# Getting the bitstream of an unknown RF signal

I am trying to get the bitstream of a signal sent over 433MHz. I have installed SDR# (I'm on Windows), connected my NESDR SMART, and I identified the signal here: I can see there is only one peak with progressively decreasing peaks, so I assume this is AM. Then I set the bandwidth to the width of the central lobe. I finally made a recording of the "Audio" and opened the WAV into Audacity but I could not make sense of the sines (I was expecting a digital stream, since the modulation was specified) so here is the I/Q data instead. This is an extract of the body of this waveform: I have also installed DSD+ and the SDR# plugin as well as the virtual cable between the two, but after setting up SDR# the waveform does not budge so nothing comes up.

What sort of encoding is this? How can I read the bitstream? I am open to other things to try to get to the bottom of this.

• That signal doesn't look like AM to me... – MBaz May 30 at 17:16
• Thanks for your comment. Could you expand on this? – user42875 Jun 4 at 18:24
• You say that the first spectrum in your post looks like AM. Personally I don't think it does, because there are no well-defined USB and LSB. To me, it looks like a rectangular pulse train. – MBaz Jun 4 at 19:15
• Am I correct in saying that the RF signal itself (source of this FFT) cannot be a rectangular pulse train, especially looking at the I/Q data? I thought that maybe this could be phase modulation, since the background sine does not look continuous. But the FFT does not show 2 peaks so I set it aside - what do you think? – user42875 Jun 4 at 21:39
• The pulses look like chopped sine waves, which is consistent with the spectrum. The zeros between the pulses are unusual, but could point to a RZ line code -- not generally used in wireless. Maybe try low-pass filtering the signal, to interpolate between the zeros? – MBaz Jun 4 at 22:34

First I found the sine wave extrema (black markers at the bottom) and stretched and superimposed a sine wave graph (red) on top of the signal graph with the extrema in the same locations. The signal matches (0) the sine wave over some of the non-zero segments, and over the other non-zero segments it matches the sine wave with a sign flip (1). This gives a binary sequence.

A sign flip is equivalent to a 180 degree phase shift, so this is a form of binary phase shift keying (BPSK, 2PSK, also phase reversal keying, PRK) with the useful symbol interval duration (of each sinusoid piece) seemingly equal to the guard interval duration (of each zero-valued segment that separates symbols). It is unusual that here the symbol rate is higher than the sine wave frequency, with a ratio of about $$20/7\approx2.86$$.

• Very interesting, thank you very much. So this would mean the signal is both modulated into 2-PSK as well as OOK-modulated by a clock with twice the frequency of the bit stream ? – user42875 Jun 5 at 13:34
• I think you have the correct understanding of it, but it may not be valid terminology to call it OOK if the clock is the modulator. The clock frequency is the same as the symbol rate. In the clock there are two edges, the rising and the falling edge, per cycle. This doesn't seem like an advanced type of modulation, more like something that is intended to be very simple to demodulate. The guard intervals help to locate the symbols. – Olli Niemitalo Jun 5 at 13:54
• Thanks for your help, Oli. I accepted your answer because you were the first one to answer correctly, and also because you explained very well how things worked - I hope you will not hod a grudge for me giving the reward to rjan87 since he has 900x less reputation than you :) – user42875 Jun 7 at 21:07
• @user42875 no worries mate :) – Olli Niemitalo Jun 7 at 21:26

The IQ data looks like a sinusoidal modulated pulse train with binary phase shift keying (BPSK) superimposed. The BPSK symbol rate appears to be at the same rate as the pulse repetition frequency (PRF).

I was bored, so I went ahead and modeled the data in MATLAB.

clear; clc;

% Measured quantities from IQ data
pw = 2.1771e-4;         % Pulse Width
pri = 4.1123e-4;        % Pulse Repetition Interval
ts = 2.419e-5;          % Sampling Interval
period = 0.0012;        % Modulation Period
npulses = 24;           % Pulses in IQ plot
t_start = 1.8660;       % Plot start time

% Derived Quantities
prf = 1/pri;            % Pulse Repetition Frequency
fs = 1/ts;              % Sampling Rate
f = 1/period;           % Modulation Frequency

% Generate pulsed data
waveform = phased.RectangularWaveform('SampleRate',fs,'PRF',prf,...
'PulseWidth',pw,'OutputFormat','Pulses','NumPulses',npulses);

pulses = waveform();

% Prepend data with zeros to match IQ plot
pulses = [zeros(fix((pri-pw)/ts),1); pulses].';

t = (0:length(pulses)-1)*ts;
t = t_start + t;

modulation = sin(2*pi*f*t);

figure(1)
subplot(2,1,1)
plot(t,pulses,'b'); title('Pulsed Data')
xlabel('t'); ylabel('Amplitude');
ylim([-0.1 1.1])
xlim([t(1) t(end)])

subplot(2,1,2)
plot(t,modulation,'r'); title('Frequency Modulation')
xlabel('t'); ylabel('Amplitude');
ylim([-1.25 1.25])
xlim([t(1) t(end)])


% Frequency Shifted Baseband Data
initial_phase = 3*pi/16;  % Used to match IQ plot
amp = 0.75;
I_mod = -amp*sin(2*pi*f*t + initial_phase);
Q_mod = -amp*cos(2*pi*f*t + initial_phase);

% Modulate the pulsed data
I_data = I_mod.*pulses;
Q_data = Q_mod.*pulses;

figure(2)
subplot(2,1,1)
plot(t,I_data,'b'); title('I-Signal');
hold on;
plot(t,I_mod,'r--');
xlabel('t'); ylabel('Amplitude');
ylim([-1.0 1.0])
xlim([t(1) t(end)])

subplot(2,1,2)
plot(t,Q_data,'b'); title('Q-Signal');
xlabel('t'); ylabel('Amplitude');
hold on;
plot(t,Q_mod,'r--');
ylim([-1.0 1.0])
xlim([t(1) t(end)])


% Phase Modulation
phase_code = [1 1 1 -1 -1 1 1 -1 1 -1 1 -1 -1 1 1 -1 -1 1 -1 -1 -1 1 1 1];
phase_chip = ones(1,pri/ts);

phase_mod = kron(phase_code,phase_chip);

% Prepend the data to match IQ plot
phase_mod = [zeros(1,fix((pri-pw)/ts)) phase_mod];

% Modulate the pulses data
I_phase = I_data.*phase_mod;
Q_phase = Q_data.*phase_mod;

figure(3)
subplot(2,1,1)
plot(t,I_phase,'b'); title('I-Signal');
hold on
plot(t,phase_mod,'r--')
xlabel('t'); ylabel('Amplitude');
ylim([-1.0 1.0])
xlim([t(1) t(end)])

subplot(2,1,2)
plot(t,Q_phase,'b'); title('Q-Signal');
hold on
plot(t,phase_mod,'r--')
xlabel('t'); ylabel('Amplitude');
ylim([-1.0 1.0])
xlim([t(1) t(end)])


In the figure above, you can see where the 180 degree phase shifts occur. I also found the ratio of the symbol rate (PRF) to modulation frequency (f) to be 2.91.

• Exactly what I needed to understand every bit of it - litterally -. Thanks a lot! – user42875 Jun 7 at 21:06