Escolar Documentos
Profissional Documentos
Cultura Documentos
SoftwareDefinedRadio 2.0
BalintSeeber(ApplicationsSpecialist&SDREvangelist)
balint@ettus.com
balint@spench.net
@spenchdotnet
ISEE3
InternationalSun/Earth
Explorer3
Launched:August12,
1978
HeliocentricOrbit
Studyinteraction
betweensolarwind
and
Earthsmagneticfield
ISEE3
RenamedICE:
InternationalCometary
Explorer
Firstspacecraftinhalo
orbitatanEarthSunL1
(Lagrangepoint)
Firstspacecrafttopass
throughtailofacomet
(GiacobiniZinner)
OldTelemetryScreen
Overview
RestaurantPagers
RDSTMC
PrimarySurveillanceRADAR
RFID
ISEE3
50MHzBW
GSMBCCH&Traffic
Dialplan
101 Registration
Textback4to10digitnumbertoregister
411 Info
600 EchoTest
777 Time
778 ANI
2103 Me
400MHzBand
50MHz 250MHz(200Msps,120MHzRFBW)
SpectrumMonitoring
SpottheAntennas
SpottheAntennas
SpottheAntennas
SpottheUSRPs
StitchedFFTs
StitchedFFTs
USRPB200&B210
USB3.0(buspowered!)
56MHzbandwidth
70MHz 6GHz
2x2MIMO
RestaurantPagers
HackingtheWirelessWorldwith#sdr
@spenchdotnet
Yourfoodisready?
Pagersinformwaitingcustomertheycan
collecttheirorder
Assumingtheirorderisready
Order&collectionrateshouldbe~same
Unlesseveryoneispagedatonce
Step1:Frequency
Either:
Findfrequencylabelonthedevice
FindFCCIDondeviceandcheckonline
Scanspectruminlikelyranges(e.g.450470MHz)
Step1:Frequency
Step1:Frequency
Notehowoftentransitionsoccur
(nolongrunsof0or1).
Implieslineencodingisinuse
(helpsclockrecoveryatreceiver).
Flowgraph
Step2:ChannelSelection
Step3:FSKDeviation
Step4:Quadrature Demod
Step5:BaudRate
Step5:ClockRecovery
Step6:LineEncoding
ManchesterEncoding
ManchesterViolation
Step7:CompareChangingBits
Step8:FindingtheID
Modulator
Reversethedecodingprocess:
1. Constructpacket
a)
b)
c)
d)
2.
3.
4.
5.
Preamble(wakeupreceiver)
Magicheader(sync&systemID)
Pagernumber
Checksum
Interpolate(choosesamplesperbit)
FrequencyModulate
Applypulseshapingfilter(ideally)
Resamplefortransmitter
Modulator
ModulatorOutput
Modulator
RemoteControl
Slider
POCSAG
Otherrestaurantpagersystemsadopta
standard
Decodewithgrpocsag
Modifiedtoendframedecodingwhensquelch
closes
POCSAGDecode
POCSAGFrames
---[00] Address: 001dc168 function: 00000000
[01] (001dc168) Data: 05[5] 0c[ ] 03[3] 03[3] 03[3]
[02] (001dc168) Idle
=== SQUELCHED (residue: 5) ===
---[00] (ffffffff) Idle
[01] (ffffffff) Idle
[02] (ffffffff) Idle
[03] (ffffffff) Idle
[04] (ffffffff) Idle
[05] (ffffffff) Idle
[06] Address: 001dc15b function: 00000000
[07] (001dc15b) Data: 05[5] 0c[ ] 03[3] 03[3] 03[3]
[08] (001dc15b) Idle
=== SQUELCHED (residue: 5) ===
---[00] (ffffffff) Idle
[01] (ffffffff) Idle
[02] (ffffffff) Idle
[03] (ffffffff) Idle
[04] (ffffffff) Idle
[05] (ffffffff) Idle
[06] Address: 001dc15b function: 00000000
[07] (001dc15b) Data: 05[5] 0c[ ] 03[3] 03[3] 03[3]
[08] (001dc15b) Idle
=== SQUELCHED (residue: 5) ===
POCSAGFrame
---[00] (ffffffff) Idle
[01] (ffffffff) Idle
5b=01011011
[02] (ffffffff) Idle
[03] (ffffffff) Idle
[04] (ffffffff) Idle
[05] (ffffffff) Idle
[06] Address: 001dc15b function: 00000000
[07] (001dc15b) Data: 05[5] 0c[ ] 03[3] 03[3] 03[3]
[08] (001dc15b) Idle
=== SQUELCHED (residue: 5) ===
PagerFrameConstruction
Preamble
SYNC
Address:System&Pager
Scheduleaddresstoappearincorrectslot
PadwithIDLEs beforehand
Pageraction
TrailingIDLE
ApplyBCH(31,21)ECCtoeachslot
POCASGModulator
ZigBee
Rolesreversed:pagerunittransmits
PagerunithasintegratedRFIDreader
RFIDchipstuckonunderside
ofeachtable
Placingpagerunitontable
transmitspager numberand
table number
2.4GHzISMband
Decodewithgrieee802154
ZigBee Transceiver
DecodedZigBee
Decoded
Pager
Pagers:
38=0x26
54=0x36
Table:
36=0x24
HostagePager
Pagersgetangrywhensystembroadcast
(beacon)isnotheardwithintimeout
Flash&vibrateuntiltheyarereturnedwithin
range
Takeapagerhostagebybroadcastingbeacon
RDSTMC
HackingtheWirelessWorldwith#sdr
@spenchdotnet
FMBroadcastBand
FMBroadcastBand
RadioDataService
SubcarrieroncommercialFMstations
Notaudible(filteredout)
BPSK@1187.5bps
Listen&decodewithgrrds
StereoFMwithRDS:Receiver
RadioDataService
TrafficMessageChannel
Type8ARDSgroupmessage
Compactrepresentationvialookuptable:
Event
Location
Duration
Examples:
Congestion
Accidents
Roadwork
TrafficMessageChannel
TrafficMessageChannel
EncryptedLocationCodes
Locationcodes:
Encryptionkeys:
Schedule:
Receiverupdate:
16bitforagiven
geographicalarea
16bit
Onerandomlychosen
eachdayfrom31
standardkeys
KeyIDbroadcast
constantly
DailyKeyID
Patterns
Alwaysthreeuniquetemperaturereports
Key:EventID
Value:Location
GroupofthreeEventIDsalwaysthesame
EncryptedLocationIDsalwaysthesamefor
givenEncID
EventIDsidenticalforperiodofdays/weeks
Canvaryaftersometime,buthidden
(unobserved)valueisalwaysthesame
Temperatures
Patterns
Days
KeyID(random
eachday)
K1
K2
K2
K3
GroupPeriod
P1
P1
P2
P2
L1
evt(P1,L1):enc(K1, L1)
evt(P1,L1):enc(K2, L1)
evt(P2,L1):enc(K2, L1)
evt(P2,L1):enc(K3, L1)
L2
evt(P1,L2):enc(K1, L2)
evt(P1,L2):enc(K2, L2)
evt(P2,L2):enc(K2, L2)
evt(P2,L2):enc(K3, L2)
L3
evt(P1,L3):enc(K1, L3)
evt(P1,L3):enc(K2, L3)
evt(P2,L3):enc(K2, L3)
evt(P2,L3):enc(K3, L3)
HiddenPlain
Location
Transmittedovertheair:
Event
= evt(period, plain location)
Location = enc(key of the day, plain location)
SecurityAnalysis
16bitisvery short
Identicalgroupoflocationcodesare
broadcastonadailybasis
Unknownbutreusedplaintext
Singulareventscanbecorrelatedfroma
trustedsource
Knownplaintext
SingularEventfromTrustedSource
InputData
PlainLocation
L1
L2
L3
K1
enc(K1, L1)
enc(K1, L2)
enc(K1, L3)
K2
enc(K2, L1)
enc(K2, L2)
enc(K2, L3)
K3
enc(K3, L1)
enc(K3, L2)
enc(K3, L3)
K4
enc(K4, L1)
enc(K4, L2)
enc(K4, L3)
K5
enc(K5, L1)
enc(K5, L2)
enc(K5, L3)
KeyID
1. Bootstrap:findallpossibleplainlocations&keysthatresultinenc(K1,L1)
2. Giventhosekeys,findallpossibleplainlocationsrecordedwiththatKeyK1(i.e.L2,L3)
RememberpoolofpossibleplainlocationsforeachL&poolofpossiblekeysforK
3. ForeachremainingK,repeatmaintainingpoolofpossiblekeysforeachK:
FindallpossiblekeysgivenpoolofpossibleplainlocationsforeachL
Repeat,filteringpoolsuntilonlyonematchremains
Removeitemfrompoolwhenenc(K,L)inputdata
Algorithm
PossiblePlainLocationPools
L1
K2
K1
L2
L3
Plain
Location
PossibleKeyPools
K4
L1
L2
L3
K1
enc(K1, L1)
enc(K1, L2)
enc(K1, L3)
K2
enc(K2, L1)
enc(K2, L2)
enc(K2, L3)
K3
enc(K3, L1)
enc(K3, L2)
enc(K3, L3)
K4
enc(K4, L1)
enc(K4, L2)
enc(K4, L3)
K5
enc(K5, L1)
enc(K5, L2)
enc(K5, L3)
KeyID
Iterate&
Filter
K5
K3
Despite16bits,
manypotential
keys/plainlocations
aregeneratedat
thestartdueto
natureofenc(K,L)
Results
Results
Convergenceexpeditedbyadditionofsingular
events
vehicle fire(s)
flooding
object(s) on roadway {something that
does not neccessarily block the road
or part of it}
EventhoughmultiplekeysexistforaKeyID,with
enoughdataplainlocationsearchyieldsone
match!
AviationRADAR
HackingtheWirelessWorldwith#sdr
@spenchdotnet
ATCRBS,PSR&SSR
AirTrafficControlRadarBeaconSystem
PrimarySurveillanceRadar
SecondarySurveillanceRadar
Primary:
TraditionalRADAR
Paintsskinsandlistensforreturn
Identifiesandtracksprimarytargets,
whileignoringgroundclutter
1
RangelimitedbyRADARequation()
d
4
ATCRBS,PSR&SSR
AirTrafficControlRadarBeaconSystem
PrimarySurveillanceRadar
SecondarySurveillanceRadar
Secondary:
Directionalradio
Requirestransponder
Interrogatestransponders,which
replywithsquawkcode,altitude,etc.
1
Increasedrange()
d
2
PrimarySurveillanceRADAR
Transmitsabang(themainpulse)
Listensforreturns(echoes)
Bang
TheModes
A:replywithsquawkcode
SSR
C:replywithaltitude
S:enablesAutomaticDependantSurveillance
Broadcast(ADSB),andtheAircraft/Traffic
CollisionAvoidanceSystem(ACAS/TCAS)
TheModes
A:replywithsquawkcode
SSR
C:replywithaltitude
S:enablesAutomaticDependant
SurveillanceBroadcast(ADSB),andthe
Aircraft/TrafficCollisionAvoidanceSystem
(ACAS/TCAS)
ModeSnotpartofATCRBS,butusessame
radiohardware(samefrequencies)
Increasingproblemofchannelcongestion
Position
Heading
Altitude
Verticalrate
FlightID
Squawkcode
ADSB
ATypical747has
31radios
2x400WvoiceHF
3x25Wvoice/dataVHF
2x100W9GHzRADARs
2xGPS,1.5GHz60Wvoice/dataSATCOM
2x75MHzmarkerbeacons
3xVHFLOClocaliser
3xUHFglideslope
2xLFADFautomaticdirectionfinder
2xVORVHFomnidirectionalrange
2x1GHz600Wtransponders
2x1GHz700WDMEdistancemeasuringequipment
3x500mW4.3GHzradaraltimeters
3x406MHzEPIRB
TCAS
Xpndr
Highgain
SATCOM
Lowgain
VHF
HF
VHF
DME
ADF
EPIRB
Marker
RADARAltimeter
ModeSResponseEncoding
Datablockiscreated&bitscontrolpositionof
pulsessentbytransmitter
Earlychip
Latechip
UsedtodifferentiateagainstotherModes
PulsePositionModulation(AM)
PulsePositionModulation
Pulselasts0.0000005seconds (0.5s)
Needtosamplesignalataminimumof2MHz
(assumingyoustartsamplingatpreciselythe
rightmomentandstaysynchronised)
Requireshighbandwidthhardwareand
increasedprocessingpower
Ideally,oversampletoincreaseaccuracy
ModeSFrame
ModeSResponse:AMsignal
PrimarySurveillance
RADAR
HackingtheWirelessWorldwith#sdr
@spenchdotnet
MoffettFieldASR9
PrimarySurveillanceRADAR
PrimarySurveillanceRADAR
PrimarySurveillanceRADAR
DualPRFMode:Weather
Bang
RADARReturns
MagnitudeHistogram
MagnitudeHistogram
AboveNoiseFloor
AboveNoiseFloor
PulseLengthHistogram
PulseEnvelope
PulseEnvelope
PulseEnvelope
StrongPulseSeparation
PRFHistogram
StrongPulsesvs.Time
StrongPulsesvs.Time(zoomed)
PulsePowervs.Time
PulsePowervs.Time(zoomed)
DistanceBetweenPulses
Pulseandechopowerovertime
RawRADARReturnPlot
Eachscanlineissynchronisedtoanemittedpulse
Scanlineisamplitudeofsamplesovertime(alsorangeofthereturn)
VirtualRADARScope
RADAR
LASASR9
Bistatic
Monostatic
Angle
DistortionMap
Distance
2DOffset
Multipath
HackingtheWirelessWorldwith#sdr
@spenchdotnet
ATSC
PN511
CorrelationPeaks
RFID
HackingtheWirelessWorldwith#sdr
@spenchdotnet
FasTrak
Traffictolltag
ContainsyourID
Interrogationsignalin900MHzISMband
Wakeupsignalactivatestag
PulsePositionModulatedpayload
Tagreplieswithbackscattermodulation
ReflectstransmittersRFenergy(tinyamount)
ModulatesreflectionwithFrequencyShiftKeying
InterrogationSignal
Payload
Backscattercarrier
Preamble
Wakeup
WakeUp/Preamble
InterrogationPayload
BackscatterCarrier
RFCirculation
ANT
2
TX
RX
InterrogationSignal
ReceivedSignal
Interrogation
CW
ReceivedSignal
Response
ReceivedSignal
Response
Title21Specification
PreambleDetection
PreambleDetection
MatchedPreambleFilterResponse
SlicerTime!
Samplebits
ReadingaTagOutside
FrequencydomainAmplitude(LF)
TimedomainAmplitude(LF)
TimedomainAmplitude(LF)
FrequencydomainAmplitude(UHF)
TimedomainAmplitude(UHF)
LF
UHF
GNURadio baudline
GNURadio+baudline
BuildingSecurityBadgeAuth
TimedomainAmplitude
TimedomainAmplitude
Reader Badge
TimedomainAmplitude
Reader
Badge
ISEE3RebootProject
HackingtheWirelessWorldwith#sdr
@spenchdotnet
DeltaVLimit
AreciboRadioObservatory
Fun
Viewfromabove
Ionosphericheaters
Stillagoodstart
WeakSignal LowRBW
numpy&matplotlib
AfterImprovingPointing
~45dBC/N
MovingpeakbelowduetoDopplershift
VerifyingTransmittedSignal
B200receiving
leakagefromdish
MomentofFirstContact
HappyDance
DualChannelRecording
RawCapturedBaseband
PLLtrackingcarrier
PLLLock
PropulsionSystem
Telemetry:16bps
Telemetry:64bps
Telemetry:512bps
Telemetry:2048bps
TelemetryDuringThrusterFiring
NoThrust
HydrazinePropulsionSystem
NewOrbit
www.spacecraftforall.com
#cyberspectrum
http://wiki.spench.net/wiki/RF
http://spench.net/
GitHub:balint256
balint@spench.net
balint@ettus.com
@spenchdotnet
OtherApplications
HackingtheWirelessWorldwith#sdr
@spenchdotnet
BlindSignalAnalysis
Whatyouneed
Dish+LNB+powerinjector+USRP+GNURadio
(settopboxwithLNBthru)
D1TLM1:12243.25MHz
MirrorofRHS*
Constantcarrierpower*
TLMsidebands
Constant
subcarrier
1PPS
BeaconwithPhaseModulation*(PM):1PPSandtwotelemetrystreams(sidebands)
Visualisation
Letstryone
FeedentirebasebandspectrumintoGR
Performchannelselectiontoisolatestreamofinterest
(createnewbaseband
centredonstream)
Frameanalysis
Header
SYNSYNSYN(EBCDIC)
Characterorientedencoding:
SOH
STX
ETX
CRC(CCITT16)
Numbersoffixedlengthmessages
EachcontainsanID
Unpack&findpatterns
8bitsigned
16bitsigned
Messageheader
BCD
#
0001
0034
0067
0101
0134
0167
0200
0233
0266
0299
0332
0365
0398
0431
0464
0497
0530
0563
0596
0630
0663
0696
0729
0762
0795
0828
0861
0894
0927
0960
0993
1026
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
[20
049
051
053
055
057
059
060
062
064
066
068
070
071
073
075
077
079
081
083
084
086
088
090
092
094
095
097
099
101
103
105
107
200]
161]
121]
082]
043]
004]
221]
182]
142]
103]
064]
025]
242]
203]
164]
125]
086]
047]
008]
225]
187]
148]
109]
069]
030]
247]
208]
169]
130]
091]
052]
013]
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
(1/1)
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
ff
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
18
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
80
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
70
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
01
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
24
e9
e9
e9
e9
e9
ea
ea
ea
ea
ea
ea
ea
ea
ea
ea
ea
ea
ea
eb
eb
eb
eb
eb
eb
eb
eb
eb
eb
eb
eb
eb
ec
ae
c7
d9
ee
ff
10
24
3b
4d
62
75
80
98
a7
bc
cf
e8
f7
06
1b
30
45
59
6b
7b
8e
a2
b7
ca
da
ef
03
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
ed
26
24
2c
2f
36
40
43
44
4c
4f
54
62
64
6e
71
76
76
80
8a
8e
92
95
99
a1
a9
af
b3
b6
bd
c4
c9
cd
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
1a
07
07
07
07
07
07
07
07
07
07
07
07
07
08
08
08
08
08
08
08
08
08
08
08
08
08
08
08
08
08
08
08
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
31
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
90
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
19
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
fa
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
03
03
03
03
03
03
03
03
03
03
03
03
03
03
03
02
03
03
03
03
03
03
03
03
03
03
03
03
03
03
03
03
02
02
02
02
03
02
02
02
03
03
04
03
02
00
00
99
00
01
01
01
01
01
03
03
03
03
02
03
03
03
03
03
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
00
72
72
71
71
72
72
73
72
74
71
70
6d
6b
6c
6c
6d
6b
69
66
67
6a
70
73
75
76
75
74
72
71
70
70
71
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
e9
2e
2d
2d
2d
2e
2d
2d
2d
2c
2c
2c
2d
2d
2d
2d
2d
2b
2b
2b
2b
2c
2c
2c
2b
2b
2b
2b
2b
2b
2b
2b
2b
GraphingtheData
1660
6
4
2
1640
0
0
10
15
20
25
30
35
25
30
35
2
1620
4
6
8
1600
120
100
1580
80
60
1560
40
20
1540
980
970
960
950
940
930
0
920
10
15
20
SoftwareDefined
RadioDirectionFinding
SDRDirectionFinding
TwoWiFichannels,andthensome
FLEXPagers&Baudline
900MHzISM SmartMeters
3GWCDMA
SignatureofUMTS:repeatingdatainCPICHat10msintervals
Noapparentsignal
1ms
Cyclic1023bitcode@1.023MHzchiprate
gnsssdr:DecodingL1
EttusHQ
TETRA
Repeatingidlepattern
Frequencycorrectionburst
TheEntireHAMBand
OpenBTS
Opensource2GGSMstack
Asterix softswitch (PBX)
VoIPbackhaul
802.11agp(OFDM)Decoding
AutomaticPictureTransmission
AutomaticIdentificationSystem