Category: Applications

Meteor M2-3 Now In Orbit and Transmitting Weather Images

Meteor-M satellites are Russian owned weather imaging satellites that are in polar orbit. They transmit images to earth in the LRPT format at 137 MHz, making them almost as easy to receive as the older NOAA APT satellites. Unfortunately all prior Meteor M satellites have suffered an early ending or partial ending to their mission from technical faults or micro-meteorite collisions.

However, on June 27th 2023 the latest Meteor M2-3 satellite was successfully launched on a Soyuz-2 and has been reported to be already transmitting LRPT images of the earth.

Soyuz-2 Launch of Meteor M2-3 and 42 Cubesats

To receive images from the Meteor M2-3 satellite you will need an appropriate 137 MHz satellite antenna such as a v-dipole, Turnstile or QFH. An RTL-SDR or any similar SDR can be used as the receiver. 

These days, the easiest software to use to receive Meteor M2-3 is probably SatDump, whose Windows and Android binary releases can be downloaded from the GitHub Releases page. Linux users can follow the build guide in the SatDump Readme. We note that we've found the SatDump GUI to run well on an Orange Pi 5, which makes this a good portable solution too. 

To determine when the satellite is over your location you can use satellite tracking software such as Gpredict on Linux and Mac, or Orbitron on Windows. (For Orbitron, remember to run the software as Administrator, and to update the TLEs so that the Meteor M2-3 weather.txt TLE tracking data is downloaded). 

More information about Meteor M2-3's operational status can be found on Happysat's page.

Over on Twitter we've already seen various Tweets about successful reception.

@aang254, the author of SatDump has also noted that he is working on finalizing projections for Meteor M2-3 and this should be ready to use in SatDump shortly.

We also note that a Meteor Demodulator has also now just been added to SDR++.

Another interesting fact is that along with Meteor M2-3 the UmKA cubesat was launched will transmit astronomical images at 2.4 GHz. To receive this, you will most likely need a 2.4 GHz WiFi dish, and also a motorized tracking system to track the satellite as it fly's overhead. Decoding of this is already supported in SatDump according to the programmer.

Testing DAB Decoders: SDRAngel versus Welle.io

Thank you to the team from DXing.org for submitting their video where they compare the DAB decoding performance of SDRAngel and Welle.io using an RTL-SDR Blog V3 dongle.

Digital Audio Broadcast (DAB) is a digital replacement for analog broadcast FM. It provides high quality digital audio at the expense of higher cost receivers, and possibly greater difficulty with reception in weak or challenging RF environments. DAB is mostly only used in Europe and Asia Pacific regions, and is not found in the USA. SDRAngel and Welle.io are both RTL-SDR compatible programs with DAB decoding capabilities. Both can run on Android, PC, MacOS and Linux devices.

In their tests they find that the Welle.io DAB decoder works perfectly without issues, however the SDRAngel DAB decoder struggles and has difficulty with decoding. Given that Welle.io is a dedicated DAB decoder, and SDRAngel is a multipurpose tool this could be expected. But we are unsure what is wrong with the DAB implementation in SDRAngel.

The team note that the test was carried out in Sofia, Bulgaria, Europe, using a Serbian DAB+ signal from Yastrebac, with a distance of 175km.

Test android apps with DAB+ signal Welle.io vs. SDRangel, receiver rtl-sdr v.3

OpenWebRX+ Updates: HFDL, ISM Band, FLEX, SELCALL decoders added

Back in March of this year we posted about an OpenWebRX fork called OpenWebRX+, which adds multiple built-in and ready to use decoders such as SSTV, AIS, CW and RTTY. OpenWebRX+ is a fork of the OpenWebRX project which is now officially maintained by DD5JFK.

Since our last post OpenWebRX+ has progressed in development further, and now includes a HFDL decoder via dumphfdl, various ISM band equipment decoders via rtl_433,  FLEX pager decoding via multimon-ng, and a SELCALL decoder has also been added. Many other improvements and changes to the software have also been added, and the full changelog can be viewed here.

OpenWebRX+ is software for Linux. If you want to install OpenWebRX+, an easy path is to use the ready to use Raspberry Pi 4 image available on the releases page, or to use their PPA.

SSTV Image received by the luarvique fork of OpenWebRX. Credit: Neil Howard
SSTV Image received by the luarvique fork of OpenWebRX. Credit: Neil Howard

TechMinds: Detecting Meteors With Software Defined Radio

In his latest video Matt from the TechMinds YouTube channel has shown how it's possible to detect the RF echoes of meteors falling in the earths atmosphere which a software defined radio.

The concept is relatively straightforward. Meteors falling in the atmosphere generate an RF reflective ionized trail, which is highly reflective to RF. In the UK where Matt lives, the Sherwood Observatory of the Mansfield and Sutton Astronomical Society (MSAS) have set up a meteor detection beacon "GB3MBA" which transmits an 80W CW signal at 50.408 MHz.

When tuned to this frequency with an SDRplay RSPdx SDR, Matt shows how the shifted reflections of meteors can be seen as blips around the beacon's carrier frequency. What is also seen are reflections from aircraft which show up as longer doppler shifted lines. Matt notes that if you live within 200km of the beacon a simple dipole antenna is sufficient, however any further might require an antenna system with more gain like a Moxon or Yagi.

We note that in Europe a similar beacon called the GRAVES space radar in France which operates at 143.050 MHz can be used.

Detecting Meteors With Software Defined Radio

Reverse Engineering a Wirelessly Controlled Adjustable Bed with a HackRF and Logic Analyzer

Over on his blog Chris Laplante has written up a post showing how he was able to reverse engineer his wirelessly controlled adjustable "TEMPUR-Contour Elite Breeze" bed. Originally the bed did have an Android App for smartphone control, however it was never updated since 2014 and so it no longer works on his modern Google Pixel device. So in order to have it controllable by his home automation system Chris decided to reverse engineer the wireless signal used by the bed's remote control. 

He first searched the FCC filing, finding that it transmitted in the ISM band at 433.050 to 434.790 MHz. Then using his HackRF he was able to capture the signal and determine that it used Gaussian frequency shift keying (GFSK) modulation.

The GFSK signal from the Tempur Pedic wireless remote control.

While the HackRF got him this far, he decided to follow a new line of investigation next, instead now using a logic analyzer to probe the SPI bus which talks to an Si4431 RF transceiver on the remote control. From this he was able to determine the important properties of the signal such as the frequency, data rate, frequency deviation, channel mapping and packet structure.

With all this information Chris was in the end able to create a product called "Tempur Bridge" that he is now selling on Tindie. It consists of an ESP32 WiFi connected microcontroller and a Si4463 RF transceiver chip. With his product Chris is now able to control his bed through a WiFi connection in Home Assistant.

Chris's TemperBridge product for WiFi control of a Tempur Pedic adjustable bed.

[This story was also seen on Hackaday]

Passive Radar Sensing via Ambient Radio Noise from the Sun and Jupiter

Recently Dr. Sean Peters from the Naval Postgraduate School, in Monterey, CA presented an interesting webinar titled "Leveraging Ambient Radio Noise for Passive Radar Sensing of the Terrestrial and Space Environment".

In passive radar, the radio source is typically an existing powerful terrestrial broadcast station, such as FM, DAB, TV or cellular. However, Dr. Peters makes use of more ambient radio noise sources, such as sun noise, and even noise from Jupiter.

By using Sun noise as the source and an Ettus USRP SDR as the receiver, he's been able to measure the ice sheet thickness at the Store glacier in Greenland. Furthermore he's also been able to utilize sun radio noise and radio noise from Jupiter for passive synthetic aperture radar, with the application being planetary remote sensing.

Traditional active radars transmit a powerful electromagnetic pulse and record the echo’s delay time and power to measure target properties of interest, such as range, velocity, and reflectivity. Such observations are critical for investigating current and evolving conditions in extreme environments (i.e., polar regions and planetary missions); however, existing radar systems are resource-intensive in terms of cost, power, mass, and spectrum usage when continuously monitoring large areas of interest. I address this challenge by presenting a novel implementation of passive radar that leverages ambient radio noise sources (instead of transmitting a powerful radio signal) as a low-resource approach for echo detection, ranging, and imaging. Starting from theory, simulation, and lab-bench testing, I first present the results of our passive radar sounding demonstration using the Sun to measure ice sheet thickness at Store Glacier, Greenland. I then project the passive radar’s performance and ability to provide valuable glaciological observations (such as melt rates, bed reflectivity changes, and englacial water storage) across Greenland and Antarctica.

In the second part of my presentation, I then extend this technique to enable passive synthetic aperture radar (SAR) imaging using radio-astronomical noise sources (e.g., the Sun and Jupiter’s radio emissions). I conclude by highlighting applications of this technique to planetary remote sensing, such as (1) using Jupiter’s HF radio emissions alongside an active VHF radar to characterize and correct for Europa’s ionospheric dispersion during a flyby mission and (2) using the Mars Reconnaissance Orbiter (MRO) Shallow Radar (SHARAD) to analyze solar radio burst candidates for Martian passive sounding.

Leveraging Ambient Radio Noise for Passive Radar Sensing of the Terrestrial and Space Environment

A Video Demonstration on Cracking a GSM Capture File

Over on YouTube Rob VK8FOES has been uploading some fairly comprehensive demonstrations and tutorials showing how to crack a GSM capture file which can be recorded with any SDR.

It's well known now that GSM aka 2G communications are insecure, with the encryption having been breakable on a standard PC for a long time now. It is for this reason that GSM is now mostly phased out, however in many regions the GSM system is still operational in reduced capacity due to some legacy users who are mostly industrial.

In his video Rob makes use of the opensource Airpobe GSM decoder tool, as well as the opensource Kraken tool (not to be confused with KrakenSDR) which is a brute force password cracking tool.

We want to note that doing this is only legal if it is your own communication that has been recorded, or you have permission from the communicating parties.

My GSM cracking content has been getting quite a lot of attention lately. Previous videos of mine relating to this topic were only boring screen recordings with no real explanation on what steps are required to crack the A5/1 stream cipher and decrypt GSM traffic by obtaining the Kc value.

I was bored one day and decided to present a live-style workflow of how hackers and security researchers 'crack' 2G cellular communications in real-time. Be warned that if you don't have an interest in cryptography or cellular network security, you might find this video rather boring.

The GSM capture file used in this video, to my knowledge, has never been publicly cracked before. 'capture_941.8M_112.cfile' was recorded and uploaded with permission by the owner of the data themselves as a decoding example for testing Airprobe.

I make a few mistakes in the video that I can't be bothered editing out. But they are not critical, just myself misreading a number at the 10 minute mark somewhere, and saying the wrong name of a software tool at 17 minutes.

Additionally, l am not a GSM technology engineer, nor a cryptography expert. I do my best to explain these concepts in a simple and easy to understand way. But due to my limited knowledge of these subjects, it's possible that some of this information may be incorrect or lacking context.

However, this video will still allow you to crack a real GSM capture file if you are able to follow along with my flip-flopping style of presentation. Haha. But please, only replicate this tutorial on GSM data that originated from YOUR OWN mobile phone. Do not attempt to decrypt private telecommunications from any other cellular subscriber, EVER.

Video Demonstrating Hydrogen Line Detection with an RTL-SDR and WiFi Dish

Back in January 2020 we posted a tutorial showing how it's possible to detect and measure the galactic Hydrogen line using a simple 2.4 GHz WiFi dish, RTL-SDR Blog V3 and a filtered LNA. Since then many people have used the same setup with great results.

Over on YouTube user stoppi who is one such person who is using the same steps from our tutorial, and he has uploaded a video showing his setup and results. If you're thinking of getting started with Hydrogen Line reception, his video slide show tutorial would be a good complimentary overview to go along with our text tutorial.

Detection of the galactic hydrogen - the 21 cm radiation - Wasserstoffstrahlung der Milchstrasse