Over on YouTube "River's Educational Channel" has uploaded a video showing how he was able to reverse engineer the wireless control signal from his ceiling fan remote, and use that information to create a new transmitter controlled via his smart home's Raspberry Pi.
In the video River uses an RTL-SDR and the Spektrum software to initially identify the remotes frequency, before moving on to record the signal in Universal Radio Hacker (URH). He then goes on to reverse engineer the signal and determine the binary control string for each button on the ceiling fan's remote control.
In part 2 which is yet to be released River will show how to transmit this signal via his Raspberry Pi 3B in order to integrate it with his smart home.
Hacking My Ceiling Fan Radio Signal With a $15 USB TV Tuner (RTL2832U)
To begin the investigation stdw first opened the case and looked for a serial UART port. After finding one he connected the UART up to a Raspberry Pi and was almost immediately able to connect to the device's terminal. From the information displayed during the boot process, stdw was able to determine that the modem was running the eCos operating system on a Broadcom BCM3383 SoC. Unfortunately after receiving that information the UART connection is dropped, preventing any further terminal investigation.
To get around this issue, stdw decided to dump the flash memory via an SPI memory chip he saw on the board. Again using the Raspberry Pi he was able to connect via SPI and use the flashrom tool to read the memory. Next using a tool called bcm2-utils, stdw was able to parse and actually modify the configuration information stored in the flash memory. With this he was able to modify the configuration so that the serial connection did not drop after boot.
With terminal access gained, stdw was now able to reverse engineer the firmware, and after a lot of searching eventually find a console command which would perform a bandpower measurement for a given frequency range. He found that IQ data for this scan was stored in a buffer which he could then stream out via a TCP connection. With the IQ data finally available on another PC he was then able to use Python libraries to compute an FFT and actually visualize the scanned spectrum. Some further investigation yielded actually demodulated FM audio, and the realization that the usable bandwidth is 7.5 MHz.
Unfortunately there were some limitations. There is only enough RAM to store less than a second of data at a time at max bandwidth and precision, which meant that a lot of data needed to be dropped in between captures. Further investigation yielded methods to reduce the sample rate down to 464 kHz which meant that only 12% of data was ever dropped - enough to stream a wideband FM radio signal.
If you wanted to try investigating the modem yourself, the Motorola MB7220 is available second hand on eBay for prices ranging between US$15 - US$40, and new on Amazon for $46.99. Although the usability of the modem for any real SDR applications may not be great, further investigation may yield better results. And if not, following along with the process stdw took looks to be a great reverse engineering learning experience. Other modems that use similar Broadcom chips may also be worth investigating.
The Motorola MB7220 connected to a Raspberry Pi for reverse engineering
Twitter user @d0tslash was watching news helicopter footage of the BLM protests on the 28th of May when he heard something that sounded like an RF telemetry feed in the background audio on the helicopter's video feed. Having seen this previous success at decoding similar helicopter telemetry, he contacted his friend proto17 who proceeded to reverse engineer and figure out how to decode the telemetry, in the end discovering that it was providing location data for the helicopter.
Over on GitHub proto17 has documented the complete process that he took in reverse engineering the telemetry. He first explored the audio in Baudline discovering that there was a 1200 Hz wide FSK signal. Next he used GNU Radio to further analyze the signal, discovering it's baud rate, resampling the signal and then using a GFSK block to demodulate the signal into 1's and 0's.
Finally he used some clever terminal tricks and a Python script to discover the bit pattern and convert the bits into ASCII characters which reveals the helicopter coordinates. The coordinates decoded indicate that the helicopter was indeed circling the protest area.
We looked into the news helicopters in use during the protests and found that Denver news stations all share one helicopter with registration N6UX. Plugging that into adsbexchange.com and looking at the helicopter ADS-B history on the 28th gives a good match to proto17's decoded data.
The ZIFON YT-500 is a pan-tilt tripod designed for mounting small cameras and smart phones. It also comes with an RF based 433 MHz wireless remote control that allows you to remotely control the positioning.
To do this he first used an RTL-SDR and SDR# to record the signals generated by each button press of the remote. He then opens the audio files in Audacity which allows him to inspect the signal's structure and determine some important information such as the preamble + payload timing and ON/OFF pattern.
Knowing this information he was then able to use an Arduino with a 433 MHz transmitter connected to replicate the signal exactly. His post contains the sample code that he used.
Reverse Engineering the Pan/Tilt Servo with an RTL-SDR, and replicating the signal with an Arduino.
Over on YouTube Black Hills Information Security (aka Paul Clark) has uploaded a one hour long presentation that shows how to use a software defined radio to reverse engineer digital signals using GNU Radio.
One of the most common uses of Software Defined Radio in the InfoSec world is to take apart a radio signal and extract its underlying digital data. The resulting information is often used to build a transmitter that can compromise the original system. In this webcast, you'll walk through a live demo that illustrates the basic steps in the RF reverse engineering process, including:
- tuning - demodulation - decoding - determining bit function - building your own transmitter - and much, much more!
Recently a new open source Linux based SDR application called SigDigger was released by programmer BatchDrake (Gonzalo J. Carracedo). It is based on his own DSP libraries called Sigutils and Suscan which can take advantage of multi-core CPUs. SigDigger also makes use of the SoapySDR interface, so it is compatible with almost all software defined radios including the RTL-SDR.
SigDigger Screenshot
Like other general purpose SDR applications, SigDigger has your typical AM/FM/LSB/USB demodulation and audio playback features. However, it also has some key additional features that make it worth taking a look at if you're interested in reverse engineering, or taking a closer look at digital signals. The features include:
Both realtime and replay analysis modes
Analog audio playback (AM, FM, LSB and USB)
Baseband recording (full spectrum and per-channel)
Per-device gain presents
Dynamic spectrum browsing
ASK, FSK and PSK inspection
Gradient-descent SNR calculation
Different spectrum sources (cyclostarionary analysis, signal power…)
Symbol recording and visualization
Transition analysis
Planned features already implemented and just waiting to be exposed to the UI:
Symbol tagging (correspondence between symbols and groups of bits)
Automatic symbol tagging guessing
Automatic convolutional code detection
Viterbi decoding
We note that while the UI looks like GQRX, it is not based on GQRX at all. Rather BatchDrake just liked the minimal UI of GQRX. Also unlike GQRX, SigDigger is not based on GNU Radio, so it may be a bit more efficient and lightweight.
Below we've embedded a video that BatchDrake uploaded his YouTube channel which demonstrates SigDigger being used to inspect a PSK channel.
Using SigDigger to inspect a PSK channel
This software looks great, and we think it deserves some serious attention and testing, so check it out on the GitHub. Binary releases are also available, although BatchDrake notes that they are minimally tested, for x64 Linux only, and preferably for Debian-like distros. Alternatively, it can be installed from source, after installing the Sigutils and Suscan DSP library dependencies.
Thank you to Shreyas Ubale for submitting his blog post about reverse engineering a wireless doorbell, and then performing a replay attack. Shreyas had purchased a wireless doorbell set containing one button transmitter and two bell receivers. However, his situation required two transmitters, one for visitors at the door, and one to be used by family within his house.
In order to create a second transmitter he decided to reverse engineer the doorbells wireless signal, and use that information to create an Arduino based transmitter. His process involves first using an RTL-SDR to determine the transmission frequency, then using the rtl_433 software to capture the raw waveform which he then analyzes manually using Audacity. Once the binary string, length and pulse width is known he is able to program an Arduino connected to a 433 MHz transmitter to replicate the signal.
In future posts Shreyas hopes to explore other ways to transmit the signal, and eventually design a simple but configurable 433 MHz push button that supports RF, WiFi, and can support the IFTTT web service.
If you're interested, check out some of our previous posts that highlight many other successful reverse engineering experiments with RF devices and SDR.
Doorbell Signal Analysis in Audacity. Captured with an RTL-SDR.
Several years ago back in 2013 and 2014 we uploaded two posts showing how it was possible to use an SDR to listen in to restaurant pagers and collect data from them, and also to spoof their signal and activate them on demand. If you were unaware, restaurant pagers (aka burger pagers), are small RF controlled discs that some restaurants hand out to customers who are waiting for food. When the food is ready, the pager is remotely activated by the staff, and then flashes and buzzes, letting the customer know that their order can be picked up.
Over on YouTube user Tony Tiger has uploaded a video that shows an overview on how to reverse engineer the signal coming from a particular brand of restaurant pagers. The tools he uses include a HackRF SDR and the Inspectrum and Universal Radio Hacker software packages. If you're interested in reverse engineering signals, this is a good overview. Later in the video he shows a GNU Radio and Python program that he's created to control the pagers.
