Category: Digital Signals

Decoding the ARES Train Protocol with an RTL-SDR

Over on YouTube user JellyImages has uploaded a video demonstrating his Windows based ARESrcvr software. ARES is a railway control communications protocol used by some trains in the USA. His code connects to an RTL-SDR dongle, and demodulates the ARES protocol, providing decoded packets to ATSCMon via UDP on localhost.

ATSCMon allows you to view train telemetry data, and see on a rail map where that control indication came from. It appears that ATSCMon actually already supports ARES decoding via audio piping, but the decoder by JellyImages is a cleaner solution that doesn't require audio piping. In the past we've posted about one other YouTube user whose uploaded videos on using ATSCMon to monitor trains [Post 1][Post 2].

JellyImages also notes that his software only supports the ARES protocol which is used mostly around former Burlington Northern (BN) territory in the USA.

Introducing ARESrcvr

YouTube Video: Reverse Engineering with SDR

Over on YouTube Black Hills Information Security (aka Paul Clark) has uploaded a one hour long presentation that shows how to use a software defined radio to reverse engineer digital signals using GNU Radio.

One of the most common uses of Software Defined Radio in the InfoSec world is to take apart a radio signal and extract its underlying digital data. The resulting information is often used to build a transmitter that can compromise the original system. In this webcast, you'll walk through a live demo that illustrates the basic steps in the RF reverse engineering process, including:

- tuning
- demodulation
- decoding
- determining bit function
- building your own transmitter
- and much, much more!

Reverse Engineering with SDR

WWV and WWVH Special Messages to Broadcast!

Starting from Monday September 16th and continuing through to October 1st, both WWV and WWVH shortwave time signal transmission stations will broadcast a special message from the Department of Defense to mark the centennial of WWV. These messages will be heard on 2.5, 5, 10, and 15 MHz. In addition from September 28 to October 2 a special WWV event will occur:

The world’s oldest radio station, WWV, turns 100 years on October 1, 2019, and we are celebrating!

From September 28 through October 2, 2019, the Northern Colorado ARC and WWV ARC, along with help from RMHam, FCCW, and operators from across the country, are planning 24-hour operations of special event station WW0WWV on CW, SSB and digital modes. Operations will shift between HF bands following normal propagation changes and will include 160m and 6m meteor scatter. We will be operating right at the WWV site and face a challenging RF environment.

WWV is a [NIST] operated HF station based in Fort Collins, Colorado. It continuously broadcasts a continuous Universal Coordinated Time signal in addition to occasional voice announcements. It has been on the air since 1919 but began continuous broadcasts in 1945 from it’s final site in Fort Collins, Colorado. WWVH is a similar time signal, but based in Hawaii.

The WWV Transmit Building

The WWV time signal can be used to automatically set RF enabled clocks to the correct time. [Andreas Spiess] on YouTube recently uploaded a video where he emulates this signal in order to control clocks within his home. This is a great watch if you’d like to learn more about how these time signals work.

The time format itself is actually pretty simple and it’s possible to emulate with a number of devices from an Arduino to Raspberry Pi and of course Software Defined Radio.

Remote Controller for Clocks (IKEA and others, DCF77, WWVB, MSF, JJY)

Mike Tests out L-Band STD-C and AERO with a Low Cost Modified GPS Antenna

SDR-Kits.net have begun selling low cost GPS antennas that are modified to receive the Inmarsat satellite frequencies between 1535 MHz to 1550 MHz. They also have a version for Iridium satellites that receives 1610 MHz to 1630 MHz. The antennas are powered by a 3-5V bias tee, so they should work fine with SDRplay, Airspy and RTL-SDR Blog V3 units.

Mike Ladd from SDRplay has recently sent us a guide to receiving AERO and STD-C messages on L-band with the SDR-Kits antenna and an SDRPlay unit running SDRUno (Megaupload link).

AERO messages are a form of satellite ACARS, and typically contain short messages from aircraft. It is also possible to receive AERO audio calls. STD-C aka FleetNET and SafetyNET is a marine service that broadcasts messages that typically contain text information such as search and rescue (SAR) and coast guard messages as well as news, weather and incident reports. Some private messages are also seen. To decode AERO Mike uses JAERO, and for STD-C he uses the Tekmanoid STD-C decoder.

Mike has also created a very handy bank of frequencies for the SDRUno frequency manager which can be downloaded from here.

We note that if you're interested in waiting, at the end of September we will have an L-band patch antenna set available too. Our antenna will work from 1525 up to 1637 MHz. Prototypes have shown have shown good Inmarsat, Iridium and GPS reception. More details coming next month when manufacturing gets closer to finishing up.

Screenshot of the Tekmanoid Decoder from Mikes Tutorial
Screenshot of the Tekmanoid Decoder from Mikes Tutorial

Decoding PAL Video from a Nintendo with an Airspy SDR

Oona (also known as [Windytan] and @windyoona) was recently looking for a way to capture PAL composite video from her old 1980’s Nintendo Entertainment System (NES) without spending a bunch of money on what are often poor video capture cards. As she already owned an Airspy SDR she decided to receive the PAL signal with the Airspy and modify some software to act as a PAL decoder.

PAL decoding was handled via some modifications to her private Tempest software. Normally Tempest type programs like TempestSDR that we covered in a [previous article] are used to spy on computer/TV monitors from signals that are unintentionally emitted in the surrounding area.

Oona has made the connection from the composite output directly to the SDR antenna input so it’s not unexpected that you’d have a strong signal. However, I have to admit that’s an incredibly clear image for a video being demodulated via a software radio.

What makes this an even more amazing feat is that the latency is low enough that it’s nearly playable using a computer and SDR in place of a television set.

We note that we’ve also seen SDRs used to decode standard PAL TV broadcasts before with an SDR# plugin called TVSharp.

WebWSPR: A Browser Based WSPR Decoder and Visualization Tool

A few days ago we posted about [dj0abr / Radio Electronics'] WebSDR software for QO-100. Having looked through his GitHub we've seen that he also has an a similar browser based server tool called WebWSPR for WSPR decoding and visualization (click with WebWSPR link) which was released earlier this year.

WSPR is an amateur radio digital HF mode designed to be decodable even if the signal is transmitted with very low power and is very weak. It can be used to help determine HF radio propagation conditions as WSPR reception reports are typically automatically uploaded to wsprnet. In the past we have been able to receive WSPR and similar modes like FT8 with our RTL-SDR V3 running in direct sampling mode.

Like his QO-100 WebSDR software, WebWSPR is designed to run on a single board computer like a Raspberry Pi or any Linux machine. It serves a web page that shows the WSPR waterfall, decoded data and has various WSPR related control options. The web page can be accessed remotely from any machine on the same network as the server, or could be put on the internet with port forwarding and a hostname service like noip.

A ready to use Raspberry Pi image for WebWSPR is available here (does not seem to support the latest Pi4 or 3B+ however). Manual installation instructions can be found here. The code is all open source and available on GitHub.

The software appears to take input from the soundcard for standard hardware receivers, but it should be possible to pipe audio from an RTL-SDR into pulseaudio, which the software can then use. The instructions from our RTL-SDR V3 WSJT-X tutorial may help.

WebWSPR Browser Screenshot
WebWSPR Browser Screenshot

SDRTrunk 0.4.0 Alpha 9 Updates Highlighted

You may recall that a few years ago we released a tutorial on how to set up and use [SDRTrunk]. Fast forward a few years and the software has seen numerous changes. This application was designed primarily for tracking trunking radio systems but also has the ability to decode things like MDC-1200, LoJack and more.

The software is compatible with many Software Defined Radios such as our RTL-SDR v3, HackRF and the Airspy. Some of the newer improvements include a bundled copy of java so that an installation of java is not required on the host computer, as well as decoding improvements for P25 among other digital voice modes. You can find a full list of improvements along with the latest release on [GitHub]

The biggest feature many have been waiting for is the ability to import talk groups for their radio system into the application from radio reference. While this has not yet been implemented, user [Twilliamson3] has created a [web application] that will convert table data from radio reference into a format that is supported by SDRTrunk.

SDRTrunk Screenshot
SDRTrunk Screenshot

Investigating the Galileo Satellite Navigation System Outage with a LimeSDR

Galileo is a European Union owned satellite navigation system. Galileo was created so that the EU does not need to rely on the US GPS or the Russian GLONASS satellites, as there is no guarantee that these systems won't be purposely turned off or degraded by their governments at any time.

Unfortunately since July 11 the Galileo system has been out of service. Not much information about the outage has been provided, but it appears to be related to problems with the Italian ground based Precise Timing Facility which consists of two ultra high precision atomic clocks that keep the Galileo systems' reference time. (We note that recently within the last few hours of this post, most satellites seem to have come back into operational status, but the EGSA website still reports an outage.)

Over on his blog, Daniel Estevez has been using his LimeSDR and a small patch antenna to gather some more information about the outage directly from the Galileo satellites. His investigations found that the modulation and signal itself are still working correctly. However, by using the GNSS-SDR software to investigate the signal data he was able to obtain the ephemeris, and see that the ephemeris is stuck in the past. The ephemeris data is used to calculate compensations for orbital drift and without frequent ephermis updates, orbital errors add up within hours resulting in poor positioning accuracy. In order to generate the ephermis, the Precise Timing Facility must be operational.

Daniel's post goes into further technical details about the information he's collected, and it's definitely an interesting read. One interesting bit of information that you can read from his post explains why the service has gone from initially just heavily degraded accuracy from July 11, to completely nonsense results from July 15 onwards.