Building a FossaSat-1 LoRa IoT Ground Station

FossaSat-1 is a recently launched open source "picosatellite" with an onboard LoRa repeater designed for Internet of Things (IoT) communications. It was launched via the Electron Rocket in New Zealand on December 6. At only 5 x 5 x 5cm in size and 250g in weight, a picosatellite is a tiny satellite that fits in your hand and can be affordably built and launched for around US$40k. 

Since the launch, it has been confirmed that FossaSat-1 was successfully launched, and is working correctly. However, the antennas have not properly deployed yet resulting in a weak signal that cannot be received by small ground stations. The team are currently working on getting the antenna manually deployed from earth and the latest updates can be found on their Twitter @FossaSys. They note that if the antennas cannot be deployed, then there is still the future launches of FossaSat-1B and FossaSat-2 to look forward to.

While waiting for the antennas to deploy you can watch Andreas Speiss' YouTube video where he explains the satellite in more detail, and shows how to build a FossaSat-1 ground station that can receive the FossaSat-1 LoRa transmission and upload it to the internet. While not SDR-related as it uses a hardware based LoRa chip, this is still an interesting project that some readers may be interested in.

#302 We build a 20 Dollars LoRa Satellite Ground Station and we follow the FossaSat-1 launch

Passive Doppler Aircraft Scatter with a VOR Beacon and an RTL-SDR

Over on YouTube Meine Videokasetten has posted a video showing how he's been using an RTL-SDR to detect aircraft landing and taking off via the scatter on a VOR beacon. VOR (aka VHF Omnidirectional Range) is a navigational beacon that is transmitted between 108 MHz and 117.95 MHz from a site usually at an airport. Although as it is an older technology it is slowly being phased out in some places. 

An interesting observation can be made that is unrelated to the actual operation and use of VOR navigation. When an aircraft passes near the VOR beacon it results in the signal reflecting and scattering off the metal aircraft body. As the aircraft is moving quickly, it also results in a frequency doppler shift that can be seen on an RF waterfall display.

In his video Meine Videokasetten uses an RTL-SDR and OpenWebRX to receive the VOR signal. He then pipes the audio output of that signal into Speclab which allows him to get significantly increased FFT resolution for the waterfall. This increased resolution allows him to clearly see the doppler scattering effects of aircraft on the VOR transmission. He notes that it's possible from the scattering to determine if an aircraft is taking off or landing.

Passive doppler radar on VOR beacon transmitter .:°:. A let's test it out

We note that back in 2015 we posted about the ability to "fingerprint" aircraft using this technique. Different types of aircraft will result in unique patterns on the waterfall. In that post they used analogue TV carriers which are not very common in most countries anymore, so it's good to see that this can be used with VOR signals too.

Comparing large and small aircraft with aircraft scatter
Comparing large and small aircraft with aircraft scatter with an analogue TV transmitter. From previous post.

Starlink GRAVES Radar Reflections Received with SDR

Over on YouTube Jan de Jong who is based in Germany has posted a short slide show video showing that he received reflections of the GRAVES space radar from the new Starlink satellites.

Starlink is a SpaceX run satellite constellation that is slowly being launched in order to provide worldwide satellite internet access. The last launch was on 11 November 2019. Typically multiple satellites are launched at once, and they follow each other closely in a line, slowly spreading out.

The GRAVES space radar is a powerful radar based in France that is used to track satellites. If you are not too far away from France and within the GRAVES radar footprint you can point an antenna at the sky, and tune to the GRAVES radar frequency of 143.05 MHz with an RTL-SDR or any other SDR. You might then receive the reflections of this radar signal coming from satellites passing overhead. GRAVES has also been used for meteor scatter detection.

As the 60 and more satellites from Starlink 2 pass over the Graves radar signal they reflect a vertical track on the HROFFT radar image from the 143.05Mhz signal. In the first images the satellites are all still very close together, in current passes they have spread already and the display looks almost like rain in the sky on the 1 second radar plot from HROFFT.
Signal received with SDR RTL (SDRuno RSP1A) and 3 element Yagi at 45 degrees towards south

#Starlink-2 Passes over #Graves Radar #ElonMusk

A new VOR Decoder Written in Python

Thank you to Martin Bernardi for writing in and sharing with us his new VOR decoder that is written in Python. The program decodes VOR from a wav file, so any SDR such as an RTL-SDR can be used to record the audio initially.

VOR stands for VHF Omnidirectional Range and is a way to help aircraft navigate by using fixed ground based beacons. The beacons are specially designed in such a way that the aircraft can use the beacon to determine a bearing towards the VOR transmitter. VOR beacons are found between 108 MHz and 117.95 MHz, and it's possible to view the raw signal in SDR# with a software defined radio such as an RTL-SDR.

Martin notes that there are already several VOR decoders available, including vortrack written in C, and several GNU Radio based decoders [1][2]. However, Martins is the first in Python, which is a fairly easy to understand language and this should make learning from the code easier.

The GitHub readme for the project is a good read too, as it explains exactly how the VOR decoder works, and shows some results that they were able to obtain. In their testing they were able to obtain measurements at three locations with an accuracy of +/-3°.

The VOR Spectrum
The VOR Spectrum

Testing the SDRplay RSPdx in HDR Mode on NDB and Broadcast AM DX

One of the selling points of the recently released SDRplay RSPdx is it's special High Dynamic Range (HDR) mode which can be used to improve signal performance for frequencies below 2 MHz. This mode should be especially useful in RF environments where there are strong signals that can overload the SDR and desensitize reception on weaker stations.

Over on YouTube Ivan (aka icholakov) has uploaded a video showing comparisons of signals being received with HDR mode turned on and off. He tests it on weak NDB DX signals, and on medium wave broadcast AM. The results do appear to show that using HDR mode results in an improvement in signal strength.

SDRPlay RSPdx HDR mode on and off - testing Non Directional Beacons and Medium Wave

The Toosheh Project: An Outernet-like Service for Iran and the Middle East

If you've been following our blog over the years, you'll know that we've mentioned the "Outernet" (now known as "Othernet") service a few times. Othernet is a satellite service that wants to provide one way data such as news, weather, audio, books and Wikipedia articles to those in areas with poor, censored or no internet connection. Previous iterations made use of home satellite TV equipment, then L-band (with RTL-SDR receivers) and now the Ku-band with LoRa receivers. Currently it's only available in North America and Europe.

However, thanks to a reader we were recently informed about an interesting and long running Othernet-like service for the Middle East called "Toosheh" (aka Knapsack) which makes use of satellite TV dishes and receivers that are very common in the Middle East. While not specifically related to SDRs, this is an interesting RF related project and situation that we wanted to post about.

Our reader is from Iran where the government recently shutdown the entire country's internet for 7-days due to anti-government protests. The reader wanted to share information about the Toosheh project which has been operating for several years now, and is one of the ways Iranians can get around heavy internet censorship and blockages.

After two rough weeks of no internet access at all, finally, we're gaining access again and getting back online slowly. As you may know (if you are following the news) a complete internet shutdown conducted by the I.R. of Iran due to some intense protests across the whole country against the government because of a 200% sudden and unannounced gas price increment. The internet is censored in my country anyhow but this time it was a big one. We only had access to a few domestic websites and NOT even Google services! That was tough!

I know it may be irrelevant to the subject of your blog but it's good for your audience to understand and know the people who have worked hard way before the OUTERNET project to develop a satellite offline broadcast with almost no special devices to receive and use and bring free and uncensored information to the people in Iran.

The major role of the Toosheh project occurred in the Iran 2012 presidential election protests which there were no major broadband internet services all over the country and it a lot to bring daily updates of news and TV programs.
The Toosheh is a one-way receive only from the satellite but the tricky part is that Toosheh is not just like a simple satellite data link but it appears as a TV channel in all satellite TV receivers which are very common in Iran, so the blockage of it is hard for the government. However, some trials were arranged by the government back in that time to collect the satellite dishes or jam the signals or mass destruction (!) of the satellite receivers which they currently no longer common in most parts of the country. (at least without unnecessary violence. check out this link: بجستان نیوز » معدوم سازی تجهیزات ماهواره‌ای در بجستان+عکس (Admin note: Article is in Perisian, use Google Translate to translate Persian to English)

The procedure to use this service is freaking simple. Set your dish to Yahsat and search for the channels on 11766 Mhz. Select the Toosheh channel, plug a flash drive to your receiver and record the blank screen in.TS format using the PVR capability. After several hours of recording unplug your flash drive and connect it to your phone, tablet or laptop. Then open the Toosheh app and you are good to go. Now you have access to dozens of free podcasts, music, books, movies, news, webpages, TV shows and much more that will be updated every single day and if you need something specifically just send them an email. Exactly as same as the OUTERNET but without any special equipment and only with ordinary receivers that are available in almost every home nowadays.

Also if you see their website at toosheh.org and search some other press blogs about Toosheh you can gain more info about the topic.
Toosheh Website Image
Toosheh Website Image

We also note that this appears to be the English language version of Toosheh project which provides some more information about coverage and the technology used: https://knapsackforhope.org. Coverage is only available in the middle east.

Toosheh Coverage
Toosheh Coverage

Solving a Frequency Hopping CTF Challenge with Aliasing

At this years BSides Ottawa security conference, Clayton Smith was tasked with setting up a wireless "Capture the Flag" (CTF) competition. CTF competitions generally consist of a mystery signal that participants need to figure out how to decode with an SDR such as an RTL-SDR. 

One CTF that Clayton set up was a frequency hopping challenge with several levels of difficulty. The signal consisted of a narrow band FM signal that constantly hopped between multiple fixed frequencies. The idea was to use whatever means possible to piece together that signal again so that the speech audio could be copied.

The first level had the audio signal hopping very slowly, so the speech could be pieced together manually by listening by ear to each channel it transmitted on. Subsequent levels had the signal hopping much faster, so they required some DSP work to piece everything back together.

In his post Clayton writes about three possible GNU Radio based DSP solutions to the problem. The first method he describes is an interesting method that abuses the effects of aliasing. Aliasing is a problem in SDRs when a signal can be folded on top of another, creating interference. However, this approach makes use of aliasing to purposely fold the hopping channels into one frequency, resulting in speech that can be copied.

The rest of his post explains two other methods that could be used as well. The second method involves treating the entire band consisting of the hopping signals as a single FM signal, then filtering it with a DC block. The third approach uses FFT to detect which channel is active with the highest power, then shifting that channel by it's offset.

Spectrum of the frequency hopping CTF challenge.
Spectrum of the frequency hopping CTF challenge.

Clayton also set up another CTF with gr-paint. The idea was to read text on a "painted" waterfall with ever decreasing text spacing that would eventually be too small to read on standard SDR programs like GQRX. Instead, the solution was to open the IQ data in a tool like Inspectrum or Baudline which has much higher FFT resolution. 

Gr-Painted spectrum with decreasing text.
Gr-Painted spectrum with decreasing text spacing.

Using a HackRF to Investigate Why WiFi on the Raspberry Pi 4 Doesn’t work when Running HDMI at 1440p

The Raspberry Pi 4 launched with it's fair share of problems, but a new problem seems to have been recently discovered and documented. It turns out that the Pi 4's WiFi stops working when running at a screen resolution of specifically 1440p.

Suspecting interference generated by the HDMI clock, Mike Walters (@assortedhackery) used a HackRF and a near field probe antenna to investigate. By placing the near field probe on the Raspberry Pi 4's PCB and running a screen at 1440p resolution he discovered a large power spike showing up at 2.415 GHz. This interferes directly with 2.4 GHz WiFi Channel 1.

An article by ExtremeTech article notes:

There’s a giant spike that could easily interfere with Channel 1 of a Wi-Fi adapter. So why is this happening? Because a 2560×1440@60Hz has a pixel clock of 241.5MHz and has a TMDS (transition-minimized differential signaling) clock of 2.415GHz, according to Hector Martin (@Marcan42). And what frequency does the RBP4 use for Wi-Fi? 2.4GHz. Which means… outputting on HDMI over 1440p can cause interference in a Wi-Fi channel.

The ExtremeTech article also notes that this problem is not unique to the Raspberry Pi 4 only. It turns out that USB 3.0 hardware is to blame, and this problem has occurred before with USB3.0 hard driver and on some MacBooks.

While the interference appears to be localized to the near field around the Pi4 PCB, we suspect that you could use TempestSDR to remotely eavesdrop on the Pi 4's video output if the interfering signal was boosted.