Over the years we've posted several times about the TEMPEST applications of software-defined radio. TEMPEST aka (Van Eck Phreaking) is when you listen to the unintentional RF emissions of electronics and are able to recover information from that. In the past, we posted about TempestSDR, an RTL-SDR compatible program that allows you to view images from a computer monitor or TV simply by picking up the unintentional RF emissions from it.
Usually, the images received are fuzzy and it can be difficult to recover any information from them. However recently there has been work on combining Tempest techniques with deep learning AI for improving image quality.
Deep-tempest has recently been released on GitHub and from their demonstrations, the ability to recover the true image with deep learning is very impressive. From a fuzzy grey screen, they show how they were able to recover clear text which looks almost exactly like the original monitor image.
Deep-tempest is based on gr-tempest, and requires GNU Radio, Python 3.10 and a Conda environment. Instructions for installing it are on the GitHub.
The whitepaper on the University research done to implement Deep-Tempest can be found freely on arxiv at https://arxiv.org/pdf/2407.09717.
In one of his recent videos, Matt from the Tech Minds YouTube channel reviews the SV4401A Vector Network Analyzer (VNA). A VNA is a powerful tool that can be used for analyzing and tuning antennas, as well as other RF components such as filters and cables.
Typically we recommend the NanoVNA V2 and Nano V2 Plus 4 as low-cost VNA's that most hobbyist users will be happy with. However, the SV4401A comes with a much larger 7-inch touch screen, a nicer UI, built-in signal generator, and large frequency range spanning from 50 kHz - 4400 MHz. The price is similar to that of the Nano V2 Plus4, coming in at US$322, versus $299 for the NanoVNA V2 Plus4.
The ONLY Vector Network Analyzer I Will EVER Need - SV4401A
The concept behind DME is simple: the aircraft broadcasts a signal pulse, and a ground station receives and repeats the pulse back at another frequency. The aircraft receives the return pulse, and from the time it has taken to receive that return pulse, the distance to the ground station can be determined. The frequencies used are between 960 MHz and 1215 MHz, and the aircraft and ground station pulses are always spaced apart by 63 MHz.
In his post, Daniel explains how he records the two signals spaced 63 MHz apart using his LimeSDR. Recording this large bandwidth has some challenges since typically the LimeSDR only supports a bandwidth of 61.44 MHz, which is too small for the 63 MHz spacing. However, Daniel explains in his post how he got around this limitation by using the two RX channels on the LimeSDR, sampling at a higher 80 MSPS sample rate, and then using the LimeSDR DSP to downconvert and decimate each DME channel to 2.5 MSPS, making the final sample rate small enough to be sent over USB.
The rest of the post details his experiments, analysis, and results when receiving the two DME channels through GNU Radio.
Over on Hackaday we've seen a post about Dan's (KB6NU) talk at the HOPE (Hackers of Planet Earth) conference about how Ham radio can be for hackers, and how hackers are the future of ham radio. Hackers in this context mean people who enjoy experimenting with electronics, building stuff, and understanding how things work.
Dan's slides have been uploaded on his blog. The slides emphasize how ham radio is not only about the traditional thought of making contacts which is probably in most people's heads, but also about hacking radios, antennas, microcontrollers, satellites, pico balloons, digital communications, GNU Radio and more. Dan mentions his goal is to promote ham radio to the much younger hacker crowd, where he believes it is underrepresented.
Last year the RFNM (RF Not Magic) software-defined radio was announced and opened up for pre-orders. RFNM is an SDR based on the new 12-bit LA9310 baseband processor chip, and together with either a 'Granita' or 'Lime' daughter board it is capable of tuning from 10 - 7200 MHz or 5 - 3500 MHz respectively. It is also capable of wide bandwidth - up to 153.6 MHz on a host device like a PC. The RFNM is affordable, costing US$299 for the motherboard, US$179 for the Lime board, and US$249 for the Granita board. Currently, the second production batch is available for preorder.
Recently we received our RFNM order, with both Granita and Lime boards. This is a review of our initial impressions and tests on it. Note that while the RFNM is capable of transmitting, in this review we did not test that capability.
Physical Review
The RFNM motherboard comes as a PCB with a large heatsink on the bottom and a very quiet inline fan. The daughterboards connect to the motherboard with a board-to-board connector and are secured in place via seven screws. There is another board-to-board connector for a second daughterboard to be connected, but in this review we did not test it.
On the right side there is a 4-18V DC barrel power jack and USB-A, USB-C, HDMI and Ethernet connectors. There is also a SIM card and SD card slot on the side. On the left of the board are MMCX connectors for external reference clock, and clock out. There are also various header pinouts for PPS OUT/IN, UART, I2C, GPIO and PWM. On the heatsink side there is a JTAG connector, jumpers for resetting the firmware, and pads to solder on an OCXO.
RFNM Motherboard and DaughterboardsRFNM bottom with heatsink, fan and rubber feet.
The device feels solid but there are a few exposed SMT components on the rear that have the potential to be knocked off with rough handling. All the main connectors are through-hole soldered and will not break off easily. During operation, the heatsink stays warm to the touch, and does not get too hot. The fan blades are exposed but should be safe from fingers and debris being on the bottom.
Initial Firmware Download
The device requires power from a 4 - 18V DC barrel jack and connects to a PC via a USB-C or USB-A port. According to the developer, it requires a 10-15W capable supply. In the tests below we used a 9V 2000mA switch mode supply, and a 12V 3000mA capable linear supply.
The device comes shipped without firmware, and the first setup step involves plugging in an internet-connected ethernet cable to automatically download and install the latest firmware. If you don't have an internet connected ethernet cable, an alternative is to plug in a USB stick with the latest firmware installed on it. The firmware installation took only a couple of minutes and went smoothly.
Initial Tests with SDR++
The easiest way to get something working with the RFNM is to use the custom SDR++ build included on the RFNM itself. When you plug in the RFNM it shows up on your PC as a disk drive, with an SDR++ folder. Getting started is as easy as running that SDR++ exe and clicking Play.
Initially, we encountered an issue where the RFNM wouldn't show up in SDR++, and wouldn't show up as a disk either. However, after flipping the USB-C connector it worked. This is an issue that continued throughout, and sometimes flipping wouldn't even work, but it always connected after a few reconnection attempts, and once the board was connected it was stable.
Lime Daughterboard Tests
We first tested the RFNM with the Lime daughter board. This is a board based on the Lime LMS7002 chip which is the same chip used in the LimeSDR. Here only the IQ output of the Lime chip is used, not the ADCs.
At this point, it's important to note that software support for the RFNM is still in the very early stages and SDR++ currently has no gain controls implemented. SDR++ is third-party software to RFNM so it's not any fault of the RFNM team. (NOTE: In the last few days after having already written this review, there have been several commits to SDR++ regarding RFNM, so this may already be resolved)
However, it is possible to SSH into the Linux OS system running on the RFNM system and change the gain setting through a bash command. To connect to SSH a network-connected ethernet cable needs to be connected to the board (alternatively you can use the UART port on the side of the board with an adapter). Once logged in via SSH we can browse to "/sys/kernel/rfnm_primary/rx0" and edit the value in the 'gain' text file. Then to activate the changes, simply set the value in the 'apply' text file to 1. This allowed us to optimize the gain settings for best reception.
cd /sys/kernel/rfnm_primary/rx0
echo 30 > gain && echo 1 > apply
RFNM with Lime daughterboard on the WiFi bandsRFNM with Lime daughterboard receiving mobile basestation signals.
With the ability to set the gain, the Lime board works great. Signals are strong in the VHF and UHF bands where sensitivity is approximately -135 dBm, and there is little sign of imaging with appropriate gain settings. In the 2.4 GHz band, the sensitivity remains good at around -130 dBm too. Although the advertised max frequency range is 3500 MHz, we were able to receive up to about 3.85 GHz with reduced sensitivity.
On HF, however, the Lime board performs very poorly. We start to see a drop off at around 50 MHz where the sensitivity is roughly -93 dBm, at 30 MHz about -58 dBm, and 15 MHz about -37 dBm.
Granita Daughterboard Tests
In the second test, we removed the Lime board from the RFNM motherboard and installed the Granita daughterboard. The Granita daughterboard is based on an Arctic Semiconductor 'Granita' chip, an RFFC2071A mixer, and several preselectors.
Unfortunately, we are very disappointed in the performance of Granita as there is very significant imaging of signals, and this wipes out the ability to cleanly receive almost every band. According to Davide, this problem is a firmware issue with the Arctic Semiconductor Granita chip that can maybe be fixed in the future, but there is no guarantee that it is fixable, as any fix is at the mercy of the Arctic Semiconductor, who don't seem to be very responsive to the issue. Davide (creator of the RFNM) writes:
In the Lime board, the IQ LPF works properly. For granita, it doesn’t work at all, like the -3 dB point of the 20 MHz LPF option is 100 MHz+. The manufacturer of the RFIC kept saying that this is a firmware bug, so I gave them a devkit to replicate, but they never fixed it over the last month. I don’t know at this point if this is a software problem or if they discovered it’s something more.
We confirmed that adjusting the gain settings on Granita did not help with the imaging problem either.
Heavy imaging was experienced with Granita (compare this to the true WiFi spectrum shown previously with the Lime board).
We also noticed that Granita was picking up or internally generating significant noise spikes. We initially assumed this was from the 9V SMPS, but even with a 12V linear power supply similar spikes were seen. The same noise was not visible with the Lime board.
Granita unknown noise spikes
Sensitivity in the bands above 600 MHz was good, at around -135 dBm. Below 600 MHz where the mixer is used, sensitivity was a bit poorer at around -123 dBm. The highest frequency we could receive was around 5900, but after about 5 GHz signals started to become very weak. The Granita board is advertised as receiving 10 - 6300 MHz, however, the documentation notes that the current batch is only capable of tuning to around 5 GHz. They note that the next batch should reach 6.3 GHz.
The Granita board was able to receive broadcast AM, shortwave, and ham frequencies with good signal strength. At 15 - 50 MHz the sensitivity is roughly -115 dBm.
Granita receiving the 0 - 15 MHz.
At the time of this review, we cannot recommend that anyone purchase the Granita board unless they are working in a very controlled environment. We hope that in the near future the IQ LPF problem can be fixed to make the Granita board usable.
GNU Radio Tests (Windows)
The file drive on the RFNM also comes with a Soapy driver available. We copied the RFNMSupport.dll file from the RFNM drive over to our GNU Radio radioconda installation's SoapySDR folder at C:\Users\proje\radioconda\Library\lib\SoapySDR\modules0.8. Then we opened GNU Radio and opened the gnuradio_example.grc file. This brings up a FFT and waterfall display like in SDR++ and with the Gain controls exposed. With the gain controls exposed the Lime + RFNM combination works great.
The daughterboards also have built-in antennas that can be switched in or out using a drop down box in the GNU Radio UI. The built-in antenna on both boards is a Pulse W3796 which has an advertised range of 698 MHz to 2.7 GHz. While the built-in antenna works well for nearby bench reception, we preferred to still use our outdoor dipole antenna for better reception.
153.6 MHz Bandwidth Mode
It's possible to set the RFNM to provide even more bandwidth by connecting two USB cables to the PC. That gives us up to 153.6 MHz of 12-bit data. Enabling this mode requires editing a variable via the terminal
Once this was set we were able to edit the samp_rate block in the GNU Radio example, and set it to 153.6 MHz. At the moment the current SDR++ does not support the 153.6 MHz sample rate.
RFNM Running 153.6MHz in GNU Radio.
Conclusion
It's clear that the RFNM is cutting edge, yet affordable, and has great potential and excellent features and specifications. The built-in processor, DSP and GPU capabilities on the RFNM could be game changers in the near future. However, at the time of this review, the software support is still in its very early stages, documentation is lacking, and it's not yet recommended for mainstream users who just want to plug in and get started with an SDR for listening and decoding signals.
Regarding the Granita daughterboard, we would probably hold off on purchasing this until there is some clarification on the IQ LPF fix.
If you are an advanced SDR user who is comfortable with GNU Radio, Linux and advanced applications like setting up and running mobile basestations, then the RFNM may be a good choice. We are looking forward to applications that make use of the onboard DSP and GPU capabilities.
In one of her latest videos on YouTube, Sarah from the SignalsEverywhere channel shows how we can use a program called "IZ8BLY Phase 3D (AO-4) Satellite Decoder" to decode the 'Mid-Beacon' on the QO-100 satellite. QO-100 is a commercial geostationary communications satellite that also contains a popular transponder for amateur radio.
However, there is also an interesting beacon called the mid-beacon that can be decoded, which provides some information about the satellite. In the video, Sarah shows how this beacon can be decoded with the software from IZ8BLY. As QO-100 is only visible from Europe, the Middle East and Africa, Sarah uses a WebSDR to receive the signal from the USA, then pipes the audio into the IZ8BLY decoder via Virtual Audio Cable.
Decode QO-100's Mid-Beacon with Virtual Audio Cables and WebSDR
Over on his blog Jeff Sandberg has posted a writeup detailing how he combined RTL-SDR, rtl_amr, and HomeAssistant to decode wireless data from his Itron power meter, and create useful graphs showing his US home's power usage.
In the post, Jeff explains how he uses an RTL-SDR Blog V4, HomeAssistant, EMQX, and rtl_amr to receive and plot the data. The RTL-SDR and rtl_amr software receives and decodes the wireless Itron electricity meter data packets, and then EQTT passes the data to HomeAssistant for logging and plotting. Jeff also notes how he used NodeRed to correctly automate the summer and winter tariff price changes.
Finally, in an update to the post Jeff mentions that he was also able to receive and log data from his gas meter.
HomeAssistant energy dashboard with data received from an RTL-SDR and rtl_amr decoder.
Last month we posted about Aaron's video on Meshtastic, and how it's possible to decode the Meshtastic protocol using an RTL-SDR and GNU Radio project called Meshtastic_SDR.
If you weren't aware, Meshtastic is software that enables off-grid mesh network based communications and can run on cheap LoRa hardware. The mesh based nature of the system means that communications can be received over long distances, without any infrastructure, as long as there are sufficient Meshtastic nodes in an area that can route the message to the destination node. One example application of Meshtastic is to use it as a mesh-based text messaging system. This might be useful for teams of hikers, pilots, or skiers who operate in remote areas without cell phone coverage.
In his latest video, Aaron shows how Meshtatsic_SDR can also be used to transmit the Meshtastic Protocol using a transmit capable SDR like the HackRF. Aaron writes in the video description:
In this video, we take a deeper dive into the setup and usage of the meshtastic_SDR repository, which now enables the transmission and reception of Meshtastic using Software Defined Radios (SDRs). Recent updates have made this possible by partially leveraging GNU Radio flow graphs for both RX (receive) and TX (transmit), and integrating Python scripts that connect to ZMQ sources for message input and ZMQ outputs for message decoding.
I demonstrate the setup using a HackRF for the transmit side and an Airspy R2 for receiving. We also verify the results of TX and RX using a standard Meshtastic receiver to ensure accurate performance.
