Tagged: rtl2832

Unknown Signal Reverse Engineering and Decoding AFSK Signals Tutorial

Over on his blog "ele y ciencia" has written up two very useful blog posts - one on how to decode AFSK signals from scratch and the other on how to reverse engineer any unknown digital signal. The blog is written entirely in Spanish, but Google translate does a decent enough job at getting the message across (in Chrome right click anywhere on the page and select Translate to English or use the Google translate webpage).

The first post is about decoding an AFSK protocol and explains that you need to record the signal with an RTL-SDR or other SDR, apply a low pass filter to obtain the signal envelope and then apply thresholding with the known baud rate to obtain the demodulated digital signal. The tutorial is high level and just explains the process, but doesn't show how to do it in any software. Later on in the post he goes on to show how he reverse engineered a train-land radiotelephone system and a TCM3105 modem chip which utilizes a FSK system.

In the second post he shows how to decode any unknown digital signal using just an RTL-SDR and Audacity. He starts off with finding and recording an unknown digital signal with an RTL-SDR and then reverse engineers it in a sort of manual fashion without using any tools like Universal Radio Hacker. The post goes through the full details and steps that he took, and in the end he gets data out of the signal discovering that it is data from a Fleet Management System used in his country for monitoring data such as speed and engine data from commercial vehicles like trucks and buses.

The two posts are very detailed and could be an excellent reference for those interested in reverse engineering some unknown digital signals in your area.

Decoding an Unknown "Fleet Management" signal from scratch.
Decoding an Unknown "Fleet Management" signal from scratch.

Sniffing MiniMed Insulin Pump RF Packets with an RTL-SDR

A MiniMed Insulin Pump with wireless meter

Over on GitHub we've just seen the release of a program called rtlmm made by user ps2 which decodes MiniMed RF packets with an RTL-SDR. We weren't entirely such what MiniMed was, but from Googling the name it appears that it is a product by a company called Medtronic who sell medical equipment such as portable automatic insulin pumps and glucose monitors for diabetic patients. These products have RF telemetry links that transmit to a meter which can receives data and forwards it to your phone via Bluetooth LE. Sniffing the telemetry from these sensors could allow you to build up your own data without the need of the meter.

Rtlmm was inspired by a similar program called rtlomni which is a program released a few months ago and made by F5OEO. rtlomni works with Omnipod diabetes insulin pumps and monitors which are similar products to MiniMeds offerings.

Turning an old Radiosonde into an Active L-Band Antenna

VK5QI's Radiosonde Collection
VK5QI's Radiosonde Collection

Over on his blog VK5QI has shown how he has was able to re-purpose an old radiosonde into a wideband active L-band antenna. Radiosondes are small packages sent up with weather balloons. They contains weather sensors, GPS and altitude meters and use an antenna and radio transmitter to transmit the telemetry data back down to a ground station. With a simple radio such as an RTL-SDR and the right software, these radiosondes can be tracked and the weather data downloaded in real time. Some hobbyists such as VK5QI go further and actually chase down the weather balloons and radiosondes as they return to earth, collecting the radiosonde as a prize.

VK5QI and his friend Will decided to put some of his radiosonde collection to good use by modifying one of his RS92 radiosondes into a cheap active L-band antenna. They did this by first opening and removing unnecessary components that may interfere such as the main CPU, GPS receiver, 16 MHz oscillator, SAW filters and balun. They left the battery, LDO's, LNA's and Quadrifilar Helix GPS antenna which is tuned to the GPS L-band frequency. Finally they soldered on a coax connector to a tap point on the PCB and it was ready to use.

They then connected the new antenna to a RTL-SDR V3 and fired up GQRX. They write that their results were quite promising with several Inmarsat and Iridium signals being visible in the spectrum. VK5QI also used gr-iridium with the antenna as was able to decode some Iridium signals.

Modified Radiosonde L-Band Antenna connected to a RTL-SDR V3.
Modified Radiosonde L-Band Antenna connected to a RTL-SDR V3.

Transmitting and Receiving Text Data via an MP3, FM Transmitter and RTL-SDR

Over on his YouTube channel Kris Occhipinti has uploaded some videos where he shows how he is able to send text data over FM radio frequencies by using an MP3 audio file that  encodes the text data, an FM transmitter connected to an Android phone or MP3 player to transmit the file and an RTL-SDR on the receiving side to receive the FM signal from the FM transmitter. The software used to encode the text into an MP3 is Minimodem, and on the receiving side Minimodem is also used which can easily decode the received audio. Minimodem is a command line program which can generate FSK modem tones from data.

These two videos are part of a series that Kris has been working on that includes many videos about using Minimodem to transfer data like text, files and images between computers via radio.

12 Minimodem an FM Transmitter and a USB SDR Dongle

13 Radio Data Trasmission with RTL FM and SDR

An RTL-SDR Based Ground Penetrating Radar & Metal Detector

Thanks to Dr. Celalettin Uçar from Turkey for submitting a video of the work done by a PhD student who as part of his research created an RTL-SDR based ground penetrating radar simulation and metal detector. He writes:

This apparatus (YAĞRIN) was created with rtlsdr in a phd work. We achieved detecting a metal gasoline tube from the depth of aproximately 1 meters. Furthermore, we created the time domain signal and ploted the reflaction from the metal with using the matlab (simulink) model.

A video on YouTube is linked which we display at the end of the post. They write that the system consists of a 12V DC supply, step down voltage regulator, ADF 4350 programmable signal generator, 25W power amplifier (470 MHz, 45 dBm signal power), Philips omnidirectional antennas (RX,TX), a 64 dB low noise amplifer and an RTL-SDR and computer to display the output. The software he uses is SDR# which appears to simply listen for a tone and detect any changes that occur when something metal moves near it. The PC also runs a MATLAB Simulink model which we believe helps detect metal signatures by plotting the reflection.

In the past we posted about a similar but simpler metal detector implementation by Ancient Discoveries.

RTL-SDR BASED GPR (Simulation) & METAL DETECTOR (YAĞRIN) - Dr. Celalettin UÇAR

Monitoring Home Power Consumption with an RTL-SDR

Over on his blog "K-roy" has completed a writeup discussing how he is using an RTL-SDR dongle to monitor and graph the power usage of his home. After seeing multiple ads for the Sense home power usage monitor, K-roy decided to roll his own similar device instead. 

Many homes in the US and elsewhere no longer require meter reader personnel to come onto the property to read a physical meter at the back of the house. Instead the meter transmits wireless data in the 900 MHz ISM band about electricity usage, and all the meter reader has to do is turn up outside the house and take a reading from the street. 

These electricity usage signals are unencrypted and can easily be decoded and displayed with an RTL-SDR and a ready to use program called rtl_amr. The signals even travel quite far, and there have been reports of receiving neighbours signals up to 600m away. K-roy took his RTL-SDR and rtl_amr and wrote on top of it a program that creates a JSON output of the data for easy processing, a PHP, SQLite3 and JQuery based database system for storing the data, and an HTML5 based page for graphing and displaying the data.

If you are interested, there is also a discussion about K-roy's work over on Reddit.

Power usage data collected and graphed by K-roys RTL-SDR, rtl_amr and his software.
Power usage data collected and graphed by K-roys RTL-SDR, rtl_amr and his software.

A Tiny Object/Animal Tracking Device with RTL-SDR + Yagi Locator

The Tiny Transmitter
The Tiny Transmitter

Over on Hackaday.io we've come across a project by "Tom" who has created a small tracking device which is located using an RTL-SDR dongle and directional Yagi antenna. The tracking device itself is a simple fingernail sized low power UHF transmitter that transmits short pulses about every second or so in the 915 MHz ISM band. Tom writes that the range is about 400m (line of sight) and with a small button cell battery the device lasts a couple of days with its 180 uA current draw. Presumably longer operation could be achieved by significantly reducing the pulse rate of the circuit.

To receive the tracking device an RTL-SDR is combined with a high gain directional Yagi antenna, a three level 10 - 30 dB attenuator and an Android phone running the RF Analyzer app. The idea is to simply use the attenuator and directional Yagi antenna to determine the direction in which the signal is strongest. That direction with the strongest signal will indicate where the transmitter is. Tom's video below shows an example of the transmitter and RTL-SDR based tracking setup.

Low-tech Tiny UHF tracker transmitter

Displaying Live Weather and Traffic Data from HD Radio (NRSC-5) Signals

Thanks to KYDronePilot for submitting news of his new Python based script called HDFM which displays live weather and traffic data from data that is embedded into iHeartRadio HD Radio (NRSC-5) radio stations. 

If you are in the USA, you might recognize HD Radio (aka NRSC-5) signals as the rectangular looking bars on the frequency spectrum that surround common broadcast FM radio signals. These signals only exist in the USA and they carry digital audio data which can be received by special HD Radio receivers. Earlier in the year in June a breakthrough in HD Radio decoding for SDRs like the RTL-SDR was achieved by Theori when he was able to piece together a full HD Radio software audio decoder that works in real time.

It turns out that some of these HD Radio signals run by iHeartRadio also contain other data streams such as live weather and traffic data that is consumed by HD Radio based car GPS receivers or audio head units in US vehicles. HDRadio.com also write that they can embed other data such as sports scores and emergency messages into the data stream as well.

KYDronePilot's Python script utilizes Theori's decoder to save all received weather and traffic data maps for a folder. Below is an example of traffic and weather data that he received.

HD Radio Received Traffic Data
HD Radio Received Traffic Data
HD Radio Received Weather Data
HD Radio Received Weather Data