Category: HackRF

Lab401: HackRF on Windows YouTube Tutorials

Over on the Lab401 YouTube channel, 'RocketGod' has uploaded three videos that are various tutorials for the HackRF on Windows. The first video covers the basics like installing software and shows how to decode pager signals with PDW.

The second video shows how to decode police transmissions, car key fobs, use rtl_433, and how to use Universal Radio Hacker to capture and analyze signals. 

The third video is not yet released, but is due to premier on YouTube in 10 hours from the time of this post. In that video RocketGod will show how to install and use DragonOS, and how to install and use SDR Trunk which turns the HackRF into a police scanner. Finally, he will demonstrate SDR Angel and show it decoding ADS-B signals from aircraft to show you live flight tracking data.

Part 1 is embedded below, and Part 2 and Part 3 are linked here.

ROCKETGOD's HackRF One guide - part 1/3 Basics, Windows apps, setting up - LAB401

Receiving Images from the US DoD Coriolis Satellite

Over on dereksgc's YouTube channel another recent video from his satellite decoding series shows how to download images from the Coriolis satellite, a US Department of Defense satellite launched in 2003, that is among other uses designed to measure wind speed and direction from space using a radiometer.

The entire history of an orbit is only downlinked in the S-band when over an official ground station, however it also has a 'tactical' downlink for live data that the US Navy uses. As the data is unencrypted, with a satellite dish, 2.2 GHz feed, LNA and a software defined radio like the HackRF, anyone can receive the data.

In his video dereksgc explains the satellite, shows his hardware, and demonstrates reception. He then passes the recording into SatDump which results in the images. The images themselves are nothing interesting to look at, as they are produced by a sensor designed to measure wind. But dereksgc shows how multiple images can be composited into something a little more interesting.

Receiving images from a US DoD satellite (Coriolis) || Satellite reception pt.9

Receiving Unintentional Voice Transmissions from GPS Satellites

Over on dereksgc's YouTube channel we've discovered a few more recent interesting videos from his satellite decoding series that people may be interested in. One from two weeks ago shows how it's possible to receive voice transmissions on navigation satellites such as GPS.

Many navigational and meteorological satellites carry a search and rescue (SAR) repeater which is intended to receive UHF emergency locator beacons and rebroadcast them in the L-band or higher. However the repeaters appear to be picking up all sorts of other signals from the ground, including voice transmissions. Dereksgc notes that the theory is that there are some land based communications systems in some countries that are sharing frequencies that emergency locator beacons use, or that malicious pirates may be actively using these SAR repeaters for their own communications.

Dereksgc shows examples of retransmitted signals on the Beidou, GLONASS and Elektro-L satellite downlinks at 1.5442 GHz and at 2.226 MHz for the GPS satellites. He also shows what sort of satellite dish and feed setup you need. In the video he uses a HackRF as the SDR, but you could also use an RTL-SDR for the satellites that transmit at 1.5442 GHz.

Receiving voice transmissions from GPS satellites || Satellite reception pt.10

OpenWebRX+ Updates: HFDL, ISM Band, FLEX, SELCALL decoders added

Back in March of this year we posted about an OpenWebRX fork called OpenWebRX+, which adds multiple built-in and ready to use decoders such as SSTV, AIS, CW and RTTY. OpenWebRX+ is a fork of the OpenWebRX project which is now officially maintained by DD5JFK.

Since our last post OpenWebRX+ has progressed in development further, and now includes a HFDL decoder via dumphfdl, various ISM band equipment decoders via rtl_433,  FLEX pager decoding via multimon-ng, and a SELCALL decoder has also been added. Many other improvements and changes to the software have also been added, and the full changelog can be viewed here.

OpenWebRX+ is software for Linux. If you want to install OpenWebRX+, an easy path is to use the ready to use Raspberry Pi 4 image available on the releases page, or to use their PPA.

SSTV Image received by the luarvique fork of OpenWebRX. Credit: Neil Howard
SSTV Image received by the luarvique fork of OpenWebRX. Credit: Neil Howard

Progress Updates on the GSG Universal Radio Test Instrument (URIT)

In May we posted about how Great Scott Gadgets (GSG), the team behind the HackRF SDR and several other popular products, are in the early stages of developing a new type of SDR product called the "Universal Radio Test Instrument" or URTI for short.

Thank you to a few blog readers for pointing out that earlier this month the URTI GitHub lab-notes were updated with a progress report, and some further information about the architecture. The URTI will be split into a mainboard PCB, and a user interface PCB. The former will contain the USB interface, FPGA computing, and radio, and the latter will run a display and tactile controls. 

For the radio components, the team appear to be using similar components to what is used in the HackRF. They have selected the MAX5865 as their analog to digital converter (ADC) chip which is a faster sampling version of the MAX5864 which is used in the HackRF. They've also chosen either the MAX2831 or MAX2830 as their quadrature transmitter, and the MAX2120 as their quadrature receiver. They are also using the RFFC5072 chip as their mixer. These are again similar or the same as parts used in the HackRF.

In the update they also make notes on their SMA connector selection, PCB trace width selection, and their selection of Unun, RF switch, clock generator and RF limiter parts. They also note progress on their software which will provide a DSP library for the FPGA, and their tests of a display via a hand held game console.

In the next stage of development the team will be designing and assembling the mainboard to try and quickly make a platform available for software developers to get started on.

Testing the MAX2830 Chips with a GreatFET
URTI Overall Architecture
URTI Mainboard Architecture

Reverse Engineering a Wirelessly Controlled Adjustable Bed with a HackRF and Logic Analyzer

Over on his blog Chris Laplante has written up a post showing how he was able to reverse engineer his wirelessly controlled adjustable "TEMPUR-Contour Elite Breeze" bed. Originally the bed did have an Android App for smartphone control, however it was never updated since 2014 and so it no longer works on his modern Google Pixel device. So in order to have it controllable by his home automation system Chris decided to reverse engineer the wireless signal used by the bed's remote control. 

He first searched the FCC filing, finding that it transmitted in the ISM band at 433.050 to 434.790 MHz. Then using his HackRF he was able to capture the signal and determine that it used Gaussian frequency shift keying (GFSK) modulation.

The GFSK signal from the Tempur Pedic wireless remote control.

While the HackRF got him this far, he decided to follow a new line of investigation next, instead now using a logic analyzer to probe the SPI bus which talks to an Si4431 RF transceiver on the remote control. From this he was able to determine the important properties of the signal such as the frequency, data rate, frequency deviation, channel mapping and packet structure.

With all this information Chris was in the end able to create a product called "Tempur Bridge" that he is now selling on Tindie. It consists of an ESP32 WiFi connected microcontroller and a Si4463 RF transceiver chip. With his product Chris is now able to control his bed through a WiFi connection in Home Assistant.

Chris's TemperBridge product for WiFi control of a Tempur Pedic adjustable bed.

[This story was also seen on Hackaday]

Bouncing LoRa Signals off the Moon with a HackRF

One part of the amateur radio hobby is 'EME', or Earth-Moon-Earth. The idea is to bounce radio signals off the surface of the moon, and have them received over a vast distance. Typically weak signal amateur radio modulation schemes such as JT65 are used due to their ability to be decoded even with the very weak signals that come back from the moon bounce.

Recently a group of students from the College of New Jersey are attempting to bounce signals off the moon using the LoRa modulation scheme. LoRa is a modulation scheme designed to be used with IoT devices, however it also has great performance when signals are weak so it's a good candidate for moon bounce.

The students are using a HackRF and the SDR-Angel software with the signal being transmitted in the amateur radio bands at 1296 MHz. The antenna hardware consists of an 1296 MHz feedhorn attached to an 8-meter dish. They hope that the use of LoRa modulation can reduce the power requirements for EME.

The main goal of this project is to establish Earth-Moon-Earth communication with LoRa modulated signals. There are three main goals that this project is trying to accomplish. The three goals of our project are to reflect a signal off the Moon and receive it back here in New Jersey, transmit a signal from here in New Jersey, bounce it off of the Moon, and then receive the signal on a dish located in Alaska, and our final goal for this project is to establish two way communication between New Jersey and Alaska.

Our initial approach to this project is to use SDRAngel to modulate and demodulate our signal. SDRAngel is a free, open-source software that we can use to transmit and receive signals via SDR (Software Defined Radio).

Our modulation technique, LoRa, uses Chirp Spread Spectrum modulation that allows for low power, long range transmissions at the cost of a low data rate.

The peripheral of choice for this project is the HackRF One, a SDR peripheral that allows us to send and receive signals.

This story was also presented on Hackaday.

Bouncing LoRa Signals Off the Moon - TCF 2023, track 5, TCNJ student presentations

Great Scott Gadgets to Develop a Universal Radio Test Instrument (URTI)

Great Scott Gadgets (GSG), creators of the HackRF, YARD Stick One and Great FET (among other products) have announced that they are developing a device called a "Universal Radio Test Instrument (URTI)". They note that:

URTI will offer radio amateurs, researchers, educators, and professionals an affordable, compact RF test tool that could be used in place of multiple expensive pieces of traditional radio test equipment.

Our goal for URTI is to design a single hardware platform capable of serving as many popular types of one-port or two-port RF test instruments. We plan to build a directional coupler into a wideband, full-duplex SDR platform to enable URTI to function as a:

  • spectrum analyzer
  • vector network analyzer
  • vector signal generator
  • vector signal analyzer
  • antenna analyzer
  • power meter
  • frequency counter
  • full-duplex SDR transceiver

The design and hardware of the URTI appear to still be in the very early stages, with nothing other than early component lab tests released yet. However, given the track record of GSG products, we expect that they will release a high quality and completely open source product in time. We look forward to tracking the progress of the URTI.

More information about the device is available at https://greatscottgadgets.com/2023/05-04-development-of-a-universal-radio-test-instrument