#dspectrum

Software Defined Radio (SDR) and Radio Frequency (RF) analysis have been becoming significantly more popular in recent years. Software & hardware advancements, particularly in the open source arena, have undoubtedly contributed to the SDR becoming something of a zeitgeist in the security community. As a former software engineer, I set out to automate the process of translating signals employing simple modulation schemes to raw binary data. The modulation schemes of greatest interest to me, due to their sheer popularity in the automotive, internet of things (IOT), and home automation/security industries, are On-Off Keying (OOK), and Frequency-Shift Keying (FSK/2FSK).

I started out using GQRX to record RF transmissions, storing them as wave files, and then attempting to analyse them visually in the open-source audio tool: Audacity. As a beginner to SDR & RF, I found this quite daunting. GQRX is undoubtedly a powerful application, however, it is was not the right fit for reverse engineering data. It felt non-intuitive and required hefty configuration based on the type of signal you were attempting to analyse. Further, the output features were not designed to allow the user to observe changes in frequency.

I found a new cross-platform tool called Inspectrum. Inspectrum visualises both the frequency shifts, and the amplitude values, of RF signals. It also supports the raw file format (complex 32-bit floating point) produced by osmocom_fft, which is a simple but effective tool for capturing and persisting true representations of RF transmissions.

With a reliable means of viewing both OOK and 2FSK signals, the process I'd follow to reverse engineer signals in Inspectrum, was to use its grid overlay to help determine the baudrate of the transmission, and visually decode it. This process was very similar to the process I was previously following with Audacity, but this approach had a few significant differences: improved reliability of transmissions, ability to inspect frequency shifts, and the somewhat automatic calculation of the transmission's baudrate.

As a former software engineer, I have a tendancy to become inspired to build tools to automate tasks as they become tedious to perform. Once I felt I had a solid grasp on the identification and demodulation of these signals, I set out to build a wrapper for Inspectrum. The wrapper assesses the amplitude measurements, or frequency shifts, that are reported by Inspectrum. The wrapper uses the average of the provided values as a threshold. When a cell's value falls below the threshold, the wrapper determines that the value is a binary '0', and when it is above the threshold, it records the value as a '1'. It then returns this raw binary data as output, in addition to the binary's hex and ascii translations.

With this automated, my reverse engineering process had seen a significant gain in efficiency and was nowhere near as error prone as my previous process was. However, at this stage, I still had to compare signals by sight. I developed an enhancement for the wrapper that turned it into an interactive console. Another two features were included: the semi-automatic comparison of two portions of a transmission in the same file, and the semi-automatic comparison of two signals in separate files.

I went through the process of (re)reverse engineering some of my RF transmitting devices, and found that the average time to determine their binary values, and whether they employ rolling code systems, or have separate functions, has been reduced from an average of 1 hour per device to approximately 5 minutes.

Figure 1: dspectrum providing an automated comparison of two 2FSK signals

I have created a short video demonstrating the wrapper application. In this demonstration, I am comparing two separate signals produced by 'twin' devices with different codes/identifiers. I was able to determine which portion of the signal contained the codes/identifiers for this unit in approximately 2 minutes.

The wrapper (dubbed: dspectrum): https://github.com/tresacton/dspectrum