Tzumi MagicTV WiFi TV Tuner Device contains an RTL-SDR, OpenWRT board and Battery for only $13

The Tzumi MagicTV is a device that allows users in the USA to watch TV on an Android phone via free over the air digital ATSC signals. It receives and decodes TV on the device,  then streams decoded TV to an Android phone via a WiFi connection.

Over on Reddit user meowTheKat has alerted everyone to the fact that 'Tzumi MagicTV' devices contain not only an R828D RTL-SDR inside them, but also an AR9331 OpenWRT board and a 3000 mAh battery pack. This means that the device could potentially be used as a portable RTL-SDR server over a WiFi connection without any additional required hardware. And right now is a particularly good time for this discovery to come out, as the device is reportedly selling at a clearance sale price of only $13 at Walmarts across the USA.

OpenWRT is custom open source firmware that is intended to be installed on compatible internet routers. It extends the functionality and stability of many routers. Since OpenWRT is based on Linux, it is possible to use the RTL-SDR on routers running OpenWRT and we have several previous posts about people doing this.

Currently meowTheKat reports that the MagicTV is indeed running OpenWRT, and that  SSH is available. The SSH password is unknown but a colleague of his is currently working on cracking the password. Once cracked it should become possible to install RTL-SDR software on to it. However, there is no word yet on if the front end has additional filtering specifically for TV signals or not. If there is additional filtering those circuits would need to be removed to restore wideband tuning to the RTL-SDR.

Update: From discussion on the Reddit thread it appears that the tuner chip used is not an R828D as first thought, but instead a MXL603/608. This tuner is currently not supported in the RTL-SDR code, but support could probably be added by a developer.

Update 2: Unfortunately it seems that this won't end up going anywhere. In the librtlsdr GitHub issues forum Hoernchen commented:

The tuner is connected to a demod ic, which is connected to the TS input of the rtl2832p, so code is not going to fix the fact that the device is unusable without quite a bit of tricky soldering to reroute the tuner output to the rtl.

The "Tzumi MagicTv" contains an RTL-SDR, OpenWRT Board and Battery Pack.
The "Tzumi MagicTv" contains an RTL-SDR, OpenWRT Board and Battery Pack.
Tweet34
Share
Reddit
Vote
Email
34 Shares

Decapping the AD9361 SDR Transceiver Chip: Hi-Res Images and Cost Analysis

The AD9361 is a highly versatile full transceiver SDR chip released by Analog Devices back in 2013. With a frequency range from 70 MHz - 6 GHz, 56 MHz bandwidth and 12-bit ADC, it is most commonly found in high end SDRs such as the USRP range and PicoZed. On Digikey purchasing the chip today would set you back about USD $280. A cheaper but similar AD9363 chip is found in the PlutoSDR.

If you are unaware, decapping is the process of removing the outer shell on silicon chips with acid, and revealing their silicon structure. Over on the 'Zeptobars' decapping blog the author has recently shared some beautiful and extremely hi-res (80 mB) photos of a decapped AD9361.

At the end of the post the author does a brief cost analysis on the chip, determining that  while the total manufacturing cost of the chip is estimated at less than $5, the cost of R&D and IP per chip is about $33, and additional costs make up another $32 per chip. Profit between distributors and Analog Devices is about even, which each party taking about $100 per chip each.

If you're interested, in the past we've also seen decapped images of the the R820T and the RTL2832U from 'electronupdate'.

AD9361 Decapped
AD9361 Decapped on the Zeptobars blog
Tweet
Share
Reddit
Vote
Email

QuestaSDR Android App now with Remote Network Streaming: RTL-SDR, Airspy, SDRplay Supported

Back in April we posted about QuestaSDR, which had just released the Android version of its SDR software. Recently QuestaSDR programmer 'hOne' wrote in and noted that a new update has enabled remote streaming in QuestaSDR.

To get set up, just run the Windows version of QuestaSDR on a PC, and open the "SDR Server" app. Once the server is running, you can connect to it via the Android version of QuestaSDR over a network connection. The server supports the RTL-SDR, Airspy and any ExtIO compatible device such as SDRplay units. As far as we're aware, this is the only Android app that currently supports streaming from non rtl_tcp compatible units such as the Airspy and SDRplay.

hOne has been able to run an Airspy at the maximum bandwidth of 10 MSPS through his network connection. He also notes that you can now zoom into the IF spectrum in detail by using the new "IF Spectrum" plugin.

hOne also notes that the streaming feature is currently in beta, and any bugs/suggestions or feedback are welcome.

QuestaSDR Streaming over a network connection with an Airspy
QuestaSDR Streaming over a network connection with an Airspy
AirSpy windows server, android client LAN Remote

Tweet16
Share
Reddit
Vote
Email
16 Shares

YouTube Talk: Investigating RF Controls with RTL-SDR

During the SANS Pen Test HackFest which was held back in 2017, speaker Katie Knowles who is a security consultant at MWR Infosecurity did a very informative talk on how an RTL-SDR can be used to investigate RF signals. The video has recently been uploaded to YouTube and is shown below. In the talk she goes over how to reverse engineer and understand simple RF protocols, like those used by common RF remote controls found in the home. She then goes on to talk about the basics of software like GNU Radio and rtl_433. The talk blurb reads:

Cranes, trains, theme park rides, sirens, and …ceiling fans? Modern RF protocols have made secure wireless communications easier to implement, but there’s still a horde of simpler RF control systems in the wireless world around us.

Lucky for us, the onset of affordable Software Defined Radios (SDRs) means that exploring these devices is easier than ever! In this talk, Katie examines capturing and understanding basic RF control signals from a common household controller with the affordable RTL-SDR so you can start your own investigations.

With a little knowledge of these protocols we can better explain what makes them risky to the environments we assess, practice thinking in the offensive mindset, and have some fun examining the signals around us.

Slides available here.

Signal Safari: Investigating RF Controls with RTL-SDR – SANS Pen Test HackFest 2017

Tweet16
Share
Reddit
Vote
Email
16 Shares

Video Demonstrating C-Band AERO Aircraft Tracking

AERO is essentially the satellite based version of aircraft ACARS. AERO's L-band signals contains short ground to air messages with things like weather reports and flight plans. The C-band signals are the air to ground portion of AERO and more difficult to receive as they require an LNB and large dish. However they are much more interesting as they contain flight position data, like ADS-B.

Over on YouTube Tomasz Haddad has uploaded a video of C-band AERO being received from the Inmarsat 3 F2 (Atlantic Ocean Region – East (AOR-E) 15W satellite. He uses a 1.80m motorized satellite dish with Kaonsat KS-N201G C-band LNB, a Prof 7301 PCI satellite card (to power the LNB) and an RTL-SDR V3. The C-band LNB translates the high C-band frequencies down to L-band which is receivable with an RTL-SDR. He notes that the LNB drifts quite a lot as it is not frequency stabilized.

With the signals received by his setup he's able to use the JAERO decoding software together with Virtual Radar Server to plot aircraft positional data using Virtual Radar Server. The plotted aircraft are mostly all in the middle of the ocean or in remote areas, which is where C-band AERO is normally used due to the lack of ground ADS-B stations.

Inmarsat 3 F2 15W C Band AERO Reception Using Jaero And Virtual Radar

Tweet
Share
Reddit
Vote
Email

Creating a Linear Transponder with an RTL-SDR, HackRF and Raspberry Pi

A linear transponder is essentially a repeater that works on a range of frequencies instead of a fixed frequency. For example, a normal repeater may receive at 145 MHz, and repeat the signal at 435 MHz. However, a linear transponder would receive a wider bandwidth, and add a set frequency offset to the received signal. For example a signal received by a linear transponder that receives from 145 - 145.5 MHz, may receive a signal at 145.2 MHz and it would translate that up to 435.2 MHz. Another signal received at 145.4 MHz would translate up to 435.4 MHz. Hence the received frequency linearly translates to the transmitted frequency.

Over on his blog ZR6AIC has shown that it is possible to create a linear transponder using an RTL-SDR for receiving, a Raspberry Pi for processing the signal, and a HackRF for re-transmitting the signal. 2M and 70cm band bandpass filters are also used. For software he uses a GNU Radio flowchart that simply moves the IQ data from the RTL-SDR to the HackRF.

In the video below he demonstrates the linear transponder in action with two handheld radios.

A Linear Transponder made with HackRF, Raspberry Pi and RTL-SDR.
A Linear Transponder made with HackRF, Raspberry Pi and RTL-SDR.
Building a Linear Transponder with Gnu Radio, rtl dongle and hackRF module..

Tweet
Share
Reddit
Vote
Email

Forwarding Pager Messages Received with an RTL-SDR to Email

Over on YouTube Jack Riley has created a video that documents his system which uses an RTL-SDR to receive POCSAG pager messages and forward messages sent to specific pager addresses to an email address. He uses his RTL-SDR on a Raspberry Pi, together with rtl_fm and multimon-ng to receive and decode the pager messages.

Then using a custom program that is available on his website he filters messages for a particular 'capcode' which indicates the address of a particular pager. When a pager message to the specified capcode address is received, the program turns the message into an email which is instantly sent out.

This is a nice way to forward pager messages on to a more modern device such as a smart phone.

Creating a Pager using a Raspberry Pi and RTL-SDR to send alerts via Email.

Tweet15
Share
Reddit
Vote
Email
15 Shares

A Discone Antenna made from 3D Printed Parts and Aluminum Rods

Over on his blog author ByTechLab has posted about his 'mostly 3D printed' discone antenna. A discone is a type of wideband antenna, so it is commonly used with SDRs like the RTL-SDR that have huge frequency ranges. Building a discone can be difficult, but ByTechLab shows that with a 3D printer it is possible to print the aluminum rod mounts, which significantly reduces construction complexity. His post shows the exact directions, and the stl files are available over on Thingiverse.

Note that back in March we saw another 3D printed discone by mkarliner that used a full cone design with the cone being made out of aluminum tape. Discones based on aluminum rods should however be more weather resistant, and more able to withstand wind loads, so ByTechLab's design is more suitable for permanent outdoor mounting.

ByTechLabs' Mostly 3D Printed Discone Antenna
ByTechLabs' Mostly 3D Printed Discone Antenna
Tweet15
Share
Reddit
Vote
Email
15 Shares