Category: Digital Signals

Watching ATSC TV with an SDRplay SDR and GNU Radio

ATSC is the digital HD TV standard used within the United States and Canada. It is 6 MHz wide so the RTL-SDR with its maximum bandwidth of about 2.8 MHz cannot decode this signal. However, higher end SDR’s such as the SDRplay, Airspy and HackRF have larger bandwidths that can easy cover 6 MHz.

One SDRplay owner was able to figure out a way to decode ATSC by using a decoder written in GNU Radio. With the process the author used we note that other wide band SDR’s such as the Airspy and HackRF should also be capable of achieving the same results.

The process the author used was to first record a RAW IQ WAV file in HDSDR in Windows, making sure that any DC spike correction is applied. The WAV file is then opened in a premade GNU Radio flow graph in Linux and processed into an MPEG file. The process is not real time. The authors article shows a step by step tutorial on how its done.

In an update post to his results the author also notes that to successfully do a recording at the maximum SDRplay bandwidth of 8 MHz a RAM disk or perhaps SSD is required so that samples are not dropped.

An ATSC signal shown in HDSDR received with an SDRplay
An ATSC signal shown in HDSDR received with an SDRplay

SDR-J Now Compatible with the Raspberry Pi 2

The popular software DAB (Digital Audio Broadcast) decoder SDR-J has recently been updated and can now run on the Raspberry Pi 2. In addition the author has also added experimental DRM decoding capabilities to his shortwave receiving software. The author writes about the Raspberry Pi 2:

The Raspberry PI 2 has a processor chip with 4 computing cores. By carefully spreading the computational load of the handling of DAB over these cores it is possible to run the DAB software on the Raspberry PI 2.

In my home situation the – headless – Raspberry PI 2 is located on the attic and remotely controlled through an SSH connection using the home WiFi on my laptop in my “lazy chair”. To accomodate listening remotely, the DAB software on the Raspberry PI 2 sends – if so configured – the generated PCI samples (rate 48000) also to an internet port (port 100240). On the laptop then runs a very simple piece of program reading the stream and sending it to the soundcard

DAB is a digital audio protocol that is used in some countries as a digital alternative to broadcast FM (music stations). SDR-J is a suite of programs that includes the ability to decode DAB, FM, and several shortwave modes such as AM, USB, LSB, PSK, RTTY, WeatherFax, SSTV, BPSK, QPSK, CW, NavTex (Amtor-B), MFSK, Domino, Olivia, Hell, Throb and now DRM. It can directly connect to RTL-SDR receivers as well as other hardware such as the Airspy and SDRplay.

Screenshot of SDR-J running on the Raspberry Pi 2.
Screenshot of SDR-J running on the Raspberry Pi 2.

Hacking GSM Signals with an RTL-SDR and Topguw

The ability to hack some GSM signals has been around for some time now, but the steps to reproduce the hack have been long and difficult to set up. Recently RTL-SDR.com reader Bastien wrote into us to let us know about his recently released project called Topguw. Bastien's Topguw is a Linux based program that helps piece together all the steps required in the GSM hacking process. Although the steps are simplified, you will still need some knowledge of how GSM works, have installed Airprobe and Kraken, and you'll also need a 2TB rainbow table which keeps the barrier to this hack still quite high. Bastien writes about his software:

So like I said my software can "crack" SMS and call over GSM network.

How ?

I put quotation marks in crack because my software is not enough to deciphered GSM itself. My software can make some steps of the known-plaintext attack, introduce by Karsten Nohl, and by the way, increase the time to decipher an SMS or call. I'll not explain here all the steps because they are long and tedious, but there is a lot of work done behind the Gui.

Actually my software can extract Keystream (or try to find some of them) from a capture file of GSM, or by sniffing GSM with a rtl-sdr device. Then you just have to use Kraken to crack the key and you're able to decipher sms or call.

Why ?

This hack is very interesting! With only a little receiver (rtl-sdr) and some hard-disk capacity (2Tb), everyone can try to hack the GSM. It's very low cost compare to other hack vector. Moreover the success rate is really great if you guess the Keystream correctly. So when I started to done this with my hands I though -> why don't try to make something to do this automatically.
This is how Topguw was born.

Topguw, I hope, will sensitize people about risk they take by calling or sending sms with GSM.

My software is currently in beta version but I did run several time and I got good results. Maybe better than something done by hand. But Topguw is made to help people who want to learn the hack. This is why several files are made to help GSM reverse-engineering.

Topguw can be downloaded from GitHub at https://github.com/bastienjalbert/topguw. Bastien has also uploaded a video showing his software in action. If you're interested in Bastiens YouTube channel as he plans to upload another video soon where he shows himself hacking his own GSM sms/call signals.

Topguw Proof of concept - GSM Hacking educational purpose

Of course remember that hacking into GSM signals is very illegal and if you do this then you must check the legality of doing so in your country and only receive your own messages or messages that are intended for you.

Update 27 Feb 2023: Note that this content is constantly being censored by video upload sites. If the above video is down, Bastien has uploaded links to alternative video upload sites on pastebin.

Receiving Digital Amateur TV from the ISS with an RTL-SDR

The international space station (ISS) is currently testing transmission of a DVB-S digital video signal. At the moment only a blank test pattern is transmitted, but one day they hope to be able to transmit live video properly for the purposes of making live contact with astronauts, and possibly to stream video of scientific experiments, extravehicular activities, docking operations, or simply live views of the Earth from space.

Over at www.pabr.org the author Pabr has been experimenting with using an RTL-SDR dongle for the reception of these digital amateur TV (DATV) signals. Over on Reddit he also posted some extra information about his work:

I have been able to receive DVB-S broadcasts from the ISS (known as HamVideo or HamTV) with a high-gain 2.4 GHz WiFi antenna ($50), a custom downconverter ($65), a R820T2 dongle, and a software demodulator (Edmund Tse’s gr-dvb). I used to think this could only be done with much more expensive SDR hardware.

It is commonly known that rtl-sdr dongles do not have enough bandwidth to capture mainstream satellite TV broadcasts, but the ISS happens to transmit DVB-S at only 2Msymbols/s in QPSK with FEC=1/2, which translates to 2 MHz of RF bandwidth (2.7 MHz including roll-off).

Before anyone gets too excited I should mention that:

  • This was done during a favourable pass of the ISS (elevation 85°)
  • With a fixed antenna, only a few seconds worth of signal can be captured
  • Demodulation is not real-time (on my low-end PC)
  • Currently the ISS only transmits a blank test pattern.

I now believe the BoM will be less than $50 by the time the ISS begins broadcasting interesting stuff on that channel.

Pabr uses a 2.4 GHz parabolic WiFi antenna to receive the signal. He writes that ideally a motorized antenna tracker would be used with this antenna to track the ISS through the sky. Also since the DATV signal is transmitted at around 2.4 GHz, a downconverter is required to convert the received frequency into one that is receivable with the RTL-SDR. The DATV decoder is available on Linux and requires GNU Radio.

Receiving DATV from the ISS
Receiving DATV from the ISS with an RTL-SDR

Reverse engineering a wireless thermostat with an RTL-SDR

When Tom Taylors home heating boiler was replaced the builders also replaced the old wired rotary thermostat with a digital wireless one. It sounds good, but Tom soon discovered that the thermostat UI was terrible and that the buttons were horrible to press, making him prefer to shiver in the cold. So Tom decided to see if there was a smarter way to control the heating.

When Tom investigated the thermostat, he discovered that the wireless unit transmitted in the unlicensed 433 MHz band and that the thermostat only transmitted two commands, turn on or turn off. By using his RTL-SDR and the CubicSDR software on his Mac he was able to detect the short blip of the thermostat wireless signal. Next he recorded the on and off signals and opened the sound files in Audacity, an audio processing software tool. In Audacity he was able to compare the sound waveforms of the on and off signals.

From his analysis he discovered that each signal consisted of a preamble and then an on or off command which is repeated twice, presumably to reduce the likelihood of interference. Tom also discovered that the commands were encoded with pulse width modulation.

From this knowledge Tom was then able to use a cheap 433 MHz transmitter together with an Arduino microcontroller board and a short script to create identical on or off transmissions that control the boiler. Tom writes that his next steps are now to create a heating schedule based on his families shared calender, make a thermostat control loop and create a web connected interface with a Raspberry Pi.

The 433 MHz thermostat on/off signal detected with an RTL-SDR in the CubicSDR software
The 433 MHz thermostat on/off signal detected with an RTL-SDR in the CubicSDR software

New Demo of the Upcoming Spyverter Upconverter

The Spyverter is a new high performance upconverter that is being developed by the team behind the Airspy software defined radio and the SDR# software. It is designed to be used together with the Airspy, but it should also be compatible with other SDRs as well. The main claimed advantages over other upconverters will be it’s low loss and high IIP3 performance, which means that the Spyverter will not saturate in the presence of strong signals as easily as other upconverters.

Recently W9RAN, who is involved in the design and testing of the Spyverter uploaded some demo videos of the Spyverter + Airspy combo in action. The first video shows how the Spyverter when used together with the Airspy and SDR# allows for seamless tuning between VLF, HF through to VHF/UHF (no need to set any offsets).

Seamless tuning of SDR# with AIrspy & Spyverter

The next video shows the Spyverter + Airspy combo working during a RTTY contest on 40M with very densely packed signals, some of which were very strong.

W9RAN demo of Spyverter in 40 meter RTTY contest

W9RAN (ranickel on YouTube) also has additional Spyverter + Airspy videos on YouTube for viewing if you are interested.

Reverse Engineering Bus Telemetry Data with an RTL-SDR

Bastian recently wrote into us at RTL-SDR.com to let us know that he’s been working on reverse engineering the bus telemetry system used in his hometown of Paderborn, Germany. Bus telemetry is often used to update live signs at bus stops that indicate based on GPS data how long a bus user needs to wait for the next bus.

Bus sign: Wireless bus telemetry updates this sign.
Bus sign: Wireless bus telemetry updates this sign.

A similar reverse engineering of bus telemetry was performed before by Oona Raissan in Helsinki, Finland. Oona found that in Helsinki bus telemetry was transmitted as a DARC subcarrier embedded in regular broadcast FM radio. In many countries bus telemetry runs through GSM or TETRA communications as well, which are encrypted and would be very difficult to decode.

However in Paderborn, Germany Bastian discovered that the bus telemetry system used a different protocol which he discovered by noticing that some very strong signals appeared on his spectrum at 150.9 MHz whenever a bus drove by his flat.

After making a recording of this signal in GQRX, bastian analysed it in Audacity and discovered that the binary data bits were encoded by the presence or absence of a half sine wave. After discovering the encoding he was then able to determine the bit rate and build a decoder in GNU Radio. His post goes into further detail about concepts he used in his GNU Radio program such as frame detection, bit stuffing and error detection.

Finally, with all his decoder program written he was able to gather lots of data from each packet such as the bus ID, line, bus stop, distance from last bus stop, delay, position and even the orientation of the bus. Bastian has also uploaded a video showing everything in action, which we have embedded below.

Bus position heatmap from data obtained via the RTL-SDR
Bus position heatmap from data obtained via the RTL-SDR

A new AIS Decoder for the RTL-SDR on Android

A reader of our blog, EBC81, has written in to let us know about a new RTL-SDR based AIS decoder that he has written for the Android OS. AIS stands for Automatic Identification System and is used by ships to broadcast their GPS locations, to help avoid collisions and aid with rescues. An RTL-SDR with the right software can be used to receive and decode these signals, and plot ship positions on a map.

EBC81’s program is called rtl_ais_android and can be downloaded from this GitHub link. It decodes the AIS data into NMEA messages, which can then be sent via UDP to mapping programs in Android or a program like OpenCPN on your PC. To use the app you will need a USB OTG cable to connect your Android device to the RTL-SDR.

In the future EBC81 hopes to create a second app which will display the ship positions on a map.