10 ms·
Using USB-VGA dongles as SDR transmitter
- quasarj 9y agoWell, that's pretty cool!
- apcragg 9y agoThat's a neat party trick and all but abusing spurious emissions/harmonics to broadcast in licensed spectrum without proper filtering is just plain irresponsible. At low power, with an unmatched antenna those signals /probably/ won't make it out of your house but it's not good practice to spew harmonics all over the spectrum, especially GSM bands. I also can't believe that they are working on increasing the TX power. Purposefully emitting all over the spectrum is both iresponsible and illegal.
- mathgenius 9y agoThat's why the osmo-fl2k page has the following text: "Before transmitting any signals with an FL2000 device, it is strongly suggested that you check the resulting spectrum with a spectrum analyzer, and apply proper filtering to suppress any but the desired transmit frequency. Operating a transmitter with the unfiltered FL2000 DAC output attached to an antenna outside a RF shielding chamber is dangerous. Don't do it!"
- quickthrower2 9y agoDangerous? Are we talking RF burns here?
- tomfanning 9y agoAs in potentially disruptive to critical-to-life public safety systems, e.g. air traffic control, emergency services communications, I suppose. Square waves = theoretically infinite harmonics at positive multiples of the fundamental frequency (in practice reducing with order of the harmonic) Then there's in-band spurs / spurious emissions, different from harmonics.
- ddalex 9y agoI think we're talking jail time here.
- apcragg 9y agoA radio amature most likely can't construct a bandpass filter with a high enough Q to filter out all of the spurs while still getting a usable signal. Releasing a tool like this and handwaving away interfearence concerns with an abstract refrence to 'proper filtering' is still iresponsible.
- _wmd 9y agoThe project page covers all of this, and takes the time to recommend various filtering strategies. It's not like this stuff is much worse than a faulty washing machine or hair dryer doing the same, or that the very same equipment under control of its official driver couldn't spew junk in exactly the same way
- Johnythree 9y agoThe device generates a comb of the original baseband, repeated all the way up to VHF. There is no way that a simple passive filter will pick out the wanted signal, while blocking all the others. It would take a sophisticated multi-stage active filter to even come close. The "very same equipment under control of its official driver" won't have an amplifier and antenna connected to its output. If it did, it obviously would fail its EMC test approvals process.
- _wmd 9y ago> The "very same equipment under control of its official driver" won't have an amplifier and antenna connected to its output. If it did, it obviously would fail its EMC test approvals process. Forgive me, but this seems quite a blanket statement to make of the tens-hundreds of millions of VGA cable and LCD/CRT designs and design combinations in deployment for the past 30+ years around the world, equipment combinations that never did (and never will) undergo system testing to verify there aren't, in fact, thousands+ of unintentional transmitters deployed already, by people who haven't a clue about their aberrant devices. It's not like you can't buy dirt-cheap $5 unshielded ultra long VGA extender cables by the literal truckload off AliExpress and eBay, and that you don't find such cables strung vertically to 640x480 projectors hanging off the ceiling of just about every conference center, lecture hall, hotel business suite or similar meeting venue known to man. Meanwhile this project is explicitly about creating a transmitter in an environment where it is understood by every user upfront the result could be noisy
- woah 9y agoIf there’s a need for spectrum enforcement, then people should be out doing it. There’s definitely enough money made from government granted spectrum monopolies to pay for it! The idea that you’re pushing here, that there should be varying degrees of a radio equipment prohibition is anti-knowledge and only serves to strengthen the spectrum monopoly businesses.
- TaylorAlexander 9y agoHere here!
- simcop2387 9y agoSpectrum enforcement does happen. It usually takes a while to identify because there's usually not a large noise source or illegal transmitter. Instead it's usually malfunctioning equipment that's doing stuff it shouldn't. Usually how enforcement happens is that someone complains that this one spot never gets a signal, or their phone always cuts out. Then the big players start getting involved to determine the problem and either get the fcc involved if needed or otherwise inform the offender to get I fixed. That's how stories like this happen, https://www.engadget.com/2016/05/25/florida-man-fined-48k-fcc-jamming-cellphones/ https://www.engadget.com/2016/05/25/florida-man-fined-48k-fc... EDIT: to add there's a lot of unintentional interference sources, neon signs are a typical culprit as they age, http://www.signindustry.com/neon/articles/2004-02-16-RadioFrequency-RC-.php3 http://www.signindustry.com/neon/articles/2004-02-16-RadioFr...
- Something1234 9y agoHow do I make a complaint about this? There's one spot on my college campus that's completely dead.
- asclepi 9y agoDon't contact the FCC directly. Contact your cellular operator. They can investigate to see if it is a problem on their end. They will also contact the FCC if necessary.
- RpFLCL 9y agoThis is a cool technique and super interesting. My little rtl-sdr dongle just became more powerful. At the same time, I hope this doesn't result in abuse of the spectrum followed by tightened regulations on the cheap dongles. Please be responsible
- bigiain 9y agoSo one of these for tx and a usb tv tuner for rx, a Raspberry Pi running OpenBTS, and you've got yourself a sub $100 IMSI catcher...
- jsjohnst 9y agoWhy do you need Tx for an IMSI catcher? Also, a USB TV tuner won’t work for the receiving side either. You’ll need to step up into an actual proper SDR for that. Still easily sub $500, but sub $100 is a bit too far a stretch.
- gsich 9y agoEasier if your target phone connects to you.
- bigiain 9y agoA $12 RTL-SDR USB stick will 100% work for most GSM rx (won't hit the 1900+MHz bands without a downconverter, but that's why you want tx - you'll use it to force the phone onto the 800-900MHz bands anyway, the top half of the 915MHz ISM band in the US if you have a HAM licence and are trying to not break _too_ many laws at once). This DefCon talk: https://www.youtube.com/watch?v=fQSu9cBaojc https://www.youtube.com/watch?v=fQSu9cBaojc Gives a good overview of why you need tx to capture an IMSI - without forcing a handset into transmitting non-encrypted, you only get the TMSI (unless you can crack the crypto - and why bother, when a base station can instruct a handset to just not encrypt anything?)
- skykooler 9y agoAs I understand it, these VGA adapters need the bandwidth of USB 3 to function. Raspberry Pi only has USB 2 ports.
- hwh 9y agoYou still need reliable clock sync / latency. Otherwise you can just announce, not communicate bi-directionally.
- angry_octet 9y agoIt's neat, but practically speaking having a transmit only device isn't useful for GSM. Having to use filtering on the output is also a major pain. It is perhaps more interesting for use as a data exfiltration technique. Simple devices, usually used without analysis, can punch out a signal which is easily decoded, with a simple (and seemingly accidental) antenna.
- Rjevski 9y agoWouldn’t you be able to use an RTL-SDR for the receive part, and thus, have a full-duplex SDR?
- angry_octet 9y agoTheoretically yes, but a HackRF One is US$300 and you will save an enormous amount of time. https://greatscottgadgets.com/hackrf/ https://greatscottgadgets.com/hackrf/
- Rjevski 9y agoHackRF actually can’t be used with GSM as it’s half-duplex only and GSM requires full-duplex.
- k0ngo 9y agoThe article doesn't mention it, but I think Fabrice Bellards PoC [1], in which he generated a valid DVB-T and PAL/SECAM carriers using a graphics card (2005), is very elegant and highly related prior art. [1] https://bellard.org/dvbt/ https://bellard.org/dvbt/
- DoctorOetker 9y agoI have often considered trying to reverse: using high resolution VGA ADC's to digitize for a cheap scope, but the effort involved seemed to high
- rasz 9y agoreverse "VGA ADC" in what exactly?
- DoctorOetker 9y agowell you can buy video ADCs from parts suppliers (digikey etc, some parts are pretty cheap, but again, it was seldom clear if they could be used continuously or would refuse to work without proper VSYNC etc) or source them from older digital monitors/dvd players/VGA2HDMI etc (roughly anything that has a VGA in)
- rasz 9y agofast ADC is not the problem per se, you can buy $10 ARM parts with 80MHz 12 bit ADC (LPC4370), pumping that data into computer fast enough is.
- DoctorOetker 9y agosuch a scope would not be a raw part, but include an FPGA: summarize the triggered traces that happened since the last transfer to PC... alternatively speaking, consider the amount of information on the screen of an oscilloscope, thats a low color count, with relatively large areas of the screen unaffected, so 60fps of very compressible image data..
- DoctorOetker 9y agoHow about a cheap optical links? If there is a similar blank- and porchless VGA to USB3.0 ADC. Let's consider the figure of 140MS/s x 3 (RGB) x 5 bits per sample (instead of 8 due to noise). then it would constitute about 2.1 Gb/s...
- adrianN 9y agoHere are some plans to build your own LOS optical network: http://ronja.twibright.com/ http://ronja.twibright.com/ Apparently you can get 10Mbps over a distance of a kilometer or so.
- pjc50 9y agoOptical free space or optical fiber? In both cases, it's not the ADC that's the issue and you'd generally use an on-off modulation anyway.
- peterburkimsher 9y agoInteresting! Researchers have successfully listened in to VGA signals using professional equipment [1]. Could the same be done with rtl-sdr receivers? One application I can imagine is to build an osmo-fl2k transmitter that looks like a USB memory stick, ask someone to plug it into the projector computer at church, and then record the video stream with the lyrics. Most projectionists have been helpful and willing to share their PPT files so I can study Chinese, but some are refusing to share them because of copyright issues. The translated songs were not officially licensed, so they're refusing to distribute their data. It is usually possible to ask someone to plug in a USB device (e.g. "to charge"), so if that's a possible entry vector then it would interesting to develop the transmitter further. [1] http://www.cl.cam.ac.uk/~mgk25/iss2006-tempest.pdf http://www.cl.cam.ac.uk/~mgk25/iss2006-tempest.pdf
- cushychicken 9y agoAre you implying that you'd use this technology to steal lyrics from a church?
- peterburkimsher 9y ago"steal" implies ownership. Their translations aren't officially licensed. They refuse to share it because they don't want to be sued for making illegal translations. But that also means I can't sing along with them, because I can't read the Chinese characters on the screen (I need to copy-paste it to my app to translate it to pinyin). When humans aren't cooperative, I try to find ways to work with the machines to achieve the goal.
- alexforster 9y agoNot mentioned in the article: its range is apparently from UHF to 1.7GHz+
- themodelplumber 9y agoThank you. So it's not like this by itself is going to enable some miraculous transceiver setup.
- rasz 9y agono, its "range" is 0 to ~150MHz, the rest is just tricks with harmonics.
- d33 9y agoNice, but where can I actually buy those things? A quick web search doesn't get me anywhere. EDIT: it looks like it's just the chipset and it's not sold directly - instead, one should look for devices based on it. I wonder if they have any competition, or whether I can just safely assume that any USB3.0 to VGA dongle will work. EDIT2: Also found this: > If they are advertised with 2048 × 1152 maximum resolution and support for Mac OS X, or only have a USB 2.0 interface, they contain a DisplayLink chipset and are not compatible with osmo-fl2k! The price range for the FL2000-based adapters is $5-15, whereas the DisplayLink devices typically cost more than $25. Also note that devices sold with USB type C connector contain a different chipset (e.g. Realtek RTD2166) and are just DisplayPort to VGA converters.
- asclepi 9y ago> Nice, but where can I actually buy those things? A quick web search doesn't get me anywhere. Plenty to be found on Amazon or eBay. See the coverage on the RTL-SDR.com blog[0] for a few links. > EDIT: it looks like it's just the chipset and it's not sold directly - instead, one should look for devices based on it. Yes, that's correct. You need a USB 3.0 to VGA adapter that is based on the Fresco Logic FL2000 chipset. [0] https://www.rtl-sdr.com/osmo-fl2k-a-tx-only-sdr-hacked-from-commodity-5-usb-to-vga-adapters-demos-available-for-transmitting-wbfm-gsm-umts-gps/ https://www.rtl-sdr.com/osmo-fl2k-a-tx-only-sdr-hacked-from-...
- Zardoz84 9y agoI just bought one on Amazon. Sadly, don't works out of the box on Linux, as the driver only works with a old version of the kernel. PD: I bought as a cheap way to plug a old VGA monitor as a secondary screen, plus allow using it as a SDR transmitter is a nice extra.
- OliverJones 9y agoHeh heh. Back in the day when VRAMs cost a fortune I hacked low-level display software for a new frame buffer product in development. The unshielded hardware lab prototypes emitted noise that stepped on the signal of the hardware team's favorite FM rock station. So they tweaked the clocks to be a little slower. Then they forgot they did that. Then benchmark time came around. And the new product wasn't up to spec. And tweaking it back up made it unreliable. Ferrite cores and shielding boxes are your friends, and your investors' friends.