ExaGear is an x86 emulator for ARM computing devices. In the past we posted about ExaGear as together with WINE, it was an affordable solution that allowed Windows SDR apps to run on ARM devices like the Raspberry Pi 3. With ExaGear and WINE we were able to get Windows only SDR programs like Unitrunker, WinSTD C, DSD+, MultiPSK, PC-HFDL, Orbitron and Sondemonitor to run smoothly. In another previous post, DE8MSH was also able to use ExaGear to get Speclab running on his Raspberry Pi 3.
Unfortunately it appears that ExaGear is to be discontinued from February 28 onwards although they note that all previously purchased licences will continue to work. No reason has been given other than noting that it is their business decision. For now the downloads and ability to purchase licences is still active until February 28, so if ExaGear was a product you were interested in, you have just over a week to obtain it.
USA-Satcom is the programmer of XRIT Decoder, which is a popular (paid) Windows decoding application for GOES weather satellites. With a WiFi grid dish antenna, LNA and SDRplay, Airspy or even an RTL-SDR, high resolution full disk images of the earth can be downloaded from these geosynchronous satellites. Browse through our previous GOES posts for ideas and various tutorials about setting up a receiver.
USA- Satcom has just released version 1.4.6985 of the XRIT Decoder software package. New features include:
1) Improved image clarity. 2) An antenna Align Mode feature. 3) And a Viterbi and Eb/No (Energy per Bit to Noise Power Spectral Density Ratio akanormalized SNR) graph over time feature.
The improved image clarity reduces image artifacts at the Earth-space boundary of the image and improves the overall aesthetics of the colorization of the full disk images. The images are quite amazing. The resolution is far better than what can be shown here due to image size limitations for this site. Below is a full disk GOES 16 image from February 17, 2019 and a corresponding zoomed in portion to get an idea of the resolution and clarity (the actual full disk images are approximately 40MB PNG images each which are much greater resolution than the below image)
The antenna Align Mode is a great new feature that allows users to view the Signal Quality, Viterbi FEC, and Eb/No from a distance using large numeric values. This mode enables users to better view these values when fine tuning adjustments to GOES receiving antennas. The Eb/No and Viterbi graphing enables users to see how well their receiving system is doing throughout the day (e.g., over temperature and while the sun is in alignment with the receiving path).
GOES 16 Received by RSP2User
More updates from USA-Satcom to the XRIT Decoder software with a new patch from today. The XRIT file manager now provides IR image enhancements for GOES Bands 8 and 13. Here are some examples:
G16 CH13 & G16 Band8 Enhancements . Images received by RSP2user.
The SDRplay team have released an updated version of a program called "rsp_tcp" (originally written by F4FHH Nicholas). This is a streaming IQ server for SDRplay devices, which is directly ported from the original rtl_tcp code that was designed for RTL-SDRs. The rsp_tcp code is fully compatible with the rtl_tcp protocol, so this should allow almost any software that accepts an rtl_tcp stream as an input to use an SDRplay device as the SDR hardware instead of an RTL-SDR.
The downside to using this server is that in order to be compatible with the standard rtl_tcp protocol, the software will downgrade the RSP data stream from 14-bits to 8-bits only, thus forfeiting the RSP's greater dynamic range. However, if a custom ExtIO plugin is used on the client software, then the full 14-bits can be restored.
This software is based on a fork of F4FHH’s version of RTL TCP Server. It has been updated to support the RSP features, but also contains an extended mode. The extended mode allows the client (via a compatible interface) to fully control all aspects of the RSPs, including notch filters, Bias-T enable and switching ports (where applicable)
We have provided binaries for Windows, Mac and RPi on our downloads page and the source code for all platforms can be found on our GitHub repository: https://github.com/SDRplay/RSPTCPServer
To utilise the extended mode, extra commands need to be sent from the client. We have provided an example of this in the form of an ExtIO plugin. You can find the Windows dll on our downloads page and the source code for the plugin on our GitHub repository: https://github.com/SDRplay/ExtIO_RSP_TCP
In standard mode, the server will be compatible with any RTL server client.
Corrosive from the SignalsEverywhere YouTube channel is starting up a radio/SDR related podcast, and today has released episode one. The podcast is 22 minutes long, and in that time he discusses Es-hail-2, a geosynchronous satellite with an amateur radio transponder that was recently launched and activated, some of his favorite recent posts from our blog here at RTL-SDR.com, including posts about a 3D printed V-Dipole holder, Radwave RF Analyzer, cloning 433 MHz devices, and finally he ends the podcast by discussing the question of what SDR is right for you.
Podcasts are a great way to catch up on what's happening in the SDR and radio world so check it out below or over on the SignalsEverywhere podcast post.
Over on YouTube Tech Minds has posted a video explaining what Es'hail-2 satellite is and why it is interesting for hams and SDR users. Briefly Es'hail-2 is a recently launched geostationary TV satellite that covers Africa, Europe, the Middle East, India, eastern Brazil and the west half of Russia/Asia.
What's special about it is that apart from the TV transmitters, it also contains the worlds first amateur radio transponder in geostationary orbit. So amateur radio users within the region covered by the satellite can simply point their antennas to a fixed position in the sky to transmit to the satellite, and the signal will be rebroadcast over the entire covered area. With a simple LNB, satellite dish and SDR the signals can be received.
After explaining Es'hail-2 Tech Minds also shows a demo of Es'hail-2 radio traffic using a public WebSDR.
The Worlds First Geostationary Satellite For Ham Radio - Es'Hail 2 - Qatar OSCAR-100
Pager systems are famously known to be insecure, and due to the lack of encryption and high transmit power anyone with an RTL-SDR or other SDR can receive and decode pager messages. The users of pagers are mostly hospitals and doctors, and IT infrastructure professionals who need to be notified of server warnings and errors quickly. We have a text tutorial on decoding these messages with an RTL-SDR available here, and there are several previousposts discussing how insecure they are.
If you prefer a video tutorial, M6LME on YouTube has recently uploaded one where he explains the PDW pager decoding software, the VB-Audio 'banana' audio mixing software, and how to use SDR-Console with an RTL-SDR and the aforementioned software to receive and decode the signal.
How to Decode POCSAG & FLEX using an RTL-SDR Dongle
Over on his YouTube channel SignalsEverywhere, Corrosive has posted a new video tutorial explaining how to use the SDRAngel software for receiving signals in Windows. SDRAngel is a general purpose SDR program similar to programs like SDR#, HDSDR and SDR-Console, however it's layout and workflow is slightly different compared to other programs. SDRAngel also has some interesting features such as built in decoders for DMR, D-Star and Fusion digital voice signals and unlike most other general purpose SDR programs, SDRAngel is also capable of controlling transmit capable SDRs. Corrosive notes that he will discuss that feature in a future tutorial.
Corrosive's tutorial goes over the main points such as changing gain, changing sample rate, tuning to signals, and adding demodulators. In the video he uses an RTL-SDR as the receiver.
Thank you to IZ5RZR for writing in and sharing his two SatNOGS rotator builds with us. SatNOGS is an open source project that aims to make it easy for volunteers to build and run RTL-SDR or other SDR based RF ground stations that automatically monitor satellites, and upload that data to the internet for public access.
IZ5RZR writes that he's now made two rotators and one was modified to use a 5:18 stepper motor (which is upgradable to 50:1) to give more torque so that heavier antennas can be turned smoothly. His rotators are powered by a 12V battery charged by solar, and they can be controlled over WiFi with a PC/tablet/phone. He's also tested the rotators with a 24 dB parabolic grid antenna and found that the rotator could handle it even without a counterweight. He also notes that together with IK5XWA they've fixed a "Meridian Flip" bug in the firmware.
The Blockstream satellite API is now live on the main Bitcoin network. Blockstream satellite is a project that aims to use geosynchronous satellites to strengthen the Bitcoin network by continuously broadcasting the Bitcoin blockchain all over the world. This allows people without internet access (or with censored internet) to receive Bitcoin. Setting up a Blockstream satellite receive station is a matter of building an RTL-SDR based receiver (or other GNU Radio compatible SDR) with a small satellite dish and LNB.
The API was also updated and this has enabled a feature that allows you to upload a file of up to 10 kB via the internet, which will then be transmitted via the satellites to anyone who is running a Blockstream RTL-SDR satellite receiver. Payment for the transmission is taken via the Bitcoin Lightning Network and transmissions appear to work on a priority basis, with larger payments receiving higher priority. The file is distributed to all receivers, so they note that private messages would need to be encrypted with public keys distributed to recipients in other ways. This service is similar to what the Othernet (prev. Outernet) network offered in the past with the ability to transmit data, tweets and APRS messages over their satellite network. We think that cheap small data satellite transmissions could have some interesting applications in remote control.
We're excited to announce the #SatelliteAPI is now on mainnet! Pay with ⚡️ to broadcast data globally! Satellite Receiver v1.3 is also now released. This required update increases bandwidth & reliability for small antennas & those with low SNR. 🚀🛰️🌐 https://t.co/hXy0uzQndOpic.twitter.com/h2IV7ZDZsj
In related news on CryptoNewsZ it has been reported that a bitcoin lightning network transaction was completed over the 20M amateur radio band. The transaction was completed with the JS8 digital mode, which is similar to FT8 but designed for weak signal usage. The message was sent via the help of twitter, with @eiaine first sending money to @nvk via the internet. @nvk then sent the Lightning Network invoice over 21 JS8 messages via the 20M band to @eiaine who received it, thus confirming that the transaction was completed.
The SCaLE conference on open source and free software was recently held on March 10 in Pasadena, California. One of the talks by Ben Kuo AI6YR was titled "Linux, Raspberry Pi, RTLSDR, LAME and Open Source (A Recipe For Responding to Natural Disasters)". This talk was streamed live, and is archived on YouTube.
In the talk Ben discusses how RTL-SDR's can be useful in disaster response by putting radio communications onto online audio streaming sites like Broadcastify. He notes how difficult it was for residents affected by the California wildfires to get up to date information on how close the fire was to their house from news stations and authorities. In contrast information on the internet came in much faster and more accurately. He notes in particular how listening in to firefighter radio communications via online streams uploaded by RTL-SDR users can give the fastest and most up to date information to concerned residents.
Ben also mentions how it can also useful to track the movement of fires via the ADS-B flight tracking data transmitted by fire fighting aircraft. By watching the aircraft movements the spread of the fire can be determined.
In the YouTube video stream, Ben's talk starts at about 3:31:00 and the video below should start at that time. The three other talks recorded in this stream are all ham radio related and may also be of interest to you.
On March 14 the Soyuz MS-12 spacecraft mission was launched and this carried three astronauts to the International Space Station (ISS). Back on the ground, YouTube creator Tysonpower was able to receive the voice communications of Russian cosmonaut Alexey Ovchinin while the Soyuz spacecraft was approaching the ISS. To do this he used an Airspy SDR and home made QFH antenna, and he notes that reception could just have easily been achieved with an RTL-SDR.
Tysonpower has uploaded a video explaining what he received along with a subtitled and translated recording of the communication. More information also available on his blog post.
[EN subs] Empfang von Cosmonaut Alexey Ovchinin im Soyuz MS-12
QIRX SDR is a multimode SDR program compatible with the RTL-SDR. One of its defining features is that it has a built in DAB+ decoder. Recently beta version 2.01 of QIRX SDR was released which has some scanner, recording and spectra display improvements. We note that the beta version appears to be a DAB decoder only, with no multi-mode features. The new features and improvements include:
Scanner:
Configurable w/r to the Muxes to be scanned and/or included in the usual set of Muxes being used.
New algo, considerably faster
"Scan forever" feature, interesting for DX-ers wishing to observe Muxes over a longer time, particularly together with TII logging.
Selectable waiting time after recognition of a Mux, for TII logging.
Recorders:
TII Recorder: File structure improved, now directly importable into Excel, with TAB as separator.
Audio Recorder (DAB+ only): Format selectable between WAV (as usual) and pure AAC (with ADTS headers). The latter allows for high-quality recordings compressed by at least a factor of 10 compared to WAV. The popular Foobar2000 app is able to play these files. Not seekable yet though, because embedding in a suitable container is not yet implemented.
Spectra:
CIR with different scales (Samples, Distance, Time)
Indication of the correlation peaks used for the "FFT Window" determination in the CIR spectrum.
Recently we've heard of a new Linux distribution called SigintOS becoming available for download. SigintOS is an Ubuntu based distribution with a number of built in signal intelligence applications for software defined radios such as RTL-SDRs and other TX capable SDRs like the HackRF, bladeRF and USRP radios.
The distro appears to be very well executed, with a built in GUI that grants easy access to the some common sigint tools like an FM and GPS transmitter, a jammer, a GSM base station search tool and an IMSI catcher. SigintOS also has various other preinstalled programs such as GNU Radio, gr-gsm, YatesBTS, wireshark and GQRX.
The OS also teases an LTE search and LTE decoder which to access requires that you get in contact with the creators, presumably for a licencing fee. Regarding an LTE IMSI catcher they write:
LTE IMSI Catcher is not myth!
Due to the nature of LTE base stations, the capture of IMSI numbers seems impossible. LTE stations use GUTI to communicate with users instead of IMSI. The GUTI contains the temporary IMSI number called T-IMSI. This allows the operator to find out who is at the corresponding LTE station who is authorized to query T-IMSI information.
Can the GUTI number be found? Answer Yes!
How to find GUTI and T-IMSI numbers? Can be found with the help of SigintOS …
For detailed information contact@sigintos.com
The image comes as a 2GB ISO file, and it's possible to run it in WMWare or VirtualBox.
The famous HAARP (High Frequency Active Auroral Research Program) antenna array will be transmitting again from March 25 - March 28, 2019. HAARP is an antenna array which is used to perform experiments on the Earth's ionosphere and thermosphere by transmitting HF RF energy into it. With an HF capable receiver like the RTL-SDR V3 it is often possible to receive these transmissions from some distance away. As HAARP only rarely transmits, it is an interesting signal to catch when it is transmitting.
HAARP (High Frequency Active Auroral Research Program)
Ghosts in the Air Glow is an ionospheric transmission art project using the HAARP Ionospheric Research Instrument to play with the liminal boundaries of outer space.
Pairing air glow experiments in the ionosphere—false auroras creating soft, glowing spots in the sky—with SSTV images, audio and image signals articulated by artist Amanda Dawn Christie will be received and decoded via SDR (Software Defined Radio) equipment by amateur radio operators around the world, and streamed live online for audiences who do not have the equipment or expertise for reception.
“The facility, which was used by the military, has an air of mystery about it and has been the subject of many conspiracy theories over the years — that’s something I reflected upon when creating the piece.”
Ghosts in the Air Glow will consist of an hour-long transmission containing eight movements, each created for a specific frequency and intended to explore different concepts related to radio science and the HAARP site itself.
From Arctic wolves meeting the aurora to poetic texts written in Morse code and the NATO phonetic alphabet, the motifs covered by this transmission art work address issues related to military research, surveillance, political territories, ionospheric science, and conspiracy theories.
The first art transmission was sent earlier today, and if you missed it Amanda live streamed the signals being received on YouTube and the recording is available here. Future live streams will be available here. DK8OK has also posted about his reception on his blog.
Further transmissions are scheduled every day until March 28, and the transmissions schedule is available here. Each transmission consists of several 'movements', which consist of differing antenna array arrangements, frequencies being used, and signals being transmitted. If the text formatting of the movements is a bit difficult to read, Reddit user
grink has formatted it into a nice table in his post. To follow the transmissions it would be also wise to follow Amanda on Twitter, where she is posting the most up to date transmission frequencies.
The idea for the project came about when Christie met Christopher Fallen, the chief scientist at HAARP, at a hackers conference earlier this year. Fallen, who is an amateur radio operator, was intrigued by Christie’s proposition to use the IRI to create site-specific transmission art.
He agreed to open the facility to her, and when she gained backing from the Canada Council for the Arts, Ghosts in the Air Glow officially became the first Canadian-funded project to take place at HAARP.
“Art and science are often seen as separate efforts but they actually share many of the same inspirations and techniques. I’m excited to see HAARP, a unique scientific instrument, used for a comparably unique artistic performance,” says Fallen.
“Amanda’s project will be a valuable contribution to the 50-year collection of scientific work in the field of ionosphere radio modification, and also to the brand new collection of artistic work using powerful high-frequency radio transmitters and the upper atmosphere — it’s art directed from the ground but created in space!”
Interdisciplinary artist Amanda Dawn Christie. Photo by Concordia University
If you prefer a video explanation of the project, YouTube user OfficialSWLchannel has prepared a video which is shown below.
HAARP tests and Ghost in the Air Glow from Amanda Dawn Christie
DSDPlus is a popular piece of software often used with RTL-SDR dongles to listen to unencrypted digital voice signals such as P25 and DMR. Digital voice is now commonly used by many Police and emergency services as well as business radio. DSDPlus fastlane is DSD's paid upgrade which allows subscribers to access to the latest releases of DSDPlus early.
Over on the SignalsEverywhere YouTube channel, Corrosive has uploaded a quick video guide that shows how to use DSDPlus Fastlane and two RTL-SDR dongles to set up a Phase 1 P25 voice decoder that automatically follows a P25 trunking channel. The basic process involves running two FMP instances which is a program in the DSDPlus suite that connects to the RTL-SDR's and receives the signal. One DSDPlus instance monitors the trunking channel, and this tunes the second FMP+DSD instance to the frequency currently active in the trunking system.
Corrosive also explains how people who are subscribed to RadioReference can download pre-populated data files that will allow the DSDPlus event log to display talkgroup information so that you can see who is talking to who.
Digital Radio Scanning With DSDPlus Setup Fastlane | Tracking Phase 1 P25 Trunking System Tutorial
RSA Conference is an information security event that was recently held on March 4 - 8 in San Francisco. The talks have been uploaded to YouTube and from what we see there are three interesting SDR/RF related talks that may be worth looking at, which we show below. The full list of videos can be found on their YouTube channel.
RF Exploitation: IoT and OT Hacking with Software-Defined Radio
Harshit Agrawal, Security Researcher, MIT Academy of Engineering, SPPU
Himanshu Mehta, Team Lead (Senior Threat Analysis Engineer), Symantec
Recent years have seen a flood of novel wireless exploits, from vulnerable medical devices to hacked OT devices, with exploitation moving beyond 802.11 and into more obscure standard and proprietary protocols. While other non-WiFi RF protocols remain a mystery to many security practitioners, exploiting them is easier than one might think. SDR is changing the game for both offense and defense.Learning Objectives:1: Become familiar with common security concerns and attack surfaces in a wireless communication system.2: Understand the ease and prevalence of wireless exploitation, with sophisticated examples.3: Learn to view IoT devices, security and privacy collectively.
RF Exploitation: IoT and OT Hacking with Software-Defined Radio
Hunting and Tracking Rogue Radio Frequency Devices
Eric Escobar, Principal Security Consultant, SecureWorks
Rogue radio frequencies pose a substantial and often overlooked threat to both organizations and targeted individuals. This talk will explore the dangers of rogue radio frequencies and highlight tactics, techniques and tools which can be used to identify and locate potential threats.Learning Objectives:1: Understand the major ways rogue wireless frequencies can impact an organization.2: Develop a basic understanding of how to locate a rogue wireless signal.3: Gain a conversational knowledge of ways to identify and track a wireless signal.Pre-Requisites:Basic understanding of security principles. Basic understanding of wireless communication. Basic understanding of computer networks.
Hunting and Tracking Rogue Radio Frequency Devices
Wireless Offense and Defense, Explained and Demonstrated!
Rick Farina, Senior Product Manager, WLAN Software Security, Aruba Rick Mellendick, Chief Security Officer, Process Improvement Achievers LLC
This session will discuss the use of radio frequency, often overlooked for network enumeration and attack. The techniques to be discuss are used to identify authorized and unauthorized signals in an organization. Without understanding the offensive attacks an organization can’t perform effective defense. The talk will explain and demonstrate how to enumerate and gain access to resources through RF signals.Learning Objectives:1: Understand that wireless doesn’t just mean WiFi.2: Understand that the Bluetooth protocol can allow for direct attacks against phones, PCs and other devices.3: Learn that other RF attacks are very difficult to detect, and gain an understanding of what they look like.Pre-Requisites:The biggest prerequisite for our talk is an open mind and the ability to understand risk, and after the talk to better assess risk on your environment.
Wireless Offense and Defense, Explained and Demonstrated!
Over on his hackaday.io blog, Gonçalo Nespral has written about his experiences in recreating Samy Kamkars now famous low cost rolljam attack. A rolljam attack allows an attacker break into a car by defeating the rolling code security offered by wireless keyfobs. Back at Defcon 2015, an information security conference, Samy Kamkar presented a method for creating a $32 Rolljam device that consisted of two 433 MHz transceiver modules controlled by an Arduino.
In his version, Gonçalo was able to recreate the attack using a Yardstick One and an RTL-SDR. The RTL-SDR receives the signal, whilst the Yardstick One performs the jamming and retransmit functions.
Actually using this attack in a real scenario would be difficult due to the need to properly jam and receive the keyfob signal, which could prove tricky in an uncontrolled environment. However, there have been reports of criminals entering high end cars with wireless devices before and this could be one such attack method in use.
The important thing to learn is to be suspicious if your car key fob doesn't work on the first press while you are definitely in range of the car. To mitigate the possibility of wireless keyfob attacks, always use a manual key and if you must use the wireless keyfob, only unlock the car when standing right next to it, so that the keyfob signal is strong enough to overcome the jammer. Although it is still plausible that an attacker could attach the rolljam device to the car itself for greater jamming power, and then retrieve it later.
In his last video, Corrosive from the SignalsEverywhere YouTube channel showed us a quick guide on setting up a Phase 1 P25 digital voice decoder with two RTL-SDR dongles and the DSDPlus Fastlane decoder.
Now in his latest video Corrosive continues with the DSDPlus tutorial and this time explains how to set up priority and groups. On a trunked radio system there may be many different agencies using the same system simultaneously. Without priorities and groups, you would be listening to all communications in the system, and following a conversation within a particular agency would be difficult. Setting up priorities and groups allows you to filter out the conversations that you are not interested in, allowing you to focus on listening in to a particular agency only.
RTL SDR Digital Radio Scanning Priority and Groups With DSDPlus Fastlane Setup Tutorial
Thank you to Alex Happysat for writing in and letting us know about the next upcoming ISS SSTV event which will begin on 11 April at about 18:00 UTC and end on 14 April 2019 18:00 UTC. If you were unaware, the International Space Station (ISS) transmits SSTV images several times a year to commemorate special space related events. SSTV or Slow Scan Television is an amateur radio mode which is used to transmit small images over radio signals.
The images will be transmitted constantly at 145.8 MHz over the active period and they are expected to be in the PD-120 SSTV format. To receive the images you can use a simple RTL-SDR dongle and the MMSSTV software. A tuned satellite antenna like a QFH, turnstile, or tracking Yagi would be preferred, but many people have had good success before using simpler antennas like a V-Dipole. Software like Orbitron, GPredict, various Android apps or NASA's Spot the Station website can be used to determine where the ISS is and predict when it will be over your location.
The next big event will be the ARISS SSTV event that starts Thursday, April 11 about 18:00 UTC and will be operational until about 18:00 UTC on Sunday, April 14. Since this event will run continuously for 72 hours, folks in the higher latitudes should have a pretty good chance to receive all 12 of the images. Operators in the mid latitudes should be able to get most of them depending on location. Good Luck and Enjoy!
Alex also mentions that for this and other ISS events AMSAT Argentina is handing out ARISS-SSTV Diplomas to amateur radio operators who receive, record and upload at least 15 images received from the ISS, in at least two different radio operation with a month or more in between then.
If you cannot set up a receiver, it is possible to use R4UAB's WebSDR which will be available directly at websdr.r4uab.ru. However, note that internet reception is not valid for the AMSAT Diploma. An example of WebSDR SSTV reception and decoding from a smaller ISS SSTV event held a few days ago is shown below.
His initial idea was to create a flexible and open portable SDR device, however keeping the device open and built for general use meant increased complexity which quickly slowed his progress. Instead [Nathan] decided to focus on just ADS-B for his portable device as living near an airport he’d been interested in aircraft tracking since his first SDR arrived.
The device consists of a Raspberry Zero, RTL-SDR, 3.5″ IPS LCD and a battery pack for portability. For software he uses dump1090 with some custom code for the map plotting. Together with a 3D printed case and some buttons, the result is a very professional looking portable aircraft tracking device.
Hopefully Nathan will continue updating his project page so that others may replicate it on their own.
Raspberry Pi Zero and RTL-SDR Portable ADS-B Receiver