Tagged: dvb-s2

VMA Radio Lab: DecSAT Extended into a Multi-SDR Receiver with DVB-T/T2, DAB+ and Analog PAL TV

Last week we posted about DecSAT, an open-source program by CasualArclamp that turns a HackRF One into a DVB-S/S2/S2X satellite receiver and analyzer. Now Vitor Martins Augusto has written to share his fork, 'VMA Radio Lab' (initially called DecSAT-VMA), which extends DecSAT into a general-purpose broadcast receiver and measurement tool.

The biggest difference between DecSAT and VMA Radio Lab is multi-SDR operation. VMA Radio Lab can run several SDRs at once, each with its own VFOs, including the HackRF, PlutoSDR, USRP B210, RTL-SDR, SDRplay RSP1 and Airspy. One SDR can be dedicated to a sweeping wideband overview, such as the full 950 - 2150 MHz satellite IF. It also pulls in DVB-T/T2, DAB/DAB+ and TETRA decoding from CasualArclamp's sibling projects DecDVB-T, DecDAB and DecLAB, and adds analog radio, PAL color TV with teletext, measurement tools such as a vectorscope and transport stream analyzer, and control of CrazyScan-compatible TBS tuner cards for LNB power and hardware DVB reception.

Meanwhile, the original DecSAT remains satellite-focused. Since our last post it has added support for Fobos SDR, Airspy and network IQ input (including rtl_tcp), and has merged some of VMA's early RTL-SDR, PlutoSDR, B210 and analog TV code.

VMA Radio Lab is GPLv3 and available as a Windows 64-bit build and source zip on the website. We note that TETRA audio needs a separate ACELP codec DLL that isn't included for legal licensing reasons, and the bundled development notes describe several of the newer decoders, such as AIS and ACARS, as experimental. 

Decscat-VMA Screenshot
Decscat-VMA Screenshot

AI Disclaimer: The original DecSAT lists Claude as a contributor. While VMA does not disclose it, the development notes included with the VMA Radio Lab source suggest that its extensions were also written with the help of AI.

Muxwright: A Multi-Standard Radio and TV Test Transmitter for the PlutoSDR

Thank you to Peter Holzhauser for writing in and sharing Muxwright, a multi-standard radio and TV test transmitter for the ADALM-Pluto (PlutoSDR). Peter has in the past submitted his ESPSoup, and Etherbulb projects. Muxwright is intended for home lab testing only, with the Pluto connected to the receiver under test via cable and attenuator or inside a shielded box, as radiating broadcast standards over the air requires a frequency assignment.

Muxwright can generate FM stereo with RDS/RBDS, DAB+, DVB-T, DVB-T2, DVB-C, DVB-S/S2, ATSC 1.0, ISDB-T, DTMB and analog PAL/NTSC TV, plus DVB-S2 DATV for QO-100 and other amateur bands (which of course requires an amateur radio license). The digital TV modulators run directly on the Pluto and everything is controlled from a browser dashboard. The Pluto's RX input can also be used as a monitoring receiver for expected vs. actual test reports.

The software runs on Windows 10/11 via WSL2 and is currently at Beta 0.4. The README notes that it has only been verified on the original Pluto Rev. B, and that DVB-T2, ATSC, ISDB-T and DTMB are still untested with real TV sets. The code is MIT licensed (with the FM/RDS module under GPL-3.0) and available on GitHub, however, the Windows installer is only available by request via email from the website.

Muxwright Transmitting DVB-T with a PlutoSDR
Muxwright Transmitting DVB-T with a PlutoSDR

AI Disclaimer: The project's GitHub commit history lists Claude as a co-author.

DecSAT: A DVB-S/S2/S2X Satellite Receiver with Blind Scanning for the HackRF One

Thank you to RTL-SDR.COM reader Vitor for writing in and sharing DecSAT, an open-source Rust program by CasualArclamp that turns a HackRF One into a DVB-S/S2/S2X satellite receiver. It's laid out like SDR++, with a large waterfall and VFOs that you drop onto carriers, each running its own decoder.

DecSAT decodes DVB-S2 and S2X carriers, including ACM, and outputs MPEG-TS to VLC or its built-in TV player, and IP data to PCAP files for Wireshark. A blind 'Identify' mode works out an unknown carrier's symbol rate and modulation, and a 'Survey' tool acts like a blind scan, identifying and decoding every carrier in the span. It also supports various SCPC modem, voice, radar, and satellite beacon formats.

Portable Windows binaries are available on the original repo's releases page, and Vitor notes that he has created a fork that adds a Visual Studio 2022 build.

Update: Vitor notes that his fork as added several new features, including analogue modes such as WFM with RDS, analogue TV (PAL/NTSC) and integration to CrazyCat's streamreader.dll allowing use of compatible satellite tuners (mostly made by TBS) to setup the LNB (polarity, band and power), launch DiSEqC commands and blindscan and stream the actual TS back to DecSAT. He notes that these updates should eventually work their way back into the upstream code.

DecSAT Identifying Carriers in a Synthetic 8 MS/s Test Scene
DecSAT Identifying Carriers in a Synthetic 8 MS/s Test Scene

AI Disclaimer: Claude is listed as a contributor to the DecSAT repo.

Using the Don’t Look Up Tool to Eavesdrop on Insecure Private Satellite Communications

Over on YouTube, Rob VK8FOES has uploaded a video showing how to install and use the "dontlookup" open-source Linux Python research tool for evaluating satellite IP link security. Back in October, we posted about a new Wired article that discussed how many geostationary satellites are broadcasting sensitive, unencrypted data in the clear and how a cheap DVB-S2 receiver and satellite dish can be used to eavesdrop on them.

In the video, Rob discusses the new dontlookup tool, which is an excellent one-stop shop open-source tool for parsing IP data from these satellites. He goes on to show the full steps on how to install and use the tool in Linux. The end result is private internet satellite data being visible in Wireshark (blurred in the video for legal reasons). In the video description, Rob writes:

I thought I would make a video showcasing this new open-source Python tool for Linux. 'Don't look up' is the result of a research campaign conducted by a group of cyber security researchers from the USA for decoding DVB-S2 satellite data transponders.

Geostationary communications satellites are somewhat of a 'perfect target' to malicious threat actors, due to their downlink signals covering large portions of earth surface. This gives attackers are large attack surface to intercept IP traffic being transmitted from space. To most peoples surprise, little-to-no security, such as encryption, are being used on these data transponders!

This is all old news to myself, and the fans of my YouTube channel that have been following my TV-satellite hobby for the past couple of years. Most of this was already possible with consumer-grade satellite equipment and a Python application called GSExtract. However, the scope of GSExtract was a lot more narrower than that of DontLookUp, with the developers claiming to have achieved an exponential packet recovery rate compared to GSExtract.

Join me in this video today where I will be showing my users how to patch and build the TBS5927 USB satellite receiver drivers for RAW data capturing. I'll also be showcasing the software application called 'DVBV5-Zap' which interfaces with our satellite receiver to capture RAW data from a satellite. And finally, I will finish-off the video by demonstrating the actual usage of DontLookUp itself. To make the tutorial as accessible as possible, I'm doing the entire process inside a Linux virtual machine!

This tutorial will probably only work in DragonOS FocalX R37 Linux by the wonderful @cemaxecuter. You are welcome to try on other Linux distributions, but your mileage will vary! Also, due to the TBS5927 using something called a 'Isochronous Endpoint', it's only possible to use this satellite receiver via USB Passthrough in VMWare versions 17.5 and above. VirtualBox does not support Isochronous USB Endpoints in any version. It's always best to run Linux on 'bare-metal' by installing it directly to your PC's internal SSD, or running it from a bootable USB thumb drive.

Please understand that if you own an internal PCI-E satellite receiver card from TBS, it is not possible to 'pass it through' to Linux running inside in a Type-2 Hypervisor (VMware, VirtualBox etc.) Installing Linux on bare-metal is the only hope for PCI-E card owners. Thanks very much for watching!

HARDWARE:
TBS5927 USB Satellite Receiver
90cm 'Foxtel' Satellite Dish
Golden Media GM202+ LNB
Hills RG-6 Coaxial Cable (F-Type Connectors, 75 Ohm)

SOFTWARE:
VMWare Workstation 17.6.2
DragonOS FocalX R37 Linux
TBS 'Linux_Media' Drivers
'RAW Data Handling' Patch
DVBV5-Zap
DontLookUp

If you're interested in this topic, Rob's YouTube channel has many videos on this topic that are worth checking out.

Don't Look Up (No, Not The Movie): A New Research Tool To Evaluate Satellite IP Link Security!

Some LimeSDR Demonstration Videos

Recently Michael DG0OPK wrote in and wanted to share some videos of the LimeSDR in action that he’s uploaded to YouTube. The first video shows LimeSDR running with the SDRangel software and receiving the 950 MHz mobile phone band. SDRangel appears to be GPU accelerated so the waterfall can show a lot of detail very quickly.

The second video shows the LimeSDR transmitting DVB-S/S2 on and ODROID XU4, and the signal being received on a PC using and Airspy, and being watched live with a standard DVB-S2 TV Card. The Odroid XU4 is a single board computer like the Raspberry Pi but much more powerful.

On his channel Michael also has some other LimeSDR videos that you can check out such as testing the LimeSDR with GNURadio on the 23cm band for full duplex DVB-S2, and running the LimeSDR at full speed 60fps, 50 MHz on a i7 PC.

The LimeSDR is a full duplex RX/TX capable SDR with a 100 kHz – 3.8 GHz frequency range, 12-bit ADC and up to 80 MHz of bandwidth. A unit currently a unit currently costs $289 USD on Crowd Supply.

Broadcasting DVB-S2 with the LimeSDR

The LimeSDR is a $299 USD software defined radio that has RX and TX capabilities, a tuning range of 100 kHz – 3.8 GHz, a 12 bit ADC and up to 61.44 MHz worth of bandwidth. It is currently seeking crowdfunding over at CrowdSupply.com, and there are still 170 early bird units available at a lower price of $249 USD. The funding campaign ends in 14 days at the time of this post.

In a recent blog post on the myriadrf website, beta tester Alexandru shows how the LimeSDR can be used to transmit DVB-S2 video using GNU Radio.  Alexandru used bladeRF dvbs2_tx.grc gr-dtv example which is provided with GNU Radio and modified it for the LimeSDR. He then transmitted the video stream and used an off the shelf satellite TV receiver to display the video, and an Airspy to monitor the spectrum. The gr-dtv library can also be used to transmit other video standards such as ATSC, DVB-T, DVB-T2, DVB-C and DVB-S2.

LimeSDR DVB-S2 GNU Radio Flowgraph
LimeSDR DVB-S2 GNU Radio Flowgraph

LimeSDR demo: High Definition Video Transmission using GNU Radio