Talk by Micheal Ossmann at Toorcon 2015: Rapid Radio Reversing

Toorcon is a yearly conference that focusus on information security related topics. At the 2015 Toorcon conference Micheal Ossmann (inventor of the HackRF SDR) gave an interesting talk about reverse engineering wireless systems using software defined radio.

Back in November Micheal gave a bit of a quick tutorial on reverse engineering in a November edition of the YouTube web series Hak5. Now his full conference talk has been released over on his website. In his talk he uses a HackRF and a Yardstick One to show how to reverse engineer a wireless cabinet lock.

The video can be viewed below or over on Micheal’s site greatscottgadgets.

Comparing a GPS Patch vs a DIY Patch Antenna on L-Band with the MIX4ALL

Over on YouTube user Adam Alicajic has recently been uploading videos that show him testing a prototype of his upcoming product the MIX4ALL. The MIX4ALL is an RF downconverter which will allow the RTL-SDR to receive signals at around 1.5 GHz or higher. Although the RTL-SDR can already tune up to ~1.7 GHz, above about 1.2 GHz sensitivity is poor and some units have problems receiving when they get hot. The downconverter will convert a 1.5 GHz signal into a signal at around 250 MHz, where the RTL-SDR operates well. At around 1.5 GHz there are several satellite signals of interest including Inmarsat EGC, Iridium and AERO signals.

On one video Adam decided to use the MIX4ALL to test the difference between a GPS patch antenna and a home made air gap patch antenna. The GPS patch antenna was salvaged from an old GPS receiver and the patch antenna is the one discussed in this previous post. In the test Adam used the MIX4ALL and an RTL-SDR, and tested reception of Inmarsat signals. His results showed that the reception given by the GPS patch was very poor compared to the home made patch antenna.

Comparing the GPS and DIY Patch antenna for the L-band INMARSAT

GPS antenna match on L-band 1575 MHz

Some other recent videos by Adam show him also testing his MIX4ALL with S-Band signals around 2.3 GHz and also receiving Alphasat XL.

MIX4ALL receiving on S-band terestrial weak signals

Alphasat XL band spectrum using the converter and R820T dongle

The Best RTL-SDR Posts of 2015

Things are developing fast in the software defined radio and RTL-SDR world. This year we’ve seen some amazing projects and developments occur. Here’s our highlight reel.

January

In January we first heard about Tim Haven’s RTL-SDR based “Driveby” system which he used to try and pinpoint a nasty source of noise in his neighbourhood. The system consisted of multiple RTL-SDR dongles scanning the spectrum and a GPS receiver. Together the system correlated noise power with locations and from the data Tim was able to pinpoint the source of the problem noise to a faulty power pole in his neighbourhood.

William Dillon, a small aircraft pilot and radio enthusiast also gave us an interesting set of videos that not only explained VOR navigation signals, but also showed how to decode them with an RTL-SDR in order to obtain a bearing.

We also heard from RF expert Leif who did a big test comparing several SDR’s on their dynamic range and other factors. The SDR-14 and Airspy SDR’s came out on top in most results.

Finally, near the end of the month Jay Moore wrote up a tutorial showing us how to receive SCA audio, which is a special audio service channel that is embedded into regular broadcast FM as a subcarrier.

February

At the beginning of February Vasilli, a SDR# plugins author released a new SDR# driver for the RTL-SDR that included manual gain control and access to the decimation feature. The decimation feature allows you to zoom in to signals without loosing FFT resolution, it is very useful for browsing HF signals.

Later in the month we saw the release of Artemis a companion program to our Signal Identification Guide sister site sigidwiki.com.

March

In March radio astronomer Jim Brown used an RTL-SDR and ham-it-up upconverter to listen to noise bursts originating from the planet Jupiter.

We also released a tutorial that showed how to measure the characteristics of RF filters and antenna VSWR with just an RTL-SDR dongle, noise source and directional coupler.

In this month we also saw the reduction of the SDRplay RSPs price from $299 down to $149. The SDRplay (and also the Airspy SDR) are software defined radios that can be considered as a next stage “step up” from the RTL-SDR dongles.

Finally, we also posted an interesting article about fingerprinting aircraft using aircraft scatter techniques, which could be done using an RTL-SDR dongle.

April

In April we learned that the FlightAware ADS-B app had started supporting UAT reception on 978 MHz, and we also reviewed Adam’s ADS-B folded monopole antenna.

May

In May we saw a post by amateur radio astronomers EA4EOZ and EB3FRN who showed us that it was possible to determine the radiant (origin point) of meteors showers, using meteor scatter techniques with an RTL-SDR.

Regular contributor to our blog Happysat wrote in and supplied us with a tutorial that showed how to decode LRPT images from Meteor M2 satellites using a new plugin by Vasilli and a new version of the Lrtpdecoder by Oleg.

June

In June on Hackaday Juha Vierinen did a nice write up that showed us how we could build a passive radar system using two RTL-SDR dongles.

We also saw an interesting story by John Wiseman about monitoring FBI aircraft that made headlines around the world on several news sites. Essentially John used ADS-B logs received by his RTL-SDR to discover several aircraft with suspicious flight paths and call signs. These aircraft turned out to probably be “persistent wide-area surveillance” FBI spy planes.

Later in the month we saw how University researchers from Tel Alviv university were able to use a FunCube dongle to extract encryption keys by sniffing unintended emissions from PCs.

July

In July we saw the release of a paper that describes how to use the RTL-SDR to detect meteors entering the earth’s atmosphere. The author also runs a live stream of his RTL-SDR based meteor detecting set up.

August

In August there were many interesting posts, but the very first piece of news was that the very first RTL-SDR manga comic book was released. Out of interest we bought a copy and it turned out to be a short comic book that detailed the installation and basic use of the RTL-SDR.

A light aircraft pilot also wrote in to let us know how some pilots have been using RTL-SDRs and dump978 as a cheap alternative to $500+ FIS-B weather report receivers.

We also released our new upgraded RTL-SDR Blog line of SDR dongles, all of which now include a TCXO and SMA connector by default.

Another story that made headlines on several news sites was Samy Kamkars Def Con conference talk on his RollJam device which can be used to break into almost any car wirelessly.

We released a tutorial that showed how to use the RTL-SDR together with a suitable L-band satellite antenna to decode Inmarsat STD-C EGC messages. The tutorial also showed how a cheap GPS antenna could be modified into a wideband L-band antenna.

We also heard about MIT Haystack Observatory researchers who had been using RTL-SDR to create a low cost ozone spectrometer to perform scientific measurements.

Bastian wrote in to show us how he was able to reverse engineer the bus telemetry signals in his area, and create a live map of all the bus locations in his area.

Finally in August we also heard how researchers at the University College of London were able to use already present WiFi signals and a USRP SDR to actually see through walls (or at least detect people and objects on the other side).

September

In September we discovered how radio astronomers Peter W East and GM Gancio were using RTL-SDR dongles to detect pulsars (rotating neutron stars). 

We also saw how Bastian Bloessl was able to use his RTL-SDR to reverse engineer the protocol used by a set of portable traffic lights used in construction outside his house. He was able to write a short program that displayed the current state of the traffic light on his PC.

September also showed us how easy it is getting to sniff GSM SMS and voice messages from mobile phones (assuming you have the encryption details of the phone you want to sniff).

October

October brought interesting news RF from the Raspberry Pi. Clever coder F5OEO was able to manipulate the GPIO pins on the Raspberry Pi enough to be able to actually transmit FM, AM, SSB and SSTV signals. Later developments saw a full transceiver built with F5OEO’s software and an RTL-SDR connected to the Pi.

Tatu Peltola created a “phase correlative direction finder” out of three RTL-SDRs and three antennas. With his system he is able to determine the direction of a transmitter.

We also saw how it it will be possible in the near future to use the RTL-SDR to decode DATV DVB-S signals from the ISS.

November

In November the Meteor M1 satellite managed to wake up from the dead, providing satellite image enthusiasts with another weather satellite signal that is receivable by the RTL-SDR.

Researchers at Disney created a very advanced smart watch prototype that could detect with good accuracy the actual (electrical) object the user was touching. The watch uses an RTL-SDR dongle as the RF receiver, and it works by receiving and correlating the electromagnetic emissions given off by electronic devices with a database of known emissions.

December

Finally in the last month of December we saw a new decoder for Inmarsat AERO signals released. AERO is a satellite based version of ACARS which is used by aircraft.

Mario Fillipi wrote in and gave us an interesting article on Ionosondes.

We reviewed the SpyVerter upconverter and determined that it is probably the one with the best performance and best value available for the RTL-SDR.

We also saw that it is now possible to use an RTL-SDR dongle and cheap GPS antenna to receive GPS signals and also acquire a position lock.

2016

2015 was full of interesting SDR developments, only some of which were covered in this post. If you want to read more we suggest going through our previous posts page by page.

No doubt we’ll continue to see more developments in the SDR field this year. We can expect to see new SDR hardware released, updates to existing SDR hardware and more accessories such as downconverters for the RTL-SDR. We can also expect to find new uses for low cost SDRs and to see new software released.

We hope that the readers of this blog will continue to experiment with the RTL-SDR and other SDR’s this year. If you have an interesting SDR related project that you’ve developed or found, please let us know at [email protected].

Running the Airspy ADSB decoder at full speed on a Raspberry Pi 2

Bob W9RAN recently wrote in to let us know about some developments he and Youssef have had with getting the Airspy to function at full speed on a Raspberry Pi 2 with ADS-B decoding. Bob and Youssef created the SpyVerter upconverter, and Youssef is the programmer of SDR# and the co-creator of the Airspy SDR. Bob writes the following:

Airspy is a high-performance SDR that streams 12 bit samples at 20 MSPS (real, not IQ) to a PC where the real processing is done. But 20 million samples per second uses a significant fraction of the bandwidth available with USB 2.0, and has made apparent the weaknesses in USB subsytems on a number of PCs. So of course the natural assumption by “experts” has been that the Raspberry Pi 2 isn’t up to the task.

As we Pi fans know, the Pi 2 has a 900 Mhz 4-core ARM Cortex A7 CPU, and the key to performance is properly implemented code that can take full advantage of the processor architecture.

Youssef Touil, author of SDR# and creator of Airspy has done that, proving first that an optimized multithreaded version of his ADSB decoder would run on a 4-core Odroid that has more CPU power than the Pi 2. But today we have proven that not only can the Raspberry Pi 2 run the optimized ADSB decoder at full speed (20 million samples per second via USB), but that it even has enough horsepower left to run the Virtual Radar Server Google map display in the Pi’s Epiphany web browser!

For those not familiar, the map display is created by a program called Virtual Radar Server that runs on a PC and receives samples from the Pi over ethernet, and includes a web server that allows other computers (in my case, the Pi 2) to view the composite map display. (For more information about ADSB, see my article in QST for January 2014).

I’m really thrilled to be able to demonstrate that the Pi 2 has this
impressive capability! This makes it feasible to create inexpensive high performance ADSB receiving systems, and who knows what else?

Decoding End Of Train and Head Of Train Packets with an RTL-SDR

Back in March 2014 we showed a video of a RTL-SDR user decoding End Of Train (EOT) and Head of Train (HOT) signals. Head of Train (HOT) and End of Train (EOT) signals are used on trains to transmit telemetry data such as brake line pressure and monitor accidental separation of the train. If you live near a trainyard of railway line you may be able to pick up these signals.

Now over on YouTube user berwin018 shows us another video of EOT and HOT signals being decoded. There doesn’t seem to be much information in these packets, but they could potentially be used to track which trains are passing by.

To decode EOT and HOT packets you can use the softEOT software which can be downloaded from the softEOT Yahoo! Group after requesting and being accepted into membership.

Decoding End Of Train & Head Of Train Packets

DSD+ Updated to Version 1.101

DSD+ (Digital Speech Decoder+) is a popular decoding tool that can be used to listen to P25, DMR and other unencrypted digital speech signals. Recently DSD+ has been updated from version 1.074 to version 1.101.

The new version brings several changes, including the ability to decode Hytera Extended Pseudo Trunk (XPT) systems, Airspy compatibility, performance improvements and a TCP/IP link from FMP to DSD+ (no longer need to use a virtual audio cable). The full change log is as follows:

DSD+: Fixed AMBE tone frame audio generation.

FMA: Added Airspy-compatible FMP (FMPA.exe)

DSD+: Significant reduction in CPU usage when monitoring busy control channels. Improvement will be most noticeable on low power processors.

DSD+: Detection and decoding of Hytera Extended Pseudo Trunk (XPT) systems.

DSD+: The DSD+ -i command line parameter can contain an IPV4 address; this lets DSD+ connect to a copy of FMP that is running on a different PC in your local network or on the Internet

Example: DSDPlus -i192.168.1.150:20001

DSD+: NEXEDGE radio alias editing

DSD+ now marks auto-generated NEXEDGE radio aliases in the DSDPlus.radios file by prepending an asterisk like so:

NEXEDGE, … yyyy/mm/dd hh:mm, *”aliastext”

If you edit a NEXEDGE alias, you must remove the asterisk; this tells DSD+ that the new alias text is NOT auto-generated and DSD+ will not replace it with OTA alias text

FMP: FMP command line processing

The FMP command line format has been modified and is now similar to the DSD+ command line. A summary is listed here:

FMP rev 1.4t

Usage:
FMP [options] Normal operation
FMP -h Show help

Options:
-i<num> RTL SDR device number (1-255) [-i1]
-o<num> Output audio device (1-255) [-o1]
-o<port> Output audio TCP port (256-65535)
-P<num> PPM value (-999.9-999.9) [-P0.0]
-g<num> RF gain (dB) [max]
-f<MHz> Initial tuned frequency [-f99.9]
-b<kHz> Initial filter bandwidth (4, 7, 9.5, 12.5) [-b7]
-z<num> Show zoomed spectrum (0-1) [-z1]
-e<num> Enable/disable economy mode (0-1) [-e1]
-n<num> Select noise filter (0-2) [-n0]
-v<num> Set volume level (0-500) [-v100]
-s<num> Enable/disable scanner mode (0-1) [-s0]
-wsl<v>.<h> Spectrum window location [-wsl50.50]
-_<num> Minimize windows at startup; bitmapped
-rv Role is trunk voice channel monitor

-rv puts FMP into voice following mode (same as pressing ‘V’ in FMP)

Any shortcuts or batch files that run FMP will have to be modified to match the new command line format.

DSD+: Less processor loading (probably only noticeable on very slow processors)

DSD+: Much faster groups/radios files loading/saving

DSD+: Editing existing radio aliases

In previous versions of DSD+, editing of pre-existing radio aliases can not be done with an external text editor while DSD+ is running; only radio records with no alias text can be edited

With DSD+ 1.092, existing radio alias text can be edited in an
external text editor while DSD+ is running; DSD+ will load and display any updated radio aliases

DSD+: A DSDPlus.radios file corruption bug has been fixed

DSD+: A command line option to add system details to event log entries has been added

-E Add NAC/RAN/DCC/RAS data to event log file entries

DSD+: Decoding of more DMR and TIII messages has been added

DSD+: A symbol recovery bug has been fixed

DSD+: Con+ handling has been modified; previous versions of DSD+ would create “DMR” entries in the DSDPlus.groups and DSDPlus.radios files for traffic on monitored voice channels; DSD+ 1.090 creates “Con+” entries; if you have “DMR” entries with nonzero NID fields, you should either bulk delete them or change their protocol string from “DMR” to “Con+”; Notepad has a simple search/replace function that can be used to do this

DSD+: A command line option to minimize windows at startup has been added

-_<num> Minimize selected windows at startup (bitmapped, 0-15) [-_0]

value window

1 console
2 source audio
4 channel activity
8 event log

sum values to minimize multiple windows

DSD+: Several high contrast display modes have been added

-H<num> High contrast mode (bitmapped, 0-63) [-H0]

two bits are used per graphical window; pressing ‘H’ in a window will cycle it to the next display mode; pressing ‘W’ displays the current -H<num> value in the event log window

DSD+: Control of AMBE and IMBE unvoiced audio levels has been added

-UA<num> AMBE unvoiced speech level (0-100) [-UA50]
-UI<num> IMBE unvoiced speech level (0-100) [-UI50]

pressing ‘A’/’a’/’I’/’i’ will also adjust the levels;
lower levels may reduce the “underwater” sound of some comms

DSD+: DSD+ can get its raw audio source from FMP via a TCP link instead of via Virtual Audio Cable or VB-Cable

-i<TCPport> FMP TCP link port number (256-65535)

linking FMP to DSD+ via VAC or VBC is deprecated; please use the TCP
link feature instead; any port number between 10000 and 65000 should be fine

DSD+: DSD+ can record separate .wav files for each voice call

-P<wav|mp3> Also create per-call wav or mp3 files

the file names encode metadata:

time
duration
protocol
NID
site number
NAC/RAN/DCC/slot
call type (group/private)
target
source

note: per-call mp3 files are not supported at this time

FMP: A command line option to minimize windows at startup has been added

-_<num> Minimize selected windows at startup (bitmapped, 0-3) [-_0]

value window

1 console
2 spectrum display

CANFI: Cheap Automatic Noise Figure Indicator Updated to V2.7

Back in July 2014 we posted about the CANFI (Cheap Automatic Noise Figure Indicator) system. The CANFI system is a set of hardware components that include an RTL-SDR and a corresponding software program for control. Back then the CANFI system only supported E4000 dongles. However, recently CANFI was updated to version 2.7 and now supports the R820T/2 tuners as well. The documentation has also been heavily improved. The authors of CANFI introduce their system as follows:

One of the main tasks for an experimenting microwave amateur is to measure the Gain (G) and Noise Figure (NF) of a particular receiving device. For this one will need a Noise Figure Indicator and a (calibrated) Noise Source.

There are a number of commercial devices available from different vendors at prices which will exceed an amateur’s budget by many times. A lot of them can be found on the surplus market but this doesn’t help very much. A combination of both meter and noise source is barely sold below the 2.000€ margin.

Since a lot of cheap DVB – T sticks became available the idea was born to use it together with a homebrew noise source as a very cheap alternative to commercial devices [1]. It is now possible to build a suitable solution within a budget of 100 – 200€. Using a PC with USB port for communication and power supply such a device is very compact and almost compatible to an industrial solution. Special software gives a convenient user interface. Last not least you can reuse the DVB-T stick (together with the preamplifier) as a sensitive receiver along with SDR software.

To create a CANFI system you will need an RTL-SDR, a MGZ 30889 preamp, a noise source, a 28V boost converter to power the noise source and a serial to USB converter to control the noise source.

The CANFI GUI
The CANFI GUI

RTLSDR-Airband V2 Released

Back in June of 2014 we posted about the released of a new program called RTLSDR-Airband. RTLSDR-Airband is a Windows and Linux compatible command line tool that allows you to simultaneously monitor multiple AM channels per dongle within the same chunk of bandwidth. It is great for monitoring aircraft voice communications and can be used to feed websites like liveatc.net.

Since our post the development of the software has been taken over by a new developer szpajder, who wrote in to us to let us know that he has now updated RTLSDR-Airband to version 2.0.0. The new versions improves performance and support for small embedded platforms such as the Raspberry Pi 2, but the Windows port is now not actively maintained and probably does not work. The full list of changes is shown below:

  •  New libconfig-style config file format
  • util/convert_cfg: can be used to convert old-style config.txt to the new format
  • Syslog logging (enabled by default)
  • Daemon mode
  • Reworked makefiles, added install rule
  • /dev/vcio is now used to access GPU on Raspberry Pi; creating char_dev no longer necessary
  • Startup scripts for Debian and Gentoo
  • Support for auto gain setting
  • Support for multiple outputs per channel
  • Support for recording streams to local MP3 files
  • Support for ARMv7-based platforms other than RPi (eg. Cubieboard)
  • Updated documentation
  • Numerous bugfixes and stability improvements

Compilation and install instructions can be found on the projects main GitHub page.

RTLSDR-Airband
RTLSDR-Airband