Category: Applications

Hacking a Ceiling Fan Radio Control Signal with an RTL-SDR

Over on YouTube "River's Educational Channel" has uploaded a video showing how he was able to reverse engineer the wireless control signal from his ceiling fan remote, and use that information to create a new transmitter controlled via his smart home's Raspberry Pi.

In the video River uses an RTL-SDR and the Spektrum software to initially identify the remotes frequency, before moving on to record the signal in Universal Radio Hacker (URH). He then goes on to reverse engineer the signal and determine the binary control string for each button on the ceiling fan's remote control.

In part 2 which is yet to be released River will show how to transmit this signal via his Raspberry Pi 3B in order to integrate it with his smart home.

Hacking My Ceiling Fan Radio Signal With a $15 USB TV Tuner (RTL2832U)

SATRAN: An Affordable Motorized Satellite Antenna Rotator

Recently we came across the SATRAN project by Daniel Nikolajsen, which is an attempt to design, build and sell low cost kits of an automatic motorized satellite antenna rotator for less than US$200. A motorized satellite antenna rotator is useful for pointing high gain directional antennas such as a Yagi or satellite dish at low earth orbit satellites which can move across the sky quickly. This is also an idea used by the well known SATNOGS project which also provides a design for a 3D printed antenna rotator, and runs servers that archive received satellite data.

Compared to the SATNOGS design, the SATRAN design appears to be much simpler and easier to build. Although being a smaller unit it's only design to handle small compact antennas such as a 70cm Yagi. SATRAN is also controllable via a web interface and there is an Android App. The design is capable of rotating 360 degrees, and 110 degrees from zenith, which allows a user to cover the entire sky.

Daniel notes that SATRAN kits should be available for sale from Feburary/March 2021. He also notes that it is possible to 3D print most of the parts and to just purchase the electronics for a lower price.

More technical information about the project is available on it's Hackaday.io blog.

SATRAN 3D render and actual prototype

Using SDR to Investigate Telemetry Still Broadcasting from 1960’s Satellite Transit-5B5

Thank you to Derek @ok9sgc for pointing us to some work Reddit user u/Xerbot has been doing on receiving telemetry coming down from a "dead" 1960's satellite called Transit-5B5. The fleet of Transit satellites was used for military navigation with the first launch in 1959 and the last in 1988. All in the fleet have since died apart from Transit-5B5 which continues to transmit telemetry at 137 MHz when receiving power from in the sun. Derek writes:

Turns out that the TRANSIT 5B-5 satellite's telemetry still has signs of some of the satellite's systems operating (albeit with a questionable reliability). The satellite represents an amazing legacy for all the people that worked on it in the 1950s and 60s, but due to its age it is also very difficult to find technical documentation about the telemetry (or I should rather say impossible), so to make sense of the data that's being broadcast by the satellite would require many people receiving, decoding, and comparing their results, mainly to identify any patterns in the satellite's behavior and the resulting demodulated data.

Derek and u/Xerbot are asking the SDR community to help collect more sample data, which might help in finding a way to decode some of the telemetry. If you have data to contribute, you can contact @ok9sgc on Twitter, and u/Xerbot on Reddit.

This reminds us of an old post from reader happysat where he demonstrated with an RTL-SDR that many "dead" satellites are actually still transmitting telemetry. Due to suspected chemical breakdown of the onboard batteries, the satellites tend to turn themselves on again when the solar panels receive sunlight.

The Transit-5B5 Satellite Telemetry Signal at 137 MHz

SignalsEverywhere: A Front End GUI Control Head for OP25

Sarah from the SignalsEverywhere YouTube channel is back and this time showing off a new program she has created called "Pi25" or "OP25 Mobile Control Head". The program is a Python GUI for OP25 which runs on almost any platform including Android and Windows. OP25 is an advanced open source digital voice P25 Phase 2 capable decoder which can be used with an RTL-SDR and run on a Raspberry Pi.

Sarah's GUI software allows information from the OP25 software to be displayed on a nice large Android tablet screen, as well as having scanner forward/back buttons, and talkgroup skip and hold controls. This is very useful for in-car control on a mobile setup.

Sarah notes that she is also considering running a Kickstarter for a physical hardware OP25 head unit controller so please let her know in the YouTube video comments if you are interested.

P25 Police Scanner Control Head OP25 SDR Raspberry Pi or Android GUI Front-End

Frugal Radio: SDR Guide Ep 9 – P25 LSM Trunking with one RTL-SDR V3 and DSDPlus

In his latest episode of his SDR Guide series Rob from Frugal Radio provides a walkthrough on using DSDPlus Fastlane to decode trunked P25 with just one RTL-SDR V3 dongle. In the video he explains each of the various DSDPlus windows, and demonstrates decoding of a Simulcast system in his area.

DSDPlus is a program capable of decoding various digital audio protocols such as DMR and P25. The "Fastlane" version is a $25 paid upgrade which allows you to download the latest version that contains more features.

2021 SDR Guide Episode 9 : $25 DSDPlus P25 LSM trunking walkthrough using 1 x $25 RTL-SDRv3

Tech Minds: Decoding Orbcomm Satellites with a Software Defined Radio

Over on his YouTube channel TechMinds has uploaded a new video showing how to decode signals from Orbcomm satellites. Orbcomm run a global network of low earth orbit satellites that perform services such as Internet of Things (IoT), Machine 2 Machine (M2M) communications, asset tracking, utilities telemetry, government communications and much more. The signals can be received at around 137 MHz.

In the video he explains how the private client data is encrypted, however it is possible to at least see the encrypted data coming down, and decode some of the data management information such as the transmitted uplink frequencies using a program called Orbcomm Plotter. Ultimately, the data available is quite boring to monitor, however decoding these satellites is still an interesting exercise.

Decoding Orbcomm Satellite Transmissions Using Software Defined Radio

New SDR# User Guide Available

Paolo Romani IZ1MLL has recently created a SDR# users guide document which comprehensively explains all the features and settings available in the program. SDR# (aka SDRSharp) from Airpsy.com is designed for Airspy SDRs, however it is one of the most popular SDR receiver programs used with RTL-SDRs as well.

Paolo's guide appears to build on our own guide at www.rtl-sdr.com/sdrsharp, providing new information and updates since many changes and new features have been released in SDR# since we wrote that guide a few years ago.

The guide can be found on the airspy.com/download page and is available in English, Italian and Spanish.

SDRSharp Guide

CalibrateSDR: Calibrating your SDR Frequency Offset with DAB+

Thanks to Andreas Hornig who has recently released a new program called "CalibrateSDR" (GitHub code) which is designed to accurately determine the frequency offset of an SDR via an IQ recording of a DAB+ station.

Cheaper RTL-SDR and SDRs use a low quality crystal oscillator which usually has a large offset from the ideal frequency. Furthermore, that frequency offset will change as the dongle warms up or as the ambient temperature changes. The end result is that any signals received will not be at the correct frequency, and they will drift as the temperature changes. Higher end SDRs and improved RTL-SDRs like our RTL-SDR Blog V3 use a temperature compensated oscillator (TCXO) which has a very small frequency offset and very little temperature drift.

CalibrateSDR can be used with almost any SDR to determine the frequency offset. Andreas notes that CalibrateSDR uses the synchronization channel symbols from DAB+ digital audio stations to determine the offset. His post contains a great explanation of how this works. If you don't have DAB+ in your area, an alternative is Kalibrate-RTL which uses GSM cellphone signals to calibrate.

His results were as expected, showing that the generic RTL-SDRs have large frequency offsets, and his RTL-SDR Blog V3 and LimeSDR have much better precision.

The null symbol (lower amplitude portion) and phase reference (Orange) in a DAB+ signal