With as cheap and versatile as RTL-SDR devices are, it’s a good idea to have...

Back in May, we posted about the upcoming DeepRad, which is advertised as a modular RTL-SDR system, providing RTL-SDR PCB boards without USB and SMA connectors that are seated into a custom motherboard. A few days ago they released their crowdfunding campaign on Crowd Supply.

The individual DeepRad RTL-SDR units are priced at US$80 each, whereas the 'DeepRad Quad' which includes four units and a motherboard is priced at US$340 with free US shipping and $12 intl. shipping for both products. It appears that the idea behind the modular boards is to allow people designing a custom PCB to easily seat an RTL-SDR on their design.

The DeepRad Quad advertises 'Synchronize TCXO', which implies that the four units can run from the same clock. However, we don't see any noise source, distribution, or switching hardware, and no heat management, so we don't expect it to be useful for coherent projects like the KrakenSDR is.

Over on Reddit there has been some discussion about the system.

Thank you to Jacopo (@lego11/IU1QPT) and Robin (@OK2AWO) for writing in and sharing with us his thoughts about how the SDR community as a whole should move on from the use of WXtoIMG, and instead switch to SatDump, which now has full feature parity with WXtoIMG and additional features too. SatDump is available on Windows, MacOS, Linux, and even on Android. An up-to-date guide for receiving APT with SatDump written by @lego11 can be found on his website here.

Historically, WXtoIMG has been the software of choice for the popular hobby of decoding NOAA APT weather satellite images with RTL-SDR and other SDRs. However, the software has unfortunately been abandoned by its authors for several years, and can now only be found on third-party websites which increases the possibility of downloading a virus. Also, a hack involving a proxy, or directly updating via a powershell script is now required to allow WXtoIMG to update its TLE/ Kepler files due to the celestrak.com to celestrak.org domain name change.

Lego11 also notes a whole host of other issues regarding vulnerabilities and bugs with WXtoIMG:

• The software is ancient and uses obsolete libraries, such as Visual C++ 2002 with .NET. These libraries are the main concern when it comes to WXtoIMG, as I don't find it particularly likely for someone to find an entry point through the software itself. However, a much more likely scenario is a virus abusing the loaded library in memory when WXtoIMG is running and using it to gain an entry point. There are at least 20 vulnerabilities affecting MSVCR70.dll, and all are well known (such as CVE-2007-0025) which makes it even more concerning. CVE-2008-4255 in particular allows for remote code execution on the user's computer, which is very serious. There are certainly many more vulnerabilities that have been exploited regarding MSVCR70, but due to the obsolescence of this software component they are usually not tracked in a CVE.
  
  In either case, just as nobody would use Windows XP as a daily driver in 2024, nobody should use WXtoIMG as a matter of caution, even if the above mentioned vulnerabilities were not present.
  
  As for the bugs, there are many. Here's a list of the most important ones:
   
• Cannot update TLE without external software, complicating the experience for newcomers and adding extra failure points
   
• Map overlay doesn't work properly most of the times, especially if the user starts to receive the satellite before it is at least at 1° elevation
   
• WXtoIMG will crash if Microsoft Defender starts a memory scan during a pass. This will lose the recording
   
• WXtoIMG uses an outdated Win32 API to access audio. This doesn't always work on Windows 11 and Microsoft has stated that it will be removed soon.
   
• WXtoIMG uses ALSA on Linux. The vast majority of Linux distributions don't support ALSA directly anymore, and WXtoIMG cannot work through an audio server (e.g. Pulseaudio) like all Linux applications are supposed to. Therefore, live recording doesn't work on Linux at all.
   
• WXtoIMG doesn't run on MacOS anymore, as the system will refuse execution due to security problems and missing libraries.
   
• WXtoIMG cannot support wav files from e.g. SDR# or SDR++ without using a third party tool such as NOAA-APT.
   
• If a user moves or copies a recorded WAV file (see above), the map overlay will no longer work.
   
• WXtoIMG is especially sensitive to concurrent CPU usage, which will result in "tears" on the image (as is evident on the images in the guy's tutorial). It cannot handle multitasking well on systems more modern than Windows XP due to changes in how the CPU scheduler works in more modern kernels.
   
• WXtoIMG will lock up and then crash if the user starts it without first having updated TLEs due to missing NOAA-17. This is very serious, as it happens to newcomers all the time. It is one of the top support request emails/messages I receive. It is not possible to fix this crash easily.
   
• WXtoIMG doesn't have updated coefficients for calibration, therefore NOAA-15 will look excessively cold compared to other satellites.

Over on YouTube Baltic Lab has uploaded a video showing how he was able to successfully use an RTL-SDR Blog V4 and the included multipurpose dipole antenna kit to receive images from polar-orbiting NOAA weather satellites.

In the video, Baltic Lab shows how to orient the dipole antenna in a "V-Dipole" shape which optimizes it for receiving from satellites. He also shows how to use a VNA to confirm that the telescopic elements on the dipole are extended to the correct length, noting that he was able to achieve a VSWR of less than 1.2 between the target frequencies of 135 to 138.1 MHz, with a near perfect match at 136.5 MHz.

He then demonstrates receiving the NOAA APT signals with his laptop, and successfully recovering the weather satellite image.

Over on the YouTube channel "SecPGH" a talk by Grey Fox titled "Introduction to Software Defined Radio For Offensive and Defensive Operations" has been uploaded from the BSidesPGH 2024 conference. BSidesPGH 2024 was a security conference held in Pittsburgh, PA, USA on July 25.

The talks are generally about network security, however, Fox's talk is all about RF security topics and software defined radio. In the talk, he introduces SDR, and devices like the Flipper Zero and demonstrates various basic examples such as receiving FM from a handheld radio and ADS-B.

Next, he goes on to demonstrate security topics such as showing how to capture and analyze signals from a 433 MHz security alarm using an RTL-SDR and Flipper Zero, and how to jam frequencies and replay captured signals. Finally, he demonstrates WiFi cracking with the help of Kali Linux and Flipper Zero with WiFi dev board attached.

Over on YouTube "Sam's eXperiments logs" have uploaded a video showing how he was able to succeed when using TEMPESTSDR to eavesdrop on HDMI cables with his SDRplay. TEMPESTSDR software combined with a software defined radio allows a user to eavesdrop on TVs, monitors, and more by wirelessly receiving their unintentional RF emissions and recovering information from those emissions. In many cases it is possible to recover live images of the display, clear enough to read text.  

Sam's video explains the challenges he faced with signal strength due to the highly effective shielding of his HDMI cables. To get around this Sam shows how he unshielded his HDMI cables for the test. This is good news for privacy, as it shows how effective shielding can be at stopping these kinds of attacks. He then goes on to show the results he obtained which show text being read from his screen.

Over on the Tech Minds YouTube channel, Matt has uploaded a video where he reviews a new book by Elektor titled "Raspberry Pi 5 For Radio Amateurs" (€5 off coupon code "Techminds"). The book is all about projects for the Raspberry Pi 5 that can be done with RTL-SDR Blog V3 and V4 software defined radios.

In the video Matt explores the books contents, showing off the various possible projects. Matt also shows how to get started with the book by installing Raspbian, and the RTL-SDR drivers, and then goes on to show how examples of the various software programs mentioned in the book such as SDR++, flrig, chirp, dump1090, predict, HamClock, rtl_tcp, rtl_433, qsstv, fldigi, Xdx and more.

Over on YouTube The Comms Channel has uploaded a video showing how they used a KrakenSDR to track down the location of an ATIS transmission tower.

If you weren't already aware, KrakenSDR is our 5-channel coherent radio based on RTL-SDRs, and it can be used for applications like radio direction finding. It can be purchased on Crowd Supply.

Airports typically have an ATIS (Automatic Terminal Information Service) transmission tower that broadcasts audio of recorded information such as weather, runway conditions, and any important notices.

In the video, they use the KrakenSDR to track down the location of an ATIS transmission tower at their local airport. In the future, they intend on using the KrakenSDR to help track down Meshtastic radios.

The latest August edition of the RadioWorld Magazine has included an article by James Careless about the use of software defined radios for shortwave radio listening. RadioWorld is a magazine targeted towards radio broadcast owners, managers and engineers all over the world. The article explores SDRplay and RTL-SDR Blog V4 units from the perspective of a shortwave listener new to software defined radios, comparing them to his high-end Sangean ATS-909X2 shortwave digital receiver.

The article can be accessed freely from this link and is found on pages 18-21.

The RTL-SDR hardware began its life as a DVB-T TV receiver USB stick, but these days it is rarely used for this purpose. However, in countries where DVB-T hasn't been upgraded to DVB-T2 it is still possible to use the RTL-SDR for TV reception.

Recently, RADIOTO bg from DXing.org wrote in and wanted to share with us his video showing how to use the RTL-SDR V3 for DVB-T reception in OpenPli Enigma2. OpenPli is an open-source Linux distribution for TV set-top boxes and Enigma2 is the TV application it runs.

RADIOTO's video shows a step-by-step guide to setting up the RTL-SDR in OpenPli. The procedure is relatively simple, just requiring the user to select the correct driver for the RTL-SDR via the set-top menu.

Over on his YouTube channel, Simon has uploaded a video showing how while on holiday he was able to explore the various HD Radio stations available around the USA. 

If you are in the USA, you might recognize HD Radio (aka NRSC-5) signals as the rectangular looking bars on the frequency spectrum that surround common broadcast FM radio signals. These signals only exist in the USA and they carry digital audio data which can be received by special HD Radio receivers. Earlier in 2017 a breakthrough in HD Radio decoding for SDRs like the RTL-SDR was achieved by Theori when he was able to piece together a full HD Radio software audio decoder that works in real-time. Nowadays you can use software like HDFM - HD Radio GUI to easily receive HD Radio with an RTL-SDR.

In his video Simon shows the various HD Radio signals he found while on holiday, and also shows some of their secondary features, including traffic data, and weather radar maps. Interestingly he also spots HD Radio in the AM bands, but finds his signal is not strong enough to decode.

The rest of the video explores other signals he finds such as a studio link, and TV audio signals.

This post is about the KrakenSDR, one of our products from our sister company KrakenRF. If you weren't already aware, KrakenSDR is our 5-channel coherent radio based on RTL-SDRs, and it can be used for applications like radio direction finding. It can be purchased on Crowd Supply.

Over the years we've posted several times about the TEMPEST applications of software-defined radio. TEMPEST aka (Van Eck Phreaking) is when you listen to the unintentional RF emissions of electronics and are able to recover information from that. In the past, we posted about TempestSDR, an RTL-SDR compatible program that allows you to view images from a computer monitor or TV simply by picking up the unintentional RF emissions from it.

Usually, the images received are fuzzy and it can be difficult to recover any information from them. However recently there has been work on combining Tempest techniques with deep learning AI for improving image quality.

Deep-tempest has recently been released on GitHub and from their demonstrations, the ability to recover the true image with deep learning is very impressive. From a fuzzy grey screen, they show how they were able to recover clear text which looks almost exactly like the original monitor image.

Deep-tempest is based on gr-tempest, and requires GNU Radio, Python 3.10 and a Conda environment. Instructions for installing it are on the GitHub.

The whitepaper on the University research done to implement Deep-Tempest can be found freely on arxiv at https://arxiv.org/pdf/2407.09717.

Last year the RFNM (RF Not Magic) software-defined radio was announced and opened up for pre-orders. RFNM is an SDR based on the new 12-bit LA9310 baseband processor chip, and together with either a 'Granita' or 'Lime' daughter board it is capable of tuning from 10 - 7200 MHz or 5 - 3500 MHz respectively. It is also capable of wide bandwidth - up to 153.6 MHz on a host device like a PC. The RFNM is affordable, costing US$299 for the motherboard, US$179 for the Lime board, and US$249 for the Granita board. Currently, the second production batch is available for preorder.

Recently we received our RFNM order, with both Granita and Lime boards. This is a review of our initial impressions and tests on it. Note that while the RFNM is capable of transmitting, in this review we did not test that capability.

Physical Review

The RFNM motherboard comes as a PCB with a large heatsink on the bottom and a very quiet inline fan.  The daughterboards connect to the motherboard with a board-to-board connector and are secured in place via seven screws. There is another board-to-board connector for a second daughterboard to be connected, but in this review we did not test it. 

On the right side there is a 4-18V DC barrel power jack and USB-A, USB-C, HDMI and Ethernet connectors. There is also a SIM card and SD card slot on the side. On the left of the board are MMCX connectors for external reference clock, and clock out. There are also various header pinouts for PPS OUT/IN, UART, I2C, GPIO and PWM. On the heatsink side there is a JTAG connector, jumpers for resetting the firmware, and pads to solder on an OCXO. 

The device feels solid but there are a few exposed SMT components on the rear that have the potential to be knocked off with rough handling. All the main connectors are through-hole soldered and will not break off easily. During operation, the heatsink stays warm to the touch, and does not get too hot. The fan blades are exposed but should be safe from fingers and debris being on the bottom.

Initial Firmware Download

The device requires power from a 4 - 18V DC barrel jack and connects to a PC via a USB-C or USB-A port. According to the developer, it requires a 10-15W capable supply. In the tests below we used a 9V 2000mA switch mode supply, and a 12V 3000mA capable linear supply.

The device comes shipped without firmware, and the first setup step involves plugging in an internet-connected ethernet cable to automatically download and install the latest firmware. If you don't have an internet connected ethernet cable, an alternative is to plug in a USB stick with the latest firmware installed on it. The firmware installation took only a couple of minutes and went smoothly.

Initial Tests with SDR++

The easiest way to get something working with the RFNM is to use the custom SDR++ build included on the RFNM itself. When you plug in the RFNM it shows up on your PC as a disk drive, with an SDR++ folder. Getting started is as easy as running that SDR++ exe and clicking Play.

Initially, we encountered an issue where the RFNM wouldn't show up in SDR++, and wouldn't show up as a disk either. However, after flipping the USB-C connector it worked. This is an issue that continued throughout, and sometimes flipping wouldn't even work, but it always connected after a few reconnection attempts, and once the board was connected it was stable.

Lime Daughterboard Tests

We first tested the RFNM with the Lime daughter board. This is a board based on the Lime LMS7002 chip which is the same chip used in the LimeSDR. Here only the IQ output of the Lime chip is used, not the ADCs.

At this point, it's important to note that software support for the RFNM is still in the very early stages and SDR++ currently has no gain controls implemented. SDR++ is third-party software to RFNM so it's not any fault of the RFNM team. (NOTE: In the last few days after having already written this review, there have been several commits to SDR++ regarding RFNM, so this may already be resolved)

However, it is possible to SSH into the Linux OS system running on the RFNM system and change the gain setting through a bash command. To connect to SSH a network-connected ethernet cable needs to be connected to the board (alternatively you can use the UART port on the side of the board with an adapter). Once logged in via SSH we can browse to "/sys/kernel/rfnm_primary/rx0" and edit the value in the 'gain' text file. Then to activate the changes, simply set the value in the 'apply' text file to 1. This allowed us to optimize the gain settings for best reception.

cd /sys/kernel/rfnm_primary/rx0
echo 30 > gain && echo 1 > apply

With the ability to set the gain, the Lime board works great. Signals are strong in the VHF and UHF bands where sensitivity is approximately -135 dBm, and there is little sign of imaging with appropriate gain settings. In the 2.4 GHz band, the sensitivity remains good at around -130 dBm too. Although the advertised max frequency range is 3500 MHz, we were able to receive up to about  3.85 GHz with reduced sensitivity.

On HF, however, the Lime board performs very poorly. We start to see a drop off at around 50 MHz where the sensitivity is roughly -93 dBm, at 30 MHz about -58 dBm, and 15 MHz about -37 dBm.

Granita Daughterboard Tests

In the second test, we removed the Lime board from the RFNM motherboard and installed the Granita daughterboard. The Granita daughterboard is based on an Arctic Semiconductor 'Granita' chip, an RFFC2071A mixer, and several preselectors. 

Unfortunately, we are very disappointed in the performance of Granita as there is very significant imaging of signals, and this wipes out the ability to cleanly receive almost every band. According to Davide, this problem is a firmware issue with the Arctic Semiconductor Granita chip that can maybe be fixed in the future, but there is no guarantee that it is fixable, as any fix is at the mercy of the Arctic Semiconductor, who don't seem to be very responsive to the issue. Davide (creator of the RFNM) writes:

In the Lime board, the IQ LPF works properly. For granita, it doesn’t work at all, like the -3 dB point of the 20 MHz LPF option is 100 MHz+. The manufacturer of the RFIC kept saying that this is a firmware bug, so I gave them a devkit to replicate, but they never fixed it over the last month. I don’t know at this point if this is a software problem or if they discovered it’s something more.  

We confirmed that adjusting the gain settings on Granita did not help with the imaging problem either.

We also noticed that Granita was picking up or internally generating significant noise spikes. We initially assumed this was from the 9V SMPS, but even with a 12V linear power supply similar spikes were seen. The same noise was not visible with the Lime board.

Sensitivity in the bands above 600 MHz was good, at around -135 dBm. Below 600 MHz where the mixer is used, sensitivity was a bit poorer at around -123 dBm. The highest frequency we could receive was around 5900, but after about 5 GHz signals started to become very weak. The Granita board is advertised as receiving 10 - 6300 MHz, however, the documentation notes that the current batch is only capable of tuning to around 5 GHz. They note that the next batch should reach 6.3 GHz.

The Granita board was able to receive broadcast AM, shortwave, and ham frequencies with good signal strength. At 15 - 50 MHz the sensitivity is roughly -115 dBm.

At the time of this review, we cannot recommend that anyone purchase the Granita board unless they are working in a very controlled environment. We hope that in the near future the IQ LPF problem can be fixed to make the Granita board usable.

GNU Radio Tests (Windows)

The file drive on the RFNM also comes with a Soapy driver available. We copied the RFNMSupport.dll file from the RFNM drive over to our GNU Radio radioconda installation's SoapySDR folder at C:\Users\proje\radioconda\Library\lib\SoapySDR\modules0.8. Then we opened GNU Radio and opened the gnuradio_example.grc file. This brings up a FFT and waterfall display like in SDR++ and with the Gain controls exposed. With the gain controls exposed the Lime + RFNM combination works great.

The daughterboards also have built-in antennas that can be switched in or out using a drop down box in the GNU Radio UI. The built-in antenna on both boards is a Pulse W3796 which has an advertised range of 698 MHz to 2.7 GHz. While the built-in antenna works well for nearby bench reception, we preferred to still use our outdoor dipole antenna for better reception.

153.6 MHz Bandwidth Mode

It's possible to set the RFNM to provide even more bandwidth by connecting two USB cables to the PC. That gives us up to 153.6 MHz of 12-bit data. Enabling this mode requires editing a variable via the terminal

echo 153 > /sys/class/i2c-dev/i2c-0/device/0-0050/rfnm_set_dcs_freq && reboot

Once this was set we were able to edit the samp_rate block in the GNU Radio example, and set it to 153.6 MHz. At the moment the current SDR++ does not support the 153.6 MHz sample rate.

Conclusion

It's clear that the RFNM is cutting edge, yet affordable, and has great potential and excellent features and specifications. The built-in processor, DSP and GPU capabilities on the RFNM could be game changers in the near future. However, at the time of this review, the software support is still in its very early stages, documentation is lacking, and it's not yet recommended for mainstream users who just want to plug in and get started with an SDR for listening and decoding signals.

Regarding the Granita daughterboard, we would probably hold off on purchasing this until there is some clarification on the IQ LPF fix.

If you are an advanced SDR user who is comfortable with GNU Radio, Linux and advanced applications like setting up and running mobile basestations, then the RFNM may be a good choice. We are looking forward to applications that make use of the onboard DSP and GPU capabilities.

Over on his blog Jeff Sandberg has posted a writeup detailing how he combined RTL-SDR, rtl_amr, and HomeAssistant to decode wireless data from his Itron power meter, and create useful graphs showing his US home's power usage.

In the post, Jeff explains how he uses an RTL-SDR Blog V4, HomeAssistant, EMQX, and rtl_amr to receive and plot the data. The RTL-SDR and rtl_amr software receives and decodes the wireless Itron electricity meter data packets, and then EQTT passes the data to HomeAssistant for logging and plotting. Jeff also notes how he used NodeRed to correctly automate the summer and winter tariff price changes.

Finally, in an update to the post Jeff mentions that he was also able to receive and log data from his gas meter.

Last month we posted about Aaron's video on Meshtastic, and how it's possible to decode the Meshtastic protocol using an RTL-SDR and GNU Radio project called Meshtastic_SDR. 

If you weren't aware, Meshtastic is software that enables off-grid mesh network based communications and can run on cheap LoRa hardware. The mesh based nature of the system means that communications can be received over long distances, without any infrastructure, as long as there are sufficient Meshtastic nodes in an area that can route the message to the destination node. One example application of Meshtastic is to use it as a mesh-based text messaging system. This might be useful for teams of hikers, pilots, or skiers who operate in remote areas without cell phone coverage.

In his latest video, Aaron shows how Meshtatsic_SDR can also be used to transmit the Meshtastic Protocol using a transmit capable SDR like the HackRF. Aaron writes in the video description:

In this video, we take a deeper dive into the setup and usage of the meshtastic_SDR repository, which now enables the transmission and reception of Meshtastic using Software Defined Radios (SDRs). Recent updates have made this possible by partially leveraging GNU Radio flow graphs for both RX (receive) and TX (transmit), and integrating Python scripts that connect to ZMQ sources for message input and ZMQ outputs for message decoding.

I demonstrate the setup using a HackRF for the transmit side and an Airspy R2 for receiving. We also verify the results of TX and RX using a standard Meshtastic receiver to ensure accurate performance.

Over on YouTube Paul Lutus has recently posted a video that is a great introduction to software-defined radio, RTL-SDR, and some of the various signals that can be received with one. In the video he uses an RTL-SDR Blog V4, which has a built-in upconverter, allowing for good reception of HF signals.

Paul's video briefly explores SDR theory, before demonstrating various signals on both the HF and VHF+UHF bands that can be received with an RTL-SDR Blog V4. He also briefly touches on GNU Radio.

If you are a just getting started with RTL-SDR this might be a good overview video to watch. Paul has also set up a companion webpage for the video that outlines some of the software installation and usage steps mentioned in the video in greater detail.

Over on her YouTube channel SignalsEverywhere, Sarah has uploaded her latest video showing how it is possible to monitor Itron ERT smart meters on an Android device.  Smart meters are used to wirelessly monitor the usage of residential utilities such as water, gas, and electricity. With an RTL-SDR and some decoding software, it is possible to monitor the data coming from your own and your neighbours meters (at least for certain brands of meter).

In her video, Sarah shows how she compiled the rtl_amr decoder software for Android, and created her own Android app called "AndAMR" for displaying the data decoded by rtl_amr. The rest of the video shows how to set up and use the app.

In his latest video, Matt from the TechMinds YouTube channel tests out an LHCP L-band helix feed designed for receiving Inmarsat satellites. Matt pairs the feed with an 85cm satellite dish, an L-band LNA, and an Airspy Mini.

The L-band helix feed comes from a small German engineering company called nolle.engineering. The feed is priced at 94.70 Euros (incl. VAT) (~$102 USD), plus shipping costs. It is a passive antenna so it needs to be combined with an LNA to be usable with a typical SDR.

In the video Matt shows that the reception with the LHCP helix + dish setup is better than expected. He also compares it to a previous test he did with a longer RHCP helix antenna also produced by nolle.engineering. The RHCP antenna is used to be used without a dish, however, as expected the SNR is less than the dish + small LHCP feed setup. Matt then shows some Inmarsat signals being decoded including STD-C and Aero voice.