Category: Applications

Testing the Mayhem Firmware on a HackRF Portapack

The Portapack is an add on for the popular HackRF SDR which allows the HackRF to be used portably without a PC. Recently the cost of this hardware duo has come down to below US$150 due to low cost Chinese clones now being available on the market. Generally the clones are of good quality too.

Once you have the hardware it is possible to install third party custom firmware such as "Mayhem" on the Portapack which enables many features such as the ability to receive and transmit various different types of RF protocols. Back in 2018 we did a review of Mayhems predecessor which was known as the "Havok" firmware. More recently Tech Minds did a video overview of Mayhem.

Now over on his blog A. Petazzoni has started a new blog series which aims to introduce the basics of the Mayhem firmware, including installation and some hands on testing with RF spoofing, denial-of-service (DoS) and replay attacks. Currently only his first post is out, and in the post he show how to install Mayhem onto the Portapack, then goes on to briefly overview some applications such as RF replay attacks, replicating wireless remote controls, receiving and transmitting POCSAG, receiving and transmitting ADS-B, and creating a jammer.

Obviously a lot of what you can do with a Portapack and the Mayhem firmware is extremely illegal and very dangerous, so please do be careful with what and where you transmit especially if you are new to RF hobby. These signals should remain in your test area only, and not leak out into the wider environment.

[Also seen on Hackaday]

HackRF Portapack transmitting a spoofed pager message.

New SDRUno Plugin Video Demos: Frequency Annotation, WEFAX, SSTV, DXToolbox

Earlier this year SDRplay updated their SDRuno software to have plugin functionality. This allows third party programmers to implement their own decoders and software which interfaces with SDRuno directly. Recently we've seen some new plugins become public, and in one of their recent blog posts, SDRplay highlights a few new ones.

SDRplay writes the following about three demonstration videos:

The first shows the latest version of FRAN – a FRequency ANnotation programme, developed by Eric Cottrell – it can read SWSKEDS or .s1b memory bank files and display the active stations from the files on the main spectrum window. This is an example of a Community Plugin

Quick Look at the FRAN Plugin (VID558)

FRAN complements the DX Cluster demo plugin provided by SDRplay. This programme displays DX cluster callsigns on the SDRuno spectrum display. A DX cluster is a network of computers, each running a software package dedicated to gathering, and disseminating, information on amateur radio DX activities. With this plugin you can overlay the DX cluster callsigns as they pop up. There’s a choice of how long you let them display and you can control the way in which they appear. Here we show it successfully tuning in to a US station flagged by the cluster. (The receiver was in the UK):

Quick Look at the DXcluster Plugin (VID560)

Finally there’s this new video showing the new plugin for interfacing the software suite from Black Cat Systems to SDRuno enabling DXToolbox, HF WEFAX and Slow Scan TV decodes:

Quick Look at the Black Cat Systems plugin

Black Cat Systems has a range of software available – more information can be found at: https://blackcatsystems.com/ For more about the SDRuno plugin system for both users and potential developers, go to https://www.sdrplay.com/plugins/

Simple DMR Plugin for SDR# Now Available

Vasili from rtl-sdr.ru has recently released a simple DMR decoder plugin for SDR# to go along with his simple dPMR and TETRA decoders that we posted about earlier.

Simple DMR decoder. No external dependencies, no settings, uses SDR # audio path. Designed for listening to unencrypted DMR channels. The voice from both slots is mixed into one channel.

To install the plugin simply copy the dll's from the zip file into the SDR# folder, then copy the line from the magline.txt text file into the plugins.xml file which can be opened with any text editor.

Simple DMR Decoder Plugin for SDR#

Job’s Radio Telescope: Hydrogen Line Northern Sky Survey with RTL-SDR

We've posted about Job Geheniau's RTL-SDR radio telescope a few times in the past [1] [2] [3], and every time his results improve. This time is no exception as he's created his highest resolution radio image of the Milky Way to date. We have uploaded his PDF file explaining the project here.

Job used the same hardware as his previous measurements, a 1.5 meter dish, with 2x LNA's, a band pass filter and an RTL-SDR. Over 72 days he used the drift scan technique to collect data in 5 degree increments. The result is a map of our Milky Way galaxy at the neutral Hydrogen frequency of 1420.405 MHz.

JRT - Northern sky Hydrogen Line Survey with RTL-SDR

This image is quite comparable to an image shown in a previous post which was created by Marcus Leech from CCERA who used a 1.8m dish and Airspy.

If you're interested in exploring our Galaxy with an RTL-SDR via Hydrogen Line reception, we have a simple tutorial available here. The ideas presented in the tutorial could be adapted to create an image similar to the above, although with lower resolution.

AirNav 20% Off ADS-B Hardware Black Friday/Cyber Monday

AirNav is the company behind RadarBox24.com, a flight data aggregation service similar to sites like FlightAware.com and FlightRadar24.com. RTL-SDR hardware is typically used to receive ADS-B, and like other providers AirNav have their own custom ADS-B optimized RTL-SDR unit. In addition they sell RTL-SDR's optimized for UAT 978 MHz and the VHF Airband. They also have a range of ADS-B/UAT/VHF airband outdoor antennas as well as filters.

Currently their products are discounted by 20% for Black Friday/Cyber Monday sales. The discount is available on Amazon, as well as directly from their store with coupon GET20.

Searching For Extraterrestrial Intelligence (SETI) with a HackRF

The Search for Extraterrestrial Intelligence (SETI) is an ongoing project that aims to detect radio signals originating from intelligent species somewhere in the universe. Recently Alberto Caballero, a SETI researcher has been proposing a distributed search (project pdf document) with amateur and/or professional radio telescopes. The idea is that multiple stations around the world would monitor a single star for a period of time in order to collect data 24/7. To participate the requirements are a dish 2.1 meters or larger, a motorized mount, and a feed, LNA and radio system able to receive 1 - 4.5 GHz.

An example of a SETI station can be found at SETI Net. Here the owner has a 3M dish on a rotor connected to a HackRF. An LNA and band pass filter are also used at the feed end. SDR Console or SDR# is used to monitor a specific frequency, and the audio is sent into a special automatic SETI analysis program as well as spectrum analysis software. If an interesting signal is detected the software notifies the user, then further analysis can be undertaken.

If you have a suitable radio telescope available and want to participate, you can contact the SETI project via their contact form.

SETI Net Block Diagram

FengYun-2H/G Geostationary Weather Satellite Now Decodable with 120cm Dish (Europe to Australia Coverage)

Hot on the heels of the GOES-13 weather satellite decoder that we posted about a few days ago, @aang254 has just released a new RTL-SDR compatible decoder for the FengYun-2H, 2G and possibly 2E geostationary weather satellites.

The FengYun-2 line of weather satellites are the Chinese equivalents to GOES, and they are positioned to cover parts of Europe, Africa, the Middle East, Asia, Russia, and Australia. So this is another geostationary weather satellite now available to Europeans which broadcasts in the L-Band at 1687.5 MHz. And unlike the weaker GOES-13 L-Band downlink, the FengYun-2 downlink is much stronger which means that reception with a 120cm satellite dish should be possible. We note that it has not yet been confirmed if the typical 90-100 cm WiFi dishes used with GOES-16 and 17 will be big enough to work. @aang254 writes:

Yesterday I successfully decoded the S-VISSR downlink from FengYun-2H thanks to a recording by @MartanBlaho. It is stronger than PDR on EWS-G1 (see Zbychu's signal twitter.com/ZSztanga/statu) meaning it should (untested) be doable with a 120cm (or smaller but no confirmation again) dish instead of 180cm.

It covers parts of Europe, Russia and down to Australia. FY-2G and FY-2E (no confirmation for this one yet) are also decodable in the same way. I released an early decoder, that currently is not suitable for automated setups but allows getting images already. A later version (that should come soon-ish) will allow live decoding / autonomous setups in a similar fashion to other satellites.

Also, the res is 2km/px on VIS and 8km/px on IR, so half that of GOES-13 with similar-ish coverage (Europe is less visible though).

(also forgot to say but the bandwidth is under 2Mhz, allowing a rtlsdr to be used)

https://github.com/altillimity/S-VISSR-Ingestor

FengYun 2H (Left) / 2G (Right) Coverage
FengYun-2H Image Courtesy of @ZSztanga and inverted by @petermeteor

Video Tutorial on Debugging RF Emissions on a Circuit Board with an RTL-SDR

Over on the Hackaday YouTube channel a video by Alex Whittemore has been uploaded showing how to do some basic RF emissions debugging. When creating electronic products it's important to ensure that there is no unintentional RF leakage in excess of emissions standards, and there is often a need to debug a circuit board to determine exactly what part or areas are generating excessive RF noise. To do this expensive EMC analyzers and near field probes are typically used.

Alex's tutorial video shows us how we can create a low cost home made EMC probe using an RTL-SDR, LNA and home made near field probe made out of magnet wire. The video starts by explaining RF compliance, demonstrating some higher end equipment, then moves on to showing how to build a probe yourself, before finally demonstrating it being used on some circuit boards. For software, he uses SDRAngel and QSPectrumAnalzyer which are preinstalled on a DragonOS image. 

The Hacakday.io project page has the tutorial in text and the video slides can be found here.

In the past we've also seen another post about home made EMC probes, and how to combine this idea with OpenCV to create noise heatmaps of circuit boards.

Basics of RF Emissions Debugging: Alex Whittemore