-trx, USRP b205mini-i)