Tagged: lorawan

rxx_lora: A Lightweight rtl_fm-Style LoRa Receiver for RTL-SDR and SDRplay, No GNU Radio Required

Thank you to Przemysław Wcisło (SO5DZ) for writing and sharing rxx_lora, a command-line LoRa receiver for RTL-SDR and SDRplay RSP devices. Przemysław notes that it was designed in the spirit of rtl_fm, so there are no GNU Radio flowgraphs to build or maintain. Instead, it is a single small C binary (rtl_lora or rsp_lora, plus file_lora for saved I/Q captures). Decoded packets are printed as JSONL to stdout, so you can pipe them into other programs.

Przemysław writes:

  • It's fast. The entire receive chain (detection, sync, demodulation, FEC) runs from dozens to hundreds times real-time, depending on the PHY parameters and hardware, of course.

  • It's sensitive. I've benchmarked the binary end-to-end over AWGN, and it comes within ~1-2 dB of ideal theoretical LoRa performance. It can easily demodulate Meshtastic's MediumFast preset at -14 dB SNR. I can also vouch for this based on real-world observations. Valid decodes regularly pop up at -12 to -14 dB. I even saw a frame at -17 dB SNR, although it had a bad CRC :)

  • It's stable. It's never crashed on me, apart from when I accidentally wiggled the dongle out of the USB port ;) It should also be stable from a software quality perspective. I've put together an extensive suite of quality gates and tests, including noise tests, tests against previously recorded over-the-air captures... This should make it quite unlikely that an upcoming change will accidentally introduce a major regression.

  • It doesn't require much: librtlsdr, FFTW, a C compiler, and make. Most who have dabbled with RTL-SDRs probably won't need to install a single package on top of what they already have. Python and a few libraries are used for the tests and extra tools, but they're not required for normal operation.

The receiver implements the standard LoRa PHY, so it can be used for Meshtastic, LoRaWAN, MeshCore, APRS-over-LoRa and other LoRa signals. An included Python script also decrypts Meshtastic packets with the default or configured channel keys and prints them in a readable form.

The demodulation core is derived from the gr-lora and gr-lora_sdr GNU Radio projects. The code is open source under GPLv3 and available on GitHub. It runs on Linux, and the README says macOS "probably" works too. The SDRplay version also requires the SDRplay API. For Meshtastic reception, it covers similar ground to the GNU Radio-based Meshtastic_SDR project, which we previously posted about, but with a much smaller footprint.

rxx_lora Decoding Meshtastic Packets with an RTL-SDR
rxx_lora Decoding Meshtastic Packets with an RTL-SDR

AI Disclaimer: Przemysław notes that the sensitivity improvements came from "patient and deliberate use of strong AI tools", and the README states that the project made heavy use of AI for both coding and theoretical exploration.

Evaluating LoRaWAN Security with an RTL-SDR

Over on their blog Trend Micro have uploaded a post describing how they evaluated the security of LoRaWAN communications using an RTL-SDR. LoRaWAN is a wireless communications technology that allows for Internet of Things (IoT) connectivity at a much lower cost compared to cellular infrastructure. However, as described in their post LoRaWAN incorporates very little security, making connected devices an easy target for hackers.

The researchers at Trend Micro used an RTL-SDR together with the LoRaPWN software tool which is an improved version of the LoRa Craft Project. With LoRaPWN the researchers were able to intercept uplink and downlink packets. Then when combined with a brute force dictionary attack, they were then able to recover the encryption keys allowing them to decode the data.  Finally they were also able to demonstrate a denial of service attack which results in a device being unable to send further data.

For more information the technical paper (pdf) describing their full setup and tests is available, as well as an older post describing possible LoRaWAN attacks. There is also a YouTube video from "The Things Conference" which we have embedded below. In the video researcher Sebastian Dudek presents some of his findings on LoRaWAN security.

An RTL-SDR Blog V3 Intercepting LoRaWAN packets.
LoRaPWNing: Practical radio attacks on LoRaWAN - Sebastian Dudek (Trend Micro)