SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsre-sdr

re-sdr

Data & analytics

View repository

Updated 10-15 21:35

About this skill

RF signal reverse engineering (SDR)

When to use / when not to use

  • Use: wireless protocol/remote control/telemetry signals (IoT wireless, remote controls, telemetry links), signal-level protocol recovery
  • Use: rapid identification of 433/868/915MHz ISM band sensors/remote control devices (rtl_433 has built-in decoders, see [[commands]])
  • Use: replay attack verification (authorized targets only — decode the frame first, then replay, don't blindly replay)
  • Don't use: wired protocols (go to [[re-protocol]]); wireless IoT protocols already encapsulated for analysis (go to [[re-iot-proto]])
  • Don't use: only analyzing already-demodulated data streams/application layer (directly [[re-proto-rev]] / [[re-crypto-decrypt]])
  • Don't use: monitoring multiple channels simultaneously (a single RTL-SDR is single-channel; multiple channels require multiple devices or a phase-coherent acquisition setup)

Tool preparation

RTL-SDR / HackRF (receive hardware)

  • Purchasing guide: RTL-SDR (receive, low-cost entry) / HackRF (transmit and receive, needed for replay)
  • Driver: apt install rtl-sdr / brew install rtl-sdr；HackRF: apt install hackrf / brew install hackrf
  • Verification: after plugging in the hardware, rtl_test or hackrf_info has output
  • Frequency calibration: rtl_test -p let it run for a few minutes to read a stable ppm error value, and during acquisition use rtl_sdr ... -e <ppm> to compensate — frequency offset is the primary cause of garbled demodulation
  • Bandwidth differences: RTL-SDR stable bandwidth is about 2.4MHz (theoretical 3.2MHz is unstable); HackRF max 20MHz, half-duplex — choose HackRF for wideband acquisition/active transmission (see [[gotchas]])

GNU Radio (signal processing)

  • Linux: apt install gnuradio / pacman -S gnuradio；macOS: brew install gnuradio
  • Windows: official installer
  • Verification: gnuradio-companion --version or grcc --version
  • Headless compilation: grcc flow.grc compile flowgraphs into executable Python scripts — for batch/repeated demodulation chains, managing files is faster than dragging wires in the GUI every time

Gqrx (spectrum/receive GUI)

  • Debian/Ubuntu: apt install gqrx-sdr(note the package name has the -sdr suffix); Arch: pacman -S gqrx；Fedora: dnf install gqrx；macOS: brew install --cask gqrx
  • Verification: gqrx --version(or the GUI can open and show the spectrum waterfall)
  • Purpose: real-time spectrum/waterfall display to quickly locate active signals and center frequencies, more intuitive than command-line frequency scanning

inspectrum (spectrum/timing visualization)

  • Linux: apt install inspectrum or compile from source; macOS: brew install inspectrum
  • Verification: inspectrum --version
  • Purpose: offline time-domain/spectrum analysis of recorded IQ files (find frame structure, symbol width)

Universal Radio Hacker (URH) (demodulation and frame recovery)

  • Multi-platform: pip install urh
  • Verification: urh --version
  • Purpose: all-in-one demodulation (modulation identification), bitstream analysis (sync words/encoding inversion), field segmentation

rtl_433 (ISM band sensor decoding)

  • Debian/Ubuntu: apt install rtl-433；Fedora: dnf install rtl-433；macOS: brew install rtl_433(underscore); Arch: pacman -S rtl_433
  • Verification: rtl_433 -h lists the supported device list (e.g. 0: generic protocol family, 1: thermometer-hygrometer...)
  • Purpose: one-click decoding of common remote control protocols such as 433/868MHz weather stations/thermometer-hygrometers/garage doors
  • Continuous output: rtl_433 -F json -f 433.9M continuously prints decoding results as JSON — use with log redirection when monitoring for a long time/collecting signals from multiple devices

Operating steps

Execute in order; authorized testing only (red line: replay/interaction requires authorization).

  1. Signal acquisition and spectrum analysis：

    # 示例（工具可替换）：GNU Radio 或命令行采集
rtl_sdr -f 433.9M -s 1M capture.iq
    • First scan the full band (find active signals) → determine center frequency and bandwidth → capture IQ
    • Scanning: rtl_power -f 400M:470M:250k -g 40 -i 10 scan.csv(outputs CSV, can be plotted with gnuplot) or use Gqrx waterfall
    • Modulation identification: spectrum shape (FSK double peak/PSK flat/AM carrier); watch in real time with Gqrx, examine offline in detail with inspectrum
    • Capture parameters: rtl_sdr -f <频率> -s <采样率> -g <增益> -n <采样数> out.iq；-g 0 automatic gain
    • Sampling rate principle: sampling rate ≥ 2× signal bandwidth—250k–1M is enough for narrowband remote controls (tens of kHz), don't max out at 2.4M just for convenience and needlessly increase file size

  2. Demodulation：

    • URH: load IQ → automatic/manual modulation identification → demodulate bitstream
    • GNU Radio: build a demodulation chain (AM/FM/PSK/QAM/FSK) based on the identification result
    • Quick monitoring: rtl_fm -f 433.9M -M fm -s 22050(FM voice/FSK audio monitoring, listen to/record audio to assist identification)
    • Output: demodulated bitstream (0/1 sequence)

  3. Frame synchronization and protocol recovery：

    • Open the capture file in URH → find sync words in the bitstream analysis view, try encoding inversion (NRZ/Manchester)
    • Find sync word (repeating pattern/fixed prefix) → determine frame boundaries → field division (address/length/payload/CRC)
    • Compare multiple frames (repeated transmission) → unchanging fields = fixed header, changing fields = data/sequence number
    • Bitstream to bytes: first confirm bit order (MSB/LSB first) and length alignment (multiple of 8)—URH displays bit by bit by default, verify before converting to bytes, otherwise field division will be completely wrong
    • Output: frame structure table (field offset/length/semantics)
    • Known ISM devices: first run rtl_433 -f 433.9M -A（-A analysis mode prints the decoded pulse sequence and protocol guesses)—common protocols (weather stations/garage doors/tire pressure) hit directly, saving manual recovery

  4. Replay and interaction(authorized scenarios):

    • HackRF replay captured frames (replay attack verification—only on authorized targets): 
      hackrf_transfer -r capture.iq          # 先采集（HackRF 口）
hackrf_transfer -t capture.iq -f 433.9M -a 1 -s 2M   # 回放（-a 1 开放大器）
    • Interactive: modify fields and resend (rolling codes/encryption require analyzing the algorithm first—see [[re-crypto-id]] / [[re-crypto-decrypt]])
    • Before replaying, verify that the sampling rate/gain match those at capture time—if parameters don't match, the target won't receive the replay (see [[gotchas]])

  5. Evidence organization (wrap-up): archive IQ files, demodulated bitstreams, frame structure tables (field offset/length/semantics), and replay records (time/parameters/results) together for comparison; write conclusions in [[re-analyze/analysis-contract]]—archive signal-level evidence (screenshots/waveforms) and protocol-level conclusions (frame structure) separately

Cross-domain combination

  • [[re-iot-proto]]: wireless IoT protocol linkage (MQTT/CoAP and other encapsulation layers)
  • [[re-protocol]]: frame structure state machine reconstruction linkage
  • [[re-crypto-id]] / [[re-crypto-decrypt]]: payload encryption analysis
  • [[re-feedback]]: accumulation of signal case experience (after desensitization)

Common pitfalls and traps

  • Frequency offset/sampling rate error: symptom—demodulation is all garbled; cause—center frequency offset, sampling rate mismatch; countermeasure—calibrate first with a known signal (FM broadcast)
  • Modulation misjudgment: symptom—FSK demodulated as PSK; cause—similar spectrum characteristics; countermeasure—compare with time-domain waveform (inspectrum) before deciding
  • Replay requires authorization: Symptom — unauthorized replay triggers device actions; Cause — out-of-bounds operation; Countermeasure — red line: only authorized targets
  • Bit inversion overlooked: Symptom — bitstream is entirely inverted; Cause — NRZ/Manchester not identified; Countermeasure — try combinations of inversion and encoding mode
  • Incomplete capture: Symptom — frame is truncated; Cause — insufficient bandwidth/trigger timing; Countermeasure — increase bandwidth, extend capture, trigger on sync word
  • RTL-SDR image frequency/bandwidth limitations: Symptom — captured signal appears at the wrong frequency, and demodulation becomes completely garbled once bandwidth exceeds 2.4MHz; Cause — direct sampling aliasing, unstable USB transfer; Countermeasure — bandwidth ≤2.4M, first rtl_test -p calibrate ppm then use -e compensation (see [[gotchas]] for details)
  • URH has weak support for complex modulation: Symptom — URH cannot demodulate a stable bitstream from DSSS/OFDM/frequency-hopping signals; Cause — URH is designed for simple modulation (ASK/FSK/PSK); Countermeasure — for spread-spectrum signals, switch to GNU Radio to build a complete demodulation chain (despreading/equalization), and use URH only for subsequent bitstream analysis
  • For hardware differences and tool-specific pitfalls, see [[gotchas]]; for a command quick reference, see [[commands]]