Category: Digital Signals

Hacking a PlayStation 3 using an RTL-SDR

There is a war going on between game console designers and the console modding community. Modders hack the console system so that they can jailbreak it and then install their own custom firmware while console designers are constantly finding new ways to prevent unauthorized modding. Custom firmware allows a console to run homebrew applications like media players and emulators that use the console in ways that is was not intended to be used in. One PlayStation 3 modder has recently been using an RTL-SDR to help jailbreak a PlayStation 3 Super Slim (4K) console, whose current official firmware appears to not yet have been jailbroken. It’s important to note that so far no actual jailbreaking has been done with this method, but the modder is currently working on it. His idea is to receive leaked RF signals from the PS3 and then use methods similar to Acoustic Cryptoanalysis to decode the data and find out what opcode operations the processors are performing. The modder writes about his method in the following.

My idea was to hook up a rtl-sdr device to the PS3 4k between chassis and real ground (yes, I actually have a two meter copper rod buried in my lawn) using the antenna leads. First I had to make sure the PS3 4k chassis wasn’t grounded in the outlet, and that no video out or USB connector was hooked up to ground indirectly via other hardware. If you want to try this, make sure that the rtl-sdr antenna leads are the only lead between the PS3 mobo/chassis and real ground. Before connecting the rtl-sdr antenna leads I measured the voltage on the PS3 chassis which peaked at around 1.8V which was safe enough, didn’t want to blow it up on the first try. 

This method will effectively turn your console into an “active antenna” leaking all kind of interesting data on the rtl-sdr frequency spectrum (between 24 – 1766 MHz). After hooking it up, I started using gqrx on my laptop to look for signal peaks while the PS3 4k was turned on, after finding a peak I just powered off the PS3 completely and turned it back on, using the waterfall plot you’ve seen in my first post I can see if there is something interesting happening during boot and verify that the signal is indeed coming from the PS3. In a similar way I learned to distinguish between the PS3 BD drive, GPU and CPU which pops up at different frequencies. Then I dumped the data (I/Q recording) that looked interesting and made a note of the frequency. It’s hard to describe the incredible feeling when you tune into a good signal and start watching the waterfall plot revealing opcodes, register bits and what might be stack contents. The Acoustic Cryptoanalysis paper (PDF) has a lot of good info how to interpret the output from various window functions in the plot.  What I’m coding right now is a gnuradio-companion block which will filter and test the dumped data for decryption keys against encrypted PS3 data. 

PS3 Data Received with an RTL-SDR and Shown on GQRX
PS3 Data Received with an RTL-SDR and shown on a GQRX Waterfall

Decoding NXDN using DSD+ and an RTL-SDR

Over on YouTube user John Miller has uploaded a video showing an example of DSD+ decoding an NXDN96 voice signal. NXDN is a digital voice protocol by developed by Kenwood that is often used by public safety organizations.

John uses SDR# to receive the NXDN signal and then pipes the audio to DSD+ using Virtual Audio Cable for decoding.

DSD+ Decoding NXDN

Hak5: Using A RTL-SDR To Learn About The GSM Network Around You

The popular YouTube electronics channel Hak5 has uploaded a video showing how they analyzed GSM signals using an RTL-SDR, Wireshark and Airprobe. In their video they use parts of our analyzing GSM tutorial and explain and show visually how to set up all the software.

Using these methods they were able to receive GSM data from a base tower and see various system information.

Using A RTL-SDR To Learn About The GSM Network Around You, Hak5 1621

Using an RTL-SDR and TI Chronos RF Wristwatch to Copy a Garage Door Opener

At Tel-Aviv University in Israel, two students undertook a class project where they were able to use an RTL-SDR to record a garage door opener signal and then use a Texas Instruments (TI) Chronos watch to retransmit a copy of the signal. Their report can be found here (pdf). The TI Chronos is a wrist watch with a built in programmable ISM band RF transmitter.

The students report contains an analysis of the signal which may be of use to anyone interested in decoding their own ISM band signals and they also describe a method used to automatically obtain the required parameters for programming the TI Chronos with the signal to be copied. The abstract of their report is as follows

We present a simple and affordable way of copying remote controls widely used for parking lot gates, garage doors and other simple systems. These simple remote controls usually use a fixed code (as opposed to the more secured rolling code used for car keys remote controls) and a simple On-Off Keying (OOK) modulation, over 433.92MHz in the ISM band. We suggest the use of the TI-Chronos wrist-watch platform for the emulation of the remote control, as this platform transmits in the same band, and can be programmed to emulate different modulations and to send user pre-defined signals.

In this report we show the complete process for copying a remote control into the Chronos platform. This process utilizes only a standard PC and low-cost hardware (less than $75 all together), alongside free software, and additional software developed by us. The process starts with recording the original remote control RF signal. It continues with automatic analysis of the recording, extracting the needed parameters of the signal. Finishing the process, we set the Chronos with those parameters. We demonstrate the copy process using a 4-channel remote control and its receiver board.

Flow Diagram of Copy Process
Flow Diagram of Copy Process

Using Xastir with the RTL-SDR

Xastir is a Linux based program that is used for plotting Automatic Packet Reporting System (APRS) data on a map. APRS is is type of packet radio system used by ham radio for real time local area digital communications. It is often used for sending messages, plotting positions on a map or providing weather station data.

Over on his blog, KJ6VVZ’s has uploaded a post showing how he was able to get the RTL-SDR working with Xastir. He uses rtl_fm piped into MultimonNG for the APRS decoding and then sends the decoded APRS information to Xastir via a FIFO buffer.

Xastir Message Log
Xastir Message Log

Analyzing 433 MHz Transmitters with the RTL-SDR

Over on his blog, Yashin has written a post showing how to analyze 433 MHz transmitters using several methods. Devices that transmit using low power 433 MHz are common and often include devices such as weather monitors, power monitors and alarm sensors.

To show his analysis methods Yashin used an ASK modulated FS1000A 433 MHz transmitter connected to an Arduino Teensy microcontroller. He first uses GQRX and baudline together with an RTL-SDR in Kali Linux to test that the transmitter is working and to visually inspect the RF spectrum. Then he shows how to use GNU Radio to receive the 433 MHz transmitter and how to record an audio file. The final tool he shows how to use is rtl_433 which will automatically decode the data into binary strings using the analysis option.

ASK 433 MHz Transmitter
ASK 433 MHz Transmitter

Transmitting DVBT HDTV from a Raspberry Pi to an RTL2832U

Over on his blog, OZ9AEC has uploaded a post showing how he was able to create a live HDTV transmitter out of a Raspberry Pi, a Raspi Cam module and a UTC DVB-T Modulator adaptor. As he does not want to interfere with commercial DVB-T broadcasts, he sets the module to transmit at 1.28 GHz, aka the 23 cm licenced ham radio band.

On the RTL2832U dongle side, he modified the RTL2832U Linux DVB-T drivers (not the SDR drivers) to work on the 1.3 GHz band. The intention of this camera is for it to fly on a rocket mission. In the YouTube video below he has uploaded some sample footage with the RTL2832U dongle receiving the stream from 300 meters away.

Rocketcam 1 test 3 (20140531_142625)

ScanEyes: Software for Visualizing, Listening to and Archiving Trunked Radio Traffic

Back in March we showed a beta version of Tyler Watts ScanEyes trunked call log recorder software. Now Tyler has released a more complete version of his ScanEyes software. A live version of the software can be found at sdrscan.com. ScanEyes works by using a software defined radio such as the RTL-SDR combined with trunking following software Unitrunker and optional P25 decoder DSD/DSD+ to archive all calls made on a trunked radio system. A user can then later go into the web interface and view and listen to archived calls.

ScanEyes Flow Diagram
ScanEyes Flow Diagram