Category: RTL-SDR

Tuning an R820T2 RTL-SDR up to 6 GHz via a Harmonic Mixing Driver Hack

A while back we heard a suggestion that it may be possible to use the 5th harmonic on R820T2 RTL-SDRs to receive frequencies much higher than the normal 1.766 GHz limit. After mentioning this to to Hayati Augen he has recently managed to implement this driver hack, and now R820T2 based RTL-SDRs can tune all the way up to 6 GHz if Hayati's experimental driver branch is used.

Before everyone gets too excited, we need to temper expectations as sensitivity reduces the higher the frequency so an LNA may be required, imaging/aliasing is a major problem, and you will absolutely require a ~1.7 GHz high pass filter to be able to actually see any signals as otherwise the lower bands drown everything out. So when combined with the relatively small bandwidth of the RTL-SDR, the overall usefulness of this feature may be very limited, however it is great that this option at least now exists.

In order to actually receive anything, you will need to filter out all signals below about 1.7 GHz, otherwise they will alias on top of your desired frequency. We used the VHF-1760+ from Mini-Circuits. There are other options available as well, however this filter seems to work well as long as the signals below 1.7 GHz are not too strong.

Testing Harmonic Reception with 700 MHz to 26 GHz Antenna, 1760 MHz High Pass Filter and an RTL-SDR Blog V3

The latest branch with the harmonic hack can be found in the librtlsdr Github on the development branch. The binary releases can be found under Github releases. The easiest way to get started is to download the static zip, and run rtl_tcp. Then we recommend connecting to the rtl_tcp server with HDSDR, and using this custom ExtIO available on the extio_rtl_tcp Github releases. Newer version of SDR# currently seem locked to 2 GHz maximum, so this is why we recommend HDSDR at the moment. 

When tuning above 1.766 GHz 5th harmonic tuning will automatically be activated. However, you can also use the -harm flags on the command line tools to choose the 3rd harmonic too if you wish to test that.

In testing we were able to receive signals generated by a HackRF and signal generator up to 4.2 GHz. Sensitivity appears to be decent until around 2.7 GHz, then it begins to lower significantly. There are also a few bugs in the tuning code, as at some frequencies the actual signal will be offset by a few MHz from where we would expect. It appears to be a scaling issue. Also we've also only been able to get up to a maximum of 4.2 GHz on HDSDR, but this may only be due to a HDSDR 32-bit limitation.

We've tested this hack on several RTL-SDRs, and found that signals are overall the strongest on our RTL-SDR Blog V3. This is most likely due to the fact that the V3 has a front end matching circuit that does not attenuate L-Band or higher frequencies, unlike models based on the original TV dongle design. 

If anyone has success with this hack for any application, please let us know down below in the comments.

Test signal from a HackRF at 2.45 GHz
Baby monitor signal

DragonOS: OP25 “Boatbod” P25 Phase 1 Running on GNU Radio 3.8 with RTL-SDR

DragonOS is a ready to use Ubuntu Linux image that comes preinstalled with multiple SDR program. The creator of DragonOS, Aaron, uploads various YouTube tutorials. In his latest tutorial he shows how to install the latest version of the "Boatbod" OP25 development code for receiving P25 Phase 1 on Linux with the latest GNU Radio 3.8. In the video Aaron uses an RTL-SDR, but notes it could also work with other SDRs like the HackRF.

DragonOS Focal OP25 "Boatbod" P25 Phase 1 w/ RTLSDR (GNU Radio 3.8, Python3, R9+)

SSTV from the International Space Station Scheduled for Dec 24 – Dec 31

Thank you to Maksim for submitting news that the International Space Station (ISS) will be transmitting Slow Scan TV (SSTV) in late December to celebrate 20 years of amateur radio operations onboard the space station. The ISS periodically transmits SSTV images during special events throughout the year. You can keep up to date on the ISS SSTV schedule on the ARISS-SSTV site.

An ARISS Slow Scan TV (SSTV) event is scheduled from the International Space Station (ISS) for late December. This will be a special SSTV event to celebrate the 20th anniversary of ARISS operations on the ISS. The event is scheduled to begin on December 24 and continue through December 31. Details to follow later. Dates are subject to change due to ISS operational adjustments.

With an RTL-SDR and a simple V-Dipole from our RTL-SDR Blog V3 antenna kit it is possible to receive these images when the ISS passes over. ISS passes for your city can be determined online, and the SSTV images can be decoded with a program like MMSSTV.

An example SSTV image from the last ISS SSTV event
An example SSTV image from an SSTV event held in previous years.

KerberosSDR with DF-Aggregator Direction Finding Attempt

Back in October we first posted about the release of DF-Aggregator, a program by Corey (ckoval7) which can be used to receive and plot data from multiple KerberosSDR direction finding units. 

If you weren't already aware KerberosSDR is our 4-channel phase coherent capable RTL-SDR unit that we previously crowdfunded back in 2018. With a 4-channel phase coherent RTL-SDR interesting applications like radio direction finding (RDF), passive radar and beam forming become possible. It can also be used as four separate RTL-SDRs for multichannel monitoring.

In one of his latest DragonOS videos, Aaron has been testing out DF-Aggregator. In his test he had two vehicles driving around each with a KerberosSDR and antenna array, with both using a mobile data connection to send data to a remote PC running DF-Aggregator. The results were successful, with the team being able to determine the location of a broadcast FM transmitter to within a few meters after a short drive.

DragonOS Focal KerberosSDR x2 Mobile w/ DF-Aggregator Direction Finding Attempt 2 (Better Results)

Frugal Radio: SDR Guide Ep 8: Overcoming FM Broadcast Interference + Simple DMR Plugin Demo

In this weeks episode of Frugal Radio's SDR Guide videos Rob shows how a FM bandstop filter can help in certain situations. A FM bandstop is designed to reduce the power level of FM broadcast stations that are received by your antenna. FM broadcast stations are often extremely strong, and this can cause an SDR to overload, resulting in poor reception on other frequencies.

In the video he demonstrates how he is unable to receive air traffic control signals due to FM broadcast overload. After inserting an FM bandstop filter the air traffic signals become receivable. We note that we sell a low cost FM bandstop filter in our store.

2020 SDR Guide EP8 : Overcoming FM Broadcast Interference with a Nooelec flamingo band stop filter

In a second video Rob demonstrates the use of the recently released Simple DMR plugin which we posted about earlier.

Quickest way to monitor DMR with your SDR? Simple DMR for SDR# installed in under 5 mins!

Gorizont-RTLSDR Linux Distro Updated to V2.0.3

Gorizont-RTLSDR is an RTL-SDR focussed Linux distribution based on Xubuntu 20.04 LTS. Recently it was updated to V2.0.3. The creator Steve Cox writes: 

New release and upgrade of gorizont linux, v 2.0.3. uploaded to sourceforge. The new AMSynch option in gqrx 2.14.2 works rather well for broadcast stations in direct sampling mode.

  • gqrx 2.14.2 - now with AMSynch mode!
  • SigDigger 0.1.0
  • Universal Radio Hacker 2.9.0
  • gqrx-scan
  • 2.2 for all your DAB and DAB+ needs.
  • Baudline
  • fldigi
  • fmsg
  • Due to multiple issues with linux versions of Dream DRM, Dream DRM is now installed as a Win 32 .exe running under wine. It works!
  • w-scan for creating DVB-T/ATSC/etc. scan files for TV viewing using VLC

DSDPlusUI Now Available as a Plugin for SDR#

At the beginning of 2020 Annunaki (@StupotSinders) released his third party user interface for DSDPlus. DSDPlus is a digital speech decoder capable of decoding protocols such as P25 P1, DMR, NXDN and more with an SDR such as the RTL-SDR. As it is a command line tool, it can be a little daunting for some users, which is where the GUI comes in handy.

Recently Annunaki has released an SDR# plugin version of DSDPlusUI. This makes it so you can visualize the digital voice signals at the same time as controlling and decoding with DSDPlus. The plugin is available on the DSDPlusUI website at To use it you will need to be using SDR# 1777 or later.

DSDPlusUI as a plugin for SDR#

Steve Mould Hacks Into his Car with a HackRF

Over on YouTube popular science content creator Steve Mould has uploaded a video showing how he was able to open his own car using a HackRF software defined radio. In the video Steve first uses the Universal Radio Hacker software to perform a simple replay attack by using his HackRF (and also an RTL-SDR V3) to record the car's keyfob signal away from the car and replay it near the car.

Steve goes on to note that most cars use rolling code security, so a simple replay attack like the above is impractical in most situations. Instead he notes how a more advanced technique called "rolljam" can be used, which we have posted about a few times in the past. Later in the video Steve interviews Samy Kamkar who was the security researcher who first popularized the rolljam technique at Defcon 2015. 

I Hacked Into My Own Car