Category: Applications

Meteor Logger: A Tool for Counting Meteor Detections with an RTL-SDR

Thanks to Wolfgang Kaufmann for submitting news about his new software called ‘Meteor Logger’. This tool can be used to count the number of meteors entering the atmosphere which have been detected by a meteor scatter setup using an RTL-SDR or similar SDR.

Wolfgang writes about his software:

I have developed a new piece of software “Meteor Logger” to detect and log radio meteors from the digital audio stream of a PC-soundcard. It is based on Python 3. It is addressed to those meteor enthusiasts who want get the most information out of forward scattering of radio waves off meteor trails. “Meteor Logger” do not display spectrograms, it delivers an instantaneous and continuous numerical output of the detected signal with a high time resolution of about 11 ms. Thereby a radio meteor signal is not detected on the basis of an amplitude threshold but on its signature in the frequency domain. “Meteor Logger” has a built in auto notch function that may be helpful in case of a persistent strong interference line. From these data not only hourly count rates can be derived but it is also possible to easily study power profiles of meteors as well as Doppler shifts of head echoes.

As receiving front end a RTL-SDR is fine, if you strive after a very high signal resolution you may use a Funcube Dongle Pro. I employed SDR# to run the RTL-SDR. GRAVES-radar is used as transmitter. The added screenshot shows this setup together with “Meteor Logger”.

Additionally I wrote an also Python 3 based post processing software “Process Data” that allows for clearing the raw data, viewing and analysing them and exporting them in different ways (e.g. as RMOB-file for opening with “Cologramme Lab” of Pierre Terrier, see added screenshot).

Everything else you may find on my website http://www.ars-electromagnetica.de/robs/download.html

Meteor Logger
Meteor Logger

Meteor scatter works by receiving a distant but powerful transmitter via reflections off the trails of ionized air that meteors leave behind when they enter the atmosphere. Normally the transmitter would be too far away to receive, but if its able to bounce off the ionized trail in the sky it can reach far over the horizon to your receiver. Typically powerful broadcast FM radio stations, analog TV, and radar signals at around 140 MHz are used. Some amateur radio enthusiasts also use this phenomena as a long range VHF communications tool with their own transmitted signals. See the website www.livemeteors.com for a livestream of a permanently set up RTL-SDR meteor detector.

Testing the Prototype Outernet Patch Antenna with Built in RTL-SDR

A few months ago satellite data broadcasting company Outernet created a limited number of prototype receivers that combined an L-band satellite patch antenna, LNA and RTL-SDR into a signal unit. This was never produced in bulk as they found it to be too noisy having the RTL-SDR so close to the antenna, but nevertheless it still worked fairly well.

Over on YouTube max30max31 bought one of these prototype units and made a video about using it for receiving and decoding various L-band satellite signals. In the video he first shows an overview of the product and then shows it receiving and/or decoding some signals like Inmarsat STD-C, AERO and Inmarsat MFSK.

Reviewing the PandwaRF: CC1111 Based Transceiver for RF Security Analysis

The PandwaRF

The PandwaRF (formerly known as GollumRF) is an RF analysis transceiver tool that can be very useful for investigating ISM band devices that communicate with digitally modulated RF signals. It can be used for applications such as performing replay attacks, brute force attacks, and other analysis. The RX/TX frequency range of the device is from 300 – 928 MHz, with a transmit power of up to +10 dBm.

The PandwaRF is based on the CC1111 chip which is the same chip used in devices like the Yard Stick One from Great Scott Gadgets (creators of the HackRF). Compared to the YS1 the PandwaRF is essentially the same, but designed to be much more portable, with a built in battery and an Android app that you connect to via Bluetooth. This makes it very useful for taking out in the field as no laptop is required to use it, just a phone or tablet. The PandwaRF can be used just like a YardstickOne when plugged into a PC however.

We should also clarify that CC1111 based devices like the PandwaRF and YS1 are not classed as SDRs. Rather they are RF transceiver chips that can demodulate, decode and transmit a fixed set of digital modulation schemes, such as OOK/ASK, 2-FSK, 4-FSK, GFSK, and MSK. While these devices are not able to receive or transmit any arbitrary signal like an SDR, they make reverse engineering, analysis, replay attacks, brute force attacks etc much simpler for common modulation schemes compared to using an SDR for the same purpose.

Early on in the year PandwaRF sent us a sample of their device for review. Unfortunately during that time their Android software was extremely buggy and we were simply unable to use the device properly. Others reported similar troubles on forums and blog comments. However fast forward to today and it now seems that the Android software is stable and functioning properly.

Replay Attack

PandwaRF Spectrum Analyzer Tool
PandwaRF Spectrum Analyzer Tool

We first tested the PandwaRF on a simple task which was a replay attack. The goal was to record the signal of a cheap wireless RF alarm, and see if we could replay it back. The wireless alarm is controlled with a keyfob.

First we used the Spectrum Analyzer tool in the PandwaRF app to try and get the frequency of the keyfob. The Spectrum Analyzer tool allows you to see about 1.2 MHz of bandwidth. We assumed the signal would be around 433 MHz. After pressing the button a few times the peak showed up at about 433.9 MHz on the spectrum analyzer. The refresh rate of the spectrum analyzer is quite low, so if the signal is not continuous it’s possible to miss the signal, which is we why we had to try several presses before the signal showed. A standard SDR like an RTL-SDR might be better for this initial frequency searching. We confirmed the frequency to be at 433.893 MHz on an RTL-SDR blog V3.

PandwaRF RX/TX Replay Attack Screen
PandwaRF RX/TX Replay Attack Screen

Next we switched to the RX/TX tool. Here you can enter the frequency of interest and set the expected modulation. We know that this device is ASK/OOK modulated, so we chose this setting. You also need to set the data rate. If you don’t know this value then the app has a data rate measuring tool. So we just pressed on the Measure button, and then pressed a button on the remote until it converged to a data rate of 5,121.

Next you need to set the ‘desired payload’. This is how many bytes long the packet is and determines how long the capture is. As we were unsure we simply set it to 250 bytes to ensure that a longer capture was taken. The PandwaRF will keep on receiving until it receives the desired payload of 250 bytes or is stopped manually. Setting it longer allows us to capture a longer signal, and ensure that the replayed signal is received. For this alarm device it is okay if the same signal is played multiple times in a short time frame.

The final setting is the RX Frame length. This determines how many bytes will be captured before transferring the data to Android. So for example, if you set the desired payload to 100 Bytes, and the RX Frame length to 52 bytes, then in total you will capture 104 Bytes of data. The PandwaRF can only transfer in 14, 33, 52, 71 or 90 bytes, so select one that is closest to a multiple of your desired payload.

Finally we pressed on ‘Sniff’ and pressed the ‘bell’ button on the remote. The PandwaRF detected the signal and recorded the data. Now pressing Xmit replays the signal successfully causing the alarm bell to sound.

Replayed and Original Signal received with an RTL-SDR
Replayed and Original Signal received with an RTL-SDR

Brute Force Attack

Brute force settings
Brute force settings

The PandwaRF can also be used as a brute forcing tool. With cheap alarms the alarm code is relatively short, so can be brute forced in a matter of minutes. The PandwaRF already had a preset mode for our cheap Forecum door alarm, so we simply selected this mode and started the brute force. It gave an estimated brute force time of 28 minutes, which is the time it takes to run through every possible alarm code.

More advanced brute force settings
More advanced brute force settings

The PandwaRF app currently supports the Idk and PT2262 chipsets, as well as some models of DIO, Extel and Forecum house alarms. If the device that you want to brute force is not yet in their database, then you’ll probably need to do some analysis first on the PC with an SDR. Software like Universal Radio Hacker and DSpectrumGUI are good tools for this. Once you know the structure of the data, then you can program PandwaRF to perform the brute force attack.

Note that their newer ‘PandwaRF Rogue’ product is supposed to be significantly faster at brute forcing. For example the Android software gives us a estimated duration of 28 minutes with the standard PandwaRF, and only 3 minutes with the Rogue.

The Rogue is also able to brute force 32 bit codewords with zero delay in between transmissions. The standard PandwaRF has a minimum delay of 100 ms which can really slow things down. It also allows for function mask bit skipping, enable more brute force patterns and can split the brute force attempt into several steps. Also as we’ve seen from their videos the Rogue has more pre-set commercial devices built into its app.

So if brute forcing is your main use for the PandwaRF then it seems to make sense to get the Rogue. Unfortunately the Rogue is significantly more costly, coming in at 990 euros, vs 145 euros for the standard PandwaRF. Of course you could still use the standard PandwaRF on a PC with tools like rfcat to perform a faster brute force attack as well, just like you would with a YardstickOne.

PandwaRF Brute Force attack as seen by an RTL-SDR
PandwaRF Brute Force attack as seen by an RTL-SDR

Javascripting

Javascript in PandwaRF

If you need more powerful analysis or TX capabilities, then the PandwaRF can be controlled in Javascript code. For example, you might have already reverse engineered a device, and simply require the PandwaRF to transmit the correct code to replace a remote control. You could also create a jammer with this.

The code runs on the Android device and not on the PandwaRF, so each RF command generates a bluetooth transfer which can be quite slow. They write this is why they have created a specific brute force implementation in the app, so that they can run their native brute force code on the PandwaRF itself, which is must faster than transferring the RF command for every brute force step.

Conclusion

Overall the PandwaRF is a very handy tool for doing replay and brute force attacks while in the field. It can also be converted back into a PC based CC1111 device, like a Yardstick One simply by plugging it into a computer with a USB cable so you’re not missing out on that functionality either.

Compared to the Yardstick One the cost is a bit more, with the Yardstick One costing $99 USD at most outlets, and the PandwaRF costing 145 Euros (~$173 USD). So it is probably only really worth it if you are doing field testing.

That said, now that the PandwaRF software seems stable it is an excellent tool for investigating wireless devices in a simpler way compared to with an SDR. An SDR is still much more powerful, but tools like this simplify the process significantly. The best set of tools for reverse engineering would be a SDR combined with a device like this.

In the future it looks like they plan to implement new features such as De Bruijn (OpenSesame) attack’s and rolling code attacks and we look forward to testing those out.

If you want more information about the PandwaRF you can visit their site, or check out their Wiki, or have a look at the demo videos on their YouTube page.

Disclaimer: The PandwaRF was provided to us for free in exchange for an honest review.

Tuning an HF Antenna with an Airspy, SWR-Bridge and Noise Source

Over on his blog Anders J. Ørts has created a good writeup showing how he used the combination of an Airspy SDR with SpyVerter upconverter, SWR-Bridge and a noise source to tune his HF dipole for the 40 meter and 20 meter bands. If you’re interested we also have a writeup on doing something similar with the RTL-SDR here.

By connecting the output of the noise source to the SWR-bridge input, and the antenna to the DUT port the return loss or SWR of the antenna can be measured with the Airspy. To get a wider than 10 MHz view of the spectrum Anders uses the SpectrumSpy software for the Airspy which is a spectrum analyzer application that allows you to view any bandwidth that you like. With the Airspy, noise source and antenna all connected correct to the SWR-Bridge significantly notches in the spectrum show up in SpectrumSpy. These notches are the resonant points of the antenna. Visually seeing these notches allows you to fine tune the length of the antenna elements for best SWR.

How to connect it all up
How to connect it all up
SpectrumSpy showing the resonant notches at 40m and 20m.
SpectrumSpy showing the resonant notches at 40m and 20m.

Visualizing the Traveled Path of a Weather Balloon, Tanker Boat and Gliders with an RTL-SDR and CesiumJS

Over on YouTube user pascal poulain has uploaded a short video that shows a timelapse of the flight path of a weather balloon in Cesiumjs as it rises and falls, as well as a time lapse of a marine tanker docking, with the signals received with an RTL-SDR. In a third video pascal also shows a visualization of glider flights tracked via FLARM and the Open Glider Network which also obtains most of it’s data through RTL-SDR contributors.

Cesiumjs is a tool similar to Google Earth. The main difference is that it works on a wider array of devices through a web browser without the need for any plugins. It is often used for visualizing data on the globe. An example of some of its many demos can be found here.

We’re not sure what tools pascal used, but over on GitHub there is a tool called airtrack which can be used together with dump1090 to display flights in real time on Cesiumjs.

Localizing Transmitters to within a few meters with TDOA and RTL-SDR Dongles

Back in August we posted a number of videos from the Software Defined Radio Academy talks held this year in Friedrichshafen, Germany. One of those talks was by Stefan Scholl, DC9ST and titled Introduction and Experiments on Transmitter Localization with TDOA. This was a very interesting talk that showed how Stefan has been using three RTL-SDR + Raspberry Pi setups to locate the almost exact position of various transmitters with time difference of arrival (TDOA) techniques. TDOA works by setting up at least three receivers spread apart by some distance. Due to the speed of radio propagation, the transmitted signal will arrive at each receiver at a different time allowing the physical origin point of the signal to be calculated.

Now over on his blog Stefan has created a very nice writeup of his work with RTL-SDRs and TDOA that is definitely worth a good read. He first explains the basics of how TDOA actually works, and then goes on to explain how his RTL-SDR based system works. He discusses the important challenges such as transferring the raw data, synchronizing the receivers in time and the signal processing required. 

Stefans TDOA System
Stefans TDOA System

He tested the system on various transmitters including a DMR signal at 439 MHz, a mobile phone signal at 922 MHz, an FM signal at 96.9 MHz and an unknown signal at 391 MHz. The results were all extremely accurate, locating transmitters with an accuracy of up to a few meters.

Stefan has also uploaded all his MATLAB code onto GitHub.

Example localization of a DMR transmitter
Example localization of a DMR transmitter
Localizing the position of a mobile phone base station (Stars indicate known base stations)
Localizing the position of a mobile phone base station (Stars indicate known base stations)

Decrambling Split-Band Voice Inversion with the Deinvert Tool

In early September we posted about Oona Räisänen’s deinvert which is a tool that can be used to unscramble voice audio that has had voice inversion scrambling applied to it. Voice inversion works by scrambling the voice frequencies so that a simple eavesdropper will have trouble listening in. A special descrambling radio is required to listen in. This provides very little real security, but may be enough to stop people with cheap scanners from listening in. Oona’s deinvert tool allows us to take a scrambled audio sample recorded with an RTL-SDR or any other radio and decramble the inversion.

In her latest blog post Oona explains how her deinvert software works and how it can also be used to decode the more difficult split-band inversion technique. She also writes that at the default quality level, the deinvert software is fast enough to run in real time on a Raspberry Pi 1.

Deinverting an inverted audio signal
Deinverting an inverted audio signal

Using a TV Antenna Tap as a Directional Coupler for Antenna Measurements with an RTL-SDR

Over on his blog Tomi Engdahl has been exploring his options for measuring the VSWR of antennas with an RTL-SDR. As discussed in one of our previous tutorials, by using an RTL-SDR, noise source and directional coupler it is possible to roughly estimate the resonant frequency of an antenna.

However, being without a directional coupler Tomi looked for other options and realized that cheap TV antenna network taps are also directional couplers. Taps are commonly used with Cable and Satellite TV installations to split a signal from an antenna over multiple TVs. They are designed as directional couplers to ensure that unwanted signals do not feed back into the antenna system and so that there is a pass through port to continue the strong signal down a long cable. 

Note that there is a difference between a tap and a splitter. Taps are used when multiple devices need a signal over a long run of cabling. A splitter divides the signal strength by the number of out ports and can feedback unwanted signals into the system.

Taps vs. Splitter Example (Source: http://forums.solidsignal.com/showthread.php/5843-Solid-Signal-s-WHITE-PAPER-The-NEW-DIRECTV-Residential-Experience)
Taps vs. Splitter Example (Source: http://forums.solidsignal.com/showthread.php/5843-Solid-Signal-s-WHITE-PAPER-The-NEW-DIRECTV-Residential-Experience)

In his tests Tomi found that TV taps worked acceptably well to determine the resonance frequency of an antenna that he was testing. Taps can be found for as cheap as $2 on sites like eBay, although for some listings it is unclear over what frequency range they work well at as sellers assume that they will be used for TV frequencies.

Tomi also tested to see if he could use a signal splitter instead of a directional coupler tap. His results showed that the splitter still worked, and he was able to see the resonant points, but the results where not as good as with the directional coupler.

Measuring the resonant point of a antenna with a noise source, tap, and RTL-SDR.
Measuring the resonant point of a antenna with a noise source, tap, and RTL-SDR.