Category: RTL-SDR

Tzumi MagicTV WiFi TV Tuner Device contains an RTL-SDR, OpenWRT board and Battery for only $13

The Tzumi MagicTV is a device that allows users in the USA to watch TV on an Android phone via free over the air digital ATSC signals. It receives and decodes TV on the device,  then streams decoded TV to an Android phone via a WiFi connection.

Over on Reddit user meowTheKat has alerted everyone to the fact that 'Tzumi MagicTV' devices contain not only an R828D RTL-SDR inside them, but also an AR9331 OpenWRT board and a 3000 mAh battery pack. This means that the device could potentially be used as a portable RTL-SDR server over a WiFi connection without any additional required hardware. And right now is a particularly good time for this discovery to come out, as the device is reportedly selling at a clearance sale price of only $13 at Walmarts across the USA.

OpenWRT is custom open source firmware that is intended to be installed on compatible internet routers. It extends the functionality and stability of many routers. Since OpenWRT is based on Linux, it is possible to use the RTL-SDR on routers running OpenWRT and we have several previous posts about people doing this.

Currently meowTheKat reports that the MagicTV is indeed running OpenWRT, and that  SSH is available. The SSH password is unknown but a colleague of his is currently working on cracking the password. Once cracked it should become possible to install RTL-SDR software on to it. However, there is no word yet on if the front end has additional filtering specifically for TV signals or not. If there is additional filtering those circuits would need to be removed to restore wideband tuning to the RTL-SDR.

Update: From discussion on the Reddit thread it appears that the tuner chip used is not an R828D as first thought, but instead a MXL603/608. This tuner is currently not supported in the RTL-SDR code, but support could probably be added by a developer.

Update 2: Unfortunately it seems that this won't end up going anywhere. In the librtlsdr GitHub issues forum Hoernchen commented:

The tuner is connected to a demod ic, which is connected to the TS input of the rtl2832p, so code is not going to fix the fact that the device is unusable without quite a bit of tricky soldering to reroute the tuner output to the rtl.

The "Tzumi MagicTv" contains an RTL-SDR, OpenWRT Board and Battery Pack.
The "Tzumi MagicTv" contains an RTL-SDR, OpenWRT Board and Battery Pack.

QuestaSDR Android App now with Remote Network Streaming: RTL-SDR, Airspy, SDRplay Supported

Back in April we posted about QuestaSDR, which had just released the Android version of its SDR software. Recently QuestaSDR programmer 'hOne' wrote in and noted that a new update has enabled remote streaming in QuestaSDR.

To get set up, just run the Windows version of QuestaSDR on a PC, and open the "SDR Server" app. Once the server is running, you can connect to it via the Android version of QuestaSDR over a network connection. The server supports the RTL-SDR, Airspy and any ExtIO compatible device such as SDRplay units. As far as we're aware, this is the only Android app that currently supports streaming from non rtl_tcp compatible units such as the Airspy and SDRplay.

hOne has been able to run an Airspy at the maximum bandwidth of 10 MSPS through his network connection. He also notes that you can now zoom into the IF spectrum in detail by using the new "IF Spectrum" plugin.

hOne also notes that the streaming feature is currently in beta, and any bugs/suggestions or feedback are welcome.

QuestaSDR Streaming over a network connection with an Airspy
QuestaSDR Streaming over a network connection with an Airspy
AirSpy windows server, android client LAN Remote

YouTube Talk: Investigating RF Controls with RTL-SDR

During the SANS Pen Test HackFest which was held back in 2017, speaker Katie Knowles who is a security consultant at MWR Infosecurity did a very informative talk on how an RTL-SDR can be used to investigate RF signals. The video has recently been uploaded to YouTube and is shown below. In the talk she goes over how to reverse engineer and understand simple RF protocols, like those used by common RF remote controls found in the home. She then goes on to talk about the basics of software like GNU Radio and rtl_433. The talk blurb reads:

Cranes, trains, theme park rides, sirens, and …ceiling fans? Modern RF protocols have made secure wireless communications easier to implement, but there’s still a horde of simpler RF control systems in the wireless world around us.

Lucky for us, the onset of affordable Software Defined Radios (SDRs) means that exploring these devices is easier than ever! In this talk, Katie examines capturing and understanding basic RF control signals from a common household controller with the affordable RTL-SDR so you can start your own investigations.

With a little knowledge of these protocols we can better explain what makes them risky to the environments we assess, practice thinking in the offensive mindset, and have some fun examining the signals around us.

Slides available here.

Signal Safari: Investigating RF Controls with RTL-SDR – SANS Pen Test HackFest 2017

Video Demonstrating C-Band AERO Aircraft Tracking

AERO is essentially the satellite based version of aircraft ACARS. AERO's L-band signals contains short ground to air messages with things like weather reports and flight plans. The C-band signals are the air to ground portion of AERO and more difficult to receive as they require an LNB and large dish. However they are much more interesting as they contain flight position data, like ADS-B.

Over on YouTube Tomasz Haddad has uploaded a video of C-band AERO being received from the Inmarsat 3 F2 (Atlantic Ocean Region – East (AOR-E) 15W satellite. He uses a 1.80m motorized satellite dish with Kaonsat KS-N201G C-band LNB, a Prof 7301 PCI satellite card (to power the LNB) and an RTL-SDR V3. The C-band LNB translates the high C-band frequencies down to L-band which is receivable with an RTL-SDR. He notes that the LNB drifts quite a lot as it is not frequency stabilized.

With the signals received by his setup he's able to use the JAERO decoding software together with Virtual Radar Server to plot aircraft positional data using Virtual Radar Server. The plotted aircraft are mostly all in the middle of the ocean or in remote areas, which is where C-band AERO is normally used due to the lack of ground ADS-B stations.

Inmarsat 3 F2 15W C Band AERO Reception Using Jaero And Virtual Radar

Creating a Linear Transponder with an RTL-SDR, HackRF and Raspberry Pi

A linear transponder is essentially a repeater that works on a range of frequencies instead of a fixed frequency. For example, a normal repeater may receive at 145 MHz, and repeat the signal at 435 MHz. However, a linear transponder would receive a wider bandwidth, and add a set frequency offset to the received signal. For example a signal received by a linear transponder that receives from 145 - 145.5 MHz, may receive a signal at 145.2 MHz and it would translate that up to 435.2 MHz. Another signal received at 145.4 MHz would translate up to 435.4 MHz. Hence the received frequency linearly translates to the transmitted frequency.

Over on his blog ZR6AIC has shown that it is possible to create a linear transponder using an RTL-SDR for receiving, a Raspberry Pi for processing the signal, and a HackRF for re-transmitting the signal. 2M and 70cm band bandpass filters are also used. For software he uses a GNU Radio flowchart that simply moves the IQ data from the RTL-SDR to the HackRF.

In the video below he demonstrates the linear transponder in action with two handheld radios.

A Linear Transponder made with HackRF, Raspberry Pi and RTL-SDR.
A Linear Transponder made with HackRF, Raspberry Pi and RTL-SDR.
Building a Linear Transponder with Gnu Radio, rtl dongle and hackRF module..

Forwarding Pager Messages Received with an RTL-SDR to Email

Over on YouTube Jack Riley has created a video that documents his system which uses an RTL-SDR to receive POCSAG pager messages and forward messages sent to specific pager addresses to an email address. He uses his RTL-SDR on a Raspberry Pi, together with rtl_fm and multimon-ng to receive and decode the pager messages.

Then using a custom program that is available on his website he filters messages for a particular 'capcode' which indicates the address of a particular pager. When a pager message to the specified capcode address is received, the program turns the message into an email which is instantly sent out.

This is a nice way to forward pager messages on to a more modern device such as a smart phone.

Creating a Pager using a Raspberry Pi and RTL-SDR to send alerts via Email.

Monitoring FT8, JT65, JT9 on Multiple Bands with Low Cost Single Board PCs

Thank you to Michael (dg0opk) who wrote in and wanted to share details of his full SDR monitoring system for weak signal HF modes. His setup consists of nine ARM mini PCs (such as Banana Pi's, Raspberry Pi's, and Odroid's), several SDRs including multiple RTL-SDR's, an Airspy Mini, FunCube Dongle and SDR-IQ, as well as some filters and a wideband amp. For software he uses Linrad or GQRX as the receiver, and WSJTx or JTDX as the decoding software, all running on Linux.

Michael also notes that his Bananapi FT8, JT65 and JT9 SDR monitor has been up and stably running continuously for half a year now. Bananapi's are lower cost alternatives to the well known Raspberry Pi single board computers, so it's good to note that a permanent weak signal monitoring system can be set up on a very low budget. Presumably even cheaper Orange Pi's would also work well.

With his setup he is able to continuously monitor FT8, JT65 and JT9 on multiple bands simultaneously without needing to tie up more expensive ham radios. His results can be seen on PSKReporter. A video of his RTL-SDR Raspberry Pi 3 decoding FT8, JT65 and JT9 can be found here.

Weak Signal Receiver Setup
dg0opk's weak signal receiver setup

SDR# TETRA Decoder Plugin Updated

The TETRA plugin for SDR# has been updated a few times since our last post on it back in March. The latest version can be downloaded directly here, and the original link comes from the Russian scanner forums.

In the new version the 'Net Info' button is now functioning and it is possible to see the current calls, groups, and meta information on the current cell and neighbour cell. It also appears that it has been updated to allow for multiple SDR# TETRA decoder instances to be opened simultaneously now for wider band monitoring.

SDR# TETRA Plugin Net Info Window
SDR# TETRA Plugin Net Info Window