Software-defined radio (SDR) has been a hot topic for many years. Software-defined radio (SDR) is a radio communication system where components that have been typically implemented in hardware (e.g. mixers, filters, amplifiers, modulators/demodulators, detectors, etc.) are instead implemented by means of software on a personal computer or embedded system.
There has been many even free software implementations of SDR (for example Gnu Radio), but to use them you have needed some special hardware that has been quite expensive. But now there are also inexpensive hardware options for receiving: rtl-sdr is a creative form of using consumer-grade DVB-T USB receivers, turning them into fully-fledged software defined radios. At a street price of about 20 Euros/USD they are undoubtedly the most capable low-cost SDR hardware that can be bought.
RTL-SDR: Inexpensive Software Defined Radio article gives an introduction how to built software radio this way. Hare is a good picture from that article the gives overview of the hardware.
Those DVB-T receivers supported by rtl-sdr are based on the Realtek RTL2832U chipset plus a tuner IC like the Elonics E4000 (can tune from 54-2200 MHz with gap at 1100-1250 MHz). The RTL2832U is a high-performance DVB-T COFDM demodulator that supports a USB 2.0 interface. It has some undocumented commands/registers, by which it can be placed into a mode where it simply forwards the unprocessed raw baseband samples (up to 2.8 MS/s 8-bit I+Q) via high-speed USB into the PC so they can be routed to suitable receiving program.
Of course you need suitable software to decode those samples. Suitable Windows Software for the application is the very nice, fast and open source SDR#. It can natively support RTLSDR hardware. Other option to connect to SDR hardware is through TCP connection: The Osmocom RTLSDR utilities include the program rtl_tcp. This allows you to run the dongle on one PC (be it Windows or Linux) or an embedded ARM/MIPS board and pump the ADC data over a TCP connection to another computer running a compatible client such as SDR#.
To test software defined radio I got quite many months ago suitable rtl2832u-sdr hardware: Ezcap EZTV645 DVB-T Digital TV USB 2.0 Dongle with FM/DAB/Remote Controller. Here is a picture of dongle and the antenna that comes with it.
Here is what the USB dongle looks like inside. As you can see there are not too many components in it.
Here is a close-up of the tuner and receiving chips.
To make the software to work the hardware, the original USB drivers for the dongle needs to be replaced with Zadig WinUSB drivers. WinUSB is a generic USB driver aimed at simple devices that are accessed by only one application at a time directly through a simple software library.
I had some problems in installing Zadig drivers to my systems. That slowed down staring to use the hardware quite a bit. The official driver instructions say to select “Bulk-In, Interface (Interface 0)” from the drop down list, but on my system the device I had showed on my system system as REALTEK 2832U (0). Zadig needed to be “run as administrator” to work as well Zadig needed to be “run as administrator” (quite slow and needed reboot).
Replacing the original driver it with Zardig (zadig_v.2.0.1.161.exe) made it work with SDR# (old Nightly built of SDR# with built-in REALTEK 2832U drivers). Here is the screen-shot of the software in use listening to FM radio (SDR# v1.0.0.357 Nighly with RTL-SDR/RTL2832U).
SDR# seemed to work well in listening to FM stations. I could also easily use it to listen to the transmissions from different 433 MHz RF remote controllers as well. The software can decode AM, NFM, LSB, USB, WFM, DSB, CW-L and CW-U signals.
The spectrum and waterfall displays give a good overview on the received signal. The spectrum display shows around 2 MHz frequency band (+-1 MHz from center frequency).
As you can see on the spectrum, the dynamic range between the noise floor and strongest signals is quite limited (due to 7 or 8 bits resolution of samples), which means you can listen to strong signals but weaker stations can easily be lost under the sample noise. Because the E4000 is a Direct Conversion Receiver, it has an Image Rejection problem. By switching on Correct IQ in SDR# a more or less acceptable 50dBs are reached. The E4000 shows many signals actually not present at its input (“birdies”).
I got pretty cheaply pretty nice radio receiver that can receive very many radio signals and do spectrum analysis for radio signals.
243 Comments
Tomi Engdahl says:
RTL SDR As A Spectrum Analyzer
http://hackaday.com/2014/11/19/rtl-sdr-as-a-spectrum-analyzer/
RTL-SDR, the USB TV tuner turned software-defined radio is an amazing device, capable of listening to nearly anything from 25MHz to 1750MHz, fits in your pocket, and costs about $20. Even more astonishing is that it’s also a kinda-okay spectrum analyzer. [Kerry D. Wong] tested out one of these USB TV tuner, and the results are exactly what you would expect: it lacks a little precision, and sampling bandwidth is only a tiny bit terrible, but it does work.
Testing an RTL-SDR Spectrum Analyzer
http://www.kerrywong.com/2014/11/16/testing-an-rtl-sdr-spectrum-analyzer/
While the typical operating frequency range for these SDR’s is specified as 25MHz-1750MHz, the actual performance varies depending on the particular unit as this frequency range is not guaranteed (particularly on the high frequency side) by the chip. The unit I have operates from 25MHz to approximately 1550MHz and beyond which the receiver would sometimes lockup and require a hard reset (e.g. unplug and plug in again) for it to work properly.
Note that the input impedance of the SDR is typically 75Ω, ideally you should use a 75Ω to 50Ω feedthrough termination adapter to ensure proper impedance matching. But since the frequency range of the SDR is not particularly high, the added SWR is low enough and typically not a big concern.
There are many open source software packages we can choose from for spectrum analysis. One thing to note though is that many of the “scanner” software actually are not quite suitable for this task. For instance, I tried rtlsdr-scanner and noticed that the measured spectrum is distorted regardless of the FFT length and dwell time settings. A few other scanner packages I tried also exhibit similar issue.
So I turned to some of the more popular SDR radio software packages such as SDR# and Gqrx SDR. SDR# renders the spectrum reasonably well but the signal amplitude reading seems to be off, at least I couldn’t seem to be able to find a way to set the gain correctly to reflect the actual signal strength.
One significant limitation of the RTL-SDR is that it’s real-time sampling bandwidth is limited to 3 MHz, which means if the frequency range is wider than 3 MHz multiple hops must be made in order to cover the entire spectrum. Since switching frequency band is a relatively slow operation scanning a frequency span of 30 MHz can take significant amount of time especially when the FFT size is large. This also limits the type of signal RTL-SDR can be used to observe. If the signal changes rapidly in the frequency domain, the slow response of the RTL-SDR means it will not be able to capture the signal. So RTL-SDR based spectrum analyzer is best suited for analyzing quasi-stationary signals and in situations where accurate absolute power measurement is not critical. Also, because the LNA can be overloaded easily RTL-SDR is best suited for analyzing small signals below -10 dBm. Otherwise, external attenuators will be needed.
Tomi Engdahl says:
RTLSDR Scanner beta
A cross platform Python frequency scanning GUI for rtl-sdr
https://sourceforge.net/projects/rtlsdrscanner/
Tomi Engdahl says:
RTL_SDR_Wide_Spectrum_Analyzer
http://zolli.altervista.org/rtl_sdr_wide_spectrum/
Basically, my program is a frontend GUI of rtl_power for spectrum visualization and control.
Tomi Engdahl says:
This looks worth to check out:
Spektrum: New RTL-SDR Spectrum Analyzer Software
http://www.rtl-sdr.com/spektrum-new-rtl-sdr-spectrum-analyzer-software/
Spektrum runs on Windows and Linux and turns an RTL-SDR dongle into a spectrum analyzer in a similar way to rtl_power GUI front ends and RTLSDR Scanner.
Spektrum also has an additional “relative mode” feature. This allows Spektrum to be easily used together with a wideband noise source to measure things like filter characteristics and the VSWR of antennas.
https://github.com/pavels/spektrum/releases
Tomi Engdahl says:
RTL-SDR Tutorial: Measuring filter characteristics and antenna VSWR with an RTL-SDR and noise source
http://www.rtl-sdr.com/rtl-sdr-tutorial-measuring-filter-characteristics-and-antenna-vswr-with-an-rtl-sdr-and-noise-source/
By using an RTL-SDR dongle together with a low cost noise source it is possible to measure the response of an RF filter. Also, with an additional piece of hardware called a directional coupler the standing wave ratio (SWR) of antennas can also be measured. Measuring the response of a filter can be very useful for those designing their own, or for those who just want to check the performance and characteristics of a filter they have purchased. The SWR of an antenna determines where the antenna is resonant and is important for tuning it for the frequency you are interested in listening to.
DC 12V Noise Source Simple Spectrum External Generator Tracking Source SMA
http://www.banggood.com/DC-12V-Noise-Source-Simple-Spectrum-External-Generator-Tracking-Source-SMA-p-1140751.html?p=27131452996820140438
Tomi Engdahl says:
Testing an RTL-SDR Spectrum Analyzer
http://www.kerrywong.com/2014/11/16/testing-an-rtl-sdr-spectrum-analyzer/
One significant limitation of the RTL-SDR is that it’s real-time sampling bandwidth is limited to 3 MHz, which means if the frequency range is wider than 3 MHz multiple hops must be made in order to cover the entire spectrum. Since switching frequency band is a relatively slow operation scanning a frequency span of 30 MHz can take significant amount of time especially when the FFT size is large. This also limits the type of signal RTL-SDR can be used to observe. If the signal changes rapidly in the frequency domain, the slow response of the RTL-SDR means it will not be able to capture the signal. So RTL-SDR based spectrum analyzer is best suited for analyzing quasi-stationary signals and in situations where accurate absolute power measurement is not critical. Also, because the LNA can be overloaded easily RTL-SDR is best suited for analyzing small signals below -10 dBm. Otherwise, external attenuators will be needed.
Tomi Engdahl says:
RTL-SDR Tutorial: Measuring filter characteristics and antenna VSWR with an RTL-SDR and noise source
http://www.rtl-sdr.com/rtl-sdr-tutorial-measuring-filter-characteristics-and-antenna-vswr-with-an-rtl-sdr-and-noise-source/
Tomi Engdahl says:
A dirt cheap “spectrum analyzer” with an RTL-SDR dongle.
http://hansvi.be/wordpress/?p=91
cross platform Python frequency scanning GUI for USB TV dongles, using the OsmoSDR rtl-sdr library.
https://eartoearoak.com/software/rtlsdr-scanner
Tomi Engdahl says:
RTL-SDR Direct Sampling Mode
http://www.rtl-sdr.com/rtl-sdr-direct-sampling-mode/
The RTL-SDR software defined radio can be told to run in a mode called “direct sampling mode”, which with a small hardware mod allows the dongle to tune to the HF frequencies where ham radio and many other interesting signals are found. This means that no upconverter circuit is required.
However, the difficulty with direct sampling is that a hardware modification to the dongle is required. Also, the performance can not be expected to be as good as an upconverter without the addition of extra filtering circuits.
The hardware mod is quite simple for someone with good soldering skills. It involves opening the dongle casing, and soldering a “random wire” or “long wire antenna” to pin one or pin two (or 4 or 5) of the RTL2832U chip. This allows RF signals to directly enter the RTL2832 chip by bypassing the tuner chip. Even a short wire a few centimeters long will be sufficient for picking up broadcast AM stations.
If you are using an R820T or R820T2 tuner it may be best to use pins 4 or 5 for this mod as they are actually unused due to the architecture it uses
Activating direct sampling mode requires a software driver adjustment. Luckily, SDRSharp has this adjustment as a built in option. In SDRSharp, go to the configure menu, and change the sampling mode to “Direct sampling (I branch)”, or “Direct sampling (Q branch)”. The I branch corresponds to pin one/pin two, and the Q branch corresponds to pin four/pin five.
If a wire antenna is connected to any one of these pins, and the correct direct sampling branch is selected, you will be able to receive signals between 0 – 14.4 MHz. Frequencies between 14.4 and 28.8 MHz can also be received by using a band pass filter.
Since the RTL2832U uses two pins to create a differential input (one pins input is subtracted from the other), a balun or matching transformer can be used to connect both pins one and two to an HF antenna that is not just a simple random wire antenna.
Robert found that he had about a 16 dB – 19dB improvement in signal levels when using the Minicircuits T16-6T-KK81 16:1 transformer, when compared to a 4:1 transformer.
If you don’t want to use a balun then it can also help to connect a 1 nF to 100 nF capacitor to ground on the unused pin.
Most experimenters of this mod find that FM interference is a problem and thus low pass filters are necessary.
Direct Sampling with No Hardware Modifications (No-Mod)
There is now an experimental driver by Oliver Jowett which allows tuning down to 13 MHz and sometimes even lower down to 1 MHz on a R820T RTL-SDR. When coupled with an LNA and low pass filtering this modified driver can work very well, but not as good as with an upconverter or hardware direct sampling mod. It is also reported that the R820T2 tuner works much better than the R820T tuner with this mod due to its wider filters.
Obtaining more Bits for your money
http://www.g8jnj.net/softwaredefinedradio.htm
The two main parameters that define the dynamic range of an SDR are the number of bits used by the Analogue to Digital Convertor (ADC) and the sample rate and filtered bandwidth that the ADC is exposed to.
If an SDR uses a high sampling rate but doesn’t have an effective band pass filter ahead of the ADC, then any strong signals within the pass-band will contribute towards the overall signal level that the ADC has to digitise. So under some circumstances it’s possible for an 8 bit RTL dongle with a 2 Mbit sample rate to out perform a 12 Bit device with a 65 Mbit sample rate but poor input filtering. This is simply because the 8 Bit dongle ADC is not exposed to as many signals within it’s receive pass band as the 12 Bit device.
Tomi Engdahl says:
New Experimental R820T RTL-SDR Driver that Tunes down to 13 MHz or Lower
http://www.rtl-sdr.com/new-experimental-r820t-rtl-sdr-driver-tunes-13-mhz-lower/
Over on the Osmocom mailing list, Oliver Jowett an RTL-SDR experimenter has posted about his new experimental driver for the R820T RTL-SDR which extends the tunable range down to around 13 and up to 1864 MHz (previously 24 – 1766 MHz).
Over on the Reddit RTL-SDR discussion board there has been talk about this patch. Most users are reporting that it works well down to around 15 MHz, but some people are reporting that they have been able to receive signals down to around 4 MHz. Testers also report that this modified driver works much better than the no-hardware direct sampling mod patch released a few months ago.
Direct Sampling Mode with No Hardware Modifcations
http://www.rtl-sdr.com/direct-sampling-mode-hardware-modifcations/
Over on the Reddit RTL-SDR forums user Jengal has posted a modified RTLSDR.dll dll file for SDR# which allows the direct sampling mode to be used on the R820T without the need for any hardware modifications.
The direct sampling mod is a hardware modification to the RTL-SDR which allows it to receive HF frequencies between 0-14.4 MHz without the need for an upconverter. It works by connecting an antenna directly to the RTL2832U chip, thus bypassing the tuner. Teejez’s modification tells the RTL-SDR to bypass the tuner in software, allowing antennas to be connected to the normal antenna port. HF reception with the experimental driver is very poor in comparison to the direct sampling hardware mod or an upconverter, but even so Jengal was able to receive AM Radio, an SSB ham radio signal and an HF weather report with a simple longwire antenna.
To use the modified dll, simply download it from this link, rename it to rtlsdr.dll, and replace the original rtlsdr.dll in the SDR# folder. Then connect an HF antenna to the normal antenna port and in SDR# tune to a frequency between 0-14.4 MHz. Next turn ON the RTL AGC option in the configure menu. Jengal replaced the function of the RTL AGC option with the direct sampling mod. He found that best reception occurred when he set the gain to 48 dB.
Tomi Engdahl says:
RTL-SDR Easy HF Dongle Mod
http://www.rtl-sdr.com/rtl-sdr-easy-hf-dongle-mod/
Over on YouTube user crookedninja5 has uploaded a video showing what he calls the “Easy HF dongle mod”. The mod involves soldering a wire from Pin 1 on the RTL2832U chip to the static protection diode near the antenna input. At the same time he also uses the modified RTL-SDR dll file for SDR# which enables the “no hardware mod” direct sampling mode.
Using this mod he is able to get decent coverage of 0 – 14.4 MHz.
https://www.youtube.com/watch?v=lrwThfWL8Mw
Tomi Engdahl says:
HDSDR
High Definition Software Defined Radio
http://www.hdsdr.de/
HDSDR is a freeware Software Defined Radio (SDR) program for Microsoft Windows 2000/XP/Vista/7/8/8.1/10.
Typical applications are Radio listening, Ham Radio, SWL, Radio Astronomy, NDB-hunting and Spectrum analysis.
HDSDR (former WinradHD) is an advanced version of Winrad, written by Alberto di Bene (I2PHD).
Tomi Engdahl says:
I use E4000 device
Generic RTL2832U OEM
Tomi Engdahl says:
Decapping the R820T and RTL2832U Chips
http://www.rtl-sdr.com/decapping-the-r820t-and-rtl2832u-chips/
Tomi Engdahl says:
Transmitting DVBT HDTV from a Raspberry Pi to an RTL2832U
http://www.rtl-sdr.com/transmitting-dvbt-hdtv-raspberry-pi-rtl2832u/
Over on his blog, OZ9AEC has uploaded a post showing how he was able to create a live HDTV transmitter out of a Raspberry Pi, a Raspi Cam module and a UTC DVB-T Modulator adaptor. As he does not want to interfere with commercial DVB-T broadcasts, he sets the module to transmit at 1.28 GHz, aka the 23 cm licenced ham radio band.
On the RTL2832U dongle side, he modified the RTL2832U Linux DVB-T drivers (not the SDR drivers) to work on the 1.3 GHz band.
Tomi Engdahl says:
Linrad home page.
http://www.sm5bsz.com/linuxdsp/linrad.htm
Linrad is a free multi-OS computer program. It is free for anyone for any purpose
Together with hardware that can bring RF signals into digital form Linrad forms an SDR receiver. (A Software Defined Radio receiver.) There is also a transmit part inside Linrad that will form an SDR transmitter together with appropriate hardware. (The transmit side is still at an early development stage.)
Linrad was originally developed under Linux (hence the name: Linux radio.) That is history now. These are the operating systems under which Linrad can be used: 32 bit Linux (from kernel 2.2.12 and up), 64 bit Linux, Windows 98 (re-compile without libusb0), Windows 2000, 32 bit Windows XP, 64 bit Windows XP, 32 bit Windows Vista, 64 bit Windows Vista, 32 bit Windows 7, 64 bit Windows 7, 32 bit PC-BSD and Mac OS X.
Linrad can operate with any soundcard for which the operating system on the PC has drive routines.
Linrad can also operate with the following direct sampling receivers: SDR-14 from Rfspace, SDR-IQ from Rfspace, Perseus HF Receiver from Microtelecom s.r.l., SDR-IP from Rfspace, Excalibur (G31DDC) from Winradio.
Starting with version 02-36 Linrad also has a transmitter albeit in a very early development stage.
Linrad for newcomers.
http://www.sm5bsz.com/linuxdsp/usage/newco/newcomer.htm
Tomi Engdahl says:
Cell Phone Signal Repeater / Booster / Femtocell
An outside pole mounted aerial picks up RF signals which are then filtered, amplified and re-transmitted through a second inside aerial.
https://hackaday.io/project/20500-cell-phone-signal-repeater-booster-femtocell
I used Pothos to create a block diagram for the LimeSDR that receives a local FM station and re-transmits it 1Mhz higher at very low power.
I then tried a similar thing in the LTE band 20 at 809 MHz, just repeating the whole base station Tx spectrum, using my trusted USD020 duplexers ….. And that worked too! I
https://www.crowdsupply.com/lime-micro/limesdr
Tomi Engdahl says:
Red Pitaya Hamlab – HF/6m 10W SDR Transceiver And Much More
http://blog.redpitaya.com/red-pitaya-hamlab-hf6m-10w-sdr-transceiver-and-much-more/
Red Pitaya Hamlab has just been announced at Friedrichshafen Ham Radio 2016 expo. It is a dual-receiver dual-transmitter DDC/DUC HF/6m 10W SDR transceiver with extended measurement capabilities, based on the popular Red Pitaya development board.
The RF is converted to the digital domain with a LTC2145-14 125Msps 14-bit ADC (comparable to what an Icom IC-7300 uses, for example), so performance should be pretty good. Receiver coverage is 0-60MHz and +15dB preamp and -6/12/18dB attenuators are available for different levels of frontend gain settings.
The transceiver is compatible with various SDR software packages out there, such as PowerSDR, HDSDR, Gqrx, GNU Radio, GNU Radio Companion and Pothos.
Tomi Engdahl says:
If The I And Q Of Software Defined Radio Are Your Nemesis, Read On
http://hackaday.com/2017/05/16/if-the-i-and-q-of-software-defined-radio-are-your-nemesis-read-on/
For those of us whose interests lie in radio, encountering our first software defined radio must have universally seemed like a miracle. Here is a surprisingly simple device, essentially a clever mixer and a set of analogue-to-digital or digital-to-analogue converters, that can import all the complex and tricky-to-set-up parts of a traditional radio to a computer, in which all signal procession can be done using software.
When your curiosity gets the better of you and you start to peer into the workings of a software defined radio though, you encounter something you won’t have seen before in a traditional radio. There are two mixers fed by a two local oscillators on the same frequency but with a 90 degree phase shift, and in a receiver the resulting mixer products are fed into two separate ADCs. You encounter the letters I and Q in relation to these two signal paths, and wonder what on earth all that means.
It sometimes seems as though SDRs are magical black boxes surrounded in a cloud of marketing woo. And with the exception of the famous RTL chipset USB TV receivers they seem to attract a price to match the hype. But the reality is that from the hardware perspective they can be surprisingly simple.
I/Q Data for Dummies
http://whiteboard.ping.se/SDR/IQ
Tomi Engdahl says:
SDRplay Software Defined Radio Receiver
https://www.youtube.com/c/SDRplayRSP
Tomi Engdahl says:
Using RTL-SDR to read temperature from outdoor sensor, part 1
https://www.youtube.com/watch?v=vh-QnFxG2qs
Using RTL-SDR to read temperature from outdoor sensor, part 2
https://www.youtube.com/watch?v=jsj_2OoyYVQ
Tomi Engdahl says:
https://wiki.gnuradio.org/index.php/Main_Page
Tomi Engdahl says:
Even simpler Software Defined Radio (and thoughts on soundcards)
https://www.youtube.com/watch?v=A6r66Pc1MYk
Is this the simplest possible software defined radio?
This video discusses the importance of a good computer soundcard, walks you through the circuit of a simple SDR for 3.5 MHz and then gives a demonstration of it.
Covering a 96 kHz segment of 80 metres, it’s an ideal way for the beginner to sample software defined radio (or amateur radio HF activity). Just one transistor and about $20 worth of parts are all that’s needed to build.
Change the crystal and front end tuned circuit for coverage of other frequencies in the low HF region.
Tomi Engdahl says:
Using a PC sound card to receive VLF radio signals
https://www.youtube.com/watch?v=L2W1x6Rb9hI
Just connect an antenna to your computer’s microphone input, and you can receive VLF (Very Low Frequency) radio signals! A sound card (or built-in sound chip) with a recording sampling rate of at least 96 kHz is recommended.
SDR Sharp software (for Windows) to receive and record VLF (and many other) radio signals
Excellent VLF receiving system with PC-SoundCard, SDRsharp and Mini-Whip active antenna
https://www.youtube.com/watch?v=fKSOoZ2vhvo
Excellent VLF receiving system with SDRsharp free software, PC-SoundCard and homemade Mini-Whip active antenna.
If your PC-soundcard has 192 KHz samplerate, than you can receive from DC to 96 KHz of RF spectrum.
If your PC-soundcart has 96 KHz, samplerate, than you can receive from DC to 48 KHz of RF spectrum.
If your PC-soundcard has 44 KHz samplerate, than you can receive from DC to 22 KHz of RF spectrum.
Tomi Engdahl says:
Camp++ 0x7e0 // GSM signal sniffing for everyone with gr-gsm and Multi-RTL by Piotr Krysik
https://www.youtube.com/watch?v=xnXMKRIqkZ4
lecture: GSM signal sniffing for everyone
https://camp.hsbp.org/2016/pp7e0/fahrplan/events/19.html
Tomi Engdahl says:
Using A RTL-SDR To Learn About The GSM Network Around You, Hak5 1621
https://www.youtube.com/watch?v=FqtJ-TvtLTQ
This time Shannon and Darren explore the available GSM information using some Kali Linux, WireShark and a RTL-SDR. All that and more, this time on Hak5!
Tomi Engdahl says:
SDR Shortwave Radio Mod “easy HF dongle mod”
https://www.youtube.com/watch?v=lrwThfWL8Mw
This HF mod uses a simple jumper from the static protection diode to the RTL2832U chip, this setup may bleed static from the antenna discharging it to ground before it has a chance to go through the RTL2832U chip…. not 100% guaranteed static protection, but way safer than hooking a long wire antenna straight to the RTL2832U chip!
Tomi Engdahl says:
Camp++ 0x7df // stef: Dumbmeters in Public Utilities
https://www.youtube.com/watch?v=yUD-ySL2oV8
lecture: Dumbmeters in Public Utilities
An excercise in utility-monitoring
https://camp.hsbp.org/2015/pp7df/fahrplan/events/3.html
Tomi Engdahl says:
Exposing Dinosaur Phone Insecurity With Software Defined Radio
http://hackaday.com/2017/06/05/exposing-dinosaur-phone-insecurity-with-software-defined-radio/
[Corrosive] has been working on deconstructing the security behind these cordless phones for a few years now and found these cordless phones aren’t secure at all.
The phone in question for this exploit is a standard 5.8 GHz cordless phone from Vtech. Conventional wisdom says these phones are reasonably secure — at least more so than the cordless phones from the 80s and 90s — because very few people have a duplex microwave transceiver sitting around. The HackRF is just that, and it only costs $300. This was bound to happen eventually.
[Corrosive] found the phone technically didn’t operate in the 5.8 GHz band. Control signals, such as pairing a handset to a base station, happened at 900 MHz. Here, a simple replay attack is enough to get the handset to ring. It gets worse: simply by looking at the 5.8 GHz band with a HackRF, [Corrosive] found an FM-modulated voice channel when the handset was on. That’s right: this phone transmits your voice without any encryption whatsoever.
Cordless Phone Security Exposed With HackRF SDR
https://www.youtube.com/watch?v=LCQtgizdgGU
While nothing is 100% secure many people thought that DECT and 5.8GHz phones were safe. While dect has been broken for a fairly long time 5.8GHz phones were considered to be safer than 900mhz phone as scanner are harder to come by in the microwave bands.
Tomi Engdahl says:
Hackaday Prize Entry: Sub Gigahertz RF
http://hackaday.com/2017/06/05/hackaday-prize-entry-sub-gigahertz-rf/
For all the press WiFi and Bluetooth-connected Internet of Things toasters get, there’s still a lot of fun to be had below one Gigahertz. For his Hackaday Prize entry, [Adam] is working on an open source, extensible 915 and 433 MHz radio designed for robotics, drones, weather balloons, and all the other fun projects that sub-Gigaherts radio enables.
The design of this radio module is based around the ADF7023 RF transceiver, a very capable and very cheap chip that transmits in the usual ISM bands. The rest of the circuit is an STM32 ARM Cortex M0+, with USB, UART, and SPI connectivity, with support for a battery for those mobile projects.
S1G RF: Sub 1GHZ Radio Modules 915MHZ and 433MHZ
https://hackaday.io/project/17997-s1g-rf-sub-1ghz-radio-modules-915mhz-and-433mhz
Sub 1GHZ RF wireless modules operating at 915MHZ and 433MHZ ISM bands, based on the ADF7023, full open source!
Tomi Engdahl says:
Even simpler Software Defined Radio (and thoughts on soundcards)
https://www.youtube.com/watch?v=A6r66Pc1MYk
Is this the simplest possible software defined radio?
This video discusses the importance of a good computer soundcard, walks you through the circuit of a simple SDR for 3.5 MHz and then gives a demonstration of it.
Covering a 96 kHz segment of 80 metres, it’s an ideal way for the beginner to sample software defined radio (or amateur radio HF activity). Just one transistor and about $20 worth of parts are all that’s needed to build.
Change the crystal and front end tuned circuit for coverage of other frequencies in the low HF region. Eg removing one of the 100pF capacitors and substituting a 5 MHz crystal might work for receiving WWV on 5 MHz (not tried).
Tomi Engdahl says:
10 sdradio playing with your dongle an introduction to software defined radio using cheap tv tuner c
https://www.youtube.com/watch?v=JPShMvHT134
Ultra-cheap SDR: HF with RTL2832U (RTL-SDR) and transverter
https://www.youtube.com/watch?v=5y2XMvrlmiA
Tomi Engdahl says:
sdr radio raspberry pi
https://www.youtube.com/watch?v=CvBbQtfgh1s
World’s cheapest INMARSAT reception systen using DVB-T USB dongle (RTL SDR)
https://www.youtube.com/watch?v=zuyHpx1tnWI
DVB-T dongles based on the Realtek RTL2832U can be used as a cheap SDR, since the chip allows transferring the raw I/Q samples with up to 3MHz bandwith to the host. I am testing here a DVB-T USB dongle based on Elonics E4000 tuner chip covering around 60-1700MHz (same tuner chip as used in the famous Funcube dongle SDR).
Tomi Engdahl says:
RTL-SDR Tutorial: Decoding DRM Radio
http://www.rtl-sdr.com/tutorial-drm-radio-using-rtl-sdr/
Digital Radio Monodial (DRM) radio is a type of digital shortwave radio signal that is used by international shortwave radio broadcasters. It provides superior audio quality compared to AM signals by using digital audio encoding. With an upconverter, good antenna, and decoding software the RTL-SDR software defined radio can receive and decode DRM signals. This tutorial is also applicable to other software defined radios that can receive HF with or without an upconverter, such as the HackRF, Airspy, Softrock and Funcube dongle.
Tutorial: How to Receive and Decode DRM Signals
To receive DRM with RTL-SDR, you will need the following:
An RTL-SDR dongle working with SDR#. (Or a more advanced SDR such an Airspy)
An HF upconverter such as the recommended SpyVerter or ham-it-up, or a dongle modded for direct sampling (such as our already modded V3 dongle), or SDR# modded to use the experimental Oliver Jowett HF driver for regular RTL-SDR dongles.
The DREAM DRM decoding software with AAC decoder.
Virtual Audio Cable or VB-Cable.
Understanding DRM: digital radio mondiale
http://www.edn.com/design/analog/4458382/Understanding-DRM–digital-radio-mondiale
Tomi Engdahl says:
SDR Sniffing Electric Gates
http://hackaday.com/2017/06/11/sdr-sniffing-electric-gates/
Most wireless OEM hardware traditionally use 433MHz OOK modules to exchange information. The encoding and encryption of this data stream is left as a task for the embedded software designer. In most cases, the system can be hacked using a replay attack where an RF packet is recorded and replayed to emulate a valid user. [Gilad Fride] hacked his parking gate using this technique but decided to go the extra mile of connecting it to the internet.
He used an RTL-SDR dongle and ook-decoder by [jimstudt] to sniff out the gate code and this code was tested using an Arduino. The final implementation was done around an Onion Omega which talks directly to the RF transmitter module using the fast-gpio binary. Internet connectivity was achieved using Onion Cloud API which is used to trigger the execution of code thereby sending the gate opening signal.
[Gilad Fride] uses the IFTTT Do button to provide a GUI
Connected RF Gate Remote
https://www.hackster.io/giladfr/connected-rf-gate-remote-d9b0ae
Using an onion-omega and a cheap RF transmitter, remotely send a pre-recorded OOK (on/off keying) code to open a gate or garage door.
The sniffing part was done using a RTL SDR dongle (such as this one from eBay) and a readily available decoder application that runs on Linux.
you connect the dongle and run the ookdump program inside the ook-decoder folder, press the remote signal and printed on screen should be the code in question.
You can see that you get the high time (transmission) and low time (no-transmission) for 53 pulses in this key example. Replaying the exact sequence over and over a few times will open the gate in case this is indeed a simple OOK remote.
Tomi Engdahl says:
Welcome to gqrx
http://gqrx.dk/
Gqrx is an open source software defined radio receiver (SDR) powered by the GNU Radio and the Qt graphical toolkit.
Gqrx is free software, licensed under the GNU General Public license
Discover devices attached to the computer.
Process I/Q data from the supported devices.
Change frequency, gain and apply various corrections (frequency, I/Q balance).
AM, SSB, CW, FM-N and FM-W (mono and stereo) demodulators.
Special FM mode for NOAA APT.
Variable band pass filter.
AGC, squelch and noise blankers.
FFT plot and waterfall.
Record and playback audio to / from WAV file.
Record and playback raw baseband data.
Spectrum analyzer mode where all signal processing is disabled.
Basic remote control through TCP connection.
Streaming audio output over UDP.
Tomi Engdahl says:
Ook-decoder reads On-Off Keying radio data commonly used in the 433MHz ISM bands using a software defined radio (SDR).
https://github.com/jimstudt/ook-decoder
Ook-decoder reads On-Off Keying radio data commonly used in the 433MHz ISM bands using a software defined radio (SDR).
On-Off-Keying (OOK) is a simple radio modulation scheme where the carrier is pulsed on and off to encode data. Morse code is a well known historical example. In modern times OOK is commonly used in the Industrial, Scientific, and Medical (ISM) radio bands (433MHz, 900MHz, and others) by simple telemetry devices like weather stations, remote thermometers, alarm systems, and other remote sensors.
ookd receives and analyzes the RF data looking for bursts of pulses. When it finds a pulse burst it multicasts the pulses to an arbitrary number of listens. ookd doesn’t know anything about any specific protocol. Most of the computation takes place in ookd. In a typical environment ookd will receive and perform computation on 2MB/s and pass on less than 100B/s. You should not need to alter ookd to support a new device.
ookdump is a client which characterizes and dumps received bursts. You will find it useful for understanding your device’s protocol and if you are lucky how to set the parameters to an already existing function to convert your pulse stream into an array of bytes.
wh1080 decodes weather information from Fine Offset wh1080/wh1081 based weather statio
nexa decodes ON/OFF signals for Nexa wireless units (http://www.nexa.se) of the smart home. This outputs the transmitter code to stdout and can also send statistics to StatsD server.
Tomi Engdahl says:
CPLD-Based Synchronization of Multiple Software Defined Radios
http://hackaday.com/2017/06/15/cpld-based-synchronization-of-multiple-software-defined-radios/
Forgive the click bait headline, but the latest work from [Marco Bartolucci] and [José A. del Peral-Rosado] is really great. They’re using multiple HackRFs, synchronized together, with hybrid positioning algorithms to derive more precise localization accuracy. (
Like all SDRs, the HackRF can be used to solve positioning problems using WIFi, Bluetooth, 3G, 4G, and GNSS. Multiple receivers can also be used, but this requires synchronization for time-based or frequency-based ranging. [Bartolucci] and [Peral-Rosado] present a novel solution for synchronizing these HackRFs using a few convenient ports available on the board, a bit of CPLD hacking, and a GNSS receiver with a 1 pps output.
http://spcomnav.uab.es/docs/conferences/Bartolucci_NAVITEC_2016.pdf
Tomi Engdahl says:
An Antenna that Really Cooks–Really
http://hackaday.com/2017/06/19/an-antenna-that-really-cooks-really/
[9A4OV] set up a receiver using the HackRF board and an LNA that can receive the NOAA 19 satellite. Of course, a receiver needs an antenna, and he made one using a cooking pot. The antenna isn’t ideal – at least indoors – but it does work. He’s hoping to tweak it to get better reception. You can see videos of the antenna and the resulting reception, below.
The satellite is sending High-Resolution Picture Transmission (HRPT) data which provides a higher image quality than Automatic Picture Transmission (APT). APT is at 137 MHz, but HRPT is at 1698 MHz and typically requires a better receiver and antenna system.
https://www.reddit.com/r/RTLSDR/comments/6hfm8u/noaa19_hrpt_1698_mhz_with_a_pot_antenna/
Tomi Engdahl says:
Crazyradio for Cheapskates
Turning a wireless mouse USB adapter into a quadcopter transmitter
https://hackaday.io/project/6741-crazyradio-for-cheapskates
The Bitcraze Crazyflie 2.0 quadcopter can be controlled by a PC with the Crazyradio USB radio dongle. Unlike the first-gen Crazyflie, this isn’t required since the 2.0 works out-of-the-box with Android or iOS as a controller over Bluetooth. However the Crazyradio opens up some fun features like servo absolute position control using Kinect or telemetry from hacked-on sensors. Bitcraze is kind enough to open source their products, giving source, tools, and documentation for the firmware running on the Crazyradio’s nRF24LU1+ SoC.
It just so happens that the Logitech Unifying Receiver, a tiny dongle for wireless mice and keyboards, contains an nRF24LU1+.
Tomi Engdahl says:
Testing the Outernet Dreamcatcher SDR
http://hackaday.com/2017/06/20/testing-the-outernet-dreamcatcher-sdr/
What do you get when you cross an ARM-based Linux PC and an RTL-SDR? Sounds like the start of a joke, but the answer is Outernet’s Dreamcatcher. It is a single PCB with an RTL-SDR software defined radio, an L-band LNA, and an Allwinner A13 processor with 512MB of RAM and a 1 GHz clock speed. The rtl-sdr site recently posted a good review of the $99 board.
Despite the L-band hardware, there is a bypass antenna jack that allows you to receive other frequencies. There’s also two SD slots, one to boot from and another for storage.
Testing the Outernet Dreamcatcher: Linux Based ARM PC with Built in RTL-SDR
http://www.rtl-sdr.com/testing-the-outernet-dreamcatcher-linux-based-arm-pc-with-built-in-rtl-sdr/
Last week we posted about Outernet’s new Dreamcatcher unit which is an RTL-SDR + L-band LNA + computing board all on the same PCB. The Dreamcatcher comes with a new active ceramic L-band patch antenna, costs $99 USD (plus shipping) and can be bought directly from their store. Outernet were kind enough to send us a review unit, and we’ve been testing it for the past few weeks. This post is a review of the unit.
Outernet is a free data service that uses L-band satellites to beam down information like news, weather updates, Wikipedia articles, books and more.
In the past Outernet have used the $9 USD C.H.I.P computing board, an RTL-SDR dongle and an external LNA as the receiving hardware for their data service. However, popularity of the Outernet service has been severely hindered by the huge supply shortages of the C.H.I.P. Over the past year or so it has been almost impossible to get a hold of a C.H.I.P unit if you did not back the Kickstarter or buy one from Outernet’s first initial stock. By manufacturing their own PCB including the computing hardware, Outernet must be hoping to be able to control their stock situation, and not rely on third parties who may not be able to deliver.
Tomi Engdahl says:
Decoding NRSC-5 with SDR to Get In Your Car
http://hackaday.com/2017/06/21/receiving-nrsc-5-with-sdr/
NRSC-5 is a high-definition radio standard, used primarily in the United States. It allows for digital and analog transmissions to share the original FM bandwidth allocations. Theori are a cybersecurity research startup in the US, and have set out to build a receiver that can capture and decode these signals for research purposes, and documented it online.
Their research began on the NRSC website, where the NRSC-5 standard is documented, however the team notes that the audio compression details are conspicuously missing
Receiving NRSC-5
http://theori.io/research/nrsc-5-c
Tomi Engdahl says:
The Breadboard RF103
http://hackaday.com/2017/07/01/the-breadboard-rf103/
When [ik1xpv] sets out to build a software-defined radio (SDR), he doesn’t fool around. His Breadboard RF103 sports USB 3.0, and 16-bit A/D converter that can sample up to 105 Msps, and can receive from 0 to 1800 MHz. Not bad. Thanks to the USB 3.0 port, all the signal processing occurs in the PC without the limitations of feeding data through a common sound port. You can see the device in action in the video below.
The Cypress FX3 USB device is an ARM processor, but it is only streaming data, not processing it. You can find the slightly modified firmware, a driver for using PC software, and schematics and board layouts on GitHub.
BreadBoard RF103
http://www.steila.com/blog/index.php?controller=post&action=view&id_post=18
I designed the breadboard BBRF103 to learn how to use and to test the following components :
FX3 SuperSpeed Explorer Kit USB3.0 transfers the ADC sample stream to the PC.
ADC (LTC2217) samples the real data at 16 bit up to 105 Msps.
0-30MHz input, attenuator (0,-10,-20 dB) and LPF transfer antenna signal to the ADC.
Tuner ( R820T2 ) down converts signals in the 30-1800 MHz range to the ADC.
Clock generator ( Si5351A ) outputs the clocks to the ADC and the R820T2.
In other words the idea is to avoid the Digital Down Converter (DDC) Custom or FPGA chip in between ADC and PC. The full HF radio spectrum is processed by the host computer connected via an USB3.0 port.
BBRF103 is placed in series between Antenna and Computer. A modern pc (I5-I7 CPU or higher) equipped with USB 3.0 is required.
The R820T2 chip has been added to look at its performance with a 16 bit ADC and wide bandwidth.
Tomi Engdahl says:
“Alexa, what plane is that?”
http://hackaday.com/2017/07/02/alexa-what-plane-is-that/
We’ve all probably done it — gazed up at a passing jetliner and wondered where it was going and what adventures its passengers were embarked upon. While the latter is hard to answer, the former just got a bit easier: just ask Alexa what the plane is.
Teaching Alexa to Spot Airplanes
Fun with RTL-SDR and Amazon Echo Dot
https://www.nicksypteras.com/projects/teaching-alexa-to-spot-airplanes
As an airplane fanatic, I’d often go to FlightRadar24.com to look up the different airplanes as they passed by, but after a while that became cumbersome.
So, I taught Alexa to do the work for me!
This was actually a pretty straightforward job. The first step was to make two new electronics purchases (not including my Echo Dot):
Raspberry Pi (~$35)
RTL-SDR USB Dongle (~$20)
The dongle is essentially a radio receiver for your computer that can pick up most unencrypted radio broadcasts.
By plugging the dongle into the raspberry pi (and placing by a window with an unobstructed view), and with the help of some open source software, the Pi can be turned into a cheap ADS-B decoder/server!
In case there’s more than one airplane nearby, I use gpxpy to calculate the distance of each plane to my window and then choose the closest.
Finally, I set up a public node js server on my raspeberry pi that pulls the airplane data and formats it into a good ol’ English sentence when requested. Then, I simply have Alexa make a request to the pi server when prompted and read back the result.
If you’re not familiar with how Alexa skills work, you basically create a new skill on the Alexa Skills Kit dashboard, give that skill a name and various utterances that can invoke it (“what plane is that?”) and point it to an AWS Lambda function or similar service capable of processing an Alexa skills request. You don’t have to use AWS Lambda, but it’s definitely a quick and easy option for simple skills. Mine simply returns a basic Alexa skill response with the formatted airplane data from the pi server.
Tomi Engdahl says:
Old Rabbit Ears Optimized for Weather Satellite Downlink
http://hackaday.com/2017/07/10/old-rabbit-ears-optimized-for-weather-satellite-downlink/
Communicating with a satellite seems like something that should take a lot of equipment. A fancy antenna and racks full of receivers, filters, and amplifiers would seem to be the entry-level suite of gear. But listening to a weather satellite with an old pair of rabbit ears and an SDR dongle? That’s a thing too.
There was a time when a pair of rabbit ears accompanied every new TV. Those days are gone, but [Thomas Cholakov (N1SPY)] managed to find one of the old TV dipoles in his garage, complete with 300-ohm twinlead and spade connectors. He put it to work listening to a NOAA weather satellite on 137 MHz by configuring it in a horizontal V-dipole arrangement.
Using a TV Dipole Antenna for NOAA Satellite Reception
http://www.rtl-sdr.com/using-a-tv-dipole-for-noaa-satellite-reception/
Tomi Engdahl says:
Hackaday Prize Entry: Open Narrowband RF Transceiver
http://hackaday.com/2017/07/14/hackaday-prize-entry-open-narrowband-rf-transceiver/
The Open Narrowband RF Transceiver from [Samuel Žák] promises deliver something more useful to the experimenter: an RF transceiver for the 868 or 915MHz allocations with full control over all transmission parameters. Transmission characteristics such as frequency, bandwidth, and deviation can be adjusted, and the modulation and encoding schemes can also be brought under full control. Where a conventional module might simply offer on-off keying or frequency shift keying, this module can be programmed to deliver any modulation scheme its chipset is capable of. Spread-spectrum? No problem!
Open narrowband RF transceiver
https://hackaday.io/project/18032-open-narrowband-rf-transceiver
No more restrictions from high level software! Access the lowest level of radio transmission with this programmable USB stick.
Project presents programmable RF transceiver in a form of USB stick.
Device is based around CC1120 radio with CC1190 front end. This combo can put out 500mW at lowest bandwidth of 8kHz. Transceiver can operate at 868MHz or 915MHz with WIDE variety of selectable properties. Radio is controlled by STM32F051 microcontroller that is open for programming.
Tomi Engdahl says:
Flush Out Car Thieves with a Key Fob Jammer Locator
http://hackaday.com/2017/07/16/flush-out-car-thieves-with-a-key-fob-jammer-locator/
We all do it — park our cars, thumb the lock button on the key fob, and trust that our ride will be there when we get back. But there could be evildoers lurking in that parking lot, preventing you from locking up by using a powerful RF jammer. If you want to be sure your car is safe, you might want to scan the lot with a Raspberry Pi and SDR jammer range finder.
Detecting car keyfob jamming using a Raspberry Pi and a DVB-T dongle
https://mikeh69.wordpress.com/2017/07/13/detecting-car-keyfob-jamming-using-a-raspberry-pi-and-a-dvb-t-dongle/
The use of RF jammers or blockers by criminals to break into cars is spreading – this BBC News report is from December 2016, and this from May 2017. How can you protect yourself? This Hackaday post describes a simple “yes/no” receiver to detect jamming on the car-keyfob frequency. Better than nothing, but it doesn’t tell you whether you’re right in the crims’ target zone, or half a mile away.
I had been messing around with a cheap RTL-2832 DVB-T dongle, and it seemed like it should be quite straightforward to use it as a direction-finding/homing receiver to give a “warmer/colder” indication and work out exactly where a jammer was being used. As it turned out, the software-radio bit was quite easy – the tricky part was making Linux generate simple beep-tones to indicate the signal-strength!
The main part of the code is written in Python 3, with the RF-power calculation implemented in C for efficiency. It can be run on a laptop, but the real fun starts when you install it on a Raspberry Pi that fits in your pocket – a single earphone feeds you audio tones that indicate “warmer / colder”
Raspbian Lite will boot faster than the “With Desktop” version, so I used that.
Build and install PortAudio and its Python bindings
Now build and install the RTL-SDR library and Python bindings for i
Finally, install a Udev rule and driver-blacklist to allow user-mode access to the DVB-T dongle
The centre-frequency of the band is currently hard-coded to 433.92MHz (the European car-keyfob band), but the Python script (jammer_detect_main.py or jammer_detect_no_ui.py) can simply be edited to change this to any frequency that the DVB-T dongle is able to tune to
Tomi Engdahl says:
Get eyes in the sky with your Raspberry Pi
17 July 2017 on raspberrypi, flight tracking, docker, flightaware, radio, IoT, Raspberry PI
https://blog.alexellis.io/track-flights-with-rpi/
Did you know that you can use your Raspberry Pi to get eyes in the sky? By tuning into radio signals emitted from planes up to 250 miles away from your location you can track flights and it only takes a few minutes and a cheap USB TV stick to get started.
This guide will give you a brief introduction into flight tracking – looking at the software, hardware and most importantly the terminology and jargon you need to know. I’ll also show you how Docker and containers make a great combination for managing your software in IoT projects.
Sites like FlightAware.com have been able to track 10s of thousands of aircraft by crowd-sourcing the task out to people all over the world equipped with their $35 Raspberry Pis and cheap USB TV tuners.
You can keep the signals you pick up to yourself or contribute them to a real-time tracking site like FlightAware.com, FlightRadar24 and PlaneFinder.net – in return you get detailed metrics – RADAR readouts and other rewards.
Tomi Engdahl says:
Instructions and Dockerfiles for tracking flights with your Raspberry Pi and a USB TV stick.
https://github.com/alexellis/eyes-in-the-sky
Tomi Engdahl says:
Serious DX: The Deep Space Network
http://hackaday.com/2017/07/21/serious-dx-the-deep-space-network/
Humanity has been a spacefaring species for barely sixty years now. In that brief time, we’ve fairly mastered the business of putting objects into orbit around the Earth, and done so with such gusto that a cloud of both useful and useless objects now surrounds us. Communicating with satellites in Earth orbit is almost trivial; your phone is probably listening to at least half a dozen geosynchronous GPS birds right now, and any ham radio operator can chat with the astronauts aboard the ISS with nothing more that a $30 handy-talkie and a homemade antenna.
The need for a way to talk to satellites was recognized very early on in the US space program, and development of the space communication network that would come to be known as the Deep Space Network (DSN) paralleled developments in space technology that quickly pushed hardware farther and farther from Earth. The DSN was built specifically so that each new mission didn’t need to roll its own communications solutions and could just leverage the current network. Networks for the ESA and for other countries’ space programs have since been built as well, and cooperation between all the network operators is commonplace, especially during emergencies.
JPL has a very cool interactive page that lists the current status of all the antennas in the DSN and what each one is doing. While I’m writing this, the 70 m dish in Madrid is sending a 19 kW signal to Voyager 1 and getting back a -154.27 dBm signal. That’s about 370 zeptowatts, but still enough signal to pull out 159 bits/second of data.
https://eyes.nasa.gov/dsn/dsn.html