Tech Minds: A Review of the Vivid Unit with GPSDR RTL-SDR Module

The Vivid Unit is a single-board computer with a built-in LCD touch screen. There is an optional module called the "GPSDR," which is an RTL-SDR, upconverter, and GPSDO module that, when combined with the Vivid Unit, creates a handheld, portable SDR.  Last month, we reviewed the Vivid Unit and its "GPSDR" RTL-SDR add-on module on our blog.

Recently, Matt from the Tech Minds YouTube channel has also uploaded a review video of the Vivid Unit and GPSDR. In the video, Matt shows the hardware and demonstrates it in action, receiving various signals, including ADS-B and HF signals. He notes that he gets a good reception on HF even with just a telescopic antenna; however, the built-in speaker is tinny, and better audio is obtained by connecting it to a Bluetooth speaker. Matt also tests rtl_433, confirming that other RTL-SDR software works on the Vivid Unit too.

Matt also notes that you can use the code "TECHMINDS" if ordering from the UUGear site directly, and you'll get 5 Euros off each GPSDR that you order.

GPS Assisted RTL-SDR For The Vivid Unit - Runs Debian 11!

Demonstrating a Rollback Attack on a Honda via HackRF Portapack and an Aftermarket Security Solution

Over on YouTube "Obsessive Vehicle Security" has uploaded a video demonstrating a rollback attack against a Honda vehicle using a HackRF Portapack and the "Remote" function on the Mayhem firmware. His recent blog post also succinctly explains the various types of keyless vehicle theft used by modern thieves, including Roll-Jam, Relay Amplification and Rollback attacks. Regarding rollback attacks he explains:

A Rollback Attack works by capturing remote signals and replaying them. In theory this should not be possible with a rolling code remote system, however, a large number of vehicles are vulnerable to it. Including my 2015 Honda Vezel!

For it to work on the Honda I need to capture 5 consecutive remote signals. It does not matter if the car has seen these or not, when I replay them it re-syncs and unlocks the car. I have tested this and can replay the sequence as many times as I like. It always works.

He also mentions in the video how an aftermarket security system can partially mitigate these attacks.

In the past we also posted about Flipper Zero based rollback attacks.

Rollback Attack on Honda - HackRF One Bypasses Rolling Code Security

Receiving DAB and FM Signals with an RTL-SDR and Engima2 on OpenPLi 9.0

Thank you to "Radioto bg" from DXing.org for writing in and sharing with us his latest YouTube video showing how to receive DAB and FM signals with an RTL-SDR and the Enigma2 application running on OpenPLi. OpenPLi is an open-source Linux distribution for TV set-top boxes and Engima2 is a TV reception application used within the distribution.

RADIOTO shows how an RTL-SDR can be added to the system, allowing it to also receive DAB+ and FM radio.  In a previous post RADIOTO also showed how the RTL-SDR could be used as a DVB-T receive in Enigma2 and OpenPLi.

Turn Your Enigma2 Receiver into a DAB+ & FM Radio with RTL-SDR v.3! 🔥 Full Tutorial with OpenPli 9.0

A Review of the SunFounder Pironman 5 MAX Raspberry Pi 5 Enclosure

Recently, SunFounder sent us a free review unit of their latest "Pironman 5 MAX" enclosure for Raspberry Pi 5 devices. While not directly related to SDR, we thought we'd accept the unit and review this product, as RTL-SDRs are often used together with Raspberry Pi 5 single-board computers. Depending on the number of SDRs connected and the software used, SDR applications can consume a significant amount of CPU, causing heat and throttling down of CPU speeds; therefore, adequate cooling may be necessary.

The Pironman 5 costs US$94.99 if purchased directly from the SunFounder website, and they advertise that US duties and EU VAT are included in the pricing. There is also the slightly lower Pironman 5 model available for US$79.99. The main difference between the 5 and 5 MAX is that there is only one SSD expansion slot vs two on the 5 MAX, and no tap-to-wake OLED functionality.

Overview

The Pironman 5 is what we would consider a high-end enclosure for the Raspberry Pi. It includes a large CPU tower cooling heatsink with a fan, along with two case fans to keep the internal temperatures down.

It also adds a dual slot NVME M.2 expansion board to the Pi 5, so that you can install two SSDs or one SSD and a Hailo AI accelerator module. SSDs might be useful for RTL-SDR users who are recording large amounts of IQ data, or saving many weather satellite images, for example. The Hailo AI accelerator module could turn a Raspberry Pi and RTL-SDR into an RF intelligence powerhouse. One advanced AI use-case might involve running local Whisper speech recognition to log voice communications to text, followed by using a local LLM to summarize daily received data (noting that you'll need to wait for the Hailo-10H model to run local LLMs).

Finally, it also adds an OLED status display, which shows current CPU temperature and fan speeds, as well as an on off button.

Another plus is that the GPIO header remains accessible on the outside of the enclosure, thanks to an extender included in the design.

Pironman 5 Fully Assembled
Pironman 5 Fully Assembled

Assembly

Assembly of the Pironman 5 took just over 30 minutes. It involves screwing in standoffs, seating the heatsink/fans, connecting jumpers and ribbon cables, and screwing down the panels. A nice color paper assembly manual is provided, making the installation easy to follow. Anyone who is mildly familiar with installing connectorized PC components should have no trouble.

All parts included with the Pironman 5.
All parts included with the Pironman 5.
Pironman 5 Assembly Manual
Pironman 5 Assembly Manual
Pironman 5 Built (Acrylic side panels off)
Pironman 5 Built (Acrylic side panels off)

Software Installation and Usage

After assembly, you can simply insert a freshly burned Raspbian image into the SD card slot and power on the unit.

At this stage, you now need to install some software to properly control the OLED, CPU fans, and case fans. This involves installing some software from their GitHub, but you can simply copy and paste the commands in the terminal one by one.

Once the software is installed a web UI is exposed at <IP_ADDR>:34001. Here you can monitor various stats including CPU temps, and make changes to the OLED, RGB and fan behaviour.

Pironman 5 Web UI
Pironman 5 Web UI

OLED QC Problems?

Unfortunately, our unit had a problem where the OLED screen wouldn't work. We attempted fresh software installs and reseated all cables and connectors, but had no luck. Upon contacting SunFounder, they immediately sent us a new OLED screen to try. But the replacement also did not work.

However, when trying the new screen, we noticed that the screen would briefly light up when we pressed on the FPC connector. Upon inspecting the FPC connector, we noticed that some pins on the PCB looked suspiciously low on solder compared to the others, so we applied flux and used a hot soldering iron to refresh them. After doing this, the OLED screen began working again.

Based on our dealings with SunFounder, we believe that they're support is good, and any customer facing similar issues would be supplied with replacement parts if required.

Pironman OLED Screen Working
Pironman OLED Screen Working

Usage and Performance with RTL-SDR

As expected, with the great cooling in place, the Raspberry Pi 5 never throttled down when running an RTL-SDR with SDR++. We also tested it with our KrakenSDR system, which requires more CPU, and found great performance too.

The rear GPIO fans are quiet enough, and the CPU fan makes almost no noise inside the enclosure. We ran a stress test using the 'stress' Linux package, which can push all four CPU cores to 100%. With the fans running in a room with an ambient temperature of 22 degrees, we saw that the CPU temperature never went above 55 degrees C.

While still running 'stress', we manually disabled the two GPIO fans, and the temperature stabilized at around 66 degrees C. So the rear fans may only be required to be on when you have an SSD or AI module installed.

Conclusion

If you're looking for a high-quality enclosure and cooling solution for the Raspberry Pi 5, the Pironman 5 MAX is probably the best high-end solution available. Not only does the enclosure protect the Raspberry Pi 5 completely, but the cooling performance is excellent, and the ability to add SSDs and AI modules is great too.

Disclaimer: We were given a unit for free in exchange for an honest review. We received no other compensation.

Pironman 5 with full RGB
Pironman 5 with full RGB

SDR-Hub: A New RTL-SDR Scanner and Audio Recorder with Web Interface

Over on GitHub, user shajen has recently released a new open source program called "sdr-hub," which combines his two prior programs, called rtl-sdr-scanner-cpp and sdr-monitor, into one easy-to-launch project. The result is a powerful RTL-SDR scanner and audio recorder, with a web interface. In the past, we posted about rtl-sdr-scanner-cpp when Tech Minds made a video on it.

The scanner feature allows users to scan for active frequencies across a wide spectrum by rapidly retuning the RTL-SDR. If the transmissions are all within the same instantaneous bandwidth, the user can also record the audio.

The web interface then allows users to easily browse any created spectrum graphs and play back any audio recordings.

The software is available as a Docker image, making it easy to install and run.

SDR-Hub: RTL-SDR Scanner, Recorder and Web UI all in one.
SDR-Hub: RTL-SDR Scanner, Recorder and Web UI all in one.

Glide Path: ADS-B Visualization Software

Thank you to Kazuya for submitting an aircraft tracking app that he's created for use with RTL-SDR dongles and dump1090. The program currently exists only as Visual C++ code and is documented in Japanese, so it may be somewhat niche and intended for advanced users to try out. Kazuya writes:

I live near Tokyo Bay, so I enjoy watching the takeoffs and landings at Haneda Airport.

The unique feature of this app is that it visualizes the descent angle, which is difficult to see on a flat map.

This app has not been available for distribution. If you are an intermediate Visual C++ user, you may be able to rebuild or modify the app.

Topographical and landmark information is in text files, allowing you to customize area information in more detail for your airport.

----

(3) Glide_Path
Can be built independently.

Execution Environment
Copy the folder (ADS_GLIDE_PATH) to C:.

・When using an ADS antenna
Install the ADSB antenna and driver software on your PC.
(As a mid-way test, you will be able to listen to radio broadcasts on your PC.)
Launch dump1090_with_StdinAPL1.bat to ensure that tmp_ADS_B-0000****.txt is continually generated in C:\ADS_GLIDE_PATH\tmpDataFolder.

- Without an ADSB antenna
You can use the data in DemoData (approximately 30 minutes, 6,000 entries) to check the software's operation.
(Procedure) Launch Glide_Path.exe and, on the parameter change screen, set [S001] Demo Mode to 1.
Exit Glide_Path.exe and restart it. The Start Demo button will appear; press it.

(4) Stdin_Apl1
Can be built independently.
This is an auxiliary program when using the ADS antenna described above in (3). Stdin_Apl1.exe
This program parses the standard output of dump1090.exe, provided by the ADS antenna manufacturer, into a text file and processes the data so that it can be read by Glide_Path.exe.

Kazuya's ADS-B Visualization Software
Kazuya's ADS-B Visualization Software

Eavesdropping on Sensitive Data via Unencrypted Geostationary Satellites

Recently, Wired.com released an article based on research by researchers at UC San Diego and the University of Maryland, highlighting how much sensitive unencrypted data many geostationary satellites are broadcasting in the clear.

The researchers used a simple off-the-shelf 100cm Ku-band satellite dish and a TBS-5927 DVB-S/S2 USB Tuner Card as the core hardware, noting that the total hardware cost was about $800. 

Simple COTS hardware used to snoop on unencrypted satellite communications.
Simple COTS hardware used to snoop on unencrypted satellite communications.

After receiving data from various satellites, they found that a lot of the data being sent was unencrypted, and they were able to obtain sensitive data such as plaintext SMS and voice call contents from T-Mobile cellular backhaul and user internet traffic. The researchers notified T-Mobile about the vulnerability, and to their credit, turned on encryption quickly.

They were similarly able to observe uncrypted data from various other companies and organizations, too, including the US Military, the Mexican Government and Military, Walmart-Mexico, a Mexican financial institution, a Mexican bank, a Mexican electricity utility, other utilities, maritime vessels, and offshore oil and gas platforms. They were also able to snoop on users' in-flight WiFi data.

Cellular Backhaul
We observed unencrypted cellular backhaul data sent from the core network of multiple telecom providers and destined for specific cell towers in remote areas. This traffic included unencrypted calls, SMS, end user Internet traffic, hardware IDs (e.g. IMSI), and cellular communication encryption keys.

Military and Government
We observed unencrypted VoIP and internet traffic and encrypted internal communications from ships, unencrypted traffic for military systems with detailed tracking data for coastal vessel surveillance, and operations of a police force.

In‑flight Wi‑Fi
We observed unprotected passenger Internet traffic destined for in-flight Wi-Fi users on airplanes. Visible traffic included passenger web browsing (DNS lookups and HTTPS traffic), encrypted pilot flight‑information systems, and in‑flight entertainment.

VoIP
Multiple VoIP providers were using unencrypted satellite backhaul, exposing unencrypted call audio and metadata from end users.

Internal Commercial Networks
Retail, financial, and banking companies all used unencrypted satellite communications for their internal networks. We observed unencrypted login credentials, corporate emails, inventory records, and ATM networking information.

Critical Infrastructure
Power utility companies and oil and gas pipelines used GEO satellite links to support remotely operated SCADA infrastructure and power grid repair tickets.

The technical paper goes in depth into how they set up their hardware, what services and organizations they were able to eavesdrop on, and how they decoded the signals. The team notes that they have notified affected parties, and most have now implemented encryption. However, it seems that several services are still broadcasting in the clear.

SignalsEverywhere Software and Video Updates: Benshi Dash, AI Vibe Coding SDR Apps, Android NTSC Receiver, NOAA SAME Encoder

Thank you to SignalsEverywhere, aka Sarah Rose, for writing in and sharing some updates on what she's been working on recently.

First, Sarah provides an updated video that shows off her Benshi Dash Android application (GithHub, Name-Your-Price Store Download) for VR N76, UV Pro, and other similar handheld radios with Bluetooth connectivity. 

Benshi Dash | The Ultimate Radio Dashboard for VR-N76 UV-PRO Etc

Next, she notes that she uploaded a video showing the power of Google's Gemini AI, and how she was able to use it to vibe code a HackRF TV transmitter program on Linux in just a few minutes.

Vibe Coding a TV Transmitter on Linux with a HackRF

Next, she mentions that she also built an RTL-SDR NTSC Receiver for Android, based on the TVSharp decoder. It is available on GitHub and via her name-your-price store, with a $0.00 minimum spend. 

RTL-TV. An NTSC video decoder for Android and RTL-SDR.
RTL-TV. An NTSC video decoder for Android and RTL-SDR.

Finally, Sarah writes that she has also created a NOAA SAME weather encoder for use with a HackRF on Linux or Android. This allows users to transmit NOAA SAME (Specific Area Message Encoding) alerts, which are weather alerts typically transmitted on the NOAA Weather Radio frequency, transmitted around 162 MHz. The software is available via GitHub, or via her store for $10 (Linux edition / Android edition).

NOAA SAME Transmitter
NOAA SAME Transmitter