OTA: Reverse Engineering, Sky-High LoRaWAN, Budget Radio Astronomy, and More

VK2Seb's Filter Tutorial

If you subscribe to OTA via email you may have missed Karl Woodward’s second entry in the new LimeSDR Made Simple series, published earlier this week, which aims to introduce you to the concepts you’ll need to get the most from SDR in the real world.

Following the first entry in the series last month, which covered core SDR concepts and the physical connections on the LimeSDR itself, Karl’s second post goes into solving impedance matching and takes a close look at the LMS7002M chip – the field-programmable radio frequency (FPRF) integrated circuit which makes the LimeSDR possible.

Karl’s next entry in the series will cover using the Lime Suite software, along with tweaks and modifications which can improve – or break – a LimeSDR application.

If you’re using SDR for the purposes of reverse-engineering or signal analysis, 雪碧 0xroot.com’s RFSec-ToolKit is a great collection of resources.

Highlighted on the Myriad-RF forum by Axeman, the RFSec-ToolKit provides links to software and utilities designed for signal reception, capture, analysis, playback, and visualisation. Although not exhaustive, it’s a great place to start as a means of seeing if a tool has already been developed to help you on your way.

Towards the end of the radiofrequency section a selection of YouTube video tutorials are provided, covering everything from the official GNU Radio channel to the OsmocomBB protocol-level GSM security analysis tool. The list also covers RFID/NFC and Bluetooth short-range radio tools and utilities.

AB Open’s Andrew Back has written of work to install a long-range radio wide-area network (LoRaWAN) regional gateway on top of a 275-foot tall landmark – making it likely to be the highest LoRaWAN gateway in the UK.

Installed on the top of the Wainhouse Tower the gateway provides excellent line-of-site coverage of the Calderdale area but brings its own issues to resolve, in particular the problem of unreliable power. “Given that power is only available at the top of Wainhouse Tower when the architectural lighting is illuminated — which in some months can be as little as 3 hours a day — there were other challenges to be solved,” Andrew writes of his team’s work.

“Since it’s connected to The Things Network,” Andrew adds of the gateway, “it’s also open for use by any other members of TTN community and any questions should be directed to the Calderdale Community category on The Things Network forums.”

LNA4ALL manufacturer Adam Alicajic has published a paper on creating a low-cost hydrogen-line front-end for radioastronomy on a budget by cascading two remote low-noise amplifiers (LNAs).

Brought to our attention by RTL-SDR, Adam’s documentation demonstrates how to create a low-noise system for receiving at 1420.4058 MHz – the hydrogen line – by chaining two of his LNA4ALL low-noise filters along with a pair of hydrogen-line filters and bias tees.

Adam found that placing the two LNA4ALL boards and one hydrogen line filter at the antenna end then a second hydrogen-line filter at the receiver end of the coaxial cable run could reduce the noise figure of an RTL-SDR from 6dB at 1420 MHz to around 1dB – making it suitable for hydrogen line detection. Adam has also promised to write a second tutorial on building antennas focused on hydrogen line detection to complete a low-budget radioastronomy rig.

Engineer Seb Holzapfel has published a video on techniques for rapid prototyping of RF filters, covering quarter-wavelength and radial stubs, stepped-impedance low-pass filters, and an end-coupled band-pass filter.

Seb’s approach to prototyping these filters is designed around as low a cost as possible, using copper tape on blank FR4 circuit board sheets – “good up to a couple gigahertz,” he explains. In the roughly 20-minute video Seb demonstrates the building and testing of a quarter-wavelength stub, a radial stub, and a stepped-impedance microstrip low-pass filter, before using the Quite Universal Circuit Simulator (Qucs) to synthesise a 10GHz end-coupled microstrip band-pass filter.

Hackaday’s coverage of the Wireless Hacking Village at the DEF CON 25 conference includes a great write-up on a talk by Michael Ossman demonstrating reverse engineering of direct-sequence spread spectrum (DSSS).

“Michael really pulled a rabbit out of a hat with his demos which detected the DSSS signal parameters in what appeared to be nothing but noise,” Hackaday’s Mike Szczys writes. “You can see below the signal with and without noise; the latter is completely indiscernible as a signal at all to the eye, but can be detected using his techniques. Michael mentioned simple math tricks, and he wasn’t kidding. It’s easy to assume that someone as experienced in RF as he would have a different definition of ‘simple’ than we would. But truly, he’s using multiplication and subtraction to do an awful lot.”

Mike has provided as detailed a write-up as possible, complete with snaps of the slides and demonstration, while those interested in the technique are advised to keep an eye on the DEF CON website for a video of the whole presentation.

RTL-SDR has written of a video by YouTube user Theali2062 demonstrating how to recognise interference from solar power inverters – something which may become more prevalent as the costs of home and commercial solar power systems continue to fall.

“This is what happens if you or your neighbours install a dodgy quality solar power system,” Theali2062 writes in the description of his video. ‘I am using a UHF phased array antenna facing away from the source of interference but I am picking up very strong interference. Just touching the antenna connector of the RTL-SDR is enough for the interference to show up. The solar inverter certainly fails the Part 15 FCC requirements.”

Tysonpower’s Manuel has written of his experiments in receiving slow-scan TV (SSTV) imagery from the International Space Station during the 20th anniversary of the ARISS project.

Updated live during the weekend-long experiment, the blog covers Manuel’s attempts at receiving the SSTV PD120 images using a laptop, SDR dongle, LNA4ALL, FM filter, and a vertical dipole antenna. Initial attempts were thwarted by the death of the laptop, but its replacement with another computer resulted in success before other technical difficulties raised their heads. The final score: three full images, two partial images, one near-full but noisy image, one half image, and what Manuel describes as “a very noisy part of an image.”

Finally, members of the eHam.net forum have been discussing a transmitter build with a difference: using components from a microwave oven to construct something capable of transmitting at gigahertz frequencies.

While some counselled caution – “I am going to hazard a guess that converting a microwave oven into a safe transmitter is only possible for someone who doesn’t need to ask about it,” warns member G8HQP – others provided links to documentation on building microwave transmitters from a range of sources, from garage door openers to the magnetron of an off-the-shelf microwave oven. “Not a quick weekend project,” concludes member G3RZP.

Focus On: Dr. David Mills

Dr. David Mills

OTA’s Focus On is a series of interviews with notable members of the Myriad-RF and wider software defined radio community. If you’d like to nominate someone to be interviewed, or would like to be interviewed yourself in a future OTA, send your proposal to ota@myriadrf.org.

Dr. David Mills’ day job, like many of those passionate about software defined radio, involves electromagnetic radiation – but at frequencies ever-so-slightly higher than most. Say, 30 petahertz to 30 exahertz. “I work in the dental school of Queen Mary University of London designing and building CT [Computer Tomography] scanners,” he explains. “They are used for all sorts of proper research on teeth and bones, but I also use them to read old scrolls and do heritage science research. Part of the fun of the job is commissioning new systems where I can scan anything I like, so I started #xraymylunch – a guessing game on Twitter where I post X-rays and CT scans of whatever I’m eating and ask people to identify it.”

David’s introduction to radio technology came at an early age. “I’ve been interested in electronics and radio for as long as I can remember – I built my first radio when I was 6,” he recalls. “I saw a demo of some early SDR technology at an open day event at QMUL in the early 2000s. It was all very prototype and expensive then, but soon after I picked up a SoftRock SDR receiver kit and started playing. I wrote an SSTV [Slow-Scan Television] decoder then some code to decode the BBC Radio 4 long wave and Rugby [MSF] time signals. I lost interest in radio for a few years, then got back into it via the RTL dongles, a HackRF and lately the LimeSDR.

“Originally I was drawn to SDR just for the ability to visualise a large section of the spectrum, but soon after I discovered how to write my own software to do things that were not available at the time or didn’t work on the platforms I use,” David explains. “I was specifically drawn to the LimeSDR because of the wide frequency coverage and the fact it supports full duplex transmission, something the my other SDRs do not.”

When David isn’t using the CT scanners, his workstation is largely comprised of affordable second-hand equipment linked to an SDR. “I use either the LimeSDR or the HackRF with a collection of amplifiers and filters I’ve pulled from decommission broadcast equipment picked up cheaply from eBay or radio rallies,” he explains. “For weather satellite reception on 137 MHz I use a set of coax stub filters to reduce interference from broadcast FM and the radio pager systems. I have Yagi antennas for the 144, 433 and 1296 MHz bands.”

When asked to recount his proudest achievement with his SDR experiments, David has to think. “I’m torn between the first time I ever got valid data from one of my own decoders, or recently detecting amateur signals reflected from the moon on 1296 MHz with a very lash-up setup,” he offers. “I had the LimeSDR connected directly to my 25 element 1296 MHz yagi antenna, while I hand-held the antenna and pointed it at the moon.”

For David, the core of a what makes an SDR of interest is simple. “Good documentation and integration with with GNURadio are a must,” he explains. “The use of FPGAs [Field-Programmable Gate Arrays] in SDR is very interesting, too, and something I really should devote some time to learning more about.”

When it comes to getting started, though, there are no shortcuts, David warns. “It really depends what their interests are,” he explains when asked what advice he would give to someone taking their first steps in the field of SDR. “If they want to operate data modes on the amateur bands, I’d suggest something totally different to someone that wants to look at RF data security. Radio experimentation is such a broad field, there is something for everyone no matter their interest – or budget!”

Asked, as is Focus On tradition, to recount any ‘learning experiences’ he has had along the way, David’s response is suitably unusual. “I killed a couple of RTL dongles with thermal shock,” he laughs, “by cooling them with liquid nitrogen in an attempt to get the thermal noise down so I could detect the interstellar hydrogen line at 1420 MHz. Aside from that, I’ve been pretty lucky.”

Leave a Reply