Radio Hacks

1333 Articles

Ice, Ice, Radio Uses FPGA

January 23, 2017 by 24 Comments

Building a software defined radio (SDR) involves many trades offs. But one of the most fundamental is should you use an FPGA or a CPU to do the processing. Of course, if you are piping data to a PC, the answer is probably a CPU. But if you are doing the whole system, it is a vexing choice. The FPGA can handle lots of data all at one time but is somewhat more difficult to develop and modify. CPUs using software are flexible–especially for coding user interfaces, networking connections, and the like) but don’t always have enough horsepower to cope with signal processing tasks (and, yes, it depends on the CPU).

[Eric Brombaugh] sidestepped that trade off. He used a board with both an ARM processor and an ICE FPGA at the heart of his SDR design. He uses three custom boards: one is the CPU/FPGA board, another is a 10-bit converter that can sample at 40 MSPS (sufficient to decode to 20 MHz), and an I2S DAC to produce audio. Each board has its own page linked from the main project.

Continue reading “Ice, Ice, Radio Uses FPGA” →

Voice At 700 Bits Per Second

January 20, 2017 by 50 Comments

All other things being equal, signals with wider bandwidth can carry more information. Sometimes that information is data, but sometimes it is frequency. AM radio stations (traditionally) used about 30 kHz of bandwidth, while FM stations consume nearly 200 kHz. Analog video signals used to take up even more space. However, your brain is a great signal processor. To understand speech, you don’t need very high fidelity reproduction.

Radio operators have made use of that fact for years. Traditional shortwave broadcasts eat up about 10kHz of bandwidth, but by stripping off the carrier and one sideband, you can squeeze the voice into about 3 kHz and it still is intelligible. Typical voice codecs (that is, something that converts speech to digital data and back) use anywhere from about 6 kbps to 64 kbps.

[David Rowe] wants to change that. He’s working on a codec for ham radio use that can compress voice to 700 bits per second. He is trying to keep the sound quality similar to his existing 1,300 bit per second codec and you can hear sound samples from both in his post. You’ll notice the voices sound almost like old-fashioned speech synthesis, but it is intelligible.

Continue reading “Voice At 700 Bits Per Second” →

Recapture Radio’s Roots With An Updated Regenerative Receiver

January 19, 2017 by 12 Comments

Crystal radios used to be the “gateway drug” into hobby electronics. Trouble was, there’s only so much one can hope to accomplish with a wire-wrapped oatmeal carton, a safety-pin, and a razor blade. Adding a few components and exploring the regenerative circuit can prove to be a little more engaging, and that’s where this simple breadboard regen radio comes in.

Sometimes it’s the simple concepts that can capture the imagination, and revisiting the classics is a great way to do it. Basically a reiteration of [Armstrong]’s original 1912 regenerative design, [VonAcht] uses silicon where glass was used, but the principle is the same. A little of the amplified RF signal is fed back into the tuned circuit through an additional coil on the ferrite rod that acts as the receiver’s antenna. Positive feedback amplifies the RF even more, a germanium diode envelope detector demodulates the signal, and the audio is passed to a simple op amp stage for driving a headphone.

Amenable to solderless breadboarding, or even literal breadboard construction using dead bug or Manhattan wiring, the circuit invites experimentation and looks like fun to fiddle with. And getting a handle on analog and RF concepts is always a treat.

[via r/electronics]

Shmoocon 2017: Dig Out Your Old Brick Phone

January 16, 2017 by 37 Comments

The 90s were a wonderful time for portable communications devices. Cell phones had mass, real buttons, and thick batteries – everything you want in next year’s flagship phone. Unfortunately, Zach Morris’ phone hasn’t been able to find a tower for the last decade, but that doesn’t mean these phones are dead. This weekend at Shmoocon, [Brandon Creighton] brought these phones back to life. The Motorola DynaTAC lives again.

[Brandon] has a history of building ad-hoc cell phone networks. A few years ago, he was part of Ninja Tel, the group that set up their own cell phone network at DEF CON. That was a GSM network, and brickphones are so much cooler, so for the last few months he’s set his sights on building out a 1G network. All the code is up on GitHub, and the hardware requirements for building a 1G tower are pretty light; you can roll your own 1G network for about $400.

The first step in building a 1G network, properly referred to as an AMPS network, is simply reading the documentation. The entire spec is only 136 pages, it’s simple enough for a single person to wrap their head around, and the concept of a ‘call’ really doesn’t exist. AMPS looks more like a trunking system, and the voice channels are just FM. All of this info was translated into GNU Radio blocks, and [Brandon] could place a call to an old Motorola flip phone.

As far as hardware is concerned, AMPS is pretty lightweight when compared to the capabilities of modern SDR hardware. The live demo setup used an Ettus Research USRP N210, but this is overkill. These phones operate around 824-849 MHz with minimal bandwidth, so a base station could easily be assembled from a single HackRF and an RTL-SDR dongle.

Yes, the phones are old, but there is one great bonus concerning AMPS. Nobody is really using these frequencies anymore in the US. That’s not to say building your own unlicensed 1G tower in the US is legally permissible, but if nobody reports you, you can probably get away with it.

The ARRL Raises A Stink About Illegal FPV Transmitters

January 16, 2017 by 38 Comments

We have all been beneficiaries of the boom in availability of cheap imported electronics over the last decade. It is difficult to convey to someone under a certain age the step change in availability of parts and modules that has come about as a result of both the growth of Chinese manufacturing and Internet sales that allow us direct access to sellers we would once only have found through a lengthy flight and an intractable language barrier.

So being able to buy an ESP8266 module or an OLED display for relative pennies is good news, but there is a downside to this free-for-all. Not all the products on offer are manufactured to legal standards wherever in the world we as customers might be, and not all of them are safe to use. We’ve all seen teardowns of lethal iPhone charger knock-offs, but this week the ARRL has highlighted an illegal import that could take being dangerous to a whole new level as well as bring an already beleaguered section of our community to a new low.

The products the radio amateurs are concerned about are video transmitters that work in the 1.2GHz band. These are sold for use with FPV cameras on multirotors, popularly referred to as drones, and are also being described as amateur radio products though their amateur radio application is minimal. The ARRL go into detail in their official complaint (PDF) about how these devices’ channels sit squarely over the frequencies used by GLONASS positioning systems, and most seriously, the frequencies used by the aircraft transponders on which the safety of our air traffic control system relies.

The multirotor community is the unfortunate recipient of a lot of bad press, most of which is arguably undeserved and the result of ignorant mass media reporting. We’ve written on this subject in the past, and reported on some of the proposals from governments which do not sound good for the enthusiast. It is thus a huge concern that products like those the ARRL is highlighting could result in interference with air traffic, this is exactly not the association that multirotor fliers need in a hostile environment.

The ARRL complaint highlights a particular model with a 5W output, which is easily high enough to cause significant interference. It is however just one of many similar products, which a very straightforward search on the likes of AliExpress or eBay will find on sale for prices well under $100. So if you are concerned with multirotors we’d urge you to ensure that the FPV transmitters you or your friends use are within the legal frequencies and power levels. We’re sure none of you would want an incident involving a manned aircraft on your conscience, nor would you relish the prospect of the encounter with law enforcement that would inevitably follow.

In the past we’ve taken a look at some of the fuss surrounding reported drone incidents, and brought you news of an Australian sausage lover in hot water for drone-based filming. It’s a hostile world out there, fly safe!

Shmoocon 2017: A Simple Tool For Reverse Engineering RF

January 15, 2017 by 23 Comments

Anyone can hack a radio, but that doesn’t mean it’s easy: there’s a lot of mechanics that go into formatting a signal before you can decode the ones and zeros.

At his Shmoocon talk, [Paul Clark] introduced a great new tool for RF Reverse Engineering. It’s called WaveConverter, and it is possibly the single most interesting tool we’ve seen in radio in a long time.

If you wanted to hack an RF system — read the data from a tire pressure monitor, a car’s key fob, a garage door opener, or a signal from a home security system’s sensor — you’ll be doing the same thing for each attack. The first is to capture the signal, probably with a software defined radio. Take this data into GNU Radio, and you’ll have to figure out the modulation, the framing, the encoding, extract the data, and finally figure out what the ones and zeros mean. Only that last part, figuring out what the ones and zeros actually do, is the real hack. Everything before that is just a highly advanced form of data entry and manipulation.

[Paul]’s WaveConverter is the tool built for this data manipulation. Take WaveConverter, input an IQ file of the relevant radio sample you’d like to reverse engineer, and you have all the tools to turn a radio signal into ones and zeros at your disposal. Everything from determining the preamble of a signal, figuring out the encoding, to determining CRC checksums is right there.

All of this is great for reverse engineering a single radio protocol, but it gets even better. Once you’re able to decode a signal in WaveConverter, it’s set up to decode every other signal from that device. You can save your settings, too, which means this might be the beginnings of an open source library of protocol analyzers. If someone on the Internet has already decoded the signals from the keyfob of a 1995 Ford Taurus, they could share those settings to allow you to decode the same keyfob. This is the very beginnings of something very, very cool.

The Github repo for WaveConverter includes a few sample IQ files, and you can try it out for yourself right now. [Paul] admits there are a few problems with the app, but most of those are UI changes he has in mind. If you know your way around programming GUIs, [Paul] would appreciate your input.

Shmoocon 2017: So You Want To Hack RF

January 15, 2017 by 6 Comments

Far too much stuff is wireless these days. Home security systems have dozens of radios for door and window sensors, thermostats aren’t just a wire to the furnace anymore, and we are annoyed when we can’t start our cars from across a parking lot. This is a golden era for anyone who wants to hack RF. This year at Shmoocon, [Marc Newlin] and [Matt Knight] of Bastille Networks gave an overview of how to get into hacking RF. These are guys who know a few things about hacking RF; [Marc] is responsible for MouseJack and KeySniffer, and [Matt] reverse engineered the LoRa PHY.

In their talk, [Marc] and [Matt] outlined five steps to reverse engineering any RF signal. First, characterize the channel. Determine the modulation. Determine the symbol rate. Synchronize a receiver against the data. Finally, extract the symbols, or get the ones and zeros out of the analog soup.

From [Marc] and [Matt]’s experience, most of this process doesn’t require a radio, software or otherwise. Open source intelligence or information from regulatory databases can be a treasure trove of information regarding the operating frequency of the device, the modulation, and even the bit rate. The pertinent example from the talk was the FCC ID for a Z-wave module. A simple search revealed the frequency of the device. Since the stated symbol rate was twice the stated data rate, the device obviously used Manchester encoding. These sorts of insights become obvious once you know what you’re looking for.

In their demo, [Marc] and [Matt] went through the entire process of firing up GNU Radio, running a Z-wave decoder and receiving Z-wave frames. All of this was done with a minimum of hardware and required zero understanding of what radio actually is, imaginary numbers, or anything else a ham license will hopefully teach you. It’s a great introduction to RF hacking, and shows anyone how to do it.