Frugal Radio: Testing a Loop on Ground Antenna with an Airspy HF+ Discovery

The KK5JY Loop on Ground (LoG) antenna is a 15 feet per side square loop designed for reception of HF and lower. It simply consists of an isolation transformer and wire that as the name implies is placed somewhere on the ground in a square loop like shape. It is cheap and easy to build and compact in that it does not take up any usable space. 

In his latest video Rob from the Frugal Radio YouTube channel tests out this antenna with his Airspy HF+ Discovery SDR. He uses a bit of wire lying around, and a low cost 9:1 Balun from NooElec as the isolation transformer. With this antenna he was able to pick up signals in the USA and all the way over to Australia from his home in Canada. NDB signals were also receivable.

2022 LoG (Loop on Ground antenna) for SDR radio tested on Airspy HF+ Discovery SDR KK5JY HAM radio

Tweet8
Share
Reddit
Vote
Email
8 Shares

Reverse Engineering a 30 Year Old Wireless Garage Door Opener with a HackRF and GNU Radio

At his childhood home Maxwell Dulin discovered that his garage door was controlled by a 30 year old system called the "Sears Craftsman 139.53708 Garage Door Remote". Being interested in SDRs Maxwell decided to see if he could reverse engineer the remote using his HackRF.

His first steps were to search for the frequency which he found active at 390 MHz. He then moved on to analyzing the signal with Inspectrum, discovering the OOK modulation, then working his way towards the binary control strings. One thing that helped with his reverse engineering was the use of the 9-bit DIP switches on the remote that configure the security code that opens up a specific door as this allowed him to control the transmitted bits, and determine which bits were used for the security code. With this and a bit of GNU Radio code he was able to recreate the signal and transmit it with his HackRF.

Finally Maxwell wanted to see how vulnerable this door is to a brute force attack that simply transmits every possible security code. Through some calculations, he discovered that brute forcing every possible security code in the 9-bit search space would only take 104 minutes to open any garage using this opener.

GNU Radio replaces a 30 year old garage door remote
Tweet59
Share
Reddit
Vote
Email
59 Shares

Remoticon 2021: Smart Meter Hacking Talk

Remoticon 2021 was an online conference held in November 2021 and videos of presentations have recently been uploaded to the Hackaday YouTube channel this month. One very interesting talk was the presentation by Hash Salehi (RECESSIM) on reverse engineering electricity smart meters that are used to remotely monitor and bill home electricity usage in some neighborhoods.

In the past we've posted about Hash (RECESSIM)'s series on smart meter hacking a few times before. In this latest talk Hash summarizes his smart meter hacking experience, talking about how he went from reverse engineering the firmware, to using an SDR to capture and decode information from all the smart meters in his neighborhood, and finally to determining how to actually transmit data to his own smart meter network.

Hackaday have also posted a full writeup on his talk. This is a very in depth reverse engineering project so it is a great talk to learn from.

Remoticon 2021 // Hash Salehi Outsmarts His Smart Meter

Tweet14
Share
Reddit
Vote
Email
14 Shares

A Review of the Soon to be Released Malahit-DDC Portable SDR

The Malahit DDC is the latest in portable SDR packages coming out of the Russian designer and manufacturer known as 'Malahiteam'.  In the past they released the hugely successfull Malhit-DSP. We want to thank Manuel Lausmann for sending us a video and review that comprehensively looks at one of the first Malahit DDC devices that have been received. Manuel writes:

Differences between Malahit DSP and Malahit DDC

The comparison results for the main characteristics are summarized in the table. The worst result of the comparison is marked in red, the best or neutral result is blue.

The comparison took into account the results from the DDC versions with two ADC versions - AD9649 and MDRA1A16FI.

1) the sensitivity is about the same, there is no difference.

2) The dynamic range blocking is a big difference in favor of DDC. It is caused by the properties of the radio reception path and not by the difference in the classes of radio receivers. This has the practical advantage that a radio receiver with large antennas can be used under difficult conditions, for example when it is necessary to receive a weak signal in the presence of a strong interfering one.

3) The dynamic range of third order intermodulation is a big difference in favor of DDC. It is caused by the properties of the radio reception path and not by the difference in the classes of radio receivers. The practical advantage of this is the lack of parasitic or false reception channels.

4) The frequency range is different. This is the difference to specific design solutions. And the DDC has to catch up with the DSP version due to the additional board developed with converters. The additional board is already under development.

5) The type of antenna input - everything is the same here, the receivers can receive signals with both the telescope and external antennas.

6) Band values ​​/ frequency values. The DDC version is the undisputed leader here. In addition, these figures have actually already been confirmed.

7) Side channels of reception. As mentioned above, these are better in DDC. The difference lies in the classes of radio receivers.

8) The capacity of the ADC. I will go into this characteristic in a little more detail. Very often the ADC bitrate is used as a marketing ploy that is misleading the user. It is logical that the more the better. But as we see, even with a 14-bit DDC, a better dynamic than 16-bit DSP. And that's why not only the ADC capacity is important for classic or analog SDRs, but also the properties of the ADC radio path. If you use 24- or 32-bit ADCs in the Malachite DSP series, the radio receivers do not get any better - MSI001 does not allow this, in which case it limits the connection. So, you need to carefully analyze the build of radio receivers and not trust misleading promotions - many bits are certainly good, but you shouldn't forget the location of the ADC either. The main properties of radio receivers are determined in particular by the first input stages.

9) Overall dimensions. Everything is the same here.

10) audio output. And everything is the same here.

11) PC connection. And this is where the big difference in favor of DDC lies. A faster type of USB interface is used, the quadrature width is increased to almost 2 MHz, and the QUISK program also has the option of viewing the spectrum up to 38 MHz against the background of radio reception.

12) Power consumption. The power consumption is not the strength of the DDC - the digital technology eats up a lot of energy. In comparison, there is one more characteristic - the prices. With the DDC, the price is significantly higher due to the more expensive components

From February you can also expect an optional additional board where reception on 6ghz is possible with additional filters. A 16 bit ADC will also be built into the Malahit DDC from February.

The video review below is in German, however you can use the YouTube autogenerated English captions below, or wait a little as Manuel indicates that English subtitles will be added soon. 

Malahit DDC in Gefahr Teil 1

Tweet7
Share
Reddit3
Vote
Email
10 Shares

Observing the NML Cygni Red Supergiant Star with an Airspy Mini SDR and Home Radiotelescope

Job Genheniau's projects have been featured several times on this blog in the past for imaging the Milkyway and other astronomical objects like supernova's and protostar regions with a 1.8m radiotelescope dish and RTL-SDR or similar SDR.

In his latest achievement Job has noted that he has had some limited success in observing  NML Cygni with his dish and an Airspy Mini SDR. NML Cygni is a 'red hypergiant' star situated within the Cygnus constellation, and it is one of the largest stars by radius known. Prior observations have found that it exhibits a spectral line at 1612.231 MHz.

Job's setup consists of his 1.5m dish (extended to 1.8m with mesh) on a rotor, a custom feed tuned for 1612 MHz, a 0.47dB NF low noise amplifier, an RF filter and an Airspy Mini SDR. Observations were made in SDR# and plotted with Excel.

The NML Cygni hypergiant is difficult for amateur's to observe, and Job notes that he is not aware of anyone previously observing it with a 1.8m dish. He notes that he had 20 failed attempts, but 5 recordings that stood out as possible successes.

However, ultimately Job has been unable to claim that the star was successfully observed, but his results to appear to show some possible success. He notes that some of the uncertainty stems from the fact that on some recordings he observed the peak at the expected -25 km's blueshift expected from the star, however other recordings had the peak at the wrong blueshift.

Job's full report on his observations can be found in this PDF document.

The NML Cygni Red Hypergiant observed with 1.8m dish and Airspy SDR.
Tweet9
Share
Reddit
Vote
Email
9 Shares

An APRS Tracker with HackRF, WebUSB and WASM

Thank you to Radoslav Gerganov for writing in and submitting news about the release of his open source web-based APRS tracker named "aprs-sdr". The web based software turns a HackRF device into a mobile APRS beacon.

Most interestingly the software works via the WebUSB interface, which allows for USB devices like a HackRF SDR to connect directly to the software through USB via the Chrome web browser. So no external app or software needs to be downloaded, all you need to do to run the code is open the hosted aprs-sdr page at https://xakcop.com/aprs-sdr with a Chrome browser, and connect the HackRF to your device.

Radoslav writes further:

The tracker is using the HTML Geolocation API to fetch the device’s location and WebUSB to talk with the SDR. The code which generates the packets is written in C++ and compiled to WASM. You can find the source at https://github.com/rgerganov/aprs-sdr.

And now to some results. I have successfully transmitted packets from my home to LZ0DOE (15km away!) using my Pixel phone, HackRF and ANT500. I find it amazing given the low TX power of HackRF.

Radoslav also notes that in the future he hopes to add other SDRs as well. He also notes that the script seems to work best on desktop Chrome. On mobile Chrome there may be a bug which stops transmission after a few packets.

Using the aprs-sdr WebUSB application.
Tweet16
Share
Reddit
Vote
Email
16 Shares

CaribouLite Raspberry Pi SDR Hat Gets Funded!

Earlier today the CaribouLite crowdfunding campaign on CrowdSupply successfully completed it's crowd funding phase with over 600 backers and $134,000 raise. The team have noted in the latest update that they are now moving on to the production stages with the estimated shipping date still indicated for May 25, 2022. Now that the campaign has ended the pricing has increased slightly from $119 + shipping to $138 + shipping.

The CaribouLite is a software defined radio HAT for the Raspberry Pi with a 30 MHz - 6 GHz frequency tuning range, 13-bit ADC, 2.5 MHz bandwidth and one TX and one RX channel.

The CaribouLite RPi HAT
Tweet55
Share
Reddit
Vote
Email
55 Shares

Receiving X-Band Images from the Arktika-M1 Arctic Monitoring Satellite

Recently on Twitter @arvedviehweger (Arved) has tweeted that he has successfully received images from the Russian Arctic monitoring satellite known as ARKTIKA-M1, via it's X-band downlink at 7865 MHz. We've reached out to Arved and he's provided the following information on his setup and how he's receiving and decoding the images.

 

The Arktika-M1 satellite is a Russian weather satellite which operates in a HEO orbit. It was launched in February 2021 and has downlinks on multiple bands. The main payload downlink for the imagery is on 7865 MHz (which is also known as the lower X-Band). The satellite only transmits imagery on the X-Band at the moment, it is currently unknown whether it will ever transmit any image data on L-Band.

For Amateur reception that means having access to X-Band RF gear. It usually consists of a low noise pre-amplifier and a downconverter to convert 7865 MHz down to a lower frequency for easier reception with a high bandwidth SDR such as the LimeSDR, a USRP etc.

In my personal setup I use a surplus pre-amplifier made by MITEQ (around 36dB of gain, 1dB NF), my own self-made DK5AV compact X-Band downconverter and a LimeSDR-USB.

The L-Band gear is mounted on top (helix and the pre-amp behind it) and the X-Band gear is right below. From left to right you can see the feed, the downconverter (silver box) and the LNA (mounted to a heatsink and a fan). Recording is done with a LimeSDR-USB running at a sample rate of 50 MSPS. The satellite transmits every 15 minutes once it reaches its apogee, each transmission including the idle period lasts for about 10 minutes. Some pictures of the idle transmission and the actual data transmission can be found in this Tweet, [noting that Idle = more spikes, actual data looks weaker]:

Depending on the geographical location a rather large satellite dish is also required for Arktika-M1. Reception reports all over Europe clearly show that the satellite has a beamed antenna (similar to ELEKTRO-L2).

In my setup I can get away with a 2.4m prime focus dish (made by Channel Master) in North Eastern Germany. It produces around 9 - 10 dB of SNR in the demod of @aang254’s excellent SatDump software. Anything above 5dB will usually result in a decode but since the satellite does not have any FEC you will need more than that for a clean picture. (Image of SNR in Satdump)

Tweet13
Share
Reddit9
Vote
Email
22 Shares