5 ms·

Universal Radio Hacker: investigate wireless protocols like a boss

236 points by happy-go-lucky 10y ago

platz 10y ago
what is the advantage of this over something like http://gnuradio.org http://gnuradio.org ?
- grandalf 10y ago
  Things like this are designed to let you easily discover the structure of a protocol for snooping or reverse engineering. You can do all that (and much more) with GNURadio, but this tool offers a streamlined way to do a smaller set of specific things.
- djfergus 10y ago
  Very different, URH assumes you have the 1's and 0's and wish to decode the protocol. gnuradio is more about implementing and decoding known protocols and interfacing to rx/tx hardware.
- bsder 10y ago
  Ever tried to install gnuradio? It's a nightmare of twisty dependencies. You can either run the obsolete version in your distro or be prepared for a world of pain. And it's made even worse because Qt decided they couldn't be bothered with binary compatibility so a whole bunch of things dependent upon Qt all broke and lots of things now all need to get fixed.
  - jokr004 10y ago
    No kidding! It's a complete nightmare to set up, urh is significantly simpler to set up and to use.. though of course the other side of that is it's not as powerful as gnuradio
- squarefoot 10y ago
  Gnuradio is much more complex and powerful but looks like it's from engineers for engineers: I could hack together a superhet receiver in a day, but have never been able to do anything with Gnuradio that even pretended to work. This is probably my fault for expecting a radio software to have knobs...
  - CamperBob2 10y ago
    Gnuradio is much more complex and powerful but looks like it's from engineers for engineers And a subset of (Linux-literate) engineers, at that. I'd sooner write an SDR from scratch in C than try to get GNU Radio working under Windows.
deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
heywire 10y ago
Nice, thanks for sharing! I'll have to check this out. Not sure how I missed hearing about this one when I was working on understanding the mesh network protocol for the water and electric meters on the side of my house. Aside from GNU Radio, which has already been mentioned, Inspectrum also proved to be invaluable to me.
- kvajjha 10y ago
  Can you elaborate on the mesh network part? I've recently discovered mesh networking. What do you recommend as a good beginner project?
  - heywire 10y ago
    Sure. The electric and water meters used by the city I live in are by a company called Elster. They use the name EnergyAxis or EA_LAN to describe the mesh network. Either of those should return hours of reading material on a Google search. The short version is that each electric meter communicates on the ISM 915MHz band using the Texas Instruments CC11xx chip, and relays messages from meter to meter until it reaches the "gatekeeper", which is tied to a WAN and to the city's infrastructure.
- Xeoncross 10y ago
  Can you share any work on this? I would love to read the electric meter readings.
  - heywire 10y ago
    Sure. If you have an Elster brand meter, you can check out my (incomplete) project ea_receiver [1] or a GNU Radio based project, gr_elster [2]. For other brands, I would check out the rtlamr [3] project. I'm using it to read my gas meter. Finally, if you're into this sort of thing, check out rtl_433 [4]. You'd be amazed how many things are silently communicating all around you. Note: my work on ea_receiver has stagnated, as my city recently completed an upgrade to their system which unfortunately included enabling message encryption. [1] https://github.com/shaunhey/ea_receiver [2] https://github.com/argilo/gr-elster [3] https://github.com/bemasher/rtlamr [4] https://github.com/merbanan/rtl_433
buserror 10y ago
Looks fun! I did some reverse engineering for the RF sensors of my weather station a few weeks back, I used gnuradio, audacity etc but it was all 'manual', ie feeding the .WAV capture file to my own program and trying to find the decoding [0]. Turns out it was a known protocol of course, but it was still fun! Next time I know where to look for the proper tools, this looks awesome! [0]: My RF/MQTT bridge for switches and sensors: https://github.com/buserror/rf_bridge https://github.com/buserror/rf_bridge
somedudeonHN 10y ago
This is genuinely awesome. I can't wait to try it out!
theRhino 10y ago
maybe pair with an rtlsdr for some low-cost input?
TeMPOraL 10y ago
A question to RF people here - if I want to snoop on the 433MHz and 868MHz signals in the air, what's the cheapest setup I can get that would let me do some useful work? I've been reading up on the RTL-SDR thing, but there seems to be so many variables to consider that I can't even estimate what's the minimum set of hardware required, and whether the cheap modules are of any use.
- pmorici 10y ago
  Some of the cheap tv tuner dongles certainly cover that frequency range. They generally have fairly narrow bandwidth though. So if the signal you want to look at is very wide you might need something better than the entry level dongle. The rtl-sdr about page has a comparison chart showing various receivers a quarter of the way down the page... http://www.rtl-sdr.com/about-rtl-sdr/ http://www.rtl-sdr.com/about-rtl-sdr/
- tomfanning 10y ago
  Probably depends on how much bandwidth you are interested in seeing at any given time. If < ~2MHz and budget is everything, this sort of thing will get you started http://www.ebay.co.uk/itm/272267647631 http://www.ebay.co.uk/itm/272267647631 These guys have iterated on the RTL stick a bit, though expect to pay a bit more: http://www.rtl-sdr.com/buy-rtl-sdr-dvb-t-dongles/ http://www.rtl-sdr.com/buy-rtl-sdr-dvb-t-dongles/ If < 8MHz, try this http://www.sdrplay.com http://www.sdrplay.com (Not an RTL stick, performance FAR better. I own this, it's great.) I notice they have a new model out. Above that, sky's the limit. Filters are possibly useful on the TV stick but by no means essential. Antennas - all depends on proximity. If you're in the same room as your RF source, a bit of wire will do, for all but the weakest signals. Beyond that, it depends what you're doing. My recommendation: Buy the £7 stick, see if it gets the job done for you. If not, try the SDRPlay unit. I own both, they're both good and will likely get the job done. Software: HDSDR http://www.hdsdr.de/ http://www.hdsdr.de/ SDR Console http://sdr-radio.com/ http://sdr-radio.com/ (current beta is excellent with SDRPlay RSP 1) No affiliation to any links posted.
  - TeMPOraL 10y ago
    Thanks! I'll start with the stick then. I am afraid to spend triple digit sums on more hardware that I don't yet know if I'll end up using much, but I wasn't sure if cheaper options are usable at all.

236 points by happy-go-lucky 10y ago

platz 10y ago

what is the advantage of this over something like http://gnuradio.org http://gnuradio.org ?

grandalf 10y ago
Things like this are designed to let you easily discover the structure of a protocol for snooping or reverse engineering. You can do all that (and much more) with GNURadio, but this tool offers a streamlined way to do a smaller set of specific things.
djfergus 10y ago
Very different, URH assumes you have the 1's and 0's and wish to decode the protocol. gnuradio is more about implementing and decoding known protocols and interfacing to rx/tx hardware.
bsder 10y ago
Ever tried to install gnuradio? It's a nightmare of twisty dependencies. You can either run the obsolete version in your distro or be prepared for a world of pain. And it's made even worse because Qt decided they couldn't be bothered with binary compatibility so a whole bunch of things dependent upon Qt all broke and lots of things now all need to get fixed.
- jokr004 10y ago
  No kidding! It's a complete nightmare to set up, urh is significantly simpler to set up and to use.. though of course the other side of that is it's not as powerful as gnuradio
squarefoot 10y ago
Gnuradio is much more complex and powerful but looks like it's from engineers for engineers: I could hack together a superhet receiver in a day, but have never been able to do anything with Gnuradio that even pretended to work. This is probably my fault for expecting a radio software to have knobs...
- CamperBob2 10y ago
  Gnuradio is much more complex and powerful but looks like it's from engineers for engineers And a subset of (Linux-literate) engineers, at that. I'd sooner write an SDR from scratch in C than try to get GNU Radio working under Windows.

deleted 10y ago

[deleted]

deleted 10y ago

[deleted]

heywire 10y ago

Nice, thanks for sharing! I'll have to check this out. Not sure how I missed hearing about this one when I was working on understanding the mesh network protocol for the water and electric meters on the side of my house. Aside from GNU Radio, which has already been mentioned, Inspectrum also proved to be invaluable to me.

kvajjha 10y ago
Can you elaborate on the mesh network part? I've recently discovered mesh networking. What do you recommend as a good beginner project?
- heywire 10y ago
  Sure. The electric and water meters used by the city I live in are by a company called Elster. They use the name EnergyAxis or EA_LAN to describe the mesh network. Either of those should return hours of reading material on a Google search. The short version is that each electric meter communicates on the ISM 915MHz band using the Texas Instruments CC11xx chip, and relays messages from meter to meter until it reaches the "gatekeeper", which is tied to a WAN and to the city's infrastructure.
Xeoncross 10y ago
Can you share any work on this? I would love to read the electric meter readings.
- heywire 10y ago
  Sure. If you have an Elster brand meter, you can check out my (incomplete) project ea_receiver [1] or a GNU Radio based project, gr_elster [2]. For other brands, I would check out the rtlamr [3] project. I'm using it to read my gas meter. Finally, if you're into this sort of thing, check out rtl_433 [4]. You'd be amazed how many things are silently communicating all around you. Note: my work on ea_receiver has stagnated, as my city recently completed an upgrade to their system which unfortunately included enabling message encryption. [1] https://github.com/shaunhey/ea_receiver [2] https://github.com/argilo/gr-elster [3] https://github.com/bemasher/rtlamr [4] https://github.com/merbanan/rtl_433

buserror 10y ago

Looks fun! I did some reverse engineering for the RF sensors of my weather station a few weeks back, I used gnuradio, audacity etc but it was all 'manual', ie feeding the .WAV capture file to my own program and trying to find the decoding [0]. Turns out it was a known protocol of course, but it was still fun! Next time I know where to look for the proper tools, this looks awesome! [0]: My RF/MQTT bridge for switches and sensors: https://github.com/buserror/rf_bridge https://github.com/buserror/rf_bridge

somedudeonHN 10y ago

This is genuinely awesome. I can't wait to try it out!

theRhino 10y ago

maybe pair with an rtlsdr for some low-cost input?

TeMPOraL 10y ago

A question to RF people here - if I want to snoop on the 433MHz and 868MHz signals in the air, what's the cheapest setup I can get that would let me do some useful work? I've been reading up on the RTL-SDR thing, but there seems to be so many variables to consider that I can't even estimate what's the minimum set of hardware required, and whether the cheap modules are of any use.

pmorici 10y ago
Some of the cheap tv tuner dongles certainly cover that frequency range. They generally have fairly narrow bandwidth though. So if the signal you want to look at is very wide you might need something better than the entry level dongle. The rtl-sdr about page has a comparison chart showing various receivers a quarter of the way down the page... http://www.rtl-sdr.com/about-rtl-sdr/ http://www.rtl-sdr.com/about-rtl-sdr/
tomfanning 10y ago
Probably depends on how much bandwidth you are interested in seeing at any given time. If < ~2MHz and budget is everything, this sort of thing will get you started http://www.ebay.co.uk/itm/272267647631 http://www.ebay.co.uk/itm/272267647631 These guys have iterated on the RTL stick a bit, though expect to pay a bit more: http://www.rtl-sdr.com/buy-rtl-sdr-dvb-t-dongles/ http://www.rtl-sdr.com/buy-rtl-sdr-dvb-t-dongles/ If < 8MHz, try this http://www.sdrplay.com http://www.sdrplay.com (Not an RTL stick, performance FAR better. I own this, it's great.) I notice they have a new model out. Above that, sky's the limit. Filters are possibly useful on the TV stick but by no means essential. Antennas - all depends on proximity. If you're in the same room as your RF source, a bit of wire will do, for all but the weakest signals. Beyond that, it depends what you're doing. My recommendation: Buy the £7 stick, see if it gets the job done for you. If not, try the SDRPlay unit. I own both, they're both good and will likely get the job done. Software: HDSDR http://www.hdsdr.de/ http://www.hdsdr.de/ SDR Console http://sdr-radio.com/ http://sdr-radio.com/ (current beta is excellent with SDRPlay RSP 1) No affiliation to any links posted.
- TeMPOraL 10y ago
  Thanks! I'll start with the stick then. I am afraid to spend triple digit sums on more hardware that I don't yet know if I'll end up using much, but I wasn't sure if cheaper options are usable at all.