Tagged: DARC

Talk: My journey into FM-RDS by Oona Räisänen

Back in November we posted about Oona’s work with decoding radio controlled bus stop display signs using her RTL-SDR. Oona has given a talk at the Chaos Communication Congress about her work on decoding FM-RDS and the bus stop displays. The talk is now available on YouTube.

How I discovered mysterious hidden signals on a public radio channel and eventually found out their meaning through hardware hacking, reverse engineering and little cryptanalysis.

A story about my experiences with FM-RDS (Radio Data System), a digital subcarrier embedded in FM broadcast transmissions, and also cryptanalysis of the weakly encrypted TMC traffic messages contained therein. I originally found about the existence of such transmissions in a roundabout way, by using a spectrum analyzer program to examine intermodulation distortion in my radio’s Line Out audio. As it turned out, the inaudibly quiet distortion, probably caused by the radio’s stereo demuxer circuitry, contained all the information needed to decode all RDS data present in the transmission. I will demonstrate the journey I took and give a short introduction to how the data is actually encoded. Live acquisition of local RDS data depending on signal conditions in the premises.

As a bonus, I’m introducing yet another little-known FM subcarrier called DARC, and my recent reverse engineering of the bus stop display radio protocol used in Helsinki.


Reverse Engineering Radio Controlled Bus Stop Displays

Over on her blog www.windytan.com, Oona has shown how she was able to reverse engineer a radio controlled bus stop display using a receiver like the RTL-SDR. Radio bus stop displays are used by bus services to display GPS enhanced bus timetables and expected bus arrival times.

Oona discovered that the bus displays in her area use Data Radio Channel (DARC) encoding. Once she discovered that no DARC decoders exist online, she implemented the full five layer DARC protocol stack in Perl and was left with data packets that had some human readable strings containing information such as bus terminal stations. With some extra work she was able to also get more information such as expected waiting times and bus numbers as well.

Bus Terminal Packet
Bus Terminal Packet