A MW DXers Review of the Airspy HF+

Medium Wave DXer Bjarne Mjelde has recently written up his experiences with the new Airspy HF+ software defined radio. If you weren't already aware, MW DXing is the art of attempting to receive extremely weak and distant broadcast AM stations which may be close to powerful local stations. Generally a radio with high end dynamic range specifications is required for this task. The HF+ is a new low cost SDR that aims to meet those very needs.

In his review Bjarne noted that the MW band sensitivity of the HF+ was good, but not quite as good as the more expensive Perseus and Cloud-IQ SDRs. He also noted that the LW band was more attenuated than expected. However, he discovered that there is an optional hardware modification for the HF+ that involves simply bypassing a capacitor on the PCB with a short circuit. After performing this mod Bjarne found that the sensitivity was significantly improved on the MW and LW bands. Also although sensitivity above 15 MHz was expected to be reduced, Bjarne found no noticeable detrimental effects.

Bjarne concludes that the HF+ is a very capable receiver that after modding satisfies the needs of a demanding MW DXer, although he does note the drawback of the limited 660 kHz of bandwidth. In other previous reviews of low cost SDRs on his blog, Bjarne  reviewed the SDRplay RSP1A, ColibiriNano and the Airspy R2 + SpyVerter. Basically he found that none really satisfied his MW DXing needs, with the RSP1A being suprisingly good but failing with strong signals, the Airspy R2 + SpyVerter having too high of a noise floor, and the ColibriNANO being okay, but with a high internal noise level.

The HF+ Mod (Edited by Bjarne, original photo by Nils Schiffhauer)
The HF+ Mod (Edited by Bjarne, original photo by Nils Schiffhauer)

How an LNA can Improve VHF Reception with an RTL-SDR

Over on his YouTube channel Adam 9A4QV has uploaded a video showing how an LNA work to improve signal SNR on VHF, as long as the LNA is placed close to the antenna. Adam is the manufacturer and seller of the popular LNA4ALL low noise amplifiers.

On UHF and high frequencies an LNA can help by reducing the system noise figure, but on VHF this effect is small. But if the LNA is placed near the antenna then the LNA can still help significantly by overcoming any losses in the coax cable, filters, switches or any other lossy components in the signal path. It might also help create a better SWR match for the dongle and antenna. The video has some sound issues in during the demonstration part, but on his Reddit thread Adam writes:

Well, monitoring the beacon signal on 144.478 Mhz the S/n without LNA was just 10dB and cannot improve with decreasing the gain. Inserting the LNA in line, close to the antenna, through the Bias-T the S/n improve from 10dB to 23dB.

To meet the most of the user's conditions I was using the RTL-SDR dongle and the 20 meters of RG-6 coaxial cable with F-connectors.

It is obvious that using the LNA on the antenna can improve your reception even on the VHF band. Using the proper bandpass filter instead of a single FM stop filter will give much better results.

LNA4ALL on the VHF close to antenna effect

Upcoming Book “Inside Radio: An Attack and Defense Guide”

Unicorn team are information security researchers who often also dabble with wireless security research. Recently they have been promoting their upcoming text book titled "Inside Radio: An Attack and Defense Guide".

Judging from the blurb and released contents the book will be an excellent introduction to anyone interested in today's wireless security issues. They cover topics such as RFID, Bluetooh, ZigBee, GSM, LTE and GPS. In regards to SDRs, the book specifically covers SDRs like the RTL-SDR, HackRF, bladeRF and LimeSDR and their role in wireless security research. They also probably reference and show how to use those SDRs in the  chapters about replay attacks, ADS-B security risks, and GSM security.

The book is yet to be released and is currently available for pre-order on Amazon or Springer for US$59.99. The expected release date is May 9, 2018, and copies will also be for sale at the HITB SECCONF 2018 conference during 9 - 13 April in Amsterdam.

The blurb and released contents are pasted below. See their promo page for the full contents list:

This book discusses the security issues in a wide range of wireless devices and systems, such as RFID, Bluetooth, ZigBee, GSM, LTE, and GPS. It collects the findings of recent research by the UnicornTeam at 360 Technology, and reviews the state-of-the-art literature on wireless security. The book also offers detailed case studies and theoretical treatments – specifically it lists numerous laboratory procedures, results, plots, commands and screenshots from real-world experiments. It is a valuable reference guide for practitioners and researchers who want to learn more about the advanced research findings and use the off-the-shelf tools to explore the wireless world.

Authors:
Qing YANG is the founder of UnicornTeam & the head of the Radio Security Research Department at 360 Technology. He has vast experience in information security area. He has presented at Black Hat, DEFCON, CanSecWest, HITB, Ruxcon, POC, XCon, China ISC etc.

Lin HUANG is a senior wireless security researcher and SDR technology expert at 360 Technology. Her interests include security issues in wireless communication, especially cellular network security. She was a speaker at Black Hat, DEFCON, and HITB security conferences. She is 360 Technology’s 3GPP SA3 delegate.

This book is a joint effort by the entire UnicornTeam, including Qiren GU, Jun LI, Haoqi SHAN, Yingtao ZENG, and Wanqiao ZHANG etc.

 

A Homemade Magnetic Loop Antenna used with RTL-SDR Direct Sampling

Over on our forums user "SandB"  has submitted his designs for a homemade magnetic loop antenna with preamp that he uses together with his RTL-SDR in direct sampling mode. The antenna looks like an interesting build so we are resharing it here. He writes:

So, antenna itself represents as handmade on-PCB winding made of two-side-foiled fiberglass size of 30x40 cm. Both 'windings' connected in the middle and thus winded to 'continue' each other.

Preamp located in metal box attached to antenna and connected via 1.5m S/FTP cable to another box with RTL stick. Note that some transistors soldered on PCB in upside-down - dot on layout means base.

Electrically preamp made as 3-stages balanced signal amplifier with low-input impedance and low-pass filter before input with cut-off at 15MHz. Such complications were required to reduce interferences and intermodulations. Antenna itself is more effective on long-medium waves, so preamp has higher gain on short waves (gain varies from 45db at 200KHz to 68 db at 10MHz - see attached freq responce pic). Getting more flat responce at lower frequencies is possible by increasing C10/C11/C12 to 22nF.

My implementation has some additional elements to make possible to adjust preamp's gain in few db's. But seems its quite useless so that details not included in this post. Anyway, its possible to reduce gain by increasing R6 to 500K.

Box with RTL SDR: I put both signal wires as 3 windings via ferrite ring with high permeability just before RTL chip. This noticeable reduced stray interference, that induced in that cable but doesn't affect differential signal.

OpenWebRX now Supports the Airspy HF+

Thanks to Stefan Dambeck for letting us know that there is now a fork of libairspyhf made by DL9RDZ which contains an adapted version of airspyhf_rx (the raw IQ generator). This enables the Airspy HF+ to be easily integrated into OpenWebRX.

If you weren't aware, OpenWebRX is a browser based SDR interface and server software that allows an SDR to be used by multiple people at the same time over the internet. It performs audio demodulation and compression on the server side allowing for very low and efficient network usage.  In this way it is different to Airspy official server solution SpyServer which sends the IQ data over the network. So an OpenWebRX server uses significantly less network bandwidth and might be more suitable for those on slower or capped internet connections.

At the moment we're not seeing any public HF+ servers available on the OpenWebRX database at sdr.hu, but this may change in the future.

Airspy HF+ Running on the OpenWebRX Web Browser Interface
Airspy HF+ Running on the OpenWebRX Web Browser Interface

Wirelessly Activated Facial Recognition with a Raspberry Pi, Camera and RTL-SDR Dongle

Over on his blog and YouTube channel Trevor Phillips has shown us how he's created a wirelessly activated facial recognition system using a Raspberry Pi Zero, Raspberry Pi camera, wireless button and RTL-SDR dongle.

He uses a handicap door button with wireless transmitter that transmits at 300 - 390 MHz, and uses the RTL-SDR on the Raspberry Pi Zero to detect whenever the button is pressed. The button detection algorithm simply looks for an increase in RF energy via an FFT transform. Once a button press is detected by the RTL-SDR and Raspberry Pi the camera and facial recognition software on the Pi activate, and a text to speech algorithm asks the button presser to face the camera for identification. If the face is recognized in the database the speech to text welcomes the user.

Facial recognition for less than $80

The LimeSDR Mini Grove Starter Kit

LimeSDR have partnered with Seeed Studio to develop a low cost SDR starter kit for learning SDR basics and experimenting with IoT applications. The kit costs US$249 and includes a LimeSDR Mini and the Grove Starter Kit. The Grove kit is simply a set of various sensors such as temperature, sound, light, ultrasonic, touch, rotary as well as interface components like buzzers, an LCD screen, and LEDs. It also includes the GrovePi+ which is a board that allows you to easily interface the Grove sensors with a Raspberry Pi. Adding a LimeSDR Mini as well as the Grove kit to a Raspberry Pi could allow for easy wireless and IoT experimentation. To make it even easier the LimeSDR team have created a ScratchRadio extension that supports the LimeSDR and Grove kit combination. ScratchRadio is a kid friendly visual programming environment.

The kit packages a LimeSDR Mini with antennas optimised for 433/868/915 MHz unlicensed bands, plus a GrovePi+ and selection of incredibly useful Grove sensors and outputs, many of which are supported by a Scratch extension. When combined with our ScratchRadio extension, this will allow the creation of simple and fun applications that integrate SDR capabilities and peripheral I/O.

Of course, use is not limited to Scratch and educational environments, and we’ll also be putting together examples that demonstrate how the kit can be used to develop applications that integrate with existing off-the-shelf systems, such as wireless thermostats and remote controls.

Kit Contents

  • 1 x LimeSDR Mini
  • 2 x Antennas optimised for 433/868/915MHz unlicensed bands use
  • 1 x Acrylic base plate
  • 1 x Short USB extension
  • 1 x GrovePi+
  • 1 x Grove - Ultrasonic Ranger
  • 1 x Grove - Temp&Humi Sensor
  • 1 x Grove - Temperature Sensor
  • 1 x Grove - Rotary Angle Sensor
  • 1 x Grove - Button
  • 1 x Grove - Light Sensor v1.2
  • 1 x Grove - 3-Axis Digital Accelerometer (±1.5 g)
  • 1 x Grove - Relay
  • 1 x Grove - Sound Sensor
  • 1 x Grove - LCD RGB Backlight
  • 1 x Grove - Buzzer
  • 1 x Grove - Red LED
  • 1 x Grove - LED Bar 2.0
  • 1 x Grove - Touch Sensor
  • 1 x Grove - Piezo Vibration Sensor

Just add your own Raspberry Pi, power supply, and microSD card!

The kit costs US$249 and is currently available for preorder on the LimeSDR Mini CrowdSupply page.

The Grove Starter Kit with LimeSDR.
The Grove Starter Kit with LimeSDR.

Using an Airspy SDR for Optical FM Spectroscopy

Spectroscopy is the study of how electromagnetic radiation interacts with matter and it can be used to study the internal structure of matter. At the DLR Institute for Technical Physics in Stutgart Germany, Peter Mahnke has been using an Airspy software defined radio as a "lock-in amplifier" in a FM spectroscopy setup. A lock-in amplifier is simply a type of amplifier that can extract a signal from a known carrier in an extremely noisy environment. 

In the experiment a laser is fiber optically coupled to an eletro-optic phase modulator, which modulates a 400 MHz FM signal onto the light. The light is then passed into a Carbon monoxide absorption cell with a photodiode used to take the spectroscopic measurements. The signal from the photodiode is passed into a LNA and then into the Airspy where the signal can then be processed on the PC.

The paper is very technical, but describes the setup, and how they characterized and calibrated the Airspy for their measurements. They conclude with the following:

A successful demonstration of a commercially available software defined radio as a lock-in amplifier was performed. For this purpose, the tuner front end and back end were characterized. The sensitivity and non-linearity of the receiver circuit was measured and analyzed. Acquisition of a CO spectral line was demonstrated using FM-spectroscopy with a repetition rate of 1 kHz. This proves the usability of an off-the-shelf SDR as a cheap but powerful lock-in amplifier by adding PLL driven frequency generators. The drawback of the arbitrary initial phase of the used phase locked loops can be either solved by software or hardware measures.

This experiment is somewhat similar to one we posted about earlier in the month where an RTL-SDR was used in an optical interferometer lab experiment.

FM Spectroscopy with an Airspy Software Defined Radio.
FM Spectroscopy with an Airspy Software Defined Radio.