Tagged: OP25

Turbine: Capture and Stream all Frequencies in a Trunked Radio System with a HackRF

Over on Reddit we've discovered an interesting program called 'Turbine' that has recently been open sourced by the author. This program connects to a wideband capable SDR such as a HackRF and captures and streams all frequencies in a trunked radio system. Users can then browse the recordings online. On his reddit post u/norasector introduces Turbine, and his application for it called 'NoraSector'.

I am open sourcing the SDR code for NoraSector, which currently captures and streams the radio systems for both King and Snohomish County, WA. It uses a HackRF One to capture every channel concurrently, and can even process multiple systems at the same time, provided they are within the same bandwidth that is captured by the SDR and there's adequate reception. I plumb the output through a WebRTC streaming infrastructure I built to stream audio to clients over the web with very low latency. My goal was to give complete access to an entire system to anyone over the web, just as they would have if they were using a handheld scanner, and with comparable latency.

Turbine is a bit different other SDR software out there. It's written entirely in Go, and was built explicitly to only use a single SDR rather than bonding multiple SDRs together.

Turbine works by tuning known control frequencies and then tuning all voice frequencies it learns from them. Voice transmissions are encoded using the Opus audio codec for compatibility with WebRTC and blasted out as frames over UDP. It also includes a functional-but-janky built-in visualization web server to look at each stage of the DSP pipeline for each frequency, which was crucial for debugging as I was building it.

Right now, it only supports legacy Motorola SmartZone systems (which is what is used near me), but it shouldn't be a large lift to make it support P25. The code is heavily influenced by op25 and GNURadio (and in some places just outright copying them). I built it in Go because a) it's what I'm most familiar with and b) the sheer density of GNURadio made it hard for me to piece things together how I wanted. Go's concurrency model is a natural fit for doing many concurrent operations on the byte stream, and I haven't had issues with garbage collection pausing execution in a detrimental way.

Turbine isn't intended for use with lower sample rate SDRs like the RTLSDR. It has a driver for it, but doesn't support bonding multiple SDRs together. If an entire system fits within the 2MHz sample rate, it would probably be fine. You should be able to fire it up with a RTLSDR but it will not be able to capture very much. It currently only officially supports the HackRF One, but adding other SDRs should be relatively trivial. Note that the HackRF I am using is the model with the upgraded TCXO, as I found that the built-in oscillator was not accurate enough.

Turbine has only been tested to run on Linux and is very CPU-intensive; the production radio runs on a dedicated i7-11700k 8c/16t CPU and consumes about 60% of all cores decoding both systems. There are some potential optimizations that could be made that would lower CPU consumption during periods of low activity, but I built it for the worst case of having to encode every voice frequency at once.

The usual disclaimers about OSS apply. I hope you find it interesting or perhaps useful, and maybe portions can be adapted so Go can be used more in SDR projects.

There have been similar projects in the past like radiocapture-rf, scaneyes, and broadcastify calls, but Turbine looks like one of the most comprehensive.

Norasector: An implementation of the Turbine Trunk Recording software

SignalsEverywhere: Installing and Configuring OP25 Phase 1 & 2 Digital Voice Decoder on Linux

In this weeks video Sarah from the SignalsEverywhere YouTube channel show us how to install and configure the OP25 software on a Linux machine. OP25 is a Linux based P25 digital voice decoder which works with RTL-SDR dongles. It is capable of decoding both Phase 1 and Phase 2 systems. Installation is fairly simple via an installation script, but it does take some time to install. After installation Sarah shows how to configure the software in order to properly follow a trunked P25 system. In order to help with importing talkgroup information from a premium RadioReference account Sarah has also created an automatic importer Python script which is very useful.

DragonOS: OP25 “Boatbod” P25 Phase 1 Running on GNU Radio 3.8 with RTL-SDR

DragonOS is a ready to use Ubuntu Linux image that comes preinstalled with multiple SDR program. The creator of DragonOS, Aaron, uploads various YouTube tutorials. In his latest tutorial he shows how to install the latest version of the "Boatbod" OP25 development code for receiving P25 Phase 1 on Linux with the latest GNU Radio 3.8. In the video Aaron uses an RTL-SDR, but notes it could also work with other SDRs like the HackRF.

DragonOS Focal OP25 "Boatbod" P25 Phase 1 w/ RTLSDR (GNU Radio 3.8, Python3, R9+)

Easily Streaming SDR Output Audio through a Network to an Android Phone

Thank you to M Khanfar for submitting another video where he demonstrates and explains how to easily send audio from your Linux PC over to an Android phone. This can be used to monitor the audio output of SDR programs like OP25 and GQRX remotely. The main piece of software used in his setup is the SoundWire Server and SoundWire Android App. SoundWire is described below:

Turn your Android device into wireless headphones / wireless speaker. Stream any music or audio from your PC to your Android phone, tablet, or other PCs. SoundWire does audio mirroring (audio cast). You can use any music player on your PC or laptop like Spotify, YouTube, or iTunes and stream low-latency live sound over WiFi directly to your Android device. Also works over 3G/4G cell networks or WAN.

M Khanfar's full tutorial on how to setup SoundWire can be found in the description of the video.

Piping Op25-GQRX Audio Through LAN to Android Phone

DragonOS Updated: Now with OP25 Installed and many new YouTube Tutorials

Last month we posted about Aaron's "DragonOS" project, which is a ready to install Linux ISO aimed to make getting started with SDR software easy by providing several programs preinstalled, as well as providing multiple video tutorials. Recently he's updated the build, this time basing it on Lubuntu 18.04 allowing for Legacy and UEFI support, along with disk encryption. The OS supports RTL-SDRs as well as the HackRF and bladeRF and probably supports most other SDRs via the SoapySDR interface.

In terms of software he's also added OP25 and bladeRF support. Other programs pre-installed include rtl_433, Universal Radio Hacker, GNU Radio, Aircrack-ng, GQRX, Kalibrate, hackrf, wireshare, gr-gsm, rtl-sdr, HackRF, IMSI-catcher, Zenmap, inspectrum, qspectrumanalyzer, LTE-Cell-Scanner, CubicSDR, Limesuite, ShinySDR, SDRAngel, SDRTrunk, Kismet, BladeRF.

His DragonOS YouTube tutorial channel is also growing fast, with several tutorials showing you how to use DragonOS to perform tasks like listen to trunked mobile radios, use QSpectrumAnalyzer with a HackRF, receive NOAA APT weather satellite images, retrieve cellular network information via a rooted Samsung Galaxy S5, create a ShinySDR server with rtl_433 and how to capture and replay with a HackRF.

DragonOS running CubicSDR
DragonOS running CubicSDR

Tutorial on Setting up OP25 for P25 Phase 2 Digital Voice Decoding

Most police departments is the USA have now upgraded or are in the process of upgrading their radio systems to P25 Phase 2 digital radio. The frequencies can easily be received with an RTL-SDR, but a decoder is required to be able to actually listen to the voice. Software like SDRTrunk and DSDPlus can decode P25 Phase 1, but at the moment the only software that is capable of decoding P25 Phase 1 AND 2 is a program called OP25. However, OP25 has a reputation of being fairly difficult to set up as it does not have a simple to use GUI, and requires Linux.

Over on John's Tech Blog, John has uploaded a very helpful step by step tutorial that should help with those trying to get OP25 to work. The tutorial assumes that you have Ubuntu 18.04 already installed, and then starts from downloading and installing OP25. The next steps involve setting up OP25 for the particular system in your area, which mostly involves just editing a spreadsheet to input frequency data from radioreference.com. John also mentions that he's been able to get OP25 running perfectly on a Raspberry Pi 3 B+ as well, with less than 40% CPU usage.

OP25 Running
OP25 Running

In the video below John reviews some of the steps, and shows OP25 running and decoding voice.

OP25 Tracking 2 Control Channels

P25 Decoding: OP25 + RTL-SDR vs a Uniden BCD996T

APCO P25 is a digital voice signal and is commonly used like public safety departments such as police and fire. With an RTL-SDR and the open source Linux based OP25 decoder these signals can be decoded, assuming they are unencrypted. Software like DSD+ can also be used, but OP25 can supposedly decode more systems. Before the RTL-SDR, hardware scanners like the $~360 USD Uniden BCD996T digital scanner radio were typically used. 

Over on YouTube user Rob Fissel has uploaded a video showing a comparison between an RTL-SDR using the OP25 decoder and a Uniden BCD996T. Both radios are used to decode a weak P25 Phase 1 LSM signal. He uses a Scantenna antenna with an antenna splitter to run both radios at the same time. His results show that even though the constellation is poor, OP25 does a good job at decoding the signal and producing voice, whereas the BCD996T doesn’t even manage to hear the control channel.

OP25 VS BCD996T - Weak Signal P25

Monitoring a Trunked P25 LSM Simulcast System with OP25 and an RTL SDR

Over on YouTube user jdlucas78 has uploaded a video showing a P25 LSM modulated digital voice signal being decoded by the Osmocom OP25 software for Linux. Although DSD and DSD+ can decode P25 voice, it seems that the Osmocom OP25 software is better at decoding P25 signals as it implements better error correction algorithms.

Over on the RadioReference forums there is a thread discussing the use of the OP25 decoding software which can be found here. There is a post in the thread that shows an easy Linux install procedure for the OP25 software.

Monitoring a Trunked P25 LSM Simulcast System w/ OP25 and RTL SDR Dongle

Take 2: Monitoring a Trunked P25 LSM Simulcast System w/ OP25 and RTL SDR Dongle