By first looking at the old FCC label on the keypad, Veghead discovered that the device transmitted between 319 MHz and 340 MHz. He then used his RTL-SDR dongle to take a recording of the transmitted signals, before opening them up in Audacity – a free audio processing program.
By analyzing the waveform in Audacity, Veghead discovered that the alarm panel uses simple ON-OFF Keying (OOK) modulation. Although the frequency of the signal drifted a lot (probably due to aged components), he was able to write a decoder that he called cletus which converts the recorded complex I/Q signal into a real signal and then uses a state machine to turn the waveform into 1’s and 0’s. Finally the program then outputs the correct button that was pressed to the terminal.
Vintage wireless alarm keypad reverse engineered with an RTL-SDR
The “ADS-B on Android” app has been updated and now supports the reception and display of 978 MHz UAT FIS-B Weather and Traffic data. The app also receives ADS-B data as per normal. To use the app you will need an RTL-SDR dongle and a USB OTG cable.
UAT stands for Universal Access Transceiver and is a protocol similar to ADS-B that is used mainly by smaller aircraft in the USA. UAT has some extra features for pilots compared to ADS-B. In addition to location information UAT provides a Traffic Information Service (TIS-B) which allows pilots in the air to see what ground control sees on their traditional RADAR system. It also provides a Flight Information Service-Broadcast (FIS-B) which includes NEXRAD weather data and other information. NEXRAD is an array of ground station weather radars that are used to provide pilots with accurate maps of precipitation and wind.
The free version of the app has ads and does not display NEXRAD weather radar on the default map. The pro version removes the ads and allows you to display a NEXRAD overlay on the map. It costs $2.50 USD.
A pulsar is a rotating neutron star that emits a beam of electromagnetic radiation. If this beam points towards the earth, it can then be observed with a large dish antenna and a radio, like the RTL-SDR. The abstract of the paper reads:
This project sought to determine the minimum useful antenna aperture for amateur radio astronomers to successfully detect pulsars around the Hydrogen line frequency of 1420MHz. The technique relied on the collaboration with GM Gancio, who provided RTL SDR data of the Vela pulsar (B0833-45, J0835-4510) and others, collected with a 30m radio telescope. This data was processed to determine the achievable signal-to-noise ratio from which, the minimum useful dish size necessary for some effective amateur work, could be calculated. Two software packages were developed to do synchronous integration, a third to provide a power detection function and a fourth for spectrum analysis to recover pulsar rotation rate.
With their system the authors were able to detect and measure the rotation period of the Vela pulsar. Also, from their data they were able to estimate that the minimum dish aperture required to observe the Vela pulsar would be 6m, noting that the Vela pulsar is probably the strongest pulsar ever detected. They also write that by utilizing 5 RTL-SDRs to gather 10 MHz of bandwidth together with some processing that the minimum required dish aperture could be reduced to 3.5m.
The Vela pulsar pulse power integrated over a 50 second 100MB file, combining some 560 pulsar pulses.
Results from air cooling the RTL-SDR.The air cooled and heat sinked RTL-SDRs
All of Peters papers can be found on his website at y1pwe.co.uk/RAProgs/index.html. He has many RTL-SDR radio astronomy related resources there, so check it out if you are interested.
Bus sign: Wireless bus telemetry updates this sign.
A similar reverse engineering of bus telemetry was performed before by Oona Raissan in Helsinki, Finland. Oona found that in Helsinki bus telemetry was transmitted as a DARC subcarrier embedded in regular broadcast FM radio. In many countries bus telemetry runs through GSM or TETRA communications as well, which are encrypted and would be very difficult to decode.
However in Paderborn, Germany Bastian discovered that the bus telemetry system used a different protocol which he discovered by noticing that some very strong signals appeared on his spectrum at 150.9 MHz whenever a bus drove by his flat.
After making a recording of this signal in GQRX, bastian analysed it in Audacity and discovered that the binary data bits were encoded by the presence or absence of a half sine wave. After discovering the encoding he was then able to determine the bit rate and build a decoder in GNU Radio. His post goes into further detail about concepts he used in his GNU Radio program such as frame detection, bit stuffing and error detection.
Finally, with all his decoder program written he was able to gather lots of data from each packet such as the bus ID, line, bus stop, distance from last bus stop, delay, position and even the orientation of the bus. Bastian has also uploaded a video showing everything in action, which we have embedded below.
Bus position heatmap from data obtained via the RTL-SDR
A reader of our blog, EBC81, has written in to let us know about a new RTL-SDR based AIS decoder that he has written for the Android OS. AIS stands for Automatic Identification System and is used by ships to broadcast their GPS locations, to help avoid collisions and aid with rescues. An RTL-SDR with the right software can be used to receive and decode these signals, and plot ship positions on a map.
EBC81’s program is called rtl_ais_android and can be downloaded from this GitHub link. It decodes the AIS data into NMEA messages, which can then be sent via UDP to mapping programs in Android or a program like OpenCPN on your PC. To use the app you will need a USB OTG cable to connect your Android device to the RTL-SDR.
In the future EBC81 hopes to create a second app which will display the ship positions on a map.
Inmarsat is a communications service provider with several geostationary satellites in orbit. They provide services such as satellite phone communications, broadband internet, and short text and data messaging services. Geostationary means that the satellites are in a fixed position in the sky and do not move. From almost any point on earth at least one Inmarsat satellite should be receivable.
Inmarsat transmits in the L-band at around 1.5 GHz. With an RTL-SDR dongle, a cheap $10 modified GPS antenna or 1-2 LNA's and a patch, dish or helix antenna you can listen to these Inmarsat signals, and in particular decode one channel known as STD-C NCS. This channel is mainly used by vessels at sea and contains Enhanced Group Call (EGC) messages which contain information such as search and rescue (SAR) and coast guard messages as well as news, weather and incident reports. More information about L band reception is available at UHF-Satcoms page. See the end of this post for a tutorial on modifying a GPS antenna for Inmarsat reception.
Some examples of the EGC messages you can receive on the STD-C NCS channel are shown below:
Military Operations: Live Firing Warning
STRATOS CSAT 4-AUG-2015 03:21:25 436322
SECURITE
FM: RCC NEW ZEALAND 040300 UTC AUG 15
COASTAL NAVIGATION WARNING 151/15
AREA COLVILLE, PLENTY
CUVIER ISLAND (REPUNGA ISLAND), BAY OF PLENTY
1. LIVE FIRING 060300 UTC TO 060500 UTC AUG 15 IN DANGER AREA NZM204.
ANNUAL NEW ZEALAND NOTICES TO MARINERS NUMBER 5 REFERS.
2. CANCEL THIS MESSAGE 060600 UTC AUG 15
NNNN
Armed Robbery / Pirate Warning
NAVAREA XI WARNING
NAVAREA XI 0571/15
SINGAPORE STRAIT.
ARMED ROBBERY INFORMATION. 301845Z JUL.
01-04.5N 103-41.8E.
FIVE ROBBERS ARMED WITH LONG KNIVES IN A SMALL UNLIT HIGH SPEED BOAT APPROACHED A BULK CARRIER UNDERWAY. ONE OF THE ROBBERS ATTEMPTED TO BOARD THE SHIP USING A HOOK ATTACHED TO A ROPE. ALERT CREW NOTICED THE ROBBER AND RAISED THE ALARM AND CREW RUSHED TO THE LOCATION. HEARING THE ALARM AND SEEING THE CREW ALERTNESS, THE ROBBERS ABORTED THE ATTEMPTED ATTACK AND MOVED AWAY. INCIDENT REPORTED TO VTIS SINGAPORE. ON ARRIVAL AT SINGAPORE WATERS, THE COAST GUARD BOARDED THE SHIP FOR INVESTIGATION.
VESSELS REQUESTED TO BE CAUTION ADVISED.
Armed Robbery / Pirate Warning
NAVAREA XI WARNING
NAVAREA XI 0553/15
SINGAPORE STRAIT.
ROBBERY INFORMATION. 261810Z JUL.
01-03.6N 103-36.7E.
DUTY ENGINEER ONBOARD AN UNDERWAY PRODUCT TANKER DISCOVERED THREE ROBBERS IN THE ENGINE ROOM NEAR THE INCINERATOR SPACE. THE ROBBER THEIR BOAT. A SEARCH WAS CARRIED OUT. NO ROBBERS FOUND ON BOARD AND NOTHING REPORTED STOLEN. VTIS SINGAPORE INFORMED. COAST GUARD BOARDED THE TANKER FOR INVESTIGATION UPON ARRIVAL AT SINGAPORE PILOT EASTERN BOARDING AREA.VESSELS REQUESTED TO BE CAUTION ADVISED.
CANCEL 0552/15.
Submarine Cable Repair Warning
NAVAREA XI WARNING
NAVAREA XI 0569/15
NORTH PACIFIC.
SUBMARINE CABLE REPAIRING WORKS BY
C/V ILE DE SEIN. 05 TO 20 AUG.
IN VICINITY OF LINE BETWEEN
A. 21-37.3N 156-11.5W AND 25-03.6N 148-43.2E.
CANCEL THIS MSG 21 AUG.
Search and Rescue - Missing Vessel
ON PASSAGE FROM LAE (06-44S 147- 00E) TO FINSCHHAFEN (06-36S 147-51E), MOROBE PROVINCE. VESSEL DEPARTED LAE AT 310500Z JUL 15 FOR FINSCHAFFEN WITH ETA OF 310800Z JUL 15 BUT FAILED TO ARRIVE.
ALL VESSELS REQUESTED TO KEEP A SHARP LOOKOUT AND BE PREPARED TO RENDER ASSISTANCE. REPORTS TO THIS STATION OR MRCC PORT MORESBY VIAEMAIL: ******@****.***.**, TELEPHONE +*** *** ****; RCC AUSTRALIA VIA TELEPHONE +*********** INMARSAT THROUGH LES BURUM (POR ***,IOR***), SPECIAL ACCESS CODE (SAC) **, HF DSC *******
NL BURUM LES 204 4-AUG-2015 03:23:14 773980
AMSA_ER 23150928
PAN PAN
FM JRCC AUSTRALIA 030858Z AUG 15 INCIDENT 2015/5086
AUS4602 CORAL AND SOLOMON SEAS
23FT WHITE BANANA BOAT WITH BROWN STRIPES, AND A 40HP OUTBOARD AND 5 ADULT MALES IS OVERDUE ON PASSAGE FROM LAE (06-44S 147- 00E) TO FINSCHHAFEN (06-36S 147-51E), MOROBE PROVINCE. VESSEL DEPARTED LAE AT 310500Z JUL 15 FOR FINSCHAFFEN WITH ETA OF 310800Z JUL 15 BUT FAILED TO ARRIVE.
ALL VESSELS REQUESTED TO KEEP A SHARP LOOKOUT AND BE PREPARED TO RENDER ASSISTANCE. REPORTS TO THIS STATION OR MRCC PORT MORESBY VIA EMAIL: *******@****.***.**, TELEPHONE +*** *** ****; RCC AUSTRALIA VIA TELEPHONE +************ INMARSAT THROUGH LES BURUM (POR ***,IOR ***), SPECIAL ACCESS CODE (SAC) **, HF DSC *********, EMAIL: ******@****.***.** OR BY FAX +************.
NNNN
Scientific Research Vessel Drilling - Request for wide clearance
NL BURUM LES 204 4-AUG-2015 02:29:41 709950
AMSA_ER 23153978
SECURITE
FM JRCC AUSTRALIA 040224Z AUG 15
AUSCOAST WARNING 202/15
SPECIAL PURPOSE VESSEL JOIDES RESOLUTION CONDUCTING DRILLING OPERATIONS IN POSITION 28 39.80` S 113 34.60` E
2.5NM CLEARANCE REQUESTED.
NNNN
Weather Warning
PAN PAN
TROPICAL CYCLONE WARNING / ISSUED FOR THE NORTH OF EQUATOR OF METAREA
XI(POR).
WARNING 050900.
WARNING VALID 060900.
TYPHOON WARNING.
TYPHOON 1513 SOUDELOR (1513) 930 HPA
AT 19.9N 133.2E WEST OF PARECE VERA MOVING WEST 12 KNOTS.
POSITION GOOD.
MAX WINDS 95 KNOTS NEAR CENTER.
RADIUS OF OVER 50 KNOT WINDS 80 MILES.
RADIUS OF OVER 30 KNOT WINDS 240 MILES NORTH SEMICIRCLE AND 210 MILES
ELSEWHERE.
FORECAST POSITION FOR 052100UTC AT 20.1N 130.6E WITH 50 MILES RADIUS
OF 70 PERCENT PROBABILITY CIRCLE.
935 HPA, MAX WINDS 90 KNOTS NEAR CENTER.
FORECAST POSITION FOR 060900UTC AT 20.8N 128.1E WITH 75 MILES RADIUS
OF 70 PERCENT PROBABILITY CIRCLE.
935 HPA, MAX WINDS 90 KNOTS NEAR CENTER.
JAPAN METEOROLOGICAL AGENCY.=
Pete’s tutorial starts from a fresh install of Ubuntu and uses GQRX, GNU Radio Companion, WxtoIMG and the MeteorM2 decoding tools. He shows how to set up the audio piping within Linux, how to run the MeteorM2 LRPT Offline decoder Windows tool in Wine, a Linux Windows emulator and how to use WxtoIMG together with GQRX.
The NOAA and Meteor M2 weather satellites transmit images that they have taken of the earth. With an RTL-SDR and appropriate antenna you can receive these images. On this blog we have Windows tutorials on receiving NOAA and Meteor M2 satellites.
The Windows LRPTOfflineDecoder tool running in Linux with Wine.
Over on YouTube user pe1etr has uploaded a tutorial video showing how to set up RDS Spy and SDR# for monitoring RDS. RDS stands for Radio Data System and is a sub carrier added to some FM broadcast signals which carries information such as the station name, the song/programme playing and other data. Although SDR# decodes RDS stations already, a more powerful RDS decoder and monitoring tool is RDS Spy. To get RDS Spy to work with SDR# you need to use a special plugin called MPX Output, which allows SDR# to output audio that includes the RDS subcarrier, which can then be piped via a virtual audio cable to RDS Spy.
Pe1etr’s video shows how to install the MPX Output plugin, how to set it up with virtual audio cable and how to use it with RDS Spy.
Tutorial: Using RDS Spy with the SDR# mpx output plug-in
