Category: Digital Signals

Sniffing and Decoding NRF24L01+ and Bluetooth LE Packets with the RTL-SDR

Omri Iluz wrote in to us to let us know about his recent project which involves sniffing and decoding wireless packets at 2.4 GHz from NRF24L01+ and Bluetooth Low Energy (BTLE) transceivers. The NRF24L01+ is a popular wireless transceiver which is used in many common devices such as keyboards, mice, remote controls, toys and appliances.

Since 2.4 GHz is out of any of the RTL-SDR’s receivable range, Omri used a cheap downconverter which he was able to buy from China using Aliexpress. The downconverter converts the 2.4 GHz signal into a lower frequency at around 400 MHz which is in the receivable range of the RTL-SDR.

He was then able to use his NRF24-BTLE-Decoder software that he developed to convert the received data from the NRF24L01+ transceiver into a decoded packet by simply piping the output of RTL_FM into his program.

Since the NRF24L01+ uses hardware similar to the Bluetooth Low Energy (BTLE) protocol, Omri was able to modify his code to be able to also decode BTLE packets.

2.4GHz NRF24 packet received on the RTL-SDR from a Logitech mouse using a downconverter
2.4GHz packet received on the RTL-SDR + downconverter from a Logitech mouse
decodednrf
Decoded NRF24 Packets

Using the RTL-SDR to help Program a TI Chronos RF Watch

Over on our Facebook page, member Александр has posted about a project he found by Georg Campana which involves using an RTL-SDR to capture signals from his TI Chronos watch which has a programmable 433 MHz RF transmitter built into it.

Georg used his TI Chronos watch to transmit a signal copied from remote controls which are used to open his house gate, garage door, light switches and set his house alarm. When he discovered that the watch signal was not transmitting properly, he used his RTL-SDR to compare the signal coming from the watch to the original signals from the remote controls to help him with debugging. In order to detect the bit stream from the RF signal, he used a GNURadio program for decoding wireless temperature sensors, which he modified slightly to work with his watch.

Tools used to program the TI Chronos watch
Tools used to program the TI Chronos watch

Using the RTL-SDR as a Cheap TV Satellite Finder

Finding the correct direction to point a satellite for TV reception can be difficult without the right equipment. YouTube user MegaOscarVideos shows us in the video below how he uses an RTL-SDR to accurately aim his satellite for TV reception.

He uses a TV satellite dish with an LNB connected to a bias-T circuit as the receiver, which is then connected to the RTL-SDR. As the satellite is moved he looks for the direction at which the signal level in SDR# increases the most.

RTL SDR as cheap TV Satfinder

Looking at the 432 to 438 MHz ISM Band

Amateur radio hobbyist LA3ZA shows an image on his blog showing how busy the 70cm ISM band can be in his area in Norway. He uses a roof mounted 1.7 m long vertical antenna with 7.2dBi gain in the 70 cm band. Each signal burst may come from a remote car key, weather monitor, electricity monitor, or other telemetry device. Some of these signals may be decodeable with rtl_433.

Busy ISM Band
Busy ISM Band

Talk: My journey into FM-RDS by Oona Räisänen

Back in November we posted about Oona’s work with decoding radio controlled bus stop display signs using her RTL-SDR. Oona has given a talk at the Chaos Communication Congress about her work on decoding FM-RDS and the bus stop displays. The talk is now available on YouTube.

How I discovered mysterious hidden signals on a public radio channel and eventually found out their meaning through hardware hacking, reverse engineering and little cryptanalysis.

A story about my experiences with FM-RDS (Radio Data System), a digital subcarrier embedded in FM broadcast transmissions, and also cryptanalysis of the weakly encrypted TMC traffic messages contained therein. I originally found about the existence of such transmissions in a roundabout way, by using a spectrum analyzer program to examine intermodulation distortion in my radio’s Line Out audio. As it turned out, the inaudibly quiet distortion, probably caused by the radio’s stereo demuxer circuitry, contained all the information needed to decode all RDS data present in the transmission. I will demonstrate the journey I took and give a short introduction to how the data is actually encoded. Live acquisition of local RDS data depending on signal conditions in the premises.

As a bonus, I’m introducing yet another little-known FM subcarrier called DARC, and my recent reverse engineering of the bus stop display radio protocol used in Helsinki.

Talk: Tracking of Low Earth Orbit Satellites with the RTL-SDR

Back in July we posted about Travis Goodspeed’s project on setting up a satellite dish that automatically tracks satellites in low earth orbit, where he uses an RTL-SDR for the radio. Travis gave a talk on this project at the Chaos Communication Congress conference, and the video has now been uploaded to YouTube.

Satellites in Low Earth Orbit have tons of nifty signals, but they move quickly though the sky and are difficult to track with fine accuracy. This lecture describes a remotely operable satellite tracking system that the author built from a Navy-surplus Inmarsat dish in Southern Appalachia.

The entire system is controlled through a Postgres database, fed by various daemons spread across multiple machines. So when I click on a satellite on my laptop or cellphone, it runs “UPDATE target SET name=’Voyager 1′;” and the motor daemon then begins to track the new target while the prediction daemon maintains accurate estimates of its position in the sky. Additional daemons take spectral prints or software-defined radio recordings of the targeted object for later review.

Improved Digital Voice P25 Decoding with DSD+

Update: This post is now very old. The latest version of DSD+ can now to found at www.dsdplus.com.

Over on Reddit we've seen mention of an upgraded Digital Speech Decoder (DSD) program, named DSD+. The original DSD is a program that can be used in conjuction with a SDR receiving program such as SDR#, and an audio piping program like VBCable to decode digital speech, such as P25 and DMR/MOTOTRBO.

DSD+ claims to have improved decoding and audio quality capabilities. An audio sample from a weak P25 sample can be found here for DSD+, and for comparison here for the old DSD.

DSD+ can be downloaded from this megaupload link.

To run DSD+. you will need to place an MP3 encoder file lame_enc.dll into the same folder as the dsd.exe executable. This file is not included with DSD+ due to licencing. For Windows, lame_enc.dll can be downloaded from http://lame1.buanzo.com.ar/#lamewindl (Mega Mirror). Download the ZIP option, and then copy the dll file into the same folder as DSD+.

If you don't know how to use DSD, see our tutorial on using DSD here, and if desired simply use DSD+ instead of the original DSD. (Note cygwin is not required for DSD+)

DSD+ Output
DSD+ Output

Using an RTL-SDR and RTL_433 to Decode Various Devices

Over on his blog, Gough Lui has posted about his experiences with decoding various ASK/OOK devices on the unlicenced 433 MHz ISM band using an RTL-SDR and the command line program rtl_433.

Gough shows how he was able to receive and decode the data from an Aldi weather station device and a wireless doorbell transmitter. He also was able to modify the rtl_433 code slightly to produce a CSV log file of the temperatures that were received and decoded from the weather station.

rtl_433 output of the weather station
rtl_433 output of the weather station