Hello readers! Until now, our schedule has only allowed time for SDR training at customer sites or at conferences such as Black Hat and the Wild West Hackinfest. After many requests, we’re finally able to offer an open class, where individual students can sign up and learn the ins and outs of Software Defined Radio.
As always, these are small class sizes full of intensive, hands-on learning. They’ll be held in the greater Seattle area (the suburb of Kirkland to be specific) from the 5th to the 8th of November. First will be our Intro to SDR class, then our Intermediate Digital class. If there’s enough demand, we’ll add on our Reverse Engineering and Python+gnuradio classes (email us if you’re interested).
You can register here, and if you sign up on or before the 3rd of October, you’ll get a discounted rate.
If you have any questions about the classes, please contact me at paul<at>factorialabs.com.
As I’ve mentioned, I’m teaching two SDR classes at Black Hat this August: an Introductory and an Intermediate class. Well, the latter has just sold out! The Introductory class still has a few seats left, though.
Thanks for your interest, and looking forward to seeing many of you in Vegas!
Just wanted to let you know that I’ll doing a webcast with the fine folks at Black Hills InfoSec next Thursday. I’ll be talking about a frequency hopping SDR system I built using Python and the gnuradio API. It was intended as a proof-of-concept RF exfiltration system, but you could use the framework for any number of things.
The host transmits requests for data downstream to the exfil device, along with the frequency at which the information should be sent back. The concept is fairly straightforward, but it’s not always clear how build these types of systems with gnuradio. Specifically, there are a number of complications to getting payload data out of gnuradio flowgraphs and into Python code where you can act on that data. I’ll show you how I did this, as well as some best practices for building code-only gnuradio systems (i.e. without using the gnuradio-companion GUI).
The webcast will be next Thursday (11-Apr) at 2pm EST aka 11am PDT. You can register here.
If you want more information about how to build radio applications with gnuradio, I do have a class that you might be interested in. Please contact me if you’d like more information.
I believe it takes 4 days to learn the basics of software defined radio, even if you’ve never done a single radio-related thing in your life. Less than a week.
If you lay that solid foundation in SDR and gnuradio, you’ll be far more effective in your future endeavors, whether that’s:
scanning for and intercepting signals
reverse engineering transmissions
building your own programmable RF systems for exfiltration
Join us this August at Black Hat to get started with SDR. We have a two-day introductory class that’s perfect for beginners. You don’t need to know a thing, and you don’t need to bring a thing. You’ll use our laptops and SDR hardware. No pre-class installation homework, just show up and sit down. You’ll learn the basics of gnuradio, RF theory and SDR operation – which will enable you to build analog transmitters and receivers.
After learning to build analog and digital radios, a number of our customers had the perfectly reasonable question: “What next?” Over the last year, we’ve developed two additional SDR courses that provide an answer.
The first course focuses on reverse engineering RF devices with SDR, with a host of practical exercises and real hardware to attack.
The second shows you how to build SDR-based radio applications, focusing on the especially tricky part of programmatically extracting data from gnuradio flowgraph objects. Getting data out of flowgraphs is a problem that stymies a number of folks, but I’ll save you a ton of time by showing you powerful methods to get this done cleanly.
As with our previous courses, we first taught them to carefully chosen lead customers. Now, after numerous improvements and tweaks, they’re ready for primetime.
You can contact us at email@example.com if you’d like to arrange a private training for your organization. We are also planning on two public training sessions this year: one in the greater DC area and a second in Seattle.
Yesterday, I had the privilege of giving a talk about a project I’d been working on to the Wild West Hackinfest in Deadwood, SD. Over the last year or two I’d been wanting to build a clean radio communication system using SDR and gnuradio. There were a number of not-so-obvious things I’d learned over the years, and I thought releasing some code that implemented such a system could help out folks that may have been struggling with some of the same things that I did.
The project I settled on was an RF exfiltration system, with a host laptop sending commands to a headless Raspberry Pi 3 B+. The twist, however, was that each time the host requested data, it also told the xfil box how to send the data: what frequency, modulation scheme, preamble, etc. The goal was to be able to communicate in a manner that was as flexible as possible, even capable of changing the RF parameters with each transmission.
The code is still at “proof-of-concept maturity” but it should help you see how to get digital payloads from external Python code into a flowgraph (on transmit) and vice versa (on receive). You can see it all here:
I’m incredibly grateful to John Strand and all the folks who made the conference happen. It’s an awesome event with great people both running and attending. If you haven’t been, you should definitely go in 2019.
PS There was a camera running, so I’ll provide an update post when the video is posted.
Hello SDR fans. A long-standing wish of mine is to have a grc block that detects a preamble on an incoming byte stream and tags it with a fixed length. There has been a block in grc for a long time called the Correlate Access Code – Tag Stream (kind of a mouthful, I know) which almost does this but not quite. This original block scans the 32 samples after the preamble and tries to extract a frame length field, which it will then use for the tag value. That function is kind of neat if you’re building your own transmitter/receiver pair, but it doesn’t help when you’ve got a mystery signal on your hands that won’t have that header in place.
So for a while a worked around the issue. On short projects, I’d use the now-deprecated Correlate Access Code block, dump the data to a file and whip up a quick Python script to handle things (you can see some examples of this in Volume 3 of our book series). For more complex situations, I employ WaveConverter, which I built to extract and analyze large amount of payload data. Despite these options, I always wanted a simple grc-only method of quickly looking at payload data.
All of which brings me to the block I built, Correlate Access Code – Tagged Stream – Fixed Length (yeah, I didn’t really reduce the mouthful any). I simply created a new module and block with the gr_modtool utility and copied over the *.cc, *.h and *.xml files from the original block. I then cut out the header parsing and added a property for you to set the Packet Length. After a bit of debug and cleanup, I had a useable block, which you can grab from:
The example flowgraph below shows how easy it is to use:
The new block allows you to detect the preamble and tag it such that the subsequent Tagged Stream to PDU block can convert the payload (and only the payload) to a Message PDU, which you can then print out with a Message Debug sink. The PDUs simply appear in the console window as you run your flowgraph.(I’m using the print input of the Message Debug block because I have ASCII data, but if you have binary data, you should use the print_pdu input instead.)
Note that you can also dump the message PDUs to a File Sink, which gives you a nice file containing only payload data, none of the preamble or inter-frame dead air. A couple lines of Python can read this file and extract each payload into a list, from which you can do all sorts of fun stuff.
The LimeSDR Mini is a great combination of things: affordable, full-duplex and incredibly configurable. Until recently, though, it wasn’t the easiest thing to get running. Scanning the forums at MyriadRF (the folks who make the Lime products) shows that a number of people have been able to get the Mini working but also that a number have not had so much success.
I was a pre-production supporter of the CrowdSupply campaign and had my LimeSDR Mini delivered in March. At first it was rough going, but after numerous attempts, I’ve been able to get a repeatable installation flow that works on Ubuntu 16.04 and supports UHD and HackRF hardware as well (it may support BladeRF, but I don’t have the hardware to test it).
The git bundle also contains a number of simple grc files to validate your installation versus each of the three hardware platforms. After installation, my advice is that you test things with:
(make sure to tune to one of your local stations)
Next, if you’ve got a second SDR (and computer) you can use the GFSK transmit and receive flowgraphs to send simple digital data back and forth between them. You should be able to send and receive from any combination of the three SDR platforms, though you will likely need to adjust the squelch levels depending on the physical distance between your SDRs. If a HackRF is involved, you’ll also need to fine tune the receiver flowgraph to compensate for their frequency error.
One thing to note about this install flow: you get version 3.7.10 of gnuradio-companion, not the latest as you’d get with a PyBOMBS installation.
Hope this helps!
Addendum: This flow will work for Ubuntu 18.04, but you’ll need to go into the install script and tweak one line per the commented instructions. You’ll also need to adjust the device args for the hackrf transmit flowgraphs to “driver=hackrf,soapy=0” (but do NOT type a space between the comma and “soapy”). A bonus to using 18.04 is that you’ll get a slightly newer version of gnuradio companion (3.7.11).
We’ve gotten some feedback recently from a number of our readers that the gnuradio installation process documented in our books (and on our books’ web site) has a few glitches. We knew that we’d need to update the instructions at some point, and the time had definitely come. If you’re planning on installing gnuradio any time soon, please see our updated instructions pdf.