Shmoocon 2017: So You Want To Hack RF

Far too much stuff is wireless these days. Home security systems have dozens of radios for door and window sensors, thermostats aren’t just a wire to the furnace anymore, and we are annoyed when we can’t start our cars from across a parking lot. This is a golden era for anyone who wants to hack RF. This year at Shmoocon, [Marc Newlin] and [Matt Knight] of Bastille Networks gave an overview of how to get into hacking RF. These are guys who know a few things about hacking RF; [Marc] is responsible for MouseJack and KeySniffer, and [Matt] reverse engineered the LoRa PHY.

In their talk, [Marc] and [Matt] outlined five steps to reverse engineering any RF signal. First, characterize the channel. Determine the modulation. Determine the symbol rate. Synchronize a receiver against the data. Finally, extract the symbols, or get the ones and zeros out of the analog soup.

From [Marc] and [Matt]’s experience, most of this process doesn’t require a radio, software or otherwise. Open source intelligence or information from regulatory databases can be a treasure trove of information regarding the operating frequency of the device, the modulation, and even the bit rate. The pertinent example from the talk was the FCC ID for a Z-wave module. A simple search revealed the frequency of the device. Since the stated symbol rate was twice the stated data rate, the device obviously used Manchester encoding. These sorts of insights become obvious once you know what you’re looking for.

In their demo, [Marc] and [Matt] went through the entire process of firing up GNU Radio, running a Z-wave decoder and receiving Z-wave frames. All of this was done with a minimum of hardware and required zero understanding of what radio actually is, imaginary numbers, or anything else a ham license will hopefully teach you. It’s a great introduction to RF hacking, and shows anyone how to do it.

Shmoocon 2017: On Not Reverse Engineering Through Emulation

Right now, I’m at Shmoocon, and it’s living up to all expectations. That’s a tall order — last year, the breakout talk was from [Travis Goodspeed] on his efforts to reverse engineer the firmware for a cheap Chinese radio. Four people in the room for that talk last year bought the radio on Amazon, and now there’s a legitimate open source project dedicated to building firmware and tools to support this radio.

tyteraNow that [Travis] has a few compatriots working on firmware for this radio, he has the same challenges as any other team. The project needs unit tests, and this isn’t easy to do when all the code is locked up inside a radio. Instead of setting up an entire development platform based around a cheap radio, [Travis] came up with a toolchain that’s unlike anything I’ve ever seen. Instead of reverse engineering the firmware for this radio, he’s simply emulating the ARM firmware on the desktop. Development is quick and easy, and he has the live demos to prove it.

The heart of the Tytera radio in question is an STM32F405. This is a pretty common part, and thanks to [Travis]’ work last year, he has all the firmware that ships on this radio. This doesn’t mean he has access to all the radio’s capabilities, though; there’s a black box in the code somewhere that translates .wav files to radio packets and back again. Open sourcing this would usually mean reverse engineering, but [Travis] had a better idea.

Instead of reverse engineering the entire radio, [Travis] is using QEMU to emulate an ARM microcontroller on his desktop, run the relevant code, and completely ignore any actual reverse engineering. Since this radio is already jailbroken and the community has a pretty good idea of where all the functions and subroutines are in the firmware, the most difficult part of pulling this trick off is setting up QEMU.

As a proof of concept, [Travis] downloaded raw AMBE packets from the radio to his laptop. These were then sent through the emulated radio, producing raw audio that was then converted into a .wav file. Effectively, a black box in this radio was emulated, which means [Travis] doesn’t need to know how the black box works.

All the code for this weird emulation / unit test, as well as everything the community has released for this radio is available on the GitHub. A lot of work has gone into the jailbreaking, reverse engineering, and emulation efforts here, making this radio somewhat ironically one of the most open radios you can buy.

Pumping Up An Antenna From A Stream Of Sea Water

Our Hackaday readership represent a huge breadth of engineering experience and knowledge, and we get a significant number of our story tips from you. For instance, today we are indebted to [sonofthunderboanerges] for delivering us a tip in the comment stream of one of our posts, detailing an antenna created by coupling RF into a jet of sea water created with a pump. It’s a few years old so we’re presenting it as an object of interest rather than as a news story, but it remains a no less fascinating project for that.

The antenna relies on the conductivity of sea water to view a jet of water as simply another conductor to which RF can be coupled. The jet is simply adjusted by altering the flow rate until it is a quarter wavelength long at the desired frequency, at which point it is a good analogue of a metal whip antenna. The RF is coupled at the base by a ferrite cored transformer that clips around the nozzle ejecting the water, and a bandwidth from 2MHz to 400MHz is claimed. If you work with RF you will probably wince at the sight of salt water coming near the RF connector, as we did.

The advantage of the system is that it allows antennas of multiple frequencies to be created at very short notice and using very little space or weight when not in use. The creator of the antenna at the US Navy’s SPAWAR technology organization points to its obvious application on Navy warships. Whether or not the sailors are using these antennas now isn’t clear, but one thing’s for certain, the idea hasn’t gone away. Early last year Popular Mechanics reported on a similar project under way courtesy of Mitsubishi, in Japan.

Continue reading “Pumping Up An Antenna From A Stream Of Sea Water”

Anatomy Of A Digital Broadcast Radio System

What does a Hackaday writer do when a couple of days after Christmas she’s having a beer or two with a long-term friend from her university days who’s made a career in the technical side of digital broadcasting? Pick his brains about the transmission scheme and write it all down of course, for behind the consumer’s shiny digital radio lies a wealth of interesting technology to try to squeeze the most from the available resources.

In the UK, our digital broadcast radio uses a system called DAB, for Digital Audio Broadcasting. There are a variety of standards used around the world for digital radio, and it’s fair to say that DAB as one of the older ones is not necessarily the best in today’s marketplace. This aside there is still a lot to be learned from its transmission scheme, and from how some of its shortcomings were addressed in later standards. Continue reading “Anatomy Of A Digital Broadcast Radio System”

Did a Russian Physicist Invent Radio?

It is said that “success has many fathers, but failure is an orphan.” Given the world-changing success of radio in the late 19th and early 20th centuries, it’s no wonder that so many scientists, physicists, and engineers have been credited with its invention. The fact that electromagnetic radiation is a natural phenomenon that no one can reasonably claim to have invented sometimes seems lost in the shuffle to claim the prize.

But it was exactly through the study of natural phenomena that one of the earliest pioneers in radio research came to have a reasonable claim to at least be the inventor of the radio receiver, well before anyone had learned how to reliably produce electromagnetic waves. This is the story of how a Russian physicist harnessed the power of lightning and became one of the many fathers of radio.

Continue reading “Did a Russian Physicist Invent Radio?”

The Poynting Vector Antenna

Radio amateurs are inventive people, and though not all of them choose to follow it there is a healthy culture of buildng radio equipment among them. In particular the field of antennas is where you’ll find a lot of their work, because the barrier to entry can be as low as the cost of a reel of wire.

Over the years a number of innovative antenna designs have come from radio amateurs’ experimentation, and it’s one of the more recent we’d like to share with you today following a [Southgate ARC] story about a book describing its theory (Here’s an Amazon link to the book itself). The Poynting Vector antenna has been one of those novel designs on the fringes for a while now, it has been variously described as the “Super-T”, or the “flute”. Its party piece is tiny dimensions, a fraction of the size of a conventional dipole, and it achieves that by the interaction between a magnetic field across the plates of a capacitor in a tuned circuit and the electric field between a very short pair of dipole radiators. The trade-off is that it has an extremely high Q and thus a narrow bandwidth, and since its feeder can become part of its resonant circuit it is notoriously difficult to match to a transmitter. [Alan MacDonald, VE3TET] and [Paul Birke, VE3PVB] have a detailed page on the development of their Poynting antenna which takes the reader through the details of its theory and the development of their practical version.

In the roof space above the room in which this is being written there hangs a traditional dipole for the 20m amateur band. Though it is a very effective antenna given that it is made from a couple of pieces of wire and a ferrite core it takes most of the length of the space, and as we’re sure Hackaday readers with callsigns will agree a relatively tiny alternative is always very welcome.

If antennas are a mystery to you then we’d suggest you read an introduction to antenna basics to get you started.

Visualization of a Phased Array Antenna System

Phased array antenna systems are at the cusp of ubiquity. We now see Multiple-Input Multiple-Output (MIMO) antenna systems on WiFi routers. Soon phased array weather radar systems will help to predict the weather and keep air travel safe, and phased array base stations will be the backbone of 5G which is the next generation of wireless data communication.  But what is a phased array antenna system?  How do they work?  With the help of 1024 LEDs we’ll show you.

Continue reading “Visualization of a Phased Array Antenna System”