Tagged: hackrf

Great Scott Gadgets URTI: Phase Two Progress Report

Over on their GitHub, Great Scott Gadgets, creators of the popular HackRF SDR, have created a phase two progress report for their upcoming URTI product. URTI (Universal Radio Test Instrument) is their next generation software defined radio which will work not only as a full-duplex SDR transceiver, but also as a vector network analyzer, spectrum analyzer and more.

In the phase two update they note that they have completed fabrication of an initial prototype board and have confirmed that all components on the board are functional. They note that much of phase four was already completed in parallel, which means the firmware and gateware development is also close to completion. So hopefully we will see more updates soon.

More information about URTI can be found at greatscottgadgets.com/urti.

URTI (Universal Radio Test Instrument) First Prototype Board

WarDragon Passive Radar with Blah2 and ADS-B Delay-Doppler Truth

Over on his YouTube channel, Aaron, creator of DragonOS and the WarDragon kit has uploaded a video showing the Blah2 passive radar software working with an SDRplay RSPDuo. In the video Aaron shows some setup steps before showing the passive radar range-doppler graph.

Blah2 is passive radar software that appears to be inspired by the KrakenSDR passive software that was removed for regulatory reasons. We note that it is legal for others to publish open source passive radar software, but KrakenSDR cannot legally publish their own open source passive radar software because it would be tied to their own physical product. Providing code would mean they essentially sell an off the shelf passive radar product which is restricted.

The notes in Blah2 specifiy that it currently only supports the SDRplay RSPduo and USRP devices, but in the future they are looking to add support for the KrakenSDR and modified RTL-SDR and HackRF hardware.

Aaron also briefly demonstrated the related adsbdd software, from the same author as Blah2. This software allows a user to convert ADS-B data to delay-doppler truth. Essentially allowing you to confirm is an aircraft position determined via ADS-B is on the range-doppler ellipse determined via passive radar. In the future the author hopes to be able to plot all aircraft in a 2D delay-doppler space graph. 

WarDragon Passive Radar Setup + Test w/ Open Source Code (RSPDUO, RTLSDR, Blah2)

Tech Minds: Taking a look at the new HackRF PortaPack Mayhem Version 2 Firmware

A few days ago the programmers of the popular Mayhem firmware for the HackRF Portapack released version V2.0.0. The new version includes multiple improvements specified in the release text below.

We are super excited to share the what's new with v2.0.0

  • Apps are now stored on the MicroSD Card so we can fit more apps on the device.
  • New file format that contains both the firmware and SD card apps to make updating super easy. (mayhem_v2.0.0_OCI.ppfw.tar)
  • Working USB serial communication when in Portapack mode
  • USB serial web interface (see details a few lines later)
  • One click update using https://hackrf.app
  • New USB serial commands
  • A bunch of bug fixes (see the changelog for the various bugs)
  • Updated 'Settings' (app settings editor, encoder options, date ,config mode, brightness...)
  • BLE apps
  • Raw auto record and replay (see Recon in wiki)

A brand new website to manage your device, https://hackrf.app

  • Can work offline once loaded first (Offline PWA)
  • Remote screen support
  • Remote file system access
  • One click firmware updates
  • Requires a chromium based browser to work

A new organization, Mayhem: https://github.com/portapack-mayhem where you can fin the sources of all our projects! Pull Requests are welcome :-)

Over on the Tech Minds YouTube channel Matt has uploaded a video showing off the new features of the Mayhem V2.0.0 firmware, and also showing how to install it. In the video Matt shows the new SD card browsing features, the new easy firmware one click update procedure, and the new web UI.

The Portapack is an accessory designed to enhance the HackRF software-defined radio (SDR), enabling portable operation. It integrates a display, user interface controls, and onboard processing capabilities. This setup allows for the direct demodulation/modulation and decoding/encoding of a wide variety of signal types without the need for an external computer.

The Best HackRF Portapack Firmware Yet - Mayhem Version 2

Canada Moves to Ban Flipper Zero and Possibly Software Defined Radios

Dominic LeBlanc, Canada's Minister of Public safety has recently declared that they plan to ban devices "used to steal vehicles by copying the wireless signals for remote keyless entry, such as the Flipper Zero". The text specifically calls out the Flipper Zero, however the wording appears to imply that any device that can copy a signal will be banned. This means the ban could extend to RX/TX SDRs like the HackRF and possibly even RX only SDRs like RTL-SDRs.

The Flipper Zero is an affordable handheld RF device for pentesters and hackers. It is not based on SDR technology, however it uses a CC1101 chip, a digitally controlled RX/TX radio that is capable of demodulating and modulating many common digital modulations such as OOK/ASK/FSK/GFSK/MSK at frequencies below 1 GHz. There are many CC1101 devices on the market, but the Flipper Zero has gained huge popularity on social media because of it's excellent software support, as well as its cute marketing tactic. In the past it was even featured on the popular Linus Tech Tips YouTube channel.

Flipper Zero has had a long line of setbacks including PayPal freezing 1.3M of its cash, and US customs temporarily seizing its shipments, then passing a $70,000 bill on to them for storage fees and Amazon banning the product on their marketplace.

In our opinion, we believe that the ban appears to be misguided. The Flipper Zero is a basic device that can only perform a simple replay attack, which is to record a signal, and replay it at a later time. These sorts of attacks do not work on vehicles built after the 90's which now use rolling codes or more sophisticated security measures. To defeat rolling code security, a more sophisticated attack called Rolljam can be used. A Rolljam device can be built for $30 out of an Arduino and two cheap transceiver modules.

However, according to arstechnica the biggest cause for concern in terms of car theft is a different sort of attack called "signal amplification relay".

The most prevalent form of electronics-assisted car theft these days, for instance, uses what are known as signal amplification relay devices against keyless ignition and entry systems. This form of hack works by holding one device near a key fob and a second device near the vehicle the fob works with. In the most typical scenario, the fob is located on a shelf near a locked front door, and the car is several dozen feet away in a driveway. By placing one device near the front door and another one next to the car, the hack beams the radio signals necessary to unlock and start the device.

This sort of attack is a lot less sophisticated in many ways as all you are doing is amplifying a signal, and no clever hardware like the Flipper Zero or a software defined radio is even required. The X video below demonstrates such a hack where a criminal holds up a loop antenna to a house. The loop antenna is connected to a signal amplifier which amplifies the keyfob signal, tricking the car into thinking the keyfob is nearby, and allowing the door to be unlocked by touching the handle, and then turned on with the push to start button.

Flipper zero note that they have not been consulted about the ban, and replied on X stating that they are not aware of the Flipper Zero being used for car theft.

Tech Minds: A Beginners Guide to the HackRF and Portapack with Mayhem Firmware

In one of his latest videos Matt from the Tech Minds YouTube channel has created a beginners guide to the HackRF and Portapack with the Mayhem Firmware. The HackRF is a popular affordable software defined radio with wide frequency range and transmit capabilities. An addon called the Portapack allows the HackRF to go portable, and custom firmware called 'Mayhem' significantly expands it's capabilities.

Matt uses a Chinese HackRF and Portapack clone set from Banggood which can be found very cheaply for around $200 shipped. The original Portpack can be found from the Sharebrained store for $200, and then original HackRF can be found form various resellers listed on the greatscottgadgets website.

In the video Matt unboxes the Portapack, shows an overview of the hardware and then goes on to show how to update the stock firmware to the Mayhem firmware. He then demonstrates a few of the capabilities of the Mayhem firmware.

Beginner's Guide To The HackRF & Portapak With Mayhem

Tech Minds: Making your own SDR Software With GNU Radio Companion

In his latest video out on YouTube, Matt from the Tech Minds channel gives us an overview of GNU Radio, and shows a few examples of how it can be used to receive, transmit and decode digital data.

GNU Radio is a popular open source DSP framework for software defined radios. With it you can graphically implement any sort of digital signal processing chain that you like, which can be used for decoding/encoding and demodulating/modulating signals.

GNU Radio can be extremely complex and powerful, but in the video Matt shows some simple starter example flowgraphs like an LSB demodulator, and a simple wav file source transmitter for the HackRF. 

How To Make Your Own SDR Software With GNU Radio Companion

Lab401: HackRF on Windows YouTube Tutorials

Over on the Lab401 YouTube channel, 'RocketGod' has uploaded three videos that are various tutorials for the HackRF on Windows. The first video covers the basics like installing software and shows how to decode pager signals with PDW.

The second video shows how to decode police transmissions, car key fobs, use rtl_433, and how to use Universal Radio Hacker to capture and analyze signals. 

The third video is not yet released, but is due to premier on YouTube in 10 hours from the time of this post. In that video RocketGod will show how to install and use DragonOS, and how to install and use SDR Trunk which turns the HackRF into a police scanner. Finally, he will demonstrate SDR Angel and show it decoding ADS-B signals from aircraft to show you live flight tracking data.

Part 1 is embedded below, and Part 2 and Part 3 are linked here.

ROCKETGOD's HackRF One guide - part 1/3 Basics, Windows apps, setting up - LAB401

Demonstrating the FM Capture Effect – Why Aircraft use AM

Over on his YouTube channel Tall Paul Tech has uploaded a video that demonstrates the FM (frequency modulation) capture effect. Apart from the costs and difficult logistics to change from AM to FM worldwide, the FM capture effect may be one additional reason as to why aircraft still choose to use AM modulation for communications instead of FM.

The FM capture effect is a phenomenon that occurs when two FM transmitters transmit on the same frequency at the same time. What will happen with FM is that the stronger of the two transmissions will be the only one heard, with the weaker one totally muted. This is in contrast to AM where both signals can be heard, albeit garbled like two people talking at the same time.

With aircraft this is important as for example if some aircraft accidentally leaves a blank transmission open, another aircraft can still transmit on top of the blank transmission and still be heard. Or allowing air traffic control to hear if multiple aircraft are trying to transmit at once, and handle communications appropriately based on urgency. The disadvantage is that without the capture effect, AM is more prone to interference from interference and atmospheric noise like lightning.  

In his demonstration Paul uses two HackRF's with their clocks linked and an RTL-SDR to simulate two transmitters and a receiver.

Demonstrating FM Capture Effect