Category: Digital Signals

DragonOS: Installing Crocodile Hunter For Detecting Fake 4G Cell Sites

A few days ago we posted about two SDR related DEFCON talks which were recently released. One of the talks was about detecting fake 4G base stations with a bladeRF SDR and a tool they created called "Crocodile Hunter". It is currently compatible with the bladeRF x40 and USRP B200. The talk summary is posted below as it nicely summarizes what fake 4G base stations are and what Crocodile Hunter can do.

4G based IMSI catchers such as the Hailstorm are becoming more popular with governments and law enforcement around the world, as well as spies, and even criminals. Until now IMSI catcher detection has focused on 2G IMSI catchers such as the Stingray which are quickly falling out of favor.

In this talk we will tell you how 4G IMSI Catchers might work to the best of our knowledge, and what they can and can't do. We demonstrate a brand new software project to detect fake 4G base stations, with open source software and relatively cheap hardware. And finally we will present a comprehensive plan to dramatically limit the capabilities of IMSI catchers (with the long term goal of making them useless once and for all).

The Crocodile Hunter software is apparently a little difficult to install and get running, so Aaron who runs DragonOS YouTube tutorial channel has uploaded a video documenting how to install and configure the software. The tutorial assumes that you are the running the latest DragonOS image which already includes a lot of the prerequisite software, and in his example he uses a USRP B205mini-i SDR.

DragonOS DEF CON 28 Crocodile Hunter Setup (DragonOS LTS PublicR4, srsLTE, USRP B205mini-i)

TechMinds: OpenWebRX Feature Overview And Raspberry Pi Setup

Over on YouTube TechMinds has posted his latest video which shows an overview of the features available in OpenWebRX, and also how to set it up on a Raspberry Pi. OpenWebRX is software which allows you to access your SDR remotely via the internet or local network through a web browser. All major SDRs are supported including RTL-SDRs. The software includes a waterfall display, all the standard demodulators, as well as several digital decoders for DMR, YSF, NXDN, D-Star, POCSAG, APRS, FT8, FT4, WSPR, JT65 and JT9.

In the video TechMinds first demonstrates OpenWebRX in action, showing reception of HF SSB amateur radio signals, decoding FT8 and plotting received grids on a map, decoding and plotting APRS on a map and decoding YSF/DSTAR/DMR digital voice. After this demonstration he goes on to show how to set up the OpenWebRX server on a Raspberry Pi via the installation image.

OpenWebRX Feature Overview And Raspberry Pi Setup

MySondy: Radiosonde Tracking Firmware for a TTGO ESP32 LORA Board

A radiosonde is a small sensor and radio package normally attached to a weather balloon. Meteorological agencies around the world typically launch two balloons a day from several locations to gather data for weather prediction. We have featured radiosondes several times on this blog as it is easy to use an RTL-SDR and computer to receive and decode their signals, which can used to hunt down the fallen sonde, or to receive the weather telemetry data.

Recently RTL-SDR.COM reader António submitted a link to an interesting project called "MySondy" which is created by Mirko Dalmonte (IZ4PNN). MySondy is custom firmware for TTGO Lora32 433 MHz boards which allows them to be turned into a radiosonde tracker. A TTGO is a cheap ~US$20 LoRa32 IoT dev board with an onboard WiFi + Bluetooth enabled ESP32 microcontroller and OLED display. Some of the slightly higher priced units come with a built in GPS receiver as well. With the custom firmware it is capable of receiving and decoding common radiosonde protocols such as RS41, M10, RS92 and DFM.

A TTGO ESP32 LoRa Board
A TTGO running MySondy firmware enclosed in a 3D Printed Case

There is also an Android App called MySondy Go and MySondy FINDER which connect to the TTGO via Bluetooth. This app plots the location of the radiosonde on a map, allowing you to easily follow and track down the balloon. You can also go to mysondy.altervista.org to see public MySondy stations. Clicking on a blinking dot will connect you with the MySondy server, allowing you to see tracked sondes.

MySondy Web Interface

The firmware and software appear to be fairly new, so there isn't much information about this that we could find just yet. Also we note that all manuals and information about the project is written in Italian, except for a French magazine article (pdf) that António sent us to upload.

We note that these TTGO ESP32 LoRa boards are quite interesting by themselves, with other custom firmware available to do things like create a Paxcounter which counts the number of mobile devices in an area via WiFi and Bluetooth signals, and the ability to use them as a GPS enabled Mesh network based text message radio.

An Introduction to Radio Trunking Systems with a Focus on P25 and SDR Trunk

Thank you to Carl Makin (VK1KCM) for submitting a video that he produced for his local ham radio club in Australia. In the video Carl first gives an overview on radio trunking systems and explains why they are used to improve spectrum efficiency.

He goes on to focus solely on P25 digital voice trunking networks. Carl is based in NSW, Australia so he talks a bit about what P25 services are available in his area and which ones are unencrypted. Finally he demonstrates the SDR Trunk software decoding one of his local P25 networks with two RTL-SDR dongles, and explains what information we can see in the software.

Carl VK1KCM on P25 Trunked

TechMinds: How to Track Weather Balloons Using SDR

In his latest video Tech Minds has uploaded a video showing how to use an SDR to receive transmissions from radiosondes carried by weather balloons. Every day meteorological agencies around the world launch weather balloons several times a day. Each balloon carries a device called a radiosonde which continuously transmits weather telemetry to a ground station. With an SDR, antenna and free software it's possible to decode these radiosonde signals yourself from home.

In the video Tech Minds uses an RSPdx, SDRuno, VBCable and the RS41 Tracker software to receive telemetry from an RS-41 radiosonde launched in his area. We note that an RTL-SDR and SDR# could also be used. He shows the various bits of weather information available from the telemetry including information like temperature, pressure, humidity and the dew point. GPS and hardware status data is also available. Finally he shows how to view the balloon's flight path in Google Earth.

How To Track Weather Balloons Using SDR

DSD (Open Source) with dPMR Decoding and Windows Binaries Released

Digital Speech Decoder (DSD) is an open source program for decoding signals containing digital speech, such as DMR and P25. The open source version has been mostly surpassed in use over the last few years by the closed source DSD+ version. However, work is still ongoing on the open source version, and a recent fork by Louis-Erig HERVE @LouisErigHerve has added support for Digital Private Mobile Radio (dPMR) decoding.

dPMR is an open, non-proprietary trunked radio standard that supports both data and digital voice transmission. A licence free variation for short range communications called dPMR466 uses the 446.1–446.2 MHz band. Other modes allow for efficient peer to peer to peer operation (mode 1), operation with a base station repeater (mode 2), or with a trunking signal (mode 3).  All dPMR signals operate in FDMA mode with an efficient bandwidth of only 6.25 kHz. dPMR is also known as Icom IDAS and Kenwood NEXEDGE.

Code for Louis-Erig's DSD fork can be found on his GitHub, and he has also released binaries for Windows on his website. Over on his Twitter he has also been mentioning that he has been able to get around the basic privacy modes on DMR.

dPMR radios, data stations and repeater hardware.
dPMR radios, data stations and repeater hardware.

DragonOS: DSP and Signal Analysis with Composable-SDR, Inspectrum and an RTL-SDR

DragonOS is a ready to use Linux OS image that includes various SDR programs preinstalled. The creator Aaron also runs a YouTube channel that contains multiple tutorial videos for DragonOS

One of the latest videos shows us how to use composable-sdr and Inspectrum to capture and analyze signals. Both programs are pre-built into the latest version of DragonOS. Composable-sdr is a set of DSP processing blocks for SDRs embedded in Haskell. One thing it does well is allowing users to easily capture and record demodulated signals for later use via the terminal. Inspectrum is a tool for analysing and reverse engineering signals that have been recorded.

In the video Aaron explores many of the composable-sdr examples discussed on it's GitHub readme page. Including analyzing a wav file recorded with Composable-sdr with Inspectrum and demodulating and recording a wideband FM signal. He also mentions how it's possible to create a PMR446 scanner that records up to 16 channels at once, and how decode helicopter FSK data from audio heard on YouTube (which we mentioned in a previous post).

DragonOS LTS DSP and signal analysis with Composable-SDR + Inspectrum (RTL-SDR)

Tech Minds: Testing the OpenEar DMR TETRA ADSB POCSAG Decoder for RTL-SDR

Back in March we posted about the release of OpenEar, a standalone TETRA decoder for the RTL-SDR. Since then OpenEar has undergone massive developments, not only improving upon the TETRA decoder, but adding DMR, ADS-B and POCSAG decoders as well as a waterfall display.

Recently Tech Minds reviewed this software on his YouTube channel. In the video he shows how to download the software, install the rtlsdr.dll file, and run and use the software. He then demonstrates reception of an amateur radio DMR repeater, reception of POCSAG pager messages and finally reception of ADS-B aircraft messages.

OpenEar Digital Decoder - DMR TETRA P25 ADSB POCSAG RTL-SDR