Category: Digital Signals

halow_scanner: An RTL-SDR Based 802.11aH HaLow Channel Scanner

Over on GitHub we've recently noticed the release of halow_scanner, a Python script that uses an RTL-SDR to scan the 802.11ah (WiFi HaLow) channels in the sub-GHz spectrum to determined which channels have the least noise/interference.

Unlike standard WiFi, which operates outside of the RTL-SDRs range at 2.4 GHz+, 802.11ah operates in the sub-GHz ISM bands, which RTL-SDRs can easily receive.

Use of these lower frequencies gives 802.11ah HaLow excellent signal penetration, making it useful for long-range, low-power IoT devices. With 802.11ah HaLow links, several kilometers can be achieved.

The software's features include:

  • šŸ” Scans all 802.11ah HaLow channels in the US 902-928 MHz band
  • šŸ“Š Supports multiple channel bandwidths: 1, 2, 4, and 8 MHz
  • šŸ“” Uses RTL-SDR for spectrum analysis
  • šŸŽÆ Identifies the cleanest channel with lowest noise floor
  • šŸ“ˆ Provides detailed power spectrum measurements
  • āš” Fast scanning with averaging for accuracy
Comparison Between regular WiFi and 802.11ah HaLow. Source: https://www.gateworks.com/802-11ah-halow-long-range-low-power-wireless-for-iot/
Comparison Between regular WiFi and 802.11ah HaLow. Source: https://www.gateworks.com/802-11ah-halow-long-range-low-power-wireless-for-iot
Ā 

Receiving DAB and FM Signals with an RTL-SDR and Engima2 on OpenPLi 9.0

Thank you to "Radioto bg" from DXing.org for writing in and sharing with us his latest YouTube video showing how to receive DAB and FM signals with an RTL-SDR and the Enigma2 application running on OpenPLi. OpenPLi is an open-source Linux distribution for TV set-top boxes and Engima2 is a TV reception application used within the distribution.

RADIOTO shows how an RTL-SDR can be added to the system, allowing it to also receive DAB+ and FM radio.Ā  In a previous post RADIOTO also showed how the RTL-SDR could be used as a DVB-T receive in Enigma2 and OpenPLi.

Turn Your Enigma2 Receiver into a DAB+ & FM Radio with RTL-SDR v.3! šŸ”„ Full Tutorial with OpenPli 9.0

Reverse Engineering the RF Communications on a 27 MHz RC Toy with an RTL-SDR and GNU Radio

On his blog, Jacob has recently uploaded an interesting post showing how he used an RTL-SDR to reverse-engineer the 27 MHz RF communications protocol used by his kids' RC toy truck.

To reverse engineer the protocol, Jacob used GNU Radio to visualize and demodulate the signal. He discovered that it was modulated via Amplitude Shift Keying (ASK), and viewing the waveform in a time-domain plot confirmed the on-off nature of the signal. Next, using symbol sync and thresholding blocks, he generated a bit pattern, which was then processed using Python.

Reverse Engineering the RC Toy Truck 27 MHz Signal
Reverse Engineering the RC Toy Truck 27 MHz Signal

Creating an Open Source DMR Transceiver with a LimeSDR Mini

Thank you to Adrian Musceac for writing and sharing his article detailing how he implemented an open-source DMR (Digital Mobile Radio) transceiver modem with his LimeSDR Mini and GNU Radio.

DMR is a digital voice communications protocol often used by commercial business band radios, as well as by amateur radio hobbyists.

Adrian explains:

I wrote an article about the implementation of an open-source DMR transceiver using the LimeSDR-mini, GNU Radio and Codec2, which could be used for SDR experiments.

The DMR modem was designed to work both in repeater and direct (DMO) mode, and supports voice and other basic features of the ETSI TS 102 361-1 standard.

In the article there is discussion about aspects of the TDMA transmission, time synchronization, as well as how David Rowe's Codec2 can be used to replace the default vocoder.

The work builds upon Jonathan Naylor's extensive DMR implementation which a large number of amateur radio operators are using as part of MMDVM.

DMR TX Flowgraph
DMR TX Flowgraph
Transmitting DMR with the LimeSDR-mini

Saveitforparts: Snooping on the SatGus Selfie Satellite

SatGus is a recently launched cubesat owned by CrunchLabs/Mark Rober, an extremely popular science and engineering YouTuber. The satellite is designed to take selfies of CrunchLabs customers' own photos in space, using a screen and a selfie camera mounted on the satellite. It then broadcasts the selfie image back down to a CrunchLabs ground station, where it is eventually emailed to the customer. Customers then claim that they've had their selfie taken in space.

Over on the saveitforparts YouTube channel, Gabe has been attempting to listen in on the SatGus downlink using a HackRF and a motorized satellite dish setup. SatGus transmits telemetry at 400.2 MHz and the payload dump at 2,262.5 MHz. While he is able to receive the signal, Gabe notes that it is encrypted, so not much can be done with it.

Snooping On SatGus Again

TechMinds: Building an Automated NavTex Receiver using a Raspberry Pi and SDRplay

Over on the TechMinds YouTube channel, Matt has uploaded a video tutorial showing how to create an automated NavTex receiver using a Raspberry Pi and an SDRplay software- defined radio.

NavTex is a safety and navigational information radio text broadcast system for mariners, typically broadcast at 518 kHz and 490 kHz. On ships, it is typically received by dedicated hardware that prints out information on a piece of paper as it comes in. However, with an appropriate antenna and an SDR, it is possible to receive and decode NavTex signals at home.Ā 

In his video, Matt shows how a Raspberry Pi loaded with a piece of software created by "boat-comm" can be combined with an SDRplay RSPdx to create a homemade automated NavTex receiver. Matt shows how to install the software and goes on to demonstrate it in action.

Currently, only SDRplay receivers are supported by boat-comms software, but it's possible that in the future, other SDRs may be supported, too.

Automated NavTex Receiver Using A Raspberry Pi & SDRPlay SDR

If you're interested, boat-comm also has a video about his software available on his YouTube channel and we've embedded his video below.

NAVTEX on raspberrypi for sailors

CCC Conference Talk: Investigating the Iridium Satellite Network

Over the years, we've posted numerous times about the work of ā€œSecā€ and ā€œSchneider,ā€ two information security researchers who have been investigating the Iridium satellite phone network using SDRs. Iridium is a constellation of 66 satellites in low Earth orbit that supports global voice, data, and messaging services.

In a talk at the Chaos Computer Club (CCC) 2024 conference, they provided updates on their work. The recorded video of their talk has recently been uploaded to YouTube.

The Iridium satellite (phone) network is evolving and so is our understanding of it. Hardware and software tools have improved massively since our last update at 32C3. New services have been discovered and analyzed. Let's dive into the technical details of having a lot of fun with listening to satellites.

We'll cover a whole range of topics related to listening to Iridium satellites and making sense of the (meta) data that can be collected that way:

  • Overview of new antenna options for reception. From commercial offerings (thanks to Iridium Time and Location) to home grown active antennas.
  • How we made it possible to run the data extraction from an SDR on just a Raspberry Pi.
  • Running experiments on the Allen Telescope Array.
  • Analyzing the beam patterns of Iridium satellites.
  • Lessons learned in trying to accurately timestamp Iridium transmissions for future TDOA analysis.
  • What ACARS and Iridium have in common and how a community made use of this.
  • Experiments in using Iridium as a GPS alternative.
  • Discoveries in how the network handles handset location updates and the consequences for privacy.
  • Frame format and demodulation of the Iridium Time and Location service.
38C3 - Investigating the Iridium Satellite Network

DragonBridge: Streaming IQ Data Over 802.11ah HaLow via Two Relay Drones

Aaron, creator of DragonOS, has uploaded a video on his YouTube channel showing him testing out long-range communications via 802.11ah Wireless Networking and a T-HaLow bridge on two drones. 802.11ah (aka HaLow) is a WiFi protocol designed for long range IoT communications of up to 1 km (without obstructions).

In the video, Aaron attempts to stream IQ data with SDR++ over 802.11ah HaLow from a Pi + KrakenSDR operating over 1.6km away. The communication is established via two drones in the air that act as a relay bridge between the two ground stations. Although there are issues with keeping the connection stable, these experiments serve as a great first test of this capability.

Join me on an exciting month long+ journey as I push the boundaries of wireless communication using the Lilygo T-HaLow 802.11ah devices in bridge mode! In this video, I demonstrate how I successfully established an SSH connection from my laptop, across six T-HaLow unitsā€”some mounted on two drones and others on the groundā€”to a Raspberry Pi ground station equipped with DragonOS pi64 and a KrakenSDR.

What You'll See:

Innovative Network Setup: I configured three pairs of T-HaLow units, each pair consisting of an access point and a client. The first pair connected my laptop to the first drone. On each drone, I bridged two T-HaLow units via Ethernet, effectively creating a relay system. The second pair connected the two drones, and the third pair linked the second drone to the ground station Raspberry Pi.

Successful Long-Distance Communication: By the third attempt, I achieved a stable ping across the entire bridge and streamed IQ data from the SDR++ server on the Raspberry Pi to the SDR++ client on my laptopā€”over a distance of 1.6 km between drones!

Challenges and Triumphs: Experience the hurdles I faced, from connectivity issues to environmental obstacles, and how perseverance led to a successful connection.

Stunning Aerial Footage: Enjoy breathtaking drone shots that not only showcase the technology but also add a visual treat to the technical journey.

Why This Matters:

This project highlights the potential of increasing the standoff distance between equipment using 802.11ah technology, also known as Wi-Fi HaLow. Operating in the sub-1 GHz unlicensed bands, 802.11ah offers extended range and improved propagation through obstacles compared to traditional Wi-Fi frequencies. It's designed for low-power, long-range connectivity with lower power consumptionā€”ideal for IoT applications, remote deployments, and innovative projects like this DragonBridge.

Equipment Used:

Building the DragonBridge: Long-Range 802.11ah Wireless Networking with Drones and T-HaLow Devices