Decoding Satellite-based Text Messages With RTL-SDR And Hacked GPS Antenna

August 21, 2015 by Rick Osgood 19 Comments

[Carl] just found a yet another use for the RTL-SDR. He’s been decoding Inmarsat STD-C EGC messages with it. Inmarsat is a British satellite telecommunications company. They provide communications all over the world to places that do not have a reliable terrestrial communications network. STD-C is a text message communications channel used mostly by maritime operators. This channel contains Enhanced Group Call (EGC) messages which include information such as search and rescue, coast guard, weather, and more.

Not much equipment is required for this, just the RTL-SDR dongle, an antenna, a computer, and the cables to hook them all up together. Once all of the gear was collected, [Carl] used an Android app called Satellite AR to locate his nearest Inmarsat satellite. Since these satellites are geostationary, he won’t have to move his antenna once it’s pointed in the right direction.

As far as antennas go, [Carl] recommends a dish or helix antenna. If you don’t want to fork over the money for something that fancy, he also explains how you can modify a $10 GPS antenna to work for this purpose. He admits that it’s not the best antenna for this, but it will get the job done. A typical GPS antenna will be tuned for 1575 MHz and will contain a band pass filter that prevents the antenna from picking up signals 1-2MHz away from that frequency.

To remove the filter, the plastic case must first be removed. Then a metal reflector needs to be removed from the bottom of the antenna using a soldering iron. The actual antenna circuit is hiding under the reflector. The filter is typically the largest component on the board. After desoldering, the IN and OUT pads are bridged together. The whole thing can then be put back together for use with this project.

Once everything was hooked up and the antenna was pointed in the right place, the audio output from the dongle was piped into the SDR# tuner software. After tuning to the correct frequency and setting all of the audio parameters, the audio was then decoded with another program called tdma-demo.exe. If everything is tuned just right, the software will be able to decode the audio signal and it will start to display messages. [Carl] posted some interesting examples including a couple of pirate warnings.

If you can’t get enough RTL-SDR hacks, be sure to check out some of the others we’ve featured in the past. And don’t forget to send in links to your own hacking!

Design Diary: Varactor-Tuned Regen Receiver

August 16, 2015 by Al Williams 19 Comments

[QRP Gaijin] likes to build regenerative receivers. If you’ve ever built a serious one, you know there are (at least) two problems: One is you need a variable capacitor (hard to find these days). The other annoyance is that if you cover a wide frequency range, you probably need more than one coil.

[QRP Gaijin’s] latest radio design doesn’t have either of these problems. He uses a coil with a single pole double throw switch to bandswitch a single coil. There is no traditional main tuning capacitor. Instead a 1SV149 varactor provides the radio’s main tuning capacity (the diode tunes between 35 to 500 pF).

The post provides a nice design and a neat looking build in a Tupperware container (well… the outside is neat, at least; the inside is… best left inside the Tupperware). Better still, [QRP Gaijin’s] post details how he got to the final design, starting with the idea, and detailing the original design and the changes he made along the way. He also used data from an earlier build to limit how much the regeneration control has to be changed over wide frequencies and details how that changed the design. The prototype actually lacks the planned bandswitch, but will cover 3 to 30 MHz with the right coil.

There are certainly simpler regenerative receivers out there. However, the sophistication of this design along with the details of the designer’s thought processes makes this an interesting intermediate weekend project.

Continue reading “Design Diary: Varactor-Tuned Regen Receiver” →

Tricking A Car Stereo To Think Your Cellphone Is A Tapedeck

August 13, 2015 by Kevin Dady 25 Comments

When you have an older vehicle there’s not a lot of options in the stock stereo department, often a CD player and tape deck is what you get. When you want to play your tunes from your mobile what do you do? Buying an adapter, or a new head unit for that matter, isn’t any fun. So why not hack it? This isn’t just a mechanical marriage of a Bluetooth dongle and an elderly stereo. Some real work went into convincing the stereo that the BT receiver was the stock tape deck.

Attacking the outdated Cassette deck [kolonelkadat] knew that inside the maze of gears and leavers, most of it is moving around actuating switches to let the radio know that there is a tape inside and that it can switch to that input and play. Tricking the radio into thinking there is a tape inserted is handled by an Arduino. Using a logic analyzer [kolonelkadat] figured out what logic signals the original unit put out and replicating that in his Arduino code.

Audio is handled by the guts of a bluetooth speaker with the output redirected into the radio where the signal coming off the tape head normally would have been directed. Join us after the break for a couple of videos with all of the details.

Continue reading “Tricking A Car Stereo To Think Your Cellphone Is A Tapedeck” →

DEF CON: The Proxy For ProxyHam

August 7, 2015 by Brian Benchoff 23 Comments

Two weeks ago, news broke of an incredible abuse of power from the National Security Agency. A DEF CON talk was cancelled, and speculation raged that information was not free. This was the ProxyHam, a device that puts you miles away from any agency hunting down your IP address.

Of course, as with just about every DEF CON talk picked up by the press, ProxyHam is an ill-conceived, terrible idea. You can replicate it with parts bought from newegg, and despite using a highly directional antenna the FCC – or any other government agency – can still track you down.

In lieu of a talk on using off-the-shelf networking hardware in the way it was intended, [Dave Maynor] and [Robert Graham] of Errata Security gave a talk at DEF CON that is the proxy to the ProxyHam. They completely debunked the outrageous speculation surrounding the cancellation of the DEF CON talk and managed to introduce a new version of Internet over radio that is actually useful for the security-minded individual.

The ‘debunking’ part of the Errata Security talk was exactly what anyone would expect; the talk was probably cancelled because the creator of ProxyHam exceeded radiated power limits, the FCC caught him, or simply because of ‘advice from counsel’. No big deal; someone was doing something illegal – encryption over ISM bands – and the things you would expect to happen in fact happened.

In the last two weeks, the guys replicated the ProxyHam build, but found a few major shortcomings. Even with a highly directional antenna, interested parties could still track you down. This led the guys at Errata Security to make this system better. They managed to do it in two weeks.

The Errata Security relies on JT65A – a radio mode made for very weak signals – to hide signals underneath the noise floor. By multiplexing data across multiple channels, this system has about the same bandwidth as a 56kbps modem from 1999. It’s not much, but it is possible to use this proxy for ProxyHam over 20 miles away from where you’re stealing WiFi from. That’s far better than ProxyHam could ever manage, and all the transmissions stay below the noise floor. The FCC and similarly equipped agencies might be able to find you, but no one with a $20 SDR dongle will.

There are no releases yet, but Errata Security plan to make the software that allows this multiplex transmissions available soon, and hope to have a Raspberry Pi-based hardware solution for this technique coming shortly. It’s a radio proxy solution that’s actually somewhat secure, and won’t immediately draw the ire of the FCC.

$40 Antenna Analyzer With Arduino And AD9850

August 6, 2015 by Al Williams 39 Comments

If you are a hacker, you might consider ham radio operators as innovative. Most people, however, just see them as cheap. So it is no surprise that hams like [jmharvey] will build an antenna analyzer from a DDS module and an Arduino instead of dropping a few hundred dollars on a commercial unit. As he points out, you probably only need an analyzer for a day or two while you set up an antenna. Unless you are a big time antenna builder, the unit will then sit idle on the shelf (or will wind up on loan to hams even cheaper than you are).

The design is rooted in another proven design, but changed to take advantage of parts he happened to have on hand. Although the build is on a universal circuit board, [jmharvey] used Eagle to lay out the circuit as though it were a PCB. Since placement can be important with an RF circuit, this isn’t a bad idea. It’s always easier to move stuff around on the screen than on the perf board.

Since this is a no frills, unit, you are expected to grab the output from the Arduino and manually put it in a spreadsheet to plot the results. There is another version of the Arduino code that drives an OLED screen, although you still need a PC to kick the process off. One interesting feature of the Arduino code is how it deals with the nonlinear nature of the diodes used in the circuit. After plotting the values with known loads, [jmharvey] broke the diode operation into three regions and used different equations for each region. Even so, he warns that readings higher than 1:1 VSWR are only accurate to 10% or 20% – still good enough for ham shack use.

If you want an antenna analyzer for $40 (or less, if you have a good stock of parts) this looks like a worthwhile project. If, however, you want to repurpose it to Rickroll your neighbor’s AM radio, you might want to go with the commercial unit.

Click past the break to see the analyzer in action.

Continue reading “$40 Antenna Analyzer With Arduino And AD9850” →

Downloading Satellite Images Via FM Radio

August 2, 2015 by James Hobson 63 Comments

Did you know weather satellites transmit their weather images over an FM frequency? And now that you know… You can intercept them yourself with a $10 FM radio dongle!

American NOAA weather satellites are in a polar orbit around earth, and each one will pass the same point approximately every 12 hours. When it is overhead, the signal is strong enough to receive. After [Matt] found out this tidbit of knowledge, he had to learn how to intercept the images himself.

The satellites transmit the images over the 137MHz band, and using a radio tuner USB dongle, you can record the transmission and then decode it into a picture. He used CubicSDR to tune and record the signal, and then Soundflower to pull out interference, and finally WXtoIMG — which starts recording when the satellite is above, and decodes the image.

[Thanks for the tip Amirgon!]

Simple One-Chip Regenerative Receiver

July 26, 2015 by Al Williams 22 Comments

Crystal radios may be the simplest kind to make, but regenerative receivers are more practical and only a little more complicated. A recent design by [Selenium] is super simple because it uses a single LM386 audio amplifier IC.

You might be surprised that you can convert an audio amplifier to a receiver using just a handful of components (a variable capacitor, a coil, a handful of capacitors, and a speaker). However, [Selenium] realized he could subvert the gain and bypass pins to cause regeneration and wound up with a very simple receiver.

If you haven’t looked at regenerative receivers before, the principle is simple (and dates back to 1912). An oscillator is an amplifier that gets (theoretically) an infinite amount of gain at one particular frequency. A regenerative receiver is just an amplifier that is almost (but not quite) at the point of oscillation. This gives it very high frequency-specific gain and a measure of selectivity. You can also nudge the receiver just into oscillation to receive CW or SSB signals.

[Selenium] built his prototype on an old receiver chassis because it had the IC and the variable capacitor already in place. However, others have built successful copies on breadboards ([Austin Heller] created several good looking breadboard versions) and on PCB material. [Selenium] also released some other unique LM386-based designs that use more parts (and, probably, have better performance). Looks like a simple way to build a practical receiver.