Category: Digital Signals

Demonstrating the New 3D Maps in SDRAngel

In December of last year we posted about a video demonstrating the many features that the SDRAngel software comes standard with. Recently they've added a new feature which are 3D maps that can be used to visualize signal data.

In the latest video demonstration they show these 3D maps projecting NOAA weather satellite images onto a 3D globe and at the same time tracking the NOAA satellites over the globe as it produces imagery. They also show the software visualizing a 3D model of aircraft on the globe, using live ADS-B data to show aircraft maneuvers when taking off, cruising and landing. With multiple SDRs they also show how the visualization can be combined with air traffic voice. Finally they also show marine vessels being visualized via live AIS data. There appear to be a wide range of vessel 3D models implemented.

Turbine: Capture and Stream all Frequencies in a Trunked Radio System with a HackRF

Over on Reddit we've discovered an interesting program called 'Turbine' that has recently been open sourced by the author. This program connects to a wideband capable SDR such as a HackRF and captures and streams all frequencies in a trunked radio system. Users can then browse the recordings online. On his reddit post u/norasector introduces Turbine, and his application for it called 'NoraSector'.

I am open sourcing the SDR code for NoraSector, which currently captures and streams the radio systems for both King and Snohomish County, WA. It uses a HackRF One to capture every channel concurrently, and can even process multiple systems at the same time, provided they are within the same bandwidth that is captured by the SDR and there's adequate reception. I plumb the output through a WebRTC streaming infrastructure I built to stream audio to clients over the web with very low latency. My goal was to give complete access to an entire system to anyone over the web, just as they would have if they were using a handheld scanner, and with comparable latency.

Turbine is a bit different other SDR software out there. It's written entirely in Go, and was built explicitly to only use a single SDR rather than bonding multiple SDRs together.

Turbine works by tuning known control frequencies and then tuning all voice frequencies it learns from them. Voice transmissions are encoded using the Opus audio codec for compatibility with WebRTC and blasted out as frames over UDP. It also includes a functional-but-janky built-in visualization web server to look at each stage of the DSP pipeline for each frequency, which was crucial for debugging as I was building it.

Right now, it only supports legacy Motorola SmartZone systems (which is what is used near me), but it shouldn't be a large lift to make it support P25. The code is heavily influenced by op25 and GNURadio (and in some places just outright copying them). I built it in Go because a) it's what I'm most familiar with and b) the sheer density of GNURadio made it hard for me to piece things together how I wanted. Go's concurrency model is a natural fit for doing many concurrent operations on the byte stream, and I haven't had issues with garbage collection pausing execution in a detrimental way.

Turbine isn't intended for use with lower sample rate SDRs like the RTLSDR. It has a driver for it, but doesn't support bonding multiple SDRs together. If an entire system fits within the 2MHz sample rate, it would probably be fine. You should be able to fire it up with a RTLSDR but it will not be able to capture very much. It currently only officially supports the HackRF One, but adding other SDRs should be relatively trivial. Note that the HackRF I am using is the model with the upgraded TCXO, as I found that the built-in oscillator was not accurate enough.

Turbine has only been tested to run on Linux and is very CPU-intensive; the production radio runs on a dedicated i7-11700k 8c/16t CPU and consumes about 60% of all cores decoding both systems. There are some potential optimizations that could be made that would lower CPU consumption during periods of low activity, but I built it for the worst case of having to encode every voice frequency at once.

The usual disclaimers about OSS apply. I hope you find it interesting or perhaps useful, and maybe portions can be adapted so Go can be used more in SDR projects.

There have been similar projects in the past like radiocapture-rf, scaneyes, and broadcastify calls, but Turbine looks like one of the most comprehensive.

Norasector: An implementation of the Turbine Trunk Recording software

Video Tutorial: Decoding HD Radio on Windows with nrsc5-gui

Thank you to "Double A" for submitting his video that shows how to install and run the RTL-SDR compatible HD Radio decoder nrsc5-gui on a Windows machine. We've posted about nrsc5-gui and the modified nrsc5-dui software in the past, however despite being Windows compatible, it has only been simple to run on Linux.

In his video Double A shows us how to download and extract the files, how to set up the Windows mingw environment which is required to run the software, and where to place a required dll file dependency. Finally he demonstrates the software in action, running on his Windows machine.

Decoding HD Radio on Windows with RTL-SDR USB

Remoticon 2021: Smart Meter Hacking Talk

Remoticon 2021 was an online conference held in November 2021 and videos of presentations have recently been uploaded to the Hackaday YouTube channel this month. One very interesting talk was the presentation by Hash Salehi (RECESSIM) on reverse engineering electricity smart meters that are used to remotely monitor and bill home electricity usage in some neighborhoods.

In the past we've posted about Hash (RECESSIM)'s series on smart meter hacking a few times before. In this latest talk Hash summarizes his smart meter hacking experience, talking about how he went from reverse engineering the firmware, to using an SDR to capture and decode information from all the smart meters in his neighborhood, and finally to determining how to actually transmit data to his own smart meter network.

Hackaday have also posted a full writeup on his talk. This is a very in depth reverse engineering project so it is a great talk to learn from.

Remoticon 2021 // Hash Salehi Outsmarts His Smart Meter

Nils Reviews our RTL-SDR Blog L-Band Active Patch Antenna

Over on his blog Nils Schiffhauer (DK8OK) has recently uploaded a review of our RTL-SDR Blog Active L-Band Patch Antenna (original site is down - archive.org link). This is a satellite patch antenna designed for experimenters who want to receive Inmarsat, Iridium, GPS and other GNSS signals. It covers 1525 - 1660 MHz. (Please note it does not cover GOES or other L-band weather satellites as these are much weaker signals that require a dish). The antenna comes as a set with mounting hardware and extension cable and can be purchased on our store for $49.95 including free worldwide shipping to most countries.

In his review Nils tests the patch antenna with his wideband BladeRF software defined radio showing a wide 60 MHz of bandwidth being received. He then goes on to show it being used to receive AERO, via the JAERO decoder, and STD-C via the Tekmanoid decoder.

We want to take this opportunity to pre-announce that due to rising shipping costs the price of this antenna set will be going up by $10 in early 2022. Before the price raise we will put out another post, but if you are interested in one we'd recommend picking one up soon.

Nils tests the water resistance of the antenna.

A RS41 and DFM09 Radiosonde Decoder Plugin for SDR++

A new decoder for RS41 and DFM09 radiosondes has been released as a plugin for SDR++ by dbDexter.  A radiosonde is a sensor package with RF transmitter that is attached to a weather balloon. Meteorological agencies around the world typically launch two per day in order to gather weather forecast data. With an RTL-SDR, appropriate antenna and a decoder it is possible to receive this data, and plot the GPS location on a map.

Installing a plugin for SDR++ requires adding the build options to the SDR++ source, and building SDR++, so it could be a little difficult for Windows, but relatively simple build instructions for Linux are provided in the Readme.

A Radiosonde Decoder for SDR++

Over on Twitter FelixTRG (@OK9UWU) has tested the plugin out and has found it to work well.

Browser Based Weather Station Graphs via RTL-SDR, rtl_433 and Dash.plotly

Thank you to Gerrit Polder who has submitted his project where he has used an RTL-SDR and the rtl_433 decoder running on a Raspberry Pi, along with some custom software to create a browser based dashboard for his wireless weather station. 

Gerrit's weather station wirelessly displays data on a wirelessly connected LCD screen, but he notes how difficult it is to view historical data, or to graph trends. Having discovered that the rtl_433 RTL-SDR decoder supports his particular weather station (a Fine Offset Electronics WH1080/WH3080 compatible Weather Station (Alecto WS-4000)), Gerrit decided to write some code to log data to a SQL database, and display that data via a Python Dash.plotly web interface. The RTL-SDR, rtl_433 and custom software all run on a Raspberry Pi.

The interface allows Gerrit to view live and historical data all on neatly plotted graphs. HIs complete open source code can be found on Github.

Dash.pltly based weatherstation with data received by RTL-SDR and rtl_433

Hacking a La Crosse Weather Station with an RTL-SDR, PlutoSDR and Universal Radio Hacker

Thank you to Ryan K for submitting his latest blog post where he gives an in depth explanation of how he reverse engineered his La Crosse weather station using an RTL-SDR, PlutoSDR and the Universal Radio Hacker (URH) software.

The La Crosse weather station system consists of a LCD base station, and various wireless sensors. Ryan first discovered that the devices used the 915 MHz frequency band via details written on the device itself. His next step was to open up Universal Radio Hacker and use one of his SDRs to record a packet.  URH then allowed him to convert that data into bits for packet analysis. The rest of his post goes into detail on how he set the symbol rate, discovered the preamble and reverse engineered the CRC code. 

The next step he took was to generate a spoofed packet generated by URH and transmitted by the PlutoSDR. This allowed him to set the base station display to any temperature that he specified. But he ran into a problem where only the first packet he sent after power up was received. Eventually he discovered that the system sets a randomized interval for each of the transmitters at startup, and data outside of that interval is ignored.

Ryan's post explains his whole though process and progress in detail, so is an excellent study for anyone looking to get into reverse engineering wireless signals.

Reverse Engineering a La Crosse Weather Station with a PlutoSDR and RTL-SDR