A brief look at the FaradayRF

The FaradayRF is not a software defined radio, but it is a computer controlled digital TX/RX radio device. Basically it is a radio designed to communicate digital data over the 33 cm ham/ISM band. The 33 cm band is between 902 to 928 MHz in the ITU Region 2 area (Americas, Canada, Greenland and some pacific islands). It was designed for amateur radio operators out of the need for a device that allows for easy experimentation with digital radio. An amateur radio licence is required, but only at the technician level which is the easiest licence to obtain.

The product itself is a simple PCB which has on board a low power microcontroller (no OS), a GPS module, and an RF front end that can TX up to 400 mW. They write that with 400 mW a signal at 900 MHz can be transmitted up to 40 miles away. Also, by using low power micro-controllers and hardware radio (instead of SDR), they write that they were able to power the device from a single 9V battery for over 12 hours. The hardware and software is also all open source.

In some ways the FaradayRF is kind of similar to the Yardstick One/PandwaRF radios which were designed for reverse engineering or security research on digital signals. But the FaradayRF comes with SAW filtering to provide a clean output, an amplifier to boost the signal, and software aimed at providing digital comms making it more for amateur radio use.

Some applications might include point to point telemetry/comms, high altitude balloons, ocean buoys, digital voice, APRS, text messaging etc.

The FaradayRF starter set currently costs $300 USD and includes two units (one with GPS included and another without) or $330 USD with two GPS capable units.

Over on TwiT the creators were interviewed earlier on in the year and a video of that interview is available. Also check out their blog which shows some of the interesting things that they're doing with the FaradayRF.

The FaradayRF PCB
The FaradayRF PCB

There was also a 5 minute "lightning talk" about the FaradayRF presented at the DCC 2017 conference, which we show below. The talk about the FaradayRF starts at 9:57.

HRN 354: Lightning Talks from the 2017 DCC on Ham Radio Now

 

Tweet29
Share
Reddit7
Vote
Email
36 Shares

Airspy HF+ Released!

The much anticipated Airspy HF+ has just been released for sale. The cost is $199 USD plus shipping from the manufacturer iTead in China which costs about $6 for a registered air mail parcel or $19 for DHL express delivery to the USA. There was a coupon available via this tweet, but it ran out within hours.

The HF+ is also available for preorder for US/Canada customers over at the airspy.us reseller. Currently there is a last chance $50 coupon available for US/Canada residents purchasing from airspy.us by using the code provided in the link. We don't know how long that coupon will last though.

Note that we believe that these are preorders, with shipping expected to commence in early December.

If you didn't know already the Airspy HF+ is a HF/VHF RX only SDR which has extremely high dynamic range and excellent sensitivity. The high dynamic range means that the SDR is unlikely to ever overload on strong signals meaning that no external filtering which can reduce SNR/sensitivity is required. The minimum discernible signal (MDS) measurements are also excellent meaning that sensitivity to weak signals is excellent too. With high dynamic range, great sensitivity and low cost combined, this SDR blows most of the current offerings out of the water by being able to 'just work' without the need to fiddle around with gain sliders, filters or attenuation.

Airspy HF+: Why Linearity Matters
Airspy HF+: Why Linearity Matters

The only disadvantage to similar offerings like the Airspy R2/Mini or SDRplay is the reduced frequency range and bandwidth specs. On the HF+ the frequency range tops out at 260 MHz and the bandwidth at 680 kHz. The Airspy R2/mini/SDRplay units have frequency ranges that go up to 1.8 - 2 GHz, and have bandwidths of up to 10 MHz. But this is an SDR designed for DXing or pulling in those weak signals, so wideband operation is not a major concern for that application.

We have a review of a prototype version of the Airspy HF+ that we received earlier in the year available here. It's one of the most impressive low cost SDRs that we've seen to date. (We consider sub $300 USD as low cost, and $20 RTL-SDRs as ultra-low cost). You can also freely test some publicly available Airspy HF+ units that were provided to reviewers and developers over the internet.

Technical specifications

  • HF coverage between 9 kHz .. 31 MHz
  • VHF coverage between 60 .. 260 MHz
  • -140.0 dBm (0.02 µV / 50 ohms at 15MHz) MDS Typ. at 500Hz bandwidth in HF
  • -141.5 dBm MDS Typ. at 500 Hz bandwidth in FM Broadcast Band (60 – 108 MHz)
  • -142.5 dBm MDS Typ. at 500 Hz bandwidth in VHF Aviation Band (118 – 136 MHz)
  • -140.5 dBm MDS Typ. at 500 Hz bandwidth in VHF Commercial Band (136 – 174 MHz)
  • -140.0 dBm MDS Typ. at 500 Hz bandwidth in the upper VHF Band (> 174 MHz)
  • +15 dBm IIP3 on HF at maximum gain
  • +13 dBm IIP3 on VHF at maximum gain
  • 110 dB blocking dynamic range (BDR) in HF
  • 95 dB blocking dynamic range (BDR) in VHF
  • 150+ dB combined selectivity (hardware + software)
  • 120 dB Image Rejection (software)
  • Up to 660 kHz alias and image free output for 768 ksps IQ
  • 18 bit Embedded Digital Down Converter (DDC)
  • 22 bit! Resolution at 3 kHz channel using State of the Art DDC (SDR# and SDR-Console)
  • +10 dBm Maximum RF input
  • 0.5 ppm high precision, low phase noise clock
  • 1 PPB! frequency adjustment capability
  • Very low phase noise PLL (-110 dBc/Hz @ 1kHz separation @ 100 MHz)
  • Best Noise reduction of the market using state of the art algorithms
  • 2 x High Dynamic Range Sigma Delta ADCs @ up to 36 MSPS
  • No Silicon RF switch to introduce IMD in the HF path
  • Routable RF inputs with simple modification
  • Wide Band RF filter bank
  • Tracking RF filters
  • Sharp IF filters with 0.1 dB ripple
  • Smart AGC with real time optimization of the gain distribution
  • All RF inputs are matched to 50 ohms
  • 4 x Programmable GPIO’s
  • No drivers required! 100% Plug-and-play on Windows Vista, Seven, 8, 8.1 and 10
  • Industrial Operating Temperature: -45°C to 85°C
  • Full details at https://airspy.com/airspy-hf-plus/
The Airspy HF+
The Airspy HF+
Tweet24
Share
Reddit
Vote
Email
24 Shares

Talks from the AMSAT-UK RSGB 2017 Convention

The Radio Society of Great Britain (RSGB) and AMSAT-UK recently presented a number of talks at their latest convention held in October of this year. Some of the talks are SDR related and are interesting for those interested in satellite reception. A couple of interesting SDR related talks are presented below, and the rest of the talks can be accessed on their YouTube page.

Software defined radio for the satellite geek - Alex Csete OZ9AEC

In this talk Alex Csete (Oz9AEC) who is the programmer behind the popular GQRX software that is often used with RTL-SDRs discusses his latest work and some of his experiences with writing software for SDRs.

2017: Software defined radio for the satellite geek - Alex Csete OZ9AEC

Going to space the libre way - Pierros Papadeas, Libre Space Foundation

In this talk Pierros Papadeas who is the founder of the Libre Space Foundation discusses their SatNOGS project. SatNOGS is a project that uses RTL-SDRs in custom 3D printed home made satellite tracking ground stations. It aims to enable easy access to live satellite data online by significantly increasing ground station coverage.

2017: Going to space the libre way - Pierros Papadeas, Libre Space Foundation

Tweet
Share
Reddit
Vote
Email

XTRX: Soon to be crowdfunding Mini PCIe based TX/RX SDR

Over on the crowd funding site crowdsupply.com there have recently been several updates on the Fairwaves XTRX SDR. The XTRX is an upcoming TX/RX capable SDR in a tiny Mini PCIe form factor. Mini PCIe is the expansion slot system used on some laptops. The SDR itself will be 2 x 2 MIMO, with a tuning range of 10 MHz - 3.7 GHz (down to 100 kHz with some degradation), and have a sample rate of up to 120 MSPS. It uses the LimeSDR RF chipset which provides most of the hardware required.

The XTRX is not yet for sale, and is planned for a crowdfunding run on Crowdsupply 'soon'. You can subscribe to future updates on their page. No word yet on pricing, but according to one of the developers comments on Reddit the price will be somewhere between the LimeSDR ($299 USD) and LimeSDR Mini ($139 USD). Eventually in the future if they can tap into a mass market they hope to get the price down to $50 USD.

Features & Specifications

  • RF Chipset: Lime Microsystems LMS7002M FPRF
  • FPGA Chipset: Xilinx Artix 7 35T
  • Channels: 2 × 2 MIMO
  • Tuning Range: 30 MHz - 3.8 GHz
  • Rx/Tx Range:
    • 10 MHz - 3.7 GHz
    • 100 kHz - 3.8 GHz with signal level degradation
  • PCIe Bandwidth:
    • PCIe x2 Gen 2.0: 8 Gbit/s
    • PCIe x1 Gen 2.0: 4 Gbit/s
    • PCIe x1 Gen 1.0: 2 Gbit/s
  • Sample Rate: ~0.2 MSPS to 120 MSPS
  • Reference clock:
    • Frequency: 26 MHz
    • Stability: <10 ppb stability after GPS/GNSS lock, 500 ppb at start up
  • Form Factor: full-size miniPCIe (30 × 51 mm)
  • Bus Latency: <10 µs, stable over time
  • Synchronization: synchronize multiple XTRX boards for massive MIMO
  • GPIO: 4 lines @ miniPCIe connector, 3 lines @ FPC edge connector
  • Accessories: miniPCIe-USB3 converter, miniPCIe-PCIe converter, etc
XTRX Prototype
XTRX Prototype
Tweet27
Share
Reddit
Vote
Email
27 Shares

A Tutorial on Receiving HRPT Weather Satellite Images with an SDRplay RSP2

RSP2user's HRPT equipment

Over on the SDRplay forums user 'RSP2user' has put up a quality post describing how he receives HRPT weather satellite images with his SDRplay RSP2. HRPT stands for 'High Resolution Picture Transmission' and provides a much higher resolution image compared to the APT weather satellite images typically downloaded from NOAA satellites. Somewhat confusingly the picture quality of HRPT is similar to LRPT (low rate picture transmission) which is used on the Russian Meteor M series weather satellite. HRPT provides 1.1 km resolution, whilst LRPT provides 1 km resolution.

Currently there are multiple satellites broadcasting HRPT signals including NOAA 19, NOAA 18, NOAA 15, Meteor M2, Fengyun 3B, Fengyun 3C, Metop A and Metop B.

The difference in difficulty of receiving APT and LRPT versus HRPT transmissions typically occur in the L-band at about 1.7 GHz, and requires a directive high gain antenna with tracking motor to track the satellite as it passes over. This makes these images many times more difficult to receive compared to APT and LRPT which only require a fixed position antenna for reception at the more forgiving 137 MHz.

Over on his post RSP2user shows how he uses a repurposed Meade Instruments telescope tracking mount and controller to drive the tracking of a 26 element loop Yagi antenna. A 0.36dB noise figure LNA modified with bias tee input is used to boost the signal and reduce the noise figure. The signal is received by a SDRplay RSP2 and processed on a PC with USA-satcoms HRPT decoder software, which is available for purchase by directly contacting him. The HRPT signal bandwidth appears to be about 2.4 MHz so possibly an RTL-SDR could also be used, but it might be pushing it to the limit.

If you are interested, RSP2user also uploaded an APT weather satellite image reception tutorial on another post. This tutorial shows how to build a quality quadrifilar helix antenna as well.

Receiving the HRPT signal on USA-Satcoms' HRPT decoder.
Receiving the HRPT signal on USA-Satcoms' HRPT decoder.
Tweet22
Share
Reddit
Vote
Email
22 Shares

Building a 3D Printed LHCP Helical L-Band Feed for Inmarsat, AERO and HRPT

Thanks to Manuel a.k.a. Tysonpower for submitting his latest YouTube video tutorial about building an 1550 MHz L-band LHCP helical antenna for receiving satellite signals such as Inmarsat, AERO and HRPT.

Manuel's design is based on a 3D printed part which is used to accurately form the helical winding. The winding then mounts onto an aluminum plate and a satellite dish arm using a custom 3D printed adapter for the dish arm. In the video he uses the helical feed with an 80cm satellite dish and a standard 40mm LNB mount on the dish arm. Attached to the feed are two LNAs in series which help to lower the noise figure and reduce losses in the coax cable.

With this setup he writes that he was able to get very good AERO and Outernet reception from Alphasat (25E geostationary). He also writes that he's had good results using it for HRPT reception as well.

The 3D printing STL files and list of parts required are available on Thingiverse, and the companion video is shown below. Note that the video is narrated in German, but English subtitles are available.

[EN subs] LHCP Helix L-Band Feed - 3D Druck für eine genaue Helix

Manuel's L-Band Helical Feed
Manuel's L-Band Helical Feed
Tweet16
Share
Reddit42
Vote
Email
58 Shares

Defcon 25 SDR and Radio Related Talks

Defcon is a huge yearly conference based on the topics of information security and hacking. Some of the talks relate to wireless and SDR concepts. Recently videos from the last Defcon 25 conference held in July 2017 have been uploaded to YouTube. Below is a selection of some interesting SDR and radio related talks that we have found. If you're interested in exploring the rest of the talks then you can find them on their YouTube page. Most of the radio related talks are in the 'WiFi Village' category.

DEF CON 25 Wifi Village - Balint Seeber - Hacking Some More of the Wireless World

The hacking continues on from last year! Three interesting applications will be demonstrated, and their underlying theory and design explained. The audience will be exposed to some novel GNU Radio tips and DSP tricks. INMARSAT Aero will be revisited to show (in Google Earth) spatial information, such as waypoints and flight plans, that are transmitted from airline ground operations to airborne flights. A good chunk of the VHF band is used for airline communications; plane spotters enjoy listening to tower and cockpit communications.

Modern SDRs can now sample the entire band, and as AM modulation is used, it's possible to use a counterintuitive, but simple, demodulator chain (first shown by Kevin Reid's wideband 'un-selective AM' receiver) to listen to the most powerful transmission. This will be demonstrated with a GNU Radio-based implementation. It is also possible to 'spatialise' the audio for the listener using stereo separation, which can convey a transmission's relative position on the spectrum. FMCW RADAR experiments are enhanced to include Doppler processing.

Plotting this new velocity information, due to the Doppler effect, shows whether a target is heading toward or away from you, and often reveals targets not normally seen in range-only information - this demonstrates the true power of full RADAR signal processing. This technique will be applied to the live audio demo, a new live SDR demo, CODAR ocean current tracking, and passive RADAR exploiting powerful ATSC digital television signals (this was used to track aircraft on approach across the Bay Area).

DEF CON 25 Wifi Village - Balint Seeber - Hacking Some More of the Wireless World

DEF CON 25 - Matt Knight - Radio Exploitation 101

What do the Dallas tornado siren attack, hacked electric skateboards, and insecure smart door locks have in common? Vulnerable wireless protocols. Exploitation of wireless devices is growing increasingly common, thanks to the proliferation of radio frequency protocols driven by mobile and IoT. While non-Wi-Fi and non-Bluetooth RF protocols remain a mystery to many security practitioners, exploiting them is easier than one might think.

Join us as we walk through the fundamentals of radio exploitation. After introducing essential RF concepts and characteristics, we will develop a wireless threat taxonomy by analyzing and classifying different methods of attack. As we introduce each new attack, we will draw parallels to similar wired network exploits, and highlight attack primitives that are unique to RF. To illustrate these concepts, we will show each attack in practice with a series of live demos built on software-defined and hardware radios.

Attendees will come away from this session with an understanding of the mechanics of wireless network exploitation, and an awareness of how they can bridge their IP network exploitation skills to the wireless domain.

DEF CON 25 - Matt Knight - Radio Exploitation 101

Continue reading →

Tweet22
Share
Reddit
Vote1
Email
23 Shares

QrssPiG: Decoding QRSS on a Raspberry Pi with an RTL-SDR

QRSS is a ham communications mode that is essentially just very slow CW (morse code), with each dash/dot being broadcast for a number of seconds. With QRSS instead of audibly decoding the morse code signal, it is decoded visually via a spectrum display (or automatically by software). It is designed to be a QRP mode, which means that hams transmitting QRSS can be heard all over the world even though very low transmit power is used. 

QrssPiG is a QRSS grabber program that runs headless on a Raspberry Pi and can interface with an RTL-SDR. It automatically generates the waterfall graphs of received QRSS images, and supports uploading them via SCP or FTP. The software can also run with a HackRF, or via audio piping from another SDR or standard hardware radio.

Recently on Twitter @ON4CDJ has been trying QrssPiG with an RTL-SDR V3 and has been having good results.

Tweet
Share
Reddit
Vote
Email