Category: Digital Signals

Recovering 433MHz Messages with RTL-SDR and MATLAB

Recently RTL-SDR.com reader Ilias wrote in to let us know about a post he uploaded to his blog showing how he was able to decode data from a device transmitting at 433 MHz using an RTL-SDR and MATLAB. MATLAB is a technical computing language that can be used for signal analysis and processing. His post clearly explains the steps he took and is a great aide for anyone wanting to learn about decoding simple signals.

The goal of Ilias’ project was to be able to use the RTL-SDR and MATLAB to uncover the details of a 433 MHz transmitter he bought on Ebay. He wanted to see if he could determine the protocol and recover the data before even looking at the transmitter’s library code.

To do this he first used SDR# to record the data sent at 433 MHz. Then by looking at the waveform in the Audacity audio editor he was able to determine that the signal was on-off-key (OOK) modulated and from this knowledge he was able to manually recover the binary string. Next he used MATLAB to create a program that can automatically decode the received OOK signal. His post goes into further detail about the signal processing steps he took in MATLAB.

433 MHz OOK Transmitter
433 MHz OOK Transmitter

New RTL-SDR Radio Data System (RDS) Decoder: Redsea

Signals hacker Oona Räisänen has released on GitHub a new software tool for the RTL-SDR called Redsea. On her blog she explains that Redsea is a Linux and OSX compatible perl based command line Radio Data System (RDS) decoder that uses the rtl_fm tool. Oona’s post explains a little about how RDS works and also explains how her software actually decodes RDS.

The Radio Data System (RDS) is a digital data subcarrier built into some broadcast FM signals. It usually carries information such as the station name and the song currently playing.

RDS Waveforms
RDS Waveform Decoding Steps

Listening to NXDN with SDRSharp, the AuxVFO Plugin and DSD+

Over on YouTube user John Miller has uploaded a video showing how he receives NXDN digital audio using a combination of SDR#, the AuxVFO plugin and DSD+. He writes:

I have it set with 5 auxiliary VFO’s one for each channel of the Christian Co NXDN system from the Kelly Towers. I use VAC to route the audio from each VFO to DSD+ each VFO has it own DSD+ running. I then have all the DSD+ go into one output VAC and use that to run a feed on Broadcastify, The secret to running multiple DSD+ is to have separate install of it, so I have 5 DSD+ folders.

RTL-SDR Cell Phone IMSI, TMSI and Key Sniffer

Over on YouTube user Kali Gsm has uploaded a video showing off a new software program he has written that allows an RTL-SDR to be used to gather IMSI, TMSI and Key information from a cell phone connected to a PC.

The IMSI (International Mobile Subscriber Identity) is a number that uniquely identifies a cell phone. Because IMSI’s are unique, they can be used to track a cell phone so they are rarely broadcast and instead a TMSI (Temporary Mobile Subscriber Identity) number is used to identify a cell phone instead. The TMSI is changed depending on geographic location or changed by the network randomly. The key is a number that is used to decrypt the GSM data sent to your phone.

Kali Gsm’s software is called rtl_tool_kit and is planned to be released soon on it’s GitHub page. It uses the gr-gsm software to sniff the GSM downlink with an RTL-SDR dongle and also interfaces to a connected mobile phone. The author writes that the following is possible with the software:

  1. You can get imsi tmsi and key of the device connected to your pc.
  2. You can send silent/flash sms
  3. You can connect/match tmsi to a mobile number if target is on the same BTS and in GSM900/2G mode.

Update 25/01/2015: All YouTube videos appear to have been removed – though the uploader reports in the comments that the videos will be back online soon.
Update 29/01/2015: Videos are back online.


Airspy GNU Radio Script for Receiving LRPT Meteor-M2 Weather Satellite Images

Previously we posted about receiving LRPT weather satellite images from the Russian Meteor-M2 weather satellite using the RTL-SDR. Now on GitHub, developer otti-soft has uploaded a LRPT decoder GNU Radio script for the Airspy. The script appears to be a modified version of the GNU Radio based real time decoder for the RTL-SDR, but optimized for the Airpsy and it’s 10 MSPS or 2.5 MSPS sampling rates. Note that although this is a real time receiver, the final image still needs to be processed on a Windows PC using LRPToffLineDecoder.

Also over on Twitter otti-soft has been uploading some images that he has received with his Airspy.

Real time LRPT Receiver for the Airspt
Real time LRPT Receiver for the Airspy

Compiling and using DSD 1.7 for D-STAR on Linux

Amateur Radio hobbyist George Smart has recently written a tutorial showing how to compile and install DSD v1.7 on a Linux computer in order to receive D-STAR digital voice. D-STAR is a digital voice protocol used by hams at a frequency of 145.670 MHz.

The tutorial shows the entire set up process from installing the required dependencies to running DSD 1.7 with GQRX by piping audio through UDP into DSD. He also shows how to run DSD 1.7 on a Raspberry Pi.

Note that DSD v1.7 also runs on Windows, and this previous post links to a precompiled Windows binary file.

GQRX Receiving D-STAR
GQRX Receiving D-STAR

Monitoring a Trunked P25 LSM Simulcast System with OP25 and an RTL SDR

Over on YouTube user jdlucas78 has uploaded a video showing a P25 LSM modulated digital voice signal being decoded by the Osmocom OP25 software for Linux. Although DSD and DSD+ can decode P25 voice, it seems that the Osmocom OP25 software is better at decoding P25 signals as it implements better error correction algorithms.

Over on the RadioReference forums there is a thread discussing the use of the OP25 decoding software which can be found here. There is a post in the thread that shows an easy Linux install procedure for the OP25 software.

Monitoring a Trunked P25 LSM Simulcast System w/ OP25 and RTL SDR Dongle

Take 2: Monitoring a Trunked P25 LSM Simulcast System w/ OP25 and RTL SDR Dongle

Decoding Oregon Scientific Weatherstation Messages using Gnuradio

Recently a reader of rtl-sdr.com, DO2BJK wrote in to let us know about his project where he used GNU Radio to decode Oregon Scientific V1 and V2 weather station messages. To receive the weather station messages which are sent in the ISM band at 433 MHz, DO2BJK used a USRP B210, but he writes that other SDRs such as an RTL-SDR or HackRF will also work. To decode the signal, DO2BJK took the usual steps of recording the signal and looking at the audio waveform in Audacity. From the waveform he was able to determine the bit string and discover the preamble, sync and data parts of a packet. He then used GNU Radio and wrote a Python program to receive the signal and automatically detect the preamble and extract the temperate data. His code is available on GitHub at https://github.com/bkerler/OregonDecoder/.

Bit string signal interpretation
Bit string signal interpretation