Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Lately I've been experimenting with software-defined radio (SDR) and have come up with some heuristics by which I can visually identify certain kinds of signals by looking at their representation on a waterfall diagram. Certain obvious characteristics such as frequency and bandwidth can be measured, but how might one systematically go about determining such things as modulation and channel coding?

All of the books and papers I've read describe the process of transmitting or receiving a known signal, but none that talk about the identification and decoding of unknown signals. Is there a system or method? Are there papers, books or other documents that describe this?

Edit: Perhaps it wasn't clear enough from the original question, but what I'm looking for are techniques (read automatable techniques) that might be used to classify and demodulate an unknown signal that is received over the air. For example, by what method might one automate a method that would reliably identify 16QAM modulation?

share|improve this question
This answer has some useful resources for using visual identification on waterfall displays. Perhaps looking at those will help you find a method that might meet your needs: – Adam Davis Mar 25 '14 at 19:25

As atdre suggested, you might want to check on and learn how usual, known, modulations function. That way you'll usually be able to at least figure out what kind of modulation is in question. In most cases it will turn out to be some known modulation. Read on how AFSK or POCSAG work for example.

Carl Weisman did a series of introductory lessons on RF and wireless communication: Part 1 , Part 2, Part 3 , Part 4. The lessons cover different types of modulation.

Also , passing the signal trough a few known demodulators can sometimes yeild results. Multimon-ng is a handy tool.

Oona recently wrote an interesting blog post about reversing an unknown signal from a helicopter video so you might find some hints there too.

share|improve this answer

If you can't access the modulation specifics in the documentation or via FCC and patent searches, then you might want to reverse it out of the firmware or chip off.

If you can get an audio-out or oscilloscope visual of the signal, then you may be able to determine the type of modulation -- whether FSK, simple on/off keying, or another data format (especially easy to spot might be ones like POCGAG and Flex). Data will always sound like a dialed modem, and it might not be too difficult to pick out certain types of modulation just based on this sound.

The RTLSDRs, which can receive only in frequencies from 64 to 1700 MHz, with some gaps around 1100–1250 MHz -- isn't ideal to do this, but it certainly can be done with just a 20 USD device and GNU Radio Companion aka GRC (which supports two-level and four-level FSK signals out of the box, no money for additional "add-ons" involved). The Hak5 Youtube channel covers using RTLSDRs with GRC.

A simple alternative to SDR (besides straight hardware, but this option does require some hardware) is RFcat. You can see a 2FSK demodulation process from that Inguardians blog post, as well as more information on how to find the information from the FCC.

However, even if you prefer SDR -- there are a few more options currently (and soon to be) available. Coming soon is the HackRF device, which will let you transmit using GRC -- a step above the RTLSDR. Available now are the Funcube and the Ettus Research Universal Software Radio Peripherals (USRP), which also work with GRC.

share|improve this answer
While these are valid techniques, that answer doesn't really match the question. The question is about how to decode an UNKNOWN signal that is received over the air. Disassembling the transmitter is not an option; the type, purpose, owner, manufacturer and even the location of the transmitter is generally unknown in this instance. – Edward Mar 25 '14 at 17:22
Nah, if you know who owns the land or nearby land, this may reveal a company who owns a certain lieu of products some of which happen to use a certain RF chip that matches some known frequency range. Purpose may occasionally be revealed by band. It really depends on the situation. What is your situation? – atdre Mar 25 '14 at 17:52

RF signals are composed of three possible modulations: Amplitude, Frequency, and Phase.

Once you've determined the width and center frequency of the signal, analyze the amplitude changes, if any. Try to determine if the amplitude is periodic. Similarly, look at the frequency and phase.

Most radio systems conform to established standards, so once you've identified which modulations the signal is using, and whether they appear to be discrete or continuous, you can narrow them down to more specific possibilities.

Note that some will be very complex, and won't be easily discerned using this type of system. GPS can't be understood this way because you're receiving signals from many satellites simultaneously, and must separate them using code division techniques. Other new technologies such as MIMO are similarly complex, and won't easily succumb to any automated system looking at the above three modulations alone.

But it should give you a start.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.