To begin the investigation stdw first opened the case and looked for a serial UART port. After finding one he connected the UART up to a Raspberry Pi and was almost immediately able to connect to the device's terminal. From the information displayed during the boot process, stdw was able to determine that the modem was running the eCos operating system on a Broadcom BCM3383 SoC. Unfortunately after receiving that information the UART connection is dropped, preventing any further terminal investigation.
To get around this issue, stdw decided to dump the flash memory via an SPI memory chip he saw on the board. Again using the Raspberry Pi he was able to connect via SPI and use the flashrom tool to read the memory. Next using a tool called bcm2-utils, stdw was able to parse and actually modify the configuration information stored in the flash memory. With this he was able to modify the configuration so that the serial connection did not drop after boot.
With terminal access gained, stdw was now able to reverse engineer the firmware, and after a lot of searching eventually find a console command which would perform a bandpower measurement for a given frequency range. He found that IQ data for this scan was stored in a buffer which he could then stream out via a TCP connection. With the IQ data finally available on another PC he was then able to use Python libraries to compute an FFT and actually visualize the scanned spectrum. Some further investigation yielded actually demodulated FM audio, and the realization that the usable bandwidth is 7.5 MHz.
Unfortunately there were some limitations. There is only enough RAM to store less than a second of data at a time at max bandwidth and precision, which meant that a lot of data needed to be dropped in between captures. Further investigation yielded methods to reduce the sample rate down to 464 kHz which meant that only 12% of data was ever dropped - enough to stream a wideband FM radio signal.
If you wanted to try investigating the modem yourself, the Motorola MB7220 is available second hand on eBay for prices ranging between US$15 - US$40, and new on Amazon for $46.99. Although the usability of the modem for any real SDR applications may not be great, further investigation may yield better results. And if not, following along with the process stdw took looks to be a great reverse engineering learning experience. Other modems that use similar Broadcom chips may also be worth investigating.
Twitter user @d0tslash was watching news helicopter footage of the BLM protests on the 28th of May when he heard something that sounded like an RF telemetry feed in the background audio on the helicopter's video feed. Having seen this previous success at decoding similar helicopter telemetry, he contacted his friend proto17 who proceeded to reverse engineer and figure out how to decode the telemetry, in the end discovering that it was providing location data for the helicopter.
Finally he used some clever terminal tricks and a Python script to discover the bit pattern and convert the bits into ASCII characters which reveals the helicopter coordinates. The coordinates decoded indicate that the helicopter was indeed circling the protest area.
We looked into the news helicopters in use during the protests and found that Denver news stations all share one helicopter with registration N6UX. Plugging that into adsbexchange.com and looking at the helicopter ADS-B history on the 28th gives a good match to proto17's decoded data.
The ZIFON YT-500 is a pan-tilt tripod designed for mounting small cameras and smart phones. It also comes with an RF based 433 MHz wireless remote control that allows you to remotely control the positioning.
To do this he first used an RTL-SDR and SDR# to record the signals generated by each button press of the remote. He then opens the audio files in Audacity which allows him to inspect the signal's structure and determine some important information such as the preamble + payload timing and ON/OFF pattern.
Knowing this information he was then able to use an Arduino with a 433 MHz transmitter connected to replicate the signal exactly. His post contains the sample code that he used.
Over on YouTube Black Hills Information Security (aka Paul Clark) has uploaded a one hour long presentation that shows how to use a software defined radio to reverse engineer digital signals using GNU Radio.
One of the most common uses of Software Defined Radio in the InfoSec world is to take apart a radio signal and extract its underlying digital data. The resulting information is often used to build a transmitter that can compromise the original system. In this webcast, you'll walk through a live demo that illustrates the basic steps in the RF reverse engineering process, including:
- tuning - demodulation - decoding - determining bit function - building your own transmitter - and much, much more!
Recently a new open source Linux based SDR application called SigDigger was released by programmer BatchDrake (Gonzalo J. Carracedo). It is based on his own DSP libraries called Sigutils and Suscan which can take advantage of multi-core CPUs. SigDigger also makes use of the SoapySDR interface, so it is compatible with almost all software defined radios including the RTL-SDR.
Like other general purpose SDR applications, SigDigger has your typical AM/FM/LSB/USB demodulation and audio playback features. However, it also has some key additional features that make it worth taking a look at if you're interested in reverse engineering, or taking a closer look at digital signals. The features include:
Both realtime and replay analysis modes
Analog audio playback (AM, FM, LSB and USB)
Baseband recording (full spectrum and per-channel)
Per-device gain presents
Dynamic spectrum browsing
ASK, FSK and PSK inspection
Gradient-descent SNR calculation
Different spectrum sources (cyclostarionary analysis, signal power…)
Symbol recording and visualization
Planned features already implemented and just waiting to be exposed to the UI:
Symbol tagging (correspondence between symbols and groups of bits)
Automatic symbol tagging guessing
Automatic convolutional code detection
We note that while the UI looks like GQRX, it is not based on GQRX at all. Rather BatchDrake just liked the minimal UI of GQRX. Also unlike GQRX, SigDigger is not based on GNU Radio, so it may be a bit more efficient and lightweight.
Below we've embedded a video that BatchDrake uploaded his YouTube channel which demonstrates SigDigger being used to inspect a PSK channel.
Using SigDigger to inspect a PSK channel
This software looks great, and we think it deserves some serious attention and testing, so check it out on the GitHub. Binary releases are also available, although BatchDrake notes that they are minimally tested, for x64 Linux only, and preferably for Debian-like distros. Alternatively, it can be installed from source, after installing the Sigutils and Suscan DSP library dependencies.
In order to create a second transmitter he decided to reverse engineer the doorbells wireless signal, and use that information to create an Arduino based transmitter. His process involves first using an RTL-SDR to determine the transmission frequency, then using the rtl_433 software to capture the raw waveform which he then analyzes manually using Audacity. Once the binary string, length and pulse width is known he is able to program an Arduino connected to a 433 MHz transmitter to replicate the signal.
In future posts Shreyas hopes to explore other ways to transmit the signal, and eventually design a simple but configurable 433 MHz push button that supports RF, WiFi, and can support the IFTTT web service.
If you're interested, check out some of our previous posts that highlight many other successful reverse engineering experiments with RF devices and SDR.
Several years ago back in 2013 and 2014 we uploaded two posts showing how it was possible to use an SDR to listen in to restaurant pagers and collect data from them, and also to spoof their signal and activate them on demand. If you were unaware, restaurant pagers (aka burger pagers), are small RF controlled discs that some restaurants hand out to customers who are waiting for food. When the food is ready, the pager is remotely activated by the staff, and then flashes and buzzes, letting the customer know that their order can be picked up.
Over on YouTube user Tony Tiger has uploaded a video that shows an overview on how to reverse engineer the signal coming from a particular brand of restaurant pagers. The tools he uses include a HackRF SDR and the Inspectrum and Universal Radio Hacker software packages. If you're interested in reverse engineering signals, this is a good overview. Later in the video he shows a GNU Radio and Python program that he's created to control the pagers.
Amazon Alexa is a smart speaker that can be programmed to control home automation devices via voice commands. For example, Stuart Hinson wanted to be able to control his wirelessly controlled blinds simply by verbally asking Alexa to close or open them. Stuart's blinds could already be controlled via a 433 MHz remote control, so he decided to replicate the control signals on an ESP8266 with 433 MHz transmitter, and interface that with Alexa. The ESP8266 is a cheap and small WiFi capable microchip which many people are using to create IoT devices.
Fortunately replicating the signal was quite easily as all he had to do was record the signal from the remote control with his RTL-SDR, and use the Universal Radio Hacker software to determine the binary bit string and modulation details. Once he had these details, he was able to program the ESP8266 to replicate the signal and transmit it via the 433 MHz transmitter. The remaining steps were all related to setting up an HTTP interface that Alexa could interface with.
If you're interested, we've also previously posted about another Alexa + RTL-SDR mashup which allows Alexa to read out ADS-B information about aircraft flying in your vicinity.