Category: Digital Signals

Listening to NXDN with SDRSharp, the AuxVFO Plugin and DSD+

Over on YouTube user John Miller has uploaded a video showing how he receives NXDN digital audio using a combination of SDR#, the AuxVFO plugin and DSD+. He writes:

I have it set with 5 auxiliary VFO’s one for each channel of the Christian Co NXDN system from the Kelly Towers. I use VAC to route the audio from each VFO to DSD+ each VFO has it own DSD+ running. I then have all the DSD+ go into one output VAC and use that to run a feed on Broadcastify, The secret to running multiple DSD+ is to have separate install of it, so I have 5 DSD+ folders.

RTL-SDR Cell Phone IMSI, TMSI and Key Sniffer

Over on YouTube user Kali Gsm has uploaded a video showing off a new software program he has written that allows an RTL-SDR to be used to gather IMSI, TMSI and Key information from a cell phone connected to a PC.

The IMSI (International Mobile Subscriber Identity) is a number that uniquely identifies a cell phone. Because IMSI’s are unique, they can be used to track a cell phone so they are rarely broadcast and instead a TMSI (Temporary Mobile Subscriber Identity) number is used to identify a cell phone instead. The TMSI is changed depending on geographic location or changed by the network randomly. The key is a number that is used to decrypt the GSM data sent to your phone.

Kali Gsm’s software is called rtl_tool_kit and is planned to be released soon on it’s GitHub page. It uses the gr-gsm software to sniff the GSM downlink with an RTL-SDR dongle and also interfaces to a connected mobile phone. The author writes that the following is possible with the software:

  1. You can get imsi tmsi and key of the device connected to your pc.
  2. You can send silent/flash sms
  3. You can connect/match tmsi to a mobile number if target is on the same BTS and in GSM900/2G mode.

Update 25/01/2015: All YouTube videos appear to have been removed – though the uploader reports in the comments that the videos will be back online soon.
Update 29/01/2015: Videos are back online.


Airspy GNU Radio Script for Receiving LRPT Meteor-M2 Weather Satellite Images

Previously we posted about receiving LRPT weather satellite images from the Russian Meteor-M2 weather satellite using the RTL-SDR. Now on GitHub, developer otti-soft has uploaded a LRPT decoder GNU Radio script for the Airspy. The script appears to be a modified version of the GNU Radio based real time decoder for the RTL-SDR, but optimized for the Airpsy and it’s 10 MSPS or 2.5 MSPS sampling rates. Note that although this is a real time receiver, the final image still needs to be processed on a Windows PC using LRPToffLineDecoder.

Also over on Twitter otti-soft has been uploading some images that he has received with his Airspy.

Real time LRPT Receiver for the Airspt
Real time LRPT Receiver for the Airspy

Compiling and using DSD 1.7 for D-STAR on Linux

Amateur Radio hobbyist George Smart has recently written a tutorial showing how to compile and install DSD v1.7 on a Linux computer in order to receive D-STAR digital voice. D-STAR is a digital voice protocol used by hams at a frequency of 145.670 MHz.

The tutorial shows the entire set up process from installing the required dependencies to running DSD 1.7 with GQRX by piping audio through UDP into DSD. He also shows how to run DSD 1.7 on a Raspberry Pi.

Note that DSD v1.7 also runs on Windows, and this previous post links to a precompiled Windows binary file.

GQRX Receiving D-STAR
GQRX Receiving D-STAR

Monitoring a Trunked P25 LSM Simulcast System with OP25 and an RTL SDR

Over on YouTube user jdlucas78 has uploaded a video showing a P25 LSM modulated digital voice signal being decoded by the Osmocom OP25 software for Linux. Although DSD and DSD+ can decode P25 voice, it seems that the Osmocom OP25 software is better at decoding P25 signals as it implements better error correction algorithms.

Over on the RadioReference forums there is a thread discussing the use of the OP25 decoding software which can be found here. There is a post in the thread that shows an easy Linux install procedure for the OP25 software.

Monitoring a Trunked P25 LSM Simulcast System w/ OP25 and RTL SDR Dongle

Take 2: Monitoring a Trunked P25 LSM Simulcast System w/ OP25 and RTL SDR Dongle

Decoding Oregon Scientific Weatherstation Messages using Gnuradio

Recently a reader of rtl-sdr.com, DO2BJK wrote in to let us know about his project where he used GNU Radio to decode Oregon Scientific V1 and V2 weather station messages. To receive the weather station messages which are sent in the ISM band at 433 MHz, DO2BJK used a USRP B210, but he writes that other SDRs such as an RTL-SDR or HackRF will also work. To decode the signal, DO2BJK took the usual steps of recording the signal and looking at the audio waveform in Audacity. From the waveform he was able to determine the bit string and discover the preamble, sync and data parts of a packet. He then used GNU Radio and wrote a Python program to receive the signal and automatically detect the preamble and extract the temperate data. His code is available on GitHub at https://github.com/bkerler/OregonDecoder/.

Bit string signal interpretation
Bit string signal interpretation

Listening to EPIRB Distress Beacons with the RTL-SDR

Over on YouTube user Tom Mladenov has recently been using his RTL-SDR to listen to EPIRB distress beacons transmitted by the SARSAT payload carried by the NOAA 18 satellite. To do this he uses a 6.5 turn helix antenna that is resonant on 1.5 GHz.

An EPIRB is a maritime device that is used to send out a distress beacon for vessels in serious trouble. The EPIRB beacon transmits data that contains GPS coordinates of the vessel at 403 MHz to the satellite. The data is then retransmitted to a mission control centre at 1.5 GHz.

Note that the professional version of MultiPSK can be used to decode EPIRB signals.

(YouTube Videos Removed)


Chaos Communications Congress Talks – Iridium Pager Hacking

A few days ago the Chaos Communications Congress (a technology and hacking focused conference) commenced. Among the talks there was one about reverse engineering the Iridium satellite paging system using software defined radio. Iridium satellites provide global communications via special satellite phones, pagers and other transceivers.

In the talk the speaker shows how they used a USRP radio together with a cheap active iridium antenna, a bandpass filter and an LNA to receive the Iridium satellite signals. They also mention that an E4000 RTL-SDR together with an LNA and appropriate home made antenna for frequencies in the ~1.6 GHz region can also be sufficient. Once they were able to receive signals they were then able to reverse engineer the signal and create several pieces of software to decode the pager messages. The code is available on their GitHub at https://github.com/muccc/iridium-toolkit.

Sec, schneider: Iridium Pager Hacking