Category: Applications

Frugal Radio: Testing a Loop on Ground Antenna with an Airspy HF+ Discovery

The KK5JY Loop on Ground (LoG) antenna is a 15 feet per side square loop designed for reception of HF and lower. It simply consists of an isolation transformer and wire that as the name implies is placed somewhere on the ground in a square loop like shape. It is cheap and easy to build and compact in that it does not take up any usable space. 

In his latest video Rob from the Frugal Radio YouTube channel tests out this antenna with his Airspy HF+ Discovery SDR. He uses a bit of wire lying around, and a low cost 9:1 Balun from NooElec as the isolation transformer. With this antenna he was able to pick up signals in the USA and all the way over to Australia from his home in Canada. NDB signals were also receivable.

2022 LoG (Loop on Ground antenna) for SDR radio tested on Airspy HF+ Discovery SDR KK5JY HAM radio

Reverse Engineering a 30 Year Old Wireless Garage Door Opener with a HackRF and GNU Radio

At his childhood home Maxwell Dulin discovered that his garage door was controlled by a 30 year old system called the "Sears Craftsman 139.53708 Garage Door Remote". Being interested in SDRs Maxwell decided to see if he could reverse engineer the remote using his HackRF.

His first steps were to search for the frequency which he found active at 390 MHz. He then moved on to analyzing the signal with Inspectrum, discovering the OOK modulation, then working his way towards the binary control strings. One thing that helped with his reverse engineering was the use of the 9-bit DIP switches on the remote that configure the security code that opens up a specific door as this allowed him to control the transmitted bits, and determine which bits were used for the security code. With this and a bit of GNU Radio code he was able to recreate the signal and transmit it with his HackRF.

Finally Maxwell wanted to see how vulnerable this door is to a brute force attack that simply transmits every possible security code. Through some calculations, he discovered that brute forcing every possible security code in the 9-bit search space would only take 104 minutes to open any garage using this opener.

GNU Radio replaces a 30 year old garage door remote

Remoticon 2021: Smart Meter Hacking Talk

Remoticon 2021 was an online conference held in November 2021 and videos of presentations have recently been uploaded to the Hackaday YouTube channel this month. One very interesting talk was the presentation by Hash Salehi (RECESSIM) on reverse engineering electricity smart meters that are used to remotely monitor and bill home electricity usage in some neighborhoods.

In the past we've posted about Hash (RECESSIM)'s series on smart meter hacking a few times before. In this latest talk Hash summarizes his smart meter hacking experience, talking about how he went from reverse engineering the firmware, to using an SDR to capture and decode information from all the smart meters in his neighborhood, and finally to determining how to actually transmit data to his own smart meter network.

Hackaday have also posted a full writeup on his talk. This is a very in depth reverse engineering project so it is a great talk to learn from.

Remoticon 2021 // Hash Salehi Outsmarts His Smart Meter

Observing the NML Cygni Red Supergiant Star with an Airspy Mini SDR and Home Radiotelescope

Job Genheniau's projects have been featured several times on this blog in the past for imaging the Milkyway and other astronomical objects like supernova's and protostar regions with a 1.8m radiotelescope dish and RTL-SDR or similar SDR.

In his latest achievement Job has noted that he has had some limited success in observing  NML Cygni with his dish and an Airspy Mini SDR. NML Cygni is a 'red hypergiant' star situated within the Cygnus constellation, and it is one of the largest stars by radius known. Prior observations have found that it exhibits a spectral line at 1612.231 MHz.

Job's setup consists of his 1.5m dish (extended to 1.8m with mesh) on a rotor, a custom feed tuned for 1612 MHz, a 0.47dB NF low noise amplifier, an RF filter and an Airspy Mini SDR. Observations were made in SDR# and plotted with Excel.

The NML Cygni hypergiant is difficult for amateur's to observe, and Job notes that he is not aware of anyone previously observing it with a 1.8m dish. He notes that he had 20 failed attempts, but 5 recordings that stood out as possible successes.

However, ultimately Job has been unable to claim that the star was successfully observed, but his results to appear to show some possible success. He notes that some of the uncertainty stems from the fact that on some recordings he observed the peak at the expected -25 km's blueshift expected from the star, however other recordings had the peak at the wrong blueshift.

Job's full report on his observations can be found in this PDF document.

The NML Cygni Red Hypergiant observed with 1.8m dish and Airspy SDR.

An APRS Tracker with HackRF, WebUSB and WASM

Thank you to Radoslav Gerganov for writing in and submitting news about the release of his open source web-based APRS tracker named "aprs-sdr". The web based software turns a HackRF device into a mobile APRS beacon.

Most interestingly the software works via the WebUSB interface, which allows for USB devices like a HackRF SDR to connect directly to the software through USB via the Chrome web browser. So no external app or software needs to be downloaded, all you need to do to run the code is open the hosted aprs-sdr page at https://xakcop.com/aprs-sdr with a Chrome browser, and connect the HackRF to your device.

Radoslav writes further:

The tracker is using the HTML Geolocation API to fetch the device’s location and WebUSB to talk with the SDR. The code which generates the packets is written in C++ and compiled to WASM. You can find the source at https://github.com/rgerganov/aprs-sdr.

And now to some results. I have successfully transmitted packets from my home to LZ0DOE (15km away!) using my Pixel phone, HackRF and ANT500. I find it amazing given the low TX power of HackRF.

Radoslav also notes that in the future he hopes to add other SDRs as well. He also notes that the script seems to work best on desktop Chrome. On mobile Chrome there may be a bug which stops transmission after a few packets.

Using the aprs-sdr WebUSB application.

Receiving X-Band Images from the Arktika-M1 Arctic Monitoring Satellite

Recently on Twitter @arvedviehweger (Arved) has tweeted that he has successfully received images from the Russian Arctic monitoring satellite known as ARKTIKA-M1, via it's X-band downlink at 7865 MHz. We've reached out to Arved and he's provided the following information on his setup and how he's receiving and decoding the images.

 

The Arktika-M1 satellite is a Russian weather satellite which operates in a HEO orbit. It was launched in February 2021 and has downlinks on multiple bands. The main payload downlink for the imagery is on 7865 MHz (which is also known as the lower X-Band). The satellite only transmits imagery on the X-Band at the moment, it is currently unknown whether it will ever transmit any image data on L-Band.

For Amateur reception that means having access to X-Band RF gear. It usually consists of a low noise pre-amplifier and a downconverter to convert 7865 MHz down to a lower frequency for easier reception with a high bandwidth SDR such as the LimeSDR, a USRP etc.

In my personal setup I use a surplus pre-amplifier made by MITEQ (around 36dB of gain, 1dB NF), my own self-made DK5AV compact X-Band downconverter and a LimeSDR-USB.

The L-Band gear is mounted on top (helix and the pre-amp behind it) and the X-Band gear is right below. From left to right you can see the feed, the downconverter (silver box) and the LNA (mounted to a heatsink and a fan). Recording is done with a LimeSDR-USB running at a sample rate of 50 MSPS. The satellite transmits every 15 minutes once it reaches its apogee, each transmission including the idle period lasts for about 10 minutes. Some pictures of the idle transmission and the actual data transmission can be found in this Tweet, [noting that Idle = more spikes, actual data looks weaker]:

Depending on the geographical location a rather large satellite dish is also required for Arktika-M1. Reception reports all over Europe clearly show that the satellite has a beamed antenna (similar to ELEKTRO-L2).

In my setup I can get away with a 2.4m prime focus dish (made by Channel Master) in North Eastern Germany. It produces around 9 - 10 dB of SNR in the demod of @aang254’s excellent SatDump software. Anything above 5dB will usually result in a decode but since the satellite does not have any FEC you will need more than that for a clean picture. (Image of SNR in Satdump)

Frugal Radio: Listening in to Live Theatre Wireless Microphones with an SDR

In one of his latest videos, Rob from the Frugal Radio YouTube channel gives us an interesting alternative way to enjoy a theatre show by demonstrating what he heard on his Airspy SDR when taking it to a Christmas theatre show. In a modern theatre show the actors and actresses typically wear hidden wireless microphones and earpieces, allowing their voices to be amplified and instructions from the producers and directors to be heard. If close enough, these devices can easily be picked up with a SDR and antenna.

In his video Rob explains what sort of radio devices and frequencies are used at the theatre, and despite a few set backs he manages to listen in on these devices from the lobby and from just outside the theatre complex. 

Some of the things he hears includes backstage instructions from the directors and production team and of course audio from the performers, including backstage conversations.

2021 SDR Guide Ep 12 : SDR Theatre fail with my AirSpy R2 and RTL-SDR dipole kit

A Comprehensive Beginners Guide to HRPT Weather Satellite Reception

Over on his blog Derek (OK9SGC) has recently uploaded a very comprehensive beginners guide to receiving HRPT weather satellite images. HRPT reception can be a little daunting as it requires a good L-Band dish setup which involves choosing and building a feed, and importantly, a way to track the satellite with the dish as it moves across the sky. Tracking can be achieved manually by hand, but that can be very difficult and so a motorized tracking mount is recommended.  

This is unlike the much easier to receive NOAA APT or Meteor LRPT satellite signals in the VHF band which can be received by a V-dipole antenna, or the geostationary GOES HRIT satellites that can be received with a WiFi grid dish and LNA. Both of which do not require tracking.

The advantage of HRPT however, is that you end up with high resolution, close-up, and uncompressed images of the earth. For example Derek notes that NOAA APT gives 4km/px resolution, and Meteor LRPT gives much better 1km/px resolution but it is heavily compressed. Whereas HRPT gives peak resolutions of 1km/px uncompressed. There are also nine satellites in operation sending HRPT, so there are more opportunities to receive.

Derek has created a very comprehensive beginners guide that covers almost everything from purchasing and building the hardware, to finding and tracking the satellites, to setting up the software and decoding images. He notes that an RTL-SDR can be used as the receiver, and that a WiFi dish with GOES SAWBird LNA can work, although the difficult tracking requirements are still there so a smaller offset dish with custom helix feed might be preferred. Derek also provides useful tips, like the fact that the NOAA15 HRPT signal is quite a lot weaker than others.

Images from Dereks HRPT Guide