Category: Digital Signals

Talk: My journey into FM-RDS by Oona Räisänen

Back in November we posted about Oona’s work with decoding radio controlled bus stop display signs using her RTL-SDR. Oona has given a talk at the Chaos Communication Congress about her work on decoding FM-RDS and the bus stop displays. The talk is now available on YouTube.

How I discovered mysterious hidden signals on a public radio channel and eventually found out their meaning through hardware hacking, reverse engineering and little cryptanalysis.

A story about my experiences with FM-RDS (Radio Data System), a digital subcarrier embedded in FM broadcast transmissions, and also cryptanalysis of the weakly encrypted TMC traffic messages contained therein. I originally found about the existence of such transmissions in a roundabout way, by using a spectrum analyzer program to examine intermodulation distortion in my radio’s Line Out audio. As it turned out, the inaudibly quiet distortion, probably caused by the radio’s stereo demuxer circuitry, contained all the information needed to decode all RDS data present in the transmission. I will demonstrate the journey I took and give a short introduction to how the data is actually encoded. Live acquisition of local RDS data depending on signal conditions in the premises.

As a bonus, I’m introducing yet another little-known FM subcarrier called DARC, and my recent reverse engineering of the bus stop display radio protocol used in Helsinki.

Talk: Tracking of Low Earth Orbit Satellites with the RTL-SDR

Back in July we posted about Travis Goodspeed’s project on setting up a satellite dish that automatically tracks satellites in low earth orbit, where he uses an RTL-SDR for the radio. Travis gave a talk on this project at the Chaos Communication Congress conference, and the video has now been uploaded to YouTube.

Satellites in Low Earth Orbit have tons of nifty signals, but they move quickly though the sky and are difficult to track with fine accuracy. This lecture describes a remotely operable satellite tracking system that the author built from a Navy-surplus Inmarsat dish in Southern Appalachia.

The entire system is controlled through a Postgres database, fed by various daemons spread across multiple machines. So when I click on a satellite on my laptop or cellphone, it runs “UPDATE target SET name=’Voyager 1′;” and the motor daemon then begins to track the new target while the prediction daemon maintains accurate estimates of its position in the sky. Additional daemons take spectral prints or software-defined radio recordings of the targeted object for later review.

Improved Digital Voice P25 Decoding with DSD+

Update: This post is now very old. The latest version of DSD+ can now to found at www.dsdplus.com.

Over on Reddit we've seen mention of an upgraded Digital Speech Decoder (DSD) program, named DSD+. The original DSD is a program that can be used in conjuction with a SDR receiving program such as SDR#, and an audio piping program like VBCable to decode digital speech, such as P25 and DMR/MOTOTRBO.

DSD+ claims to have improved decoding and audio quality capabilities. An audio sample from a weak P25 sample can be found here for DSD+, and for comparison here for the old DSD.

DSD+ can be downloaded from this megaupload link.

To run DSD+. you will need to place an MP3 encoder file lame_enc.dll into the same folder as the dsd.exe executable. This file is not included with DSD+ due to licencing. For Windows, lame_enc.dll can be downloaded from http://lame1.buanzo.com.ar/#lamewindl (Mega Mirror). Download the ZIP option, and then copy the dll file into the same folder as DSD+.

If you don't know how to use DSD, see our tutorial on using DSD here, and if desired simply use DSD+ instead of the original DSD. (Note cygwin is not required for DSD+)

DSD+ Output
DSD+ Output

Using an RTL-SDR and RTL_433 to Decode Various Devices

Over on his blog, Gough Lui has posted about his experiences with decoding various ASK/OOK devices on the unlicenced 433 MHz ISM band using an RTL-SDR and the command line program rtl_433.

Gough shows how he was able to receive and decode the data from an Aldi weather station device and a wireless doorbell transmitter. He also was able to modify the rtl_433 code slightly to produce a CSV log file of the temperatures that were received and decoded from the weather station.

rtl_433 output of the weather station
rtl_433 output of the weather station

Locating an Interfering Signal with Radio Direction Finding and the RTL-SDR

The people at the MIT Haystack Observatory discovered recently that someone was transmitting an interfering signal on their licensed radar band. The interferer was effectively jamming the radar, preventing them from carrying out any experiments.

After checking for local causes of interference and finding nothing, they decided that the interferer must be coming from further away. To find the location of the jamming signal they did some radio direction finding. This involved driving around with Yagi and magnetic loop antennas and RTL-SDR and USRP N200 SDRs and then measuring the signal strength at various points.

For the software they used a custom GNURadio block which calculated the power spectra using the FFTW C library, and averaged the results to disk. They then post processed the data to calculated the RFI power, and correlated the data with GPS coordinates recorded on his phone.

After all the data was processed, they discovered that the interference originated from an FM radio tower which had a faulty FSK telemetry link. They notified the engineer responsible who then replaced the link and the interference disappeared.

RFI strength at various geographic locations
RFI strength at various geographic locations

Receiving the Chinese Yutu Moon Rover with the RTL-SDR

Amateur radio hobbyist EB3FRN was able to use his RTL-SDR to receive the telemetry signal from the recently landed Chinese Yutu moon rover. The Yutu rover transmits at 8462.08000 MHz, which is outside of any RTL-SDRs frequency range, so he used a downconverter with a local oscillator at 8 GHz to convert the signal to 462 MHz.

For the software he used Baudline and rtl_fm as the receiver. He has posted a short audio clip of the received signal on his blog as well.

Chinese Yutu Moon Rover Received with RTL-SDR and Baudline
Chinese Yutu Moon Rover Received with RTL-SDR and Baudline

ADS-B Decoder for the RTL-SDR now available for Android

A (beta version) of an ADS-B decoder and display app for the RTL-SDR dongle for Android has been released. This app allows you to receive the ADS-B radio signals emitted by modern aircraft, which contain information such as flight number, latitude, longitude and altitude, essentially giving you a live portable aircraft radar.

To use the app, you will need an Android device that supports USB OTG, which most Android devices on Android 4.0+ should support. You will also need a USB OTG cable, and an RTL-SDR dongle. You may want to consider a USB OTG cable that has a second port for external charging capabilities, as the RTL-SDR can drain the battery quickly.

The app is cheaply priced at under $2, so give it a try!

ADS-B Decoding on Android
ADS-B Decoding on Android

Using the RTL-SDR to listen to the Funcube Satellite

Recently, the FUNcube-1 satellite was successfully launched. The FUNcube is a CubeSat (a low cost miniature 10cm cube sized satellite) which is intended mainly for educating young people about radio, space, physics and electronics, but has also piqued the interest of amateur radio hobbyists.

Amateur radio hobbyist N4JTC’s has shared on his blog his experiences with receiving the FUNcube-1’s telemetry using his RTL-SDR dongle. By using the RTL-SDR to receive the telemetry beacon as the satellite passes overhead, he was able to use the FUNcube Dashboard software to record and decode and view the satellites telemetry data.

Receiving the FUNcube-1 Satellite
Receiving the FUNcube-1 Satellite