Category: Other

Building a Software Defined Radio from Scratch

Over on his blog Lukas Lao Beyer has uploaded a post that shows his journey with designing and building a software defined radio from scratch. Lukas’ finished SDR design is called the FreeSRP and is based on the Analog Deviced AD9364 transceiver and a Xlinx FPGA.

In his post Lukas describes how he designed the PCB with Altium Designer, routing the traces carefully to ensure the shortest path was used, and to ensure impedance matching was correct. Then after producing the PCB’s with OSH park he writes how he assembled the board by carefully placing the components down by hand and using his reflow oven. This was no easy task due to the manual nature of the operation and the high possibility for undetectable solder problems to arise. Despite the difficulties he found that the SDR powered up as expected.

His next steps were to start work on the FPGA controller design, however he discovered that he had failed to properly route some clock pins on the FPGA. On his third revision of the PCB he was able to fix this. Finally he was able to program the FPGA and get his SDR to work.

Designing an SDR from scratch is no easy task, especially if you have little design experience like Lukas did. However, in the end despite some mistakes he was able to build a working SDR that interfaces with GNU Radio. 

Lukas' FreeSRP SDR.
Lukas’ FreeSRP SDR.

Cheating at Pokémon Go with a HackRF and GPS Spoofing

"Pokémon Go" is the latest in smartphone augmented reality gaming crazes. You may have already heard about the game on the news, or seen kids playing it in your neighborhood. To play, players must walk around in the real world with their GPS enabled smartphone, collecting different virtual Pokémon which appear at random spots in the real world, replenishing the virtual items need to collect Pokemon at "Pokéstops" and putting Pokémon to battle at "Gyms". Pokéstops and gyms are often city landmarks such as popular shops, fountains, statues, signs etc. For those who have no idea what "Pokémon" are: Pokémon are fictional animals from a popular children's cartoon and comic.

Since the game is GPS based, Stefan Kiese decided to see if he could cheat at the game by spoofing his GPS location using a HackRF software defined radio. The HackRF is a relatively low cost multipurpose TX and RX capable software defined radio. When playing the game, players often walk from Pokéstop to Pokéstop, collecting Pokémon along the way, and replenishing their items. By spoofing the GPS signal he is able to simulate walking around in the physical world, potentially automating the collection of Pokémon and replenishment of items at Pokéstops.

To do this he used the off the shelf "GPS-SDR-Sim" software by Takuji Ebinuma which is a GPS Spoofing tool for transmit capable SDR's like the HackRF, bladeRF and USRP radios. At first, when using the software Stefan noticed that the HackRF was simply jamming his GPS signals, and not simulating the satellites. He discovered the problem was with the HackRF's clock not being accurate enough. To solve this he used a function generator to input a stable 10 MHz square wave into the HackRF's clock input port. He also found that he needed to disable "Assisted GPS (a-gps)" on his phone which uses local cell phone towers to help improve GPS location tracking.

Next he was able to use the GPS-SDR-Sim tools to plot a simulated walking route and see his virtual character walking around on the real world map. A warning if you intend on doing this: Remember that 1) spoofing or jamming GPS is highly illegal in most countries outside of a shielded test lab setting, so you must ensure that your spoofed GPS signal does not interfere with anything, and 2) the game likely has cheating detection and will probably ban you if you don't simulate a regular walking speed.

GPS spoofing is not new. One attempt in 2013 allowed university researchers to send a 80 million dollar 213-foot yacht off course, and it is suspected that hackers from the Iranian government have used GPS spoofing to divert and land an American stealth drone back in 2011. In past posts we also showed how security researcher Lin Huang was able to spoof GPS and bypass drone no fly restrictions.

[Also seen on Hackaday.com] / [Russian Readers: There is a translation of this article by softdroid now available]

The "Pokemon Go" GPS spoofing set up.
The "Pokemon Go" GPS spoofing set up.

What’s so special about 50 Ohms?

Hackaday contributor Al Williams has posted an article on Hackaday titled “What’s special about 50 Ohms”. Components such as coax, connectors and other components in RF circuits all have an important parameter called impedance. For good signal performance we want everything to have the same impedance. If wildly different impedances are used between components the signal will experience reflection (i.e. not all of the signal gets transmitted and some gets reflected back, causing a reduction in signal).

The standard impedance used in most radio equipment is 50 Ohms, however some applications like TV prefer to use 75 Ohms. The hackaday article discusses why 50 and 75 Ohms is the standard impedance used. Basically 50 Ohms is an compromise between the impedance of best power handling (30 Ohms) and the impedance of lowest loss (77 Ohms) of air dielectric coax cable.

coax

Live Right Now: Cyberspectrum 17 Software Defined Radio Meetup

Every month SDR evangelist Balint Seeber hosts the Cyberspectrum Meetup in San Francisco, where many SDR fans come together to listen to various presentations. This months meetup is live right now (at the time of this post) and you can watch it live now on YouTube, or delayed later now over, but the recorded stream is available for viewing on YouTube. If you are in San Francisco you can attend the live meetup, but if not you can watch the live stream on YouTube.

This time the talks include:

•”The Land Mobile Radio Spectrum: What is out there, how it works, and how you can hear it” with Desmond Crisis (@dcrisis)

Wireless two-way is the technology that keeps the world working in sync. I’ll explore the various public safety, private enterprise, and personal communications services from[masked] MHz.  We’ll discuss the occupied spectrum, modulation bandwidths, trunked radio schemes and digital transmission modes currently in use on the band as well as what lies ahead. Bring your SDR kit and play along!

lmrs

• An Academic Look at Interference & Jamming

• Installfest / Hackfest / Debugfest

University Course on Digital Signal Processing with the RTL-SDR

Over the past few years the Electrical Engineering department of the University of California, Berkley has been using RTL-SDR’s in their EE123 Digital Signal Processing (DSP) course. We’d posted about this course years before when it first came out, but recently Micheal Lustig (KK6MRI), the Associate Professor of the course wrote in to let us know that the course has evolved and is now better than ever.

The course covers DSP essential material such as the Discrete Fourier Transform, Fast Fourier Transform, RF Filter design, as well as more complex subjects. All the course material is available in note and video form if you scroll down on the main page at https://inst.eecs.berkeley.edu/~ee123/sp16/index.html.

However, the professor writes that the best gem that they have developed in their labs which can be found at https://inst.eecs.berkeley.edu/~ee123/sp16/labs.html. The labs run on the web based Ipython/Jupyter Notebooks and guide you through the implementation of an ADS-B receiver, broadcast FM and subcarrier demodulation, frequency calibration with GSM, and a full python APRS transceiver using the baofeng radio and a custom audio interface. These labs are an excellent tutorial into the world of DSP.

The final project of the class is also very interesting. The students of the class were given the task to send images using a Baofeng UV-5R handheld radio and receive them with an RTL-SDR. On the day of the project demonstration they were given two images, and the challenge was to transmit the best quality image over 75 seconds. Videos of the presentation can be found at https://inst.eecs.berkeley.edu/~ee123/sp16/projectVideos.html. The winning team used a combination of five Baofeng’s for simultaneous transmission of a compressed image and an RTL-SDR for receiving.

Richard-Allan-James

Making use of the Infrared LED on RTL-SDR Dongles

The infrared (IR) LED on most RTL-SDR dongles is a vestigial from the days when it was actually used for its original purpose as an DVB-T HDTV receiver. It was used to read a remote control that allowed you to change TV channels. For SDR use, the IR has little to no purpose and in many new dongles that come in metal cases (like ours) the IR LED is no longer even included on the PCB.

However, not one to waste a perfectly good interface, RTL-SDR experimenter R. X Seger created a new tool called rtl_ir which allows users to read IR data from any remote control with the RTL-SDR IR LED. Seger tested his program with the TV remote that comes included with some RTL-SDR dongles and was able to decode the scancode for power on/off as well as all the other buttons. He also tested an Apple and Siri Remote, and found that he was able to decode their scancodes too.

R. X Segers post goes over in detail what the IR spectrum is, how the IR driver works, and how to use the rtl_ir program and run it simultaneously with other RTL-SDR programs. He also shows an example on how it can be used to remotely power off a Raspberry Pi.

IR data received with rtl_ir.
IR data received with rtl_ir.

LuaRadio: New Flowgraph Based Digital Signal Processing Framework for SDR

LuaRadio is a new Digital Signal Processing (DSP) framework for software defined radios such as the RTL-SDR. It is similar to GNU Radio in that the flowgraph is composed of graphical blocks that can be visually connected to one another in an editor. However compared to GNURadio it aims to be very lightweight in terms of disk space used (1 MB footprint) and the number of dependencies required (zero dependencies required unless you need real time highly optimized libraries). It is also written purely in the Lua programming language. The authors of LuaRadio write “LuaRadio is more inclined towards scripting and prototyping than GNU Radio, and emphasizes fast block development.”

On their website there are already several example application flowgraphs uploaded, such as decoders for WBFM Mono/Stereo, NBFM, AX.25, POCSAG, RDS, AM and SSB. Looking and building such flowgraphs is extremely helpful for learning DSP, and DSP languages like this are excellent for prototyping new signal decoders. In addition, if you are new to SDR they also have a very useful page that explains basic SDR and radio concepts.

A LuaRadio based POCSAG decoder flowgraph.
A LuaRadio based POCSAG decoder flowgraph.

Cyberspectrum #16: Software Defined Radio Meetup

Every month SDR evangelist Balint Seeber hosts the Cyberspectrum Meetup in San Francisco, where many SDR fans come together to listen to various presentations. This months meetup is due to be held on June 29 at 7 PM (San Fran time, about 18 hours from the time of this post). If you are in San Francisco you can attend the live meetup, but if not you can watch the live stream on YouTube.

This time the talks include:

• “Understanding the LTE Physical Layer” with Sandor Szilvasi (@sszilvasi)

LTE is an incredible, yet complex, cellular networking standard. Sandor will break it down and explain how a LTE signal is constructed. He will also live demo the demodulation and decoding of local carriers.

LTE_cyberspectrum

• “Interactive Install & Setup-fest” with the group

We would like to open up the forum to those who wish to get set up with SDR (hardware and/or software). Bring along your equipment, and as a group we can look at/debug the steps required to get you up and running. This could also include setting up an app, or fixing an Out-Of-Tree module, or even an environment issue on your laptop.

• “GNU Radio Tutorial Part 2” with Neel Pandeya

The tutorial series will continue! This time we will look at how to construct an FM radio receiver, and decode the RDS digital subcarrier. This will include:

• Explain concepts behind commercial FM and RDS
• Receiving mono FM using a from-scratch flowgraph
• Showing how to build ‘gr-rds’
• Demonstrate stereo FM+RDS reception using ‘gr-rds’
• Building GQRX
• Demonstrate FM reception using GQRX