System for reverse engineering RF signals

Question

Lately I've been experimenting with software-defined radio (SDR) and have come up with some heuristics by which I can visually identify certain kinds of signals by looking at their representation on a waterfall diagram. Certain obvious characteristics such as frequency and bandwidth can be measured, but how might one systematically go about determining such things as modulation and channel coding?

All of the books and papers I've read describe the process of transmitting or receiving a known signal, but none that talk about the identification and decoding of unknown signals. Is there a system or method? Are there papers, books or other documents that describe this?

Edit: Perhaps it wasn't clear enough from the original question, but what I'm looking for are techniques (read automatable techniques) that might be used to classify and demodulate an unknown signal that is received over the air. For example, by what method might one automate a method that would reliably identify 16QAM modulation?

Answer 1

As atdre suggested, you might want to check on and learn how usual, known, modulations function. That way you'll usually be able to at least figure out what kind of modulation is in question. In most cases it will turn out to be some known modulation. Read on how AFSK or POCSAG work for example.

Carl Weisman did a series of introductory lessons on RF and wireless communication: Part 1 , Part 2, Part 3 , Part 4. The lessons cover different types of modulation.

Also , passing the signal trough a few known demodulators can sometimes yeild results. Multimon-ng is a handy tool.

Oona recently wrote an interesting blog post about reversing an unknown signal from a helicopter video so you might find some hints there too.

Answer 2

If you can't access the modulation specifics in the documentation or via FCC and patent searches, then you might want to reverse it out of the firmware or chip off.

If you can get an audio-out or oscilloscope visual of the signal, then you may be able to determine the type of modulation -- whether FSK, simple on/off keying, or another data format (especially easy to spot might be ones like POCGAG and Flex). Data will always sound like a dialed modem, and it might not be too difficult to pick out certain types of modulation just based on this sound.

The RTLSDRs, which can receive only in frequencies from 64 to 1700 MHz, with some gaps around 1100–1250 MHz -- isn't ideal to do this, but it certainly can be done with just a 20 USD device and GNU Radio Companion aka GRC (which supports two-level and four-level FSK signals out of the box, no money for additional "add-ons" involved). The Hak5 Youtube channel covers using RTLSDRs with GRC.

A simple alternative to SDR (besides straight hardware, but this option does require some hardware) is RFcat. You can see a 2FSK demodulation process from that Inguardians blog post, as well as more information on how to find the information from the FCC.

However, even if you prefer SDR -- there are a few more options currently (and soon to be) available. Coming soon is the HackRF device, which will let you transmit using GRC -- a step above the RTLSDR. Available now are the Funcube and the Ettus Research Universal Software Radio Peripherals (USRP), which also work with GRC.

Answer 3

RF signals are composed of three possible modulations: Amplitude, Frequency, and Phase.

Once you've determined the width and center frequency of the signal, analyze the amplitude changes, if any. Try to determine if the amplitude is periodic. Similarly, look at the frequency and phase.

Most radio systems conform to established standards, so once you've identified which modulations the signal is using, and whether they appear to be discrete or continuous, you can narrow them down to more specific possibilities.

Note that some will be very complex, and won't be easily discerned using this type of system. GPS can't be understood this way because you're receiving signals from many satellites simultaneously, and must separate them using code division techniques. Other new technologies such as MIMO are similarly complex, and won't easily succumb to any automated system looking at the above three modulations alone.

But it should give you a start.

Answer 4

After reading this excellent presentation

http://ewh.ieee.org/r5/denver/sscs/Presentations/2012_10_Agilent2.pdf ,

I have a much better understanding of where all the modes come from and that their decoding might not be so utterly complex. A lot of the apparent complexity comes from sloppy terminology, different points of view and several names for the same thing, as I read in CCC-editor where many modes use the same decoder

On the Wavecom website there is a lot of information (CCCeditor), examples and I suspect even decoders, that can be downloaded for free. From the information on the Sigmira and Sorcerer websites, and also Wavecom which appears to be no longer active, I get the idea that the various decoders are some-how or some-where available, or built into the software as modules and that they must just be activated, copied in or selected.

The Wavecom CCCeditor show a great many digital modes and the names of the decoders. Once the right decoder was selected, one only have to adjust one or two parameters, mainly baud rate, to decode the signal. Not that I know how to do this, or where to find the decoders, but it gives an idea.

Out of this will come decoded text, which may be freeform or arranged according to some protocol such as for POCSAG or ACARS and that might need further interpretation. The Constellation display and Eye-diagram can be used to determine when the right baud and other adjustments are selected.

If given the OK. I can write a page or two on how I think we can proceed from here, but I suggest that you look in great detail at the Wavecom/ Sigmira / Sorcerer approaches, do a bit of disassembly and see if one can discover the various decoders and hopefully re-use them or upgrade them. Them we simply need a GUI and GNURADIO could be a good starting point.

73 Henry ZS3HA