Reverse Engineering Cheap Chinese Radio Firmware TyTera MD-380 (Shmoocon 2016 via Hackaday)

Cool Stuff:

For those who are interested in the intersection of microcontrollers, hacking, and radio, an interesting deep dive into the firmware of one of the Chinese DMR/mototrbo ($140) radios, the Tytera MD380.

Unlike the cheap analog Chinese radios (Wouxun, Baofeng) which can only be programmed once, this radio supports a firmware upgrade.  The bit that is interesting for people who aren't deep into digital electronics is that this hack produced a version of the firmware that turns the MD380 into the first (hardware) DMR scanner.  N2NOV has been pointing out the gap, that no scanners cover DMR for a while now.

Note: this exploration/hack is at the experimental stage, so I wouldn't consider this ready/usable/applicable to anyone but those that want to experiment and are willing to risk bricking their radio or worse.

I couldn't resist, so I ordered a Tytera MD-380 this morning. More details to come.  So now my To Do list includes, learning about DMR/MotoTRBO, programming NYC area DMR amateur radio repeaters, and finding/joining communities that are covering alternative firmware development for the MD-380.

Out of the box, this radio is supposed to allow field programming (aka front panel programming) of DMR talkgroups.

Travis GoodSpeed's github repo, has a package of command-line Python tools for the MD380. Looks like enough for reading and writing the radio on Linux and Mac OS.  Also there is the beginnings of a CHiRP driver for the MD380. It doesn't read/write the radio but can be used for maintaining the analog channels and banks.

Also, hack-a-day, has had some good radio articles lately that aren't that deep into digital electronics for a wider audience.

You might recognize the name Travis Goodspeed from other projects like the GoodFET, an open source JTAG adapter inspired by Dangerous Prototype's Bus Pirate.

Links:

• Hack-a-day article: Reverse Engineering Cheap Chinese Radio Firmware from Shmoocon 2016 
• Hack-a-day articles in category Radio-Hacks
• (There is also a tag for Radio)  
• PoC || GTFO Newletter with the referenced article,the article is on pages 76-87. 
• Amateur Radio Guide to DMR (Digital Mobile Radio) - 28 page PDF introduction by W2XAB
• The DMR-MARC worldwide network - good web site with information about amateur DMR repeaters, and talkgroup listings
• Travis GoodSpeed's github repo
• Travis Goodspeed's blogspot blog,  (last update July 2013)

More Yaesu VX-8 GPS implementation details.

4Z7DTF left a comment on my post "Another Yaesu VX-8DR external GPS with an Arduino/..." to let me know about his VX-8 Arduino GPS project on github.

There have been a number of projects that use either an Arduino or bare ATtmega microcontroller to turn the GPS module's NMEA sentences back into the a format the brain dead parser built into the VX-8's firmware can handle.

He has done some additional testing, actually fuzzing, showing the VX-8's parser does no error checking what so ever. 

Also, another interesting bit, in his work, he noted there is no need for the communication to be bi-directional. I don't know what, if anything the VX-8 tries to send to the GPS module, but it appears to be unnecessary. 

What is interesting about that is the microcontroller then really only needs a single serial port.  Most of the other projects are bi-directional using a software UART emulation for the second port.   So it might be possible to implement this project with something much smaller and even lower power.   It would be interesting to see if this can be done with the ATTiny85, using something like the Adafruit 3.3V trinket.  That is supposed to draw around 9 milliAmps at 8 Mhz, but 3 mA of that is just for the green power LED!  The ATTiny has no built in UART, so it would be all software serial. 

Raspberry Pi (RPi) and Amateur Radio Resources

Here are a few resources you might find helpful for Linux and radio on PCs or RPis.

http://www.trinityos.com/HAM/index-ham.html

• Ham radio software on CentOS Linux
• Getting Started with Packet Radio
• Raspberry Pi APRS and Packet Radio
• APRS beginner's guide
• Amateur Radio and Linux: Opening Doors without Windows

Raspberry Pi for Ham Radio Yahoo Group - a fairly active Yahoo Group. Yahoo Group Description:

This is a place for Amateur Radio Ops to discuss the Raspberry Pi and how it can be applied to Ham Radio.  This is a moderated Group. Please keep posts civil and on topic. (Any discussion of the RPi is welcome)

• https://groups.yahoo.com/neo/groups/Raspberry_Pi_4-Ham_RADIO/info

Info on Intel's AMT with an open source client.

Found this blog entry,  "Everything you need to know about Intel AMT and the Intel NUC with Ubuntu" on Dustin Kirkland's blog. AMT is vaguely related to IPMI, but is somewhat Intel proprietary. The key bit of info is there is a package available for Ubuntu, amtterm, that has a command, amttool that can be used for remote management of systems with AMT built-in (Intel VPro) and enabled.

Automate Cygwin package installation, search for packages from the command line, grep the list of installed packges.

Stumbled across two things for improving life when dealing with Cygwin.  (Cygwin is a port of Unix-like GNU tools for Windows.)

First, the standard Cygwin-setup utility takes command line arguments that will avoid all of the prompts, so you can have a single command to update a system without having to do a lot of clicking.   See this blog post from Cody Dunne.

Put this in a batch file, run it as administrator:

cd C:\cygwin
wget -N http://cygwin.com/setup-x86.exe
setup-x86.exe --no-desktop --no-shortcuts --no-startmenu --quiet-mode

Or if you are typing it by hand:

setup-x86 -nNdq

Second, there is a nice command link apt-get like utility, called apt-cyg. It's a neat, simple bash script. Nothing to really install. Provides command like search, and text access to the list of installed packages. apt-cyg is in Stephen Jungel's github repo.

Note: the key data is in the setup INI files stored in cygwin-pkgs/mirror-name/x86/setup.ini.

Hope this helps,
--Rob

Acurite 592TXR Temperature and Humidity Sensors now decoded by rtl_433.

I've added decoding of Acurite's 592TXR "Tower" temperature and humidity sensors to rtl_433. These are small, inexpensive, wirelesss (433 Mhz), temperature and humidity sensors. The 592TXR has several different model numbers including 06002RM

These are compatible with Acurite's consoles such as the 01512 that I have as well as Acurite's Acu-Link Internet bridge which posts to acu-link's web page as well as weatherunderground. I picked up the Acurite 5-n-1 Weather Station, a console, and the internet bridge because the support for the 5-n-1 had been added to rtl_433 and the package price was pretty reasonable.

There were a number of people interested in decoding the 592TXR, but for some reason, it never got added, so I finally added it and cleaned up the Acurite 5-n-1 weather station decoding. The pull request got merged November 8th, 2015.

I think the temperature only version, the 592TX, should also be supported but I don't have one to test. Please let me know if it decodes successfully or not.

The protocol used by the Acurite 592TXR and the 5-n-1 weather station are very similar. The weather station's messages are one byte longer, but they are basically the same with the same RF signaling characteristics.

Remotely monitor Refrigerator / Freezer temperature with Acurite 986 and rtl_433 (rtl-sdr)

I suspected the thermostat in my basement refrigerator was going bad, so I picked up an Acurite 986 refrigerator and freezer remote thermometer.  The display unit will give alarms if the temperature goes out of range.

I wanted a better picture of what was going on so I figured out the Acurite's 433 mhz protocol for the 986 sensors. I've added support to rtl_433. The pull request was merged November 20th, 2015.

Now I pump the data into rrdtool and see what's going on. I now see how long and often the compressor is running, and how long it times to warm up between cycles. The spikes are the defrost cycles.

Now I can also monitor/get alerted when I'm out of the house.

I'm pretty happy with the Acurite 986 display and temperature sensors even without the rtl_433 decoding.

Acurite 00986 Refrigerator / Freezer Thermometer Protocol

• Includes two sensors and a display, labeled 1 and 2, by default Sensor 1 - Refrigerator, 2 - Freezer.
• Data format: Pulse Position Modulated (PPM), 5 bytes, sent twice, no gap between repeaters
• Start/sync pulses: two short, with short gaps, followed by 4 long pulse/gaps.
• Data Format - 5 bytes, sent LSB first, reversed
• TT II II SS CC
• TT - Temperature in Fahrenehit
• integer, 
• MSB = sign. Encoding is "Sign and magnitude"
• II - 16 bit sensor ID changes at each power up
• SS - status/sensor type
• 0x01 = Sensor 2 (
• 0x02 = low battery
• CC = CRC (CRC-8 polynomial 0x07, little-endian) 

I was able to easily figure out the CRC with CRC RevEng..