-
Notifications
You must be signed in to change notification settings - Fork 25
/
Copy pathfsk_transmitter.html
171 lines (99 loc) · 5.7 KB
/
fsk_transmitter.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
<!DOCTYPE html>
<html>
<head>
<meta charset='utf-8'>
<meta http-equiv="X-UA-Compatible" content="chrome=1">
<link rel="stylesheet" type="text/css" href="stylesheets/stylesheet.css" media="screen">
<link rel="stylesheet" type="text/css" href="stylesheets/pygment_trac.css" media="screen">
<link rel="stylesheet" type="text/css" href="stylesheets/print.css" media="print">
<title>RF Testing Methodology by NCC Group</title>
</head>
<body>
<header>
<div class="container">
<h1>RF Testing Methodology</h1>
<h2>www.nccgroup.com</h2>
<section id="downloads">
<a href="https://github.com/nccgroup/RFTM/zipball/master" class="btn">Download as .zip</a>
<a href="https://github.com/nccgroup/RFTM/tarball/master" class="btn">Download as .tar.gz</a>
<a href="https://github.com/nccgroup/RFTM" class="btn btn-github"><span class="icon"></span>View on GitHub</a>
</section>
</div>
</header>
<div class="container">
<section id="main_content">
<h2>
<a id="developing-a-digital-fsk-transmitter-step-by-step" class="anchor" href="#developing-a-digital-fsk-transmitter-step-by-step" aria-hidden="true"><span class="octicon octicon-link"></span></a>Developing an FSK transmitter step-by-step</h2>
<p>If you have captured some data from a target system using a receiver and you now wish to modify that data and re-transmit it (for example if you are developing an RF-based fuzzer) the following process can be followed. This transmitter is assumed to use FSK modulation (this example is actually a transmitter developed for the <a href="https://wiki.pentest.ngs/index.php/Io-homecontrol">io-homecontrol protocol</a>)</p>
<h3>
<a id="data-source" class="anchor" href="#data-source" aria-hidden="true"><span class="octicon octicon-link"></span></a>Data source</h3>
<p>The assumption is that you start with a data file containing the binary data bytes you want to send</p>
<p>Create a new flow-graph and set the "samp_rate_tx" variable to 4e6</p>
<p><img src="images/tx_samp_rate.png" alt=""></p>
<p>Add a "File Source" block and set the file to be your data file. Ensure that "Repeat" is set to "No" (unless you specifically want it to repeat)</p>
<h3>
<a id="set-the-baud-rate" class="anchor" href="#set-the-baud-rate" aria-hidden="true"><span class="octicon octicon-link"></span></a>Set the Baud rate</h3>
<p>Having received the data, you should already know what the Baud rate should be set to. Add a new "Variable" block called "baud_rate" and set it to the correct value.</p>
<p><img src="images/tx_baud_rate.png" alt=""></p>
<h3>
<a id="modulation" class="anchor" href="#modulation" aria-hidden="true"><span class="octicon octicon-link"></span></a>Modulation</h3>
<p>Add a new "Variable" called "sps" (samples per symbol) and set it's value to be 10</p>
<p><img src="images/tx_sps.png" alt=""></p>
<p>Change the default "samp_rate" "Variable" block to 384000 (10 x Baud rate, as we want 10 samples per symbol)</p>
<p>Add a "GFSK Mod" block, which will modulate the data using FSK. Configure the following settings:</p>
<ul>
<li> "Samples/Symbol": sps</li>
</ul>
<ul>
<li> "Sensitivity": 1</li>
</ul>
<ul>
<li> "BT": 1 (this will effectively remove the Gaussian filter and make it FSK rather than GFSK)</li>
</ul>
<p><img src="images/tx_gfsk_mod.png" alt=""></p>
<p>Your flow-graph should now look like this:</p>
<p><img src="images/tx_source_and_mod.png" alt=""></p>
<h3>
<a id="resampling" class="anchor" href="#resampling" aria-hidden="true"><span class="octicon octicon-link"></span></a>Resampling</h3>
<p>We now need to match the sample rate of the data with the transmitter (as it is the final sample rate of the transmitter that will actually determine the rate that the data is transmitted).</p>
<p>Add a "Rational Resampler" block with the following settings:</p>
<ul>
<li> "Interpolation": samp_rate_tx (the output sample rate)</li>
</ul>
<ul>
<li> "Decimation": samp_rate (the input sample rate)</li>
</ul>
<p><img src="images/tx_resampler.png" alt=""></p>
<h3>
<a id="adjust-the-signal-level" class="anchor" href="#adjust-the-signal-level" aria-hidden="true"><span class="octicon octicon-link"></span></a>Adjust the signal level</h3>
<p>We don't want to overload the input to the transmitter so we need to attenuate (reduce) the signal level.</p>
<p>Add a "Multiply Const" block and set "Constant" to be 0.8</p>
<p><img src="images/tx_const.png" alt=""></p>
<h3>
<a id="configure-the-transmitter" class="anchor" href="#configure-the-transmitter" aria-hidden="true"><span class="octicon octicon-link"></span></a>Configure the transmitter</h3>
<p>We are now ready to transmit the signal.</p>
<p>Add a "Variable" block with the name "freq" and value equal to the transmit frequency:</p>
<p><img src="images/tx_freq.png" alt=""></p>
<p>Add an "osmocom Sink" block with the following settings:</p>
<ul>
<li> "Ch0: Frequency": freq</li>
</ul>
<ul>
<li> "Ch0: RF Gain (dB)": 30 (can be changed as required)</li>
</ul>
<ul>
<li> "Ch0: IF Gain (dB)": 20 (can be changed as required)</li>
</ul>
<ul>
<li> "Ch0: BB Gain (dB)": 20 (can be changed as required)</li>
</ul>
<p><img src="images/tx_tx.png" alt=""></p>
<p>The complete transmitter flow-graph should now look like this:</p>
<p><img src="images/iohome_tx_crop.png" alt=""></p>
<h3>
<a id="communicating-with-the-transmitter-in-real-time" class="anchor" href="#communicating-with-the-transmitter-in-real-time" aria-hidden="true"><span class="octicon octicon-link"></span></a>Communicating with the transmitter in real-time</h3>
<p>Rather than using a file as a source you can use a "TCP Sink" block, bind it to a socket and send it data via TCP</p>
</section>
</div>
</body>
</html>