0
$\begingroup$

I'm working on a project involving FSK-modulated signals. I'm trying to reverse-engineer these signals to determine the preamble pattern used, because the protocol is proprietary.

Shown below is a plot of the real parts of two captured transmissions that seem to follow the same pattern - except their frequencies appear to be inverted. This is further evidenced by the instantaneous frequency plots also shown. I captured these signals using an RTL-SDR dongle, which outputs complex I/Q samples. What does this mean?

enter image description here

$\endgroup$
4
  • 1
    $\begingroup$ Why are you analysing the real part only? Don't! Simply directly apply your frequency estimator to the complex (IQ) signal and don't modify your signal by throwing away the imaginary part! $\endgroup$ Apr 6 '18 at 17:34
  • $\begingroup$ The instantaneous frequency plots are generated from the IQ data, I was just displaying the real part plots that demonstrate what I’m dealing with. $\endgroup$
    – Aaron
    Apr 6 '18 at 17:51
  • $\begingroup$ If that is the case, why are all these frequencies positive? With complex baseband, you'd represent the full -f_sample/2 to +f_sample/2 range, not just the positive frequencies! $\endgroup$ Apr 6 '18 at 17:56
  • 1
    $\begingroup$ Because these transmission plots are only a small subset of the entire data file. The transmitting devices use FHSS, so I isolated two transmissions operating in one of the hopping channels. $\endgroup$
    – Aaron
    Apr 6 '18 at 17:59
0
$\begingroup$

The apparent exchange of preamble symbols between mark and space in separate transmissions indicates that the packet is differentially encoded in some way. NRZI encoding is used in both Packet Radio and AIS, so you might wish to investigate if that appears to be the case for your unknown packet format as well.

$\endgroup$
4
  • $\begingroup$ I thought something like this might be the case, but I’m not really sure how to find out without access to the protocol, sadly. $\endgroup$
    – Aaron
    Apr 6 '18 at 19:31
  • 1
    $\begingroup$ Well, make an assumption, e.g. it is NRZI, and move forward as far as you can with that. If you end up with nonsense, it was probably a bad assumption. Lather, rinse, and repeat. Reverse engineering is reallly tedious. $\endgroup$
    – Andy Walls
    Apr 6 '18 at 20:42
  • $\begingroup$ I always look for out of band information when trying to puzzle out unknown protocols: FCC documents, user manuals, object code name/symbol dumps, patents, firmware upgrade archive s, etc. $\endgroup$
    – Andy Walls
    Apr 6 '18 at 20:45
  • $\begingroup$ Yeah I’ve been through the FCC docs and been in touch with their tech support - they’re pretty tight lipped. $\endgroup$
    – Aaron
    Apr 6 '18 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.