Category: RTL-SDR

WaveConverter: An Open Source RF Reverse Engineering Tool

During the Schmoocon 2017 conference presenter Paul Clark introduced a new open source Linux tool called WaveConverter which he’s been working on for reverse engineering RF signals. Paul writes:

WaveConverter is a tool that helps you extract digital data from RF transmissions that have been captured via Software Defined Radio (SDR). After the user defines the modulation parameters, framing and encoding, WaveConverter will process a stored I-Q file and extract the data from any transmissions that match this definition. Using programmable timing tolerances and glitch filters, WaveConverter is able to extract data from signals that would otherwise appear corrupted.

This software will make the process of reverse engineering signals easier and more error-proof. Because WaveConverter includes the ability to store and retrieve signal protocols (modulation + encoding parameters), we have been generating a database of protocols that we can quickly use to iteratively attack unknown signals.

This tool should be very useful for reverse engineering digital signals, such as those found in keyfobs, wireless doorbells, wireless temperature sensors and any other simple RF device. Simply use an SDR device like an RTL-SDR to capture a sample of the signal of interest and then open it up in WaveConverter to first easily analyze the signal and determine it’s properties, then to automatically demodulate any subsequent signal into a binary string. For more information the documentation can be found here (pdf).

WaveConverter seems to be quite similar in purpose to Inspectrum and DSpectrum which are two Linux tools that are also designed for reverse engineering digital signals.

WaveConverter Screenshot
WaveConverter Screenshot

[First seen on Hackaday]

 

Receiving GOES Weather Satellite Images with a Small Grid Antenna and an Airspy Mini

GOES is an L-band geosynchronous weather satellite service that can be received typically with a satellite dish. It produces very nice full disk images of the earth. In the past we’ve posted about Lucas Teske’s work in building a GOES receiving system from scratch (including the software decoder for Airspy and RTL-SDR receivers), devnullings post about receiving GOES and also this talk by @usa_satcom on decoding GOES and similar satellites.

Over on Twitter @usa_satcom has been tweeting about his experiments where he has been successfully receiving GOES L-Band weather satellite images with a small grid antenna and an Airspy Mini. In a Tweet he writes that the antenna is an $85 USD Hyperlink 1.9 GHz 22 dBi Grid Antenna made by L-com. A grid antenna may be more suitable for outdoor mounting for many people as they are typically lighter, smaller and more suitable for windy and snowy conditions. As the GOES satellite is in geosynchronous orbit, no tracking motor or tracking mount is required.


Testing a Prototype of the SDRx: A Custom Outernet L-Band RTL-SDR

Recently the Outernet team sent us a prototype of their L-Band tuned RTL-SDR which is called the SDRx for testing. This is an RTL-SDR with RTL2832U and R820T2 chips together with an L-band LNA and filter on the same PCB. It is designed for their Outernet system which transmits from geostationary L-Band satellites. 

Outernet is an L-band satellite service that hopes to be a library in the sky. Currently it is broadcasting down about 20 MB of data a day, with data like weather updates, books, pictures, wikipedia pages, APRS repeats and more.

For their DIY Outernet kit they have been using E4000 or our RTL-SDR V3 dongles, so we speculate that this SDRx is going to be used in the “Lantern” which will be their fully assembled Outernet receiver product. The Lantern looks like it will be a single unit, with patch antenna, battery pack, solar panel, RTL-SDR radio and CHIP built into a plastic enclosure.

The upcoming RTL-SDR base Lantern Outernet Receiver.
The upcoming RTL-SDR base Lantern Outernet Receiver.

The SDRx connects to the computer via a micro USB port. It also has a USB repeater and two USB expansion ports on board. This is useful as Outernet is designed to be used with the CHIP portable computer which only has one USB port. The expansion USB ports can be used for plugging in a portable hard drive which can be used as the storage for downloaded Outernet files.

We’ve been running a version of the SDRx prototype on an Outernet receiver for a number of weeks without issue. The SNR on Outernet signals is about identical to the V3 dongles combined with the external Outernet LNA and no L-band heat problems are observed.

The SDRx Prototype
The SDRx Prototype
Under the shield. SAW Filter, R820T2. LNA top left.
Under the shield. SAW Filter, R820T2. LNA top left.

Ships: New RTL-SDR Compatible Android App for AIS Reception and Plotting

Today an Android app programmer sent a message to let us know about his new open source RTL-SDR compatible AIS app called Ships.  This is a free app that allows you to decode AIS signals, and plot them directly onto an OpenStreetMap/OpenSeaMap or output the data via UDP to another mapping program.

Ships also has another interesting feature which is that it will automatically determine the PPM offset of a dongle, meaning that generic dongles without TCXO’s can be easily used for AIS. It appears to do this by using the AIS signals themselves, so you will need sufficient AIS traffic in your area for the calibration to work.

AIS stands for Automatic Identification System, and is a system used to track the locations of marine vessels. It is similar to ADS-B in that nearby ships can be plotted and tracked on a map by using an RTL-SDR as the receiver. We have a tutorial for PC available here.

The app can be downloaded for free on Google Play, and the open source code is available on GitHub.

Ships RTL-SDR Android App Screenshot
Ships RTL-SDR Android App Screenshot

Cloud-SDR Releases New Client and Server Software for the RTL-SDR

Cloud-SDR is a company that aims to make using SDR over the cloud/network/internet easier. It allows you to set up a remote SDR server that you can access from anywhere. Previously Cloud-SDR was still in development, but now we recently received mail from Cloud-SDR programmer Sylvain that the client and server software has just been released for the RTL-SDR. It appears that it also currently supports the Airspy, BladeRF, SDRplay and PerseusSDR.

The email reads:

I am pleased to inform you that we have just released two softwares compatible with your devices :

  • The Cloud-SDR free client, a windows + Linux (to be released soon) client able to run locally RTL-SDR devices (check the news/turorials, we have featured several times dongles from your blog)
  • The Cloud-SDR streaming server (codenamed SDRNode) , a windows + Linux (to be released soon) multi-user configurable streaming server.

SDRNode is a commercial software but an evaluation version is already available. Both softwares can be downloaded from our store after registration.

Source code for the drivers are already released as open source software through our GitHub repo: https://github.com/cloud-sdr

You can find more details here :

The Cloud-SDR Network
The Cloud-SDR Network

To download the software you must register an account with them at https://store.cloud-sdr.com/my-account. The client is free but the server costs 110 euros for personal and hobby usage, although a 30 day trial version is available. Currently only the Windows Client and Server are available, but they write that Linux should be available soon.

We tested the software out with an RTL-SDR V3. The client installation process was a simple wizard and after installation we launched the Cloud-SDR client by opening the shortcut “cSDRc” in the Start Menu. We found that the hardware needed to be plugged in first for the client to recognize it. The client is basic, but can already demodulate USB/LSB/CW/AM/FMN without trouble. It also has some interesting features:

  1. Dual channel receiver: RXA and RXB are two totally independent receivers;
  2. Geographic integration: Display on map beacons, ADS-B reported airliners, known HF broadcast stations or any geo-localized information coming from the SDRNode server;
  3. GPS compatibility: plug a GPS receiver to your computer and track your location on the map, record signals with your position for later processing (coverage mapping etc.); display the UTC time;
  4. Digital Terrain Elevation: See the terrain elevation around your position, or in the direction of the antenna directly on the map (requires to download the free SRTM3 files from NASA, with 90m resolution);
  5. MP3 audio recording: record to mp3 the demodulated streams to reduce disk requirements;
  6. Chat with other users connected to the SDRNode Group: when used as a remote client for the SDRNode streaming server, you can interact with other users with messages or station spotting;
  7. Time-domain analysis: the MSR mode enables analysis of any sub-band and displays in real time the time domain signals of the selected spectrum portion. This sub-band can also be recorded (with geographic position if GPS is connected) and processed with provided MATLAB®.
The Cloud-SDR Client Software
The Cloud-SDR Client Software

Next we tested the evaluation version of the SDR-Node server software on a remote laptop with an RTL-SDR connected. Again installation was easy, just follow the wizard after ordering the evaluation version. SDR-Node installs itself as a Windows service which starts up automatically on boot. To set up the Node we followed the guide shown in the video below. To connect with the client you need to know the IP address of the remote computer, the port is 8080, and the certificate is displayed on the server PC SDR-Node dashboard. We note that we also had to disable the Windows firewall to get it to connect, but it should be possible to also add SDR-Node to the firewall whitelist.

Using the SDRNode wizard

When streaming it appears that only 1/4 of the SDR sample rate can only be sent over the network. There are also compression options which can be used on slower networks or the internet to reduce bandwidth. Using the interface while in network mode was slightly laggy, but the waterfall and audio was smooth.

Overall everything worked as expected and it looks to be a very useful tool. More information is available at cloud-sdr.com. Some already existing alternative remote SDR streaming software that supports the RTL-SDR includes rtl_tcp, the SDR Console V2 server, OpenWebRX and ShinySDR.

Outernet Patch Antenna Pan-Tilt Servo

Over on YouTube user Tomi Simola has uploaded a video showing his servo based Outernet satellite antenna tracker. Outernet uses L-band geostationary satellites which means that they are at a fixed position in the sky. Optimal reception of the Outernet and other L-Band satellite signals can be obtained by pointing the patch antenna towards the satellite.

Tomi wanted an easy way to remotely switch the antenna to point at one of two geostationary satellites, Alphasat at 25E which has the Outernet signal and Inmarsat at 64E which has more services like AERO and STD-C. Another potential use of his tracker might be for tracking L-Band satellite while in a moving vehicle such as a car or boat. 

To automatically point the Outernet L-band patch antenna Tomi used a commonly found Pan-Tilt servo mounted inside an waterproof enclosure. On the servo is a 3D printed mount which the patch antenna is attached on. An Arduino Nano with Bluetooth module allows control of the servo.

The video below shows a test of the system, over on Reddit he has written a comment explaining the project and over on Imgur he’s uploaded some photos of the construction.

Outernet patch antenna project

Nigun (Melody): Open Hardware Plans for an RTL-SDR Downconverter

A downconverter is a circuit that allows the RTL-SDR to receive frequencies above its maximum frequency range of about 1.8 GHz. It works by converting all higher frequencies down into a lower frequency which can be received by the RTL-SDR. It is the opposite of an upconverter which is used to receive HF frequencies on an RTL-SDR. In the past the Outernet project was working on a commercial downconverter product for the RTL-SDR, but they had to unfortunately put an end to that project as the costs were not economical.

But now over on GitHub Raziel Einhorn has uploaded plans for his open hardware 1.5 – 3 GHz downconverter which is code named Nigun (Melody). Currently the design has just about been completed, and he is planning to order the first prototype this January. The main component appears to be the ADRF6612 RF mixer which is controlled by an ATSAMD21E18A ARM microcontroller. On the GitHub page he explains the main properties as:

  • Dynamic LO – LO will be determined by the user and programmed by the MCU
  • Almost no filtering – will leave this challenge outside of this project scope
  • Power up and programming via micro-usb connector. Should be able to power up from a USB power-pack (but probably not from a computer port)
  • Highest RF frequency will be 3GHz
  • Product also features a VCO for signal-generation purposes. VCO support should be 200-2700MHz
Nigun Downconverter Schematics
Nigun Downconverter Schematics

HDSDR Version 2.75 (Stable) Released

The beta 2.75 version of HDSDR was released about two months ago. Now the stable version has just been released. HDSDR is a free general purpose SDR receiver, similar in nature to other programs like SDR# and SDR-Console. HDSDR can be downloaded from hdsdr.de.

The author of HDSDR emailed us with the following release information:

this morning we released the final version 2.75. Here’s the changelog:

Version 2.75 (January 01, 2017)
– more recording options
– support for 8bit sampling format – ideal for RTLSDR, halving RF recording size
– display level / clipping for RF and AF
– additive noise generator for hiding aliases
– Highpass Filter for AM/FM deactivatable – useful for slow digimodes
– configurable gain for I/Q output – useful for digimode decoding weak signals of SDRs with >16 Bit dynamic range
– Uniform “Calibration” dialog for Frequency/S-Meter/DC Removal/Channel Skew
– “Custom color palette” to customize colors of Waterfall/Spectrum and some more
– output soundcard no longer necessary (e.g. for recording or monitoring)
– support for 8k display resolution (7680×4320)
– some new keyboard shortcuts (see )
– extended ExtIO capabilities
– experimental transmit capability through ExtIO API interface
– many fixes and improvements

Some of the new features were introduced especially for the RTLSDR Dongles:

– 8 bit support, of course

– displaying the RF (ADC) level in dBFS allow working with deactivated Tuner AGC – NOT oversteering/clipping the ADC.
This would also ease making good suitable recordings as used in
https://www.rtl-sdr.com/using-rpitx-and-an-rtl-sdr-to-reverse-engineer-and-control-ask-devices

Especially for decoding this kind of signals (AM/FM) , deactivating the Highpass filter (Ctrl-H) will make the demodulated Audio clearer:
long periods of positive or negative levels will not fade towards zero.
Find attached recordings and screenshots with active and deactivated highpass filter of a garage door opener demodulated in AM.

– additive noise generator (Ctrl-N) is for hiding some alias carriers in scenarios where the ADC does not see real noise from the antenna.
The noise generators level has to be configured carefully for not hiding real signals. A level between -25 to -10 looked fine for me. But that should be measured in a lab.

Below are the mentioned attached images and .wav files.

Highpass Filter - Active
Highpass Filter – Active
Highpass Filter - Inactive
Highpass Filter – Inactive

Highpass Active .wav file (Download)

Highpass Inactive .wav file (Download)