Tagged: CTCSS

NyxScope: A Windows Multi-Protocol SDR Decoder Program with Multiple Digital Native Decoders

WARNING: Multiple people have noted that this program is not working as expected and may be overly buggy.

Recently, we've learned about NyxScope, a multi-protocol SDR receiver program for Windows that comes with multiple native decoders built right into the software. Their own description describes this all-in-one program best:

You get spectrum and waterfall, multiple concurrent VFOs, trunked-radio following, digital voice, aviation and marine tracking, paging, ISM sensors, HD Radio, and transcription, in one binary.

NyxScope includes decoders for P25 Phase 1 and Phase 2 voice, EDACS and NXDN control channels, ADS-B, AIS, ACARS, POCSAG, FLEX, LoRa CSS PHY + LoRaWAN MAC, Morse, RDS, CTCSS/DCS, Iridium decoding (with voice), and also includes a signal classification tool, Bluetooth LE scanner, and Whisper voice-to-text transcriber. It also outsources decoding of other protocols to mature decoding software such as multimon-ng, rtl_433, dsd-neo, nrsc5, direwolf, dumpvdl2, dump978, rs41mod where required, noting that the outsourced decoders are bundled with the software, meaning no extra installation work is required.

The software supports RTL-SDR, HackRF, Airpsy, bladeRF, SDRplay, Fobos and PlutoSDR. It also supports using multiple SDRs used in parallel.

The software does not appear to be open source, but it is provided for free with a limitation of 3 concurrent VFOs and a limitation on recording, transcribing, and pager messages. A perpetual per-machine license for $89.95 can be purchased to lift these restrictions and add access to their FCC frequency lookup database.

AI-Disclaimer: While the developers have not noted any use of AI tools, we suspect that AI was used in the creation of this software.

NyxScope Screenshot Scanning the 800 MHz Band
NyxScope Screenshot Scanning the 800 MHz Band

Identifying Transmitters with CTCSS Fingerprinting

Oona Räisänen is a RF hacker and enthusiast who has in the past brought us posts about decoding burger pagers in restaurants, decoding wireless bus signs and FM-RDS with SDR’s like the RTL-SDR. This time she has written an interesting post that shows how she can “fingerprint” radio transmitters by analysing their CTCSS transmissions. CTCSS is short for “Continuous Tone-Coded Squelch System” and is a low frequency tone added on to some transmissions used in handheld radio systems shared by several distinct groups. The CTCSS tone prevents users of a shared system from having to listen to other users talking if they are not part of the same group with the same CTCSS tone frequency. CTCSS provides no means for actually individually identifying a radio.

Oona wanted to see if she could fingerprint and thus identify individual radios by their CTCSS tone by looking at identifying features such as small variances in CTCSS tone power and frequency. The idea is that each radio will have minute differences in the exact tone and power produced by the CTCSS circuitry, due to differences in the crystal oscillators and component tolerances. Oona used an RTL-SDR to record CTCSS data from a conversation on a local handheld radio network. Then by plotting the frequency vs power data on a heatmap graph she was able to find 8 different clusters of points, which potentially identifies 8 individual handheld radios.

Frequency vs power heatmap identifying 8 different radios.
Frequency vs power heatmap identifying 8 different radios.

With the individual radios identifiable by their cluster centers, each cluster can be assigned a name. Now each subsequent transmission can be compared to each cluster center, and assigned to the closest matching cluster, thus matching a new unknown transmission with a known radio. This makes it easier for someone listening in with no context to follow a conversation. 

Assign names to each radio.
Assign names to each radio/cluster center.

New CTCSS Detector Plugin for SDR#

CTCSS is an acronym for Continuous Tone-Coded Squelch System and is a system that is used in shared two way radio systems. It is common for a single radio channel to be shared over a number of user groups for frequency use efficiency. CTCSS uses a special tone to identify each group of users, and this tone is used to prevent a group hearing radio chatter from another group sharing the channel.

Over on the SDR# Yahoo Groups forum, a CTCSS detector plugin for SDR# has been posted. The plugin can detect CTCSS tones and provide a squelch for the desired tone. The latest version of the plugin can be downloaded from this link.

CTCSS SDR# Plugin
CTCSS SDR# Plugin