Universal Radio Hacker - 03: Analysis

[@hbirtt]

The name of this application is both perfect and detrimental to the perception of it. On the one hand, I have heard of it a few times and discounted it because the name made me think it was some script kiddy tool for "hacking." I imagined it having deauth functionality and a handshake collector for gathering hashes etc. On the other hand, my ignorance aside, this is a great universal tool for actually hacking rf protocols like a big boy, so the name is perfect. This is an amazing tool that I feel stupid for not looking at MUCH sooner.

[@curiousmuch.9911]

This is really awesome. Thank you so much for this program!

[@neuroforlunch1423]

Nice. I'm going to apply this to bioelectric signals.

[@BR.]

This is fantastic! You just gained a very interested subscriber :)

[@dr.johannespohl8547]

Thanks, glad to hear that. :)

[@szabonandi]

Very good tool. Thanks for developing.

[@FalcoGer]

I have a question here. I have a frame that starts with the demodulated signal 101010... (24 bits). Then there are roughly 17000 samples (10 bits) of 0. And then it seems to switch over to a different mode of operation in that a 0 is represented by a raw 100 and a 1 is represented by a 110, or in other words it's a short pulse for a 0 followed by a long pause and a long pulse for a 1 followed by a short pause. I have found out I can use the "remove carrier" option with 1_0 and get the bits like that for that message. URH breaks those two things apart into two messages because of the relatively lengthy pause of 10 bits. And I don't want that because they're linked. One is always preceding the other and they're always exactly 17000 +/- 50 samples apart. On the other hand I still want to handle the two things differently because they're encoded differently. So 1. How do I make it recognize the 17000 samples of nothing as 10 zeroes instead of silence between messages? and 2. How do I decode the preamble differently from the other data in the same message? and 3. how do I generate a fake message using that mixed encoding?

[@dr.johannespohl8547]

1. If you hit the wrench symbol next to the ASK modulation in the Interpretation, you can configure after how many 0 bits to break a message (default 8) 2.+3. If you go into to configuration of a label you can uncheck the "apply decoding" checkbox. Doing that for Preamble and Sync should take you where you want

[@tactical_hen]

This is pure awesome!

[@dr.johannespohl8547]

Thanks man!

[@tobiasxy1230]

Hallo Herr Dr. Pohl, haben Sie die BOS für Technik in Augsburg besucht? Beste Grüße

[@diyalaisabar6641]

Hi, great videos! Unfortunately , I am still having a hard time understanding how to interpret and analyze my signals... The signals I listen to use 2.405GHz and 6LoWPAN. I know that each channel bandwidth is 2e6, I therefore set the sample rate to 4e6. I also know that the modulation used is OQPSK. Meaning there are 2 bits/symbol and I've set the samples/symbol to 8. However, I do not know where to put my center or how to analyze them, I am very confused...Which decoder technique should I use? How do I know what everything is? I would appreciate all help I can get.

[@abidjetethan6578]

Hello I would like to know if possible to locate a phone with the imei number with its hardware

[@JNET_Reloaded]

ok so i can interpret the binary fsk signal how do i copy and paste the binary data to a text file for playback later? a dw i litrally copy and pasted with kb :D

[@ThisPageIntentionallyLeftBlank]

Jump to @2:24 for protocol

[@zukjeff]

subscribed. Thanks for the work. I have read, played and watched all the vids for 24 hours i can on 'Decoding'. I'm no closer. I am trying to custom a decoder for something like 4-DPIM ( yes temperature sender). any other vids or doco please ?

[@dr.johannespohl8547]

Thanks man. We can have a chat about custom decodings in our slack: join.slack.com/t/stralsundsecurity/shared_invite/enQtMjEwOTIxNzMzODc3LWU4ZWIzMTQ3NDAyNjkzODBhZTJiZDNmN2U0MTA4ZTM1MjhhNTNiYTc4YzQ5MDk2NjU5YzMxOWJmMDQyZDczYjg

[@5ch4um1]

how cool is that?!? :) so, i could tell it to decode alice as, say... modified miller, and bob as say manchester code? that sounds pretty nice! :)

[@dr.johannespohl8547]

Correct!

[@5ch4um1]

@@dr.johannespohl8547 installed it yesterday and took a quick look, looks amazing! just out of curiosity, if i had a device that could send, would it be possible to send like a weak, inverted version of the original signal to emulate a device that doesn't actually send, but rather communicates by "turning it's antenna off and on again" ? ;)

[@dr.johannespohl8547]

@@5ch4um1 Sure thats no problem. Just put an invert encoding on the signal in Analysis tab and then send it back via Generation.

[@5ch4um1]

@@dr.johannespohl8547 amazing... next you tell me that i could even send arbitrary messages by simply using the fuzzer tool...? o.O

[@5ch4um1]

@@dr.johannespohl8547 i saw the other video now, like, you even implemented a handshake, that's all pretty crazy stuff!

[@isso013]

I HACKED MY SCOOTERALARM!