Using a HackRF to Reverse Engineer and Control Restaurant Pagers

Several years ago back in 2013 and 2014 we uploaded two posts showing how it was possible to use an SDR to listen in to restaurant pagers and collect data from them, and also to spoof their signal and activate them on demand. If you were unaware, restaurant pagers (aka burger pagers), are small RF controlled discs that some restaurants hand out to customers who are waiting for food. When the food is ready, the pager is remotely activated by the staff, and then flashes and buzzes, letting the customer know that their order can be picked up.

Over on YouTube user Tony Tiger has uploaded a video that shows an overview on how to reverse engineer the signal coming from a particular brand of restaurant pagers. The tools he uses include a HackRF SDR and the Inspectrum and Universal Radio Hacker software packages. If you're interested in reverse engineering signals, this is a good overview. Later in the video he shows a GNU Radio and Python program that he's created to control the pagers.

Hacking Restaurant Pagers with HackRF

Airspy HF+ Discovery Now Available for Preorder + Brief Initial Review

The Airspy team have recently announced the release of their new "Airspy HF+ Discovery". The Discovery is a smaller, lighter and improved version of the Airspy HF+. The frequency range, bandwidth and bit depth and specs all remain the same, but there are some improvements to the dynamic range due to the addition of preselectors. The original Airspy HF+ was released back in mid-2017 and it still is in our opinion one of the best low cost HF DX SDRs because of its very high dynamic range design, so strong interfering signals are not much of a problem. We have a previous review of the Airspy HF+ available here were we compare it against a number of other HF SDRs.

Although the dynamic range was very high, some users reported that extremely strong signals could still desensitize the HF+. So in response the new HF+ Discovery improves on the dynamic range even further by including multiple low insertion loss preselectors built in to the front end. For HF there is are 0, 5, 10 or 17 MHz High Pass Filter corners, and 5 or 31 MHz Low Pass filter corners in series which can provide filtering for a number of bands. For VHF, there are 60-118 MHz and 118-260 MHz filters. The designer boasts that the inclusion of these filters bring the HF+ Discovery up to the performance level of expensive new SDR based ham rigs like the Icom 7300.

Airspy HF+ Discovery Block Diagram
Airspy HF+ Discovery Block Diagram

As for the physical design, the enclosure is now much smaller (60 x 45 x 10 mm) and made from plastic. These changes make the SDR very light at only 28 grams (1 oz). Although the case is plastic, local interference doesn't seem to be an issue as the PCB itself is fully shielded. The plastic case is rugged and will withstand a beating. Also, the original HF+ had two input ports, one for HF and one for VHF whereas the HF+ Discovery only has one input port which covers all bands.

Despite the improvements and additional circuitry, the Airspy HF+ Discovery is actually priced cheaper than the original. The original HF+ costs US$199, but the Discovery is only US$169. So unless you require the two input ports, the HF+ Discovery should be the way to go. Currently the HF+ Discovery is in preorder status, and can be ordered internationally from the manufacturer iTead, or within the US from airspy.us. As far as we can see no expected shipping date has been given yet, but we expect that it would ship soon.

RTL-SDR For Scale
RTL-SDR For Scale

Initial Testing

We were sent a prototype sample of the Airspy Discovery HF+ a few weeks ago. We note that the version we received was an early prototype and does not yet implement the 10 MHz and 17 MHz HF filters.

From our test on real world signals we find that it performs at least as good as the original Airspy HF+, if not better due to the additional filtering. The signals in our area were not strong enough to really overload the original Airspy HF+, so any benefit from the additional filtering may not be too apparent.  Insertion loss from the filters seems to be not noticeable, as we saw no differences to SNR levels between the two units.

In our VHF tests we saw no differences between the two units, but as with HF we note that it would take some fairly strong signals to make a difference.

In a future post we'll follow up with some tests by injecting strong signals into the SDR, and seeing how well it can performs with the additional filtering compared to the original.

TOP: Airspy HF+ Discovery, BOTTOM: Original Airspy HF+
TOP: Airspy HF+ Discovery, BOTTOM: Original Airspy HF+

Conclusion

If you have an HF+ and were still troubled by really strong out of band interferers, the HF+ Discovery might be a good upgrade. Newcomers to SDR looking for high a performance DX SDR for HF and VHF should also strongly consider the HF+ Discovery. The original HF+ is still one of the best low cost DX SDRs we've tested, and the Discovery only makes it better.

As far as we can see regarding the choice between the original HF+ and HF+ Discovery, the only reason to really consider the original HF+ would be if you prefer to have separate HF and VHF antenna ports. The plastic case brings no real disadvantage, and the preselectors improve dynamic range and have no noticeable insertion loss.

Short Article Explaining DSP Basics Without Math

If the math behind software defined radio and digital signal processing (DSP) concepts does your head in, the RSGB has a short document that explains core DSP concepts without any math. If you're just looking for an overview of what terms like sampling, nyquist, aliasing, number of bits, undersampling, digital filters and fast fourier transform mean, then this short article is a great start.

This article, based on a presentation first given at the 2017 RSGB Convention, is intended for the amateur radio exam tutors to help with teaching the new Software Defined Radio (SDR) material in Syllabus 2019. It goes slightly beyond the syllabus requirements and is designed to give a basic background into Digital Signal Processing (DSP), enabling Tutors to answer some questions that trainees may ask, and to help tutors develop their own knowledge. Links to suggested further reading are given for those who might want to know more.

Direct PDF Link: https://rsgb.services/public/exams/presentations/190427_DSP_without_maths_article_v1-3.pdf

[First seen on Southgate Amateur Radio News]

Excerpt of the explanation on sampling
Excerpt of the explanation on sampling

A More In-depth Look at the Tunisian RTL-SDR Espionage Story

The Africa Report, an online newspaper specializing in African stories recently ran a story titled "A Tunisian spy story". The story discusses the circumstances behind the mysterious arrest of a UN expert in Tunisian, supposedly for having used an RTL-SDR dongle as part of his research into violations of the UN arms embargo on Libya. See our previous post for the original details.

The Africa Report story gives a more in depth look at what happened during his arrest and what is happening in Tunisia. If you're interested in following this story, this is a good read.

An RTL-SDR aircraft tracker, which can be purchased legally on the internet, is composed of an antenna and a USB key. There are smartphone apps that have similar functionalities that allow you to track commercial flight routes. Can it be that this object, found in his home, is the sole piece of evidence used by the Tunisian courts to justify the detention of United Nations (UN) expert Moncef Kartas for espionage, as his defence claims?

Kartas, who is German-Tunisian, was officially mandated in 2016 by the UN to lead an investigation into violations of the arms embargo on Libya. His carefully selected team was appointed by the UN secretary general and were due to draft a report in June. Kartas’s arrest disrupted those plans.

Kartas was arrested as he walked off a plane on 11 April in a theatrical scene at Tunis airport involving around 10 security agents. He is now awaiting trial in his cell in Mornaguia prison. Accused of “treason” and “spying for a foreign power”, he faces the death penalty. Fortunately for him, Tunisia has banned that punishment.

Rumours are running high around the activities of a security company he co-founded and the role of a second man who was also arrested. But several pieces are missing from the puzzle. The versions of the Tunisian authorities and the UN are completely different, as is the information supplied by the defence and that supplied by the prosecution. Saying it is “very concerned”, the UN is calling for the researcher’s release, pointing out that the lifting of his immunity is illegal.

[Read More]

UPDATE: Kartas was recently freed on bail.

SignalsEverywhere: P25 Trunking with Just One RTL-SDR and DSDPlus Fastlane

Over on YouTube Corrosive from the SignalsEverywhere channel has uploaded a new video showing us how to set up P25 trunking and decoding with DSDPlus Fastlane and only a single RTL-SDR.

Normally two dongles are required to follow a P25 trunking system. One dongle continuously receives the trunking channel, and a second tunes to the voice channel chosen by the trunking channel. However, the latest DSDPlus Fastlane has a feature that allows one only dongle to be used. It works by tuning back and forth between the control and voice channel. The disadvantage is that trunking information could be missed while tuned to a voice channel, so some calls could be missed.

RTL SDR Setup P25 Trunking With 1 SDR and DSDPlus FastLane

Osmocom Now Releasing Weekly Windows Binaries for RTL-SDR and Osmo-FL2K

Osmocom is the open source team behind the RTL-SDR driver project and the Osmo-FL2K discovery. In a recent announcement they have noted that they are now publishing weekly binary builds for the RTL-SDR and Osmo-FL2K projects. This means that Windows users are now able to test the latest driver updates without having to compile them manually. Laforge writes:

While Osmocom in general is a very much Linux-centric development community, we are now finally publishing automatic weekly Windows binary builds for the most widely used Osmocom SDR related projects: rtl-sdr and osmo-fl2k.

You can find the binaries at The actual builds are done by roox who is building them using MinGW on OBS, see

The status of the osmocom binary publish job, executed once per week from now on, can be found at https://jenkins.osmocom.org/jenkins/view/All%20no%20Gerrit/job/Osmocom-OBS_MinGW_weekly_publish/

As a reminder, if you've ever enjoyed the RTL-SDR or Osmo-FL2k projects, you can thank Osmocom for bringing them to us for free by donating to them at Open Collective. The drivers are the root of all that we can do with RTL-SDR and FL2K, so it is only fair to thank them.

Stratux 1090 MHz + 978 MHz Diplexer Now Available

Recently the company Stratux released a new ADS-B/UAT diplexer PCB. This is useful if you have a single antenna and want to feed two RTL-SDR dongles, with one receiving 1090 MHZ ADS-B and the second receiving 978 MHz UAT. The filter consists of a splitter and two SAW filters.

ADS-B is short for Automatic Dependant Surveillance Broadcast and is used to help track aircraft in the sky. It is transmit at 1090 MHz and the signal contains aircraft data such as the location, speed, altitude and aircraft call sign. ADS-B is utilized worldwide.

UAT is short for Universal Access Tranceiver and is transmit at 978 MHz. Like ADS-B it is used to keep track of aircraft, however UAT is only available in the USA and only for aircraft that fly below 18,000ft. It is a little cheaper and unlike ADS-B, UAT transmissions can also contain weather and traffic data.

US aircraft owners/operators that fly below 18,000ft can choose to install either UAT or ADS-B transmitters in their aircraft, so in the US a complete monitoring solution needs to monitor both 1090 MHz and 978 MHz.

The Stratux Diplexer board is currently available on Amazon for $24.99.

Stratux Diplexer for 1090 MHz ADS-B and 978 MHz UAT.
Stratux Diplexer for 1090 MHz ADS-B and 978 MHz UAT.

Demonstrating HFDL Reception with a Cloud-IQ SDR and MultiPSK

Over on YouTube user Shortwave Bavaria has uploaded a video that demonstrates HFDL reception. HFDL is short for High Frequency Data Link and is a signal used by aircraft to communicate short messages with ground stations over long distances. It is often used in place of VHF ACARS when flying over oceans.

In his video Shortwave Bavaria uses a 26.5m end fed wire, and a Cloud-IQ SDR. But we note that any HF capable SDR can be used to receive HFDL. SDR-Console V3 is used as the receiver, and MultiPSK Professional edition as the decoder. Many HFDL messages contain location data, so aircraft can be plotted on a map and he demonstrates this using Google Earth. In the video he notes how amazing it is that flights from across the globe can be received with his set up.

Amazing Decoding HFDL reception with SDR over central Europe