Posts

Some ideas about decoding TETRA with TI CC1120 and Arduino Due

https://www.rtl-sdr.com/decoding-tetra-voice-on-a-retevis-c62-handheld-with-custom-openrtx-firmware/ TI CC1120 has a mode called CFM. The CC1120 receives Custom Frequency Modulation (CFM) / Analog FM by bypassing its packet handler and continuously reading the instantaneous frequency offset from the CFM_RX_DATA_OUT register over SPI. This mode is designed for demodulating e.g. custom FSK modes. To configure the CC1120 for CFM, apply std RF settings (frequency, ch filter bw and AGC) and modify the following extended registers: Enable CFM Mode (CFM_DATA_CFG at 0x2F09) Bypass Packet Handling (PKT_CFG2 at 0x0026) Disable Sync Word Qualification (SYNC_CFG1 at 0x0008) Set RX Filter bw (CHAN_BW at 0x0010): Match the channel filter bandwidth to 25 kHz. Reading demodulated data (CFM_RX_DATA_OUT) Once the chip enters RX state via the SRX command strobe, your microcontroller must sample the demodulated frequency offset at regular intervals. Data format: register returns a signed 8-bit integer (tw...
Post a Comment
Read more

Burger pager FM and other devs in shopping centre

Image
Some times ago I noticed pager devices in burger restaurant. Specs found stated that it uses FM and works in frequencies 433.5 MHz and 433.85 MHz + also 462.750 MHz. RTL-SDR found two active frequencies 433.5 MHz and 433.85 MHz near restaurant.   Freqs around 433.85 MHz proved to be ISM OOK devices.   Pager device at 433.5 MHz seems to use POCSAG protocol. I used OnAir software to check whether it is standard pager tx and verified with SDR# Pocsag plugin. On Bluetooth sector I found some SBUS light controls. Probably by writing something in unknown service (UUID) values something can happen in lightning.   
Post a Comment
Read more

CC1120 + Arduino : Mobitex-1200

Image
https://techcoderadio.blogspot.com/2025/03/arduinosx1278-mobitex-1200-462325-mhz.html   #include <SPI.h> #include "cc1120.h" #define PRINT_INFO  1 #define DATA_SIZE   128 #define pinOfPin(P)\   (((P)>=0&&(P)<8)?&PIND:(((P)>7&&(P)<14)?&PINB:&PINC)) #define pinIndex(P)((uint8_t)(P>13?P-14:P&7)) #define pinMask(P)((uint8_t)(1<<pinIndex(P))) #define isHigh(P)((*(pinOfPin(P))& pinMask(P))>0) #define isLow(P)((*(pinOfPin(P))& pinMask(P))==0) #define digitalState(P)((uint8_t)isHigh(P)) uint8_t data[DATA_SIZE]; uint8_t chipStatus      = 0; volatile uint8_t index  = 0; volatile bool printData = false; void setup() {   Serial.begin(57600);   pinMode(RESET_PIN, OUTPUT);   pinMode(SS_PIN, OUTPUT);   pinMode(GDO0_PIN, INPUT);   pinMode(GDO2_PIN, INPUT);   pinMode(GDO3_PIN, INPUT);   digitalWrite(SS_PIN, HIGH);   digitalWrite(RESET_PIN, HIGH); ...
Post a Comment
Read more

Tweaks for the Bearmock with USB serial adapter and USB null modem adapter

Image
https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html .. and generally for anykind of serial based dev emulator written in Python. Python 3.14/.15 with JIT tends to work a bit better than older versions $env:PYTHON_JIT=1 USB serial adapter: USB selective suspend off.   USB null modem adapter: try different Latency Timer values.  
Post a Comment
Read more

Optimizing Uniden bearmock srecutils

https://techcoderadio.blogspot.com/2025/04/bearmock-for-python-3.html Some optimizations   # srecutils.py # # Copyright (C) 2011 Gabriel Tremblay - initnull hat gmail.com # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License as published by # the Free Software Foundation; either version 2 of the License, or # (at your option) any later version. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program; if not, write to the Free Software # Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA """     Motorola S-Record utis     - Kudos to Montreal CISSP Groupies """ from functools...
Post a Comment
Read more

BT scans 2026 #1

Image
Pump   Bar sound sys   Unprovisioned Mesh in hypermarket  
Post a Comment
Read more

Guidelines for inspecting old (circa 1998 - 2007) receiver control and updater software

Image
Old control/updater programs are usually written in VB6, Delphi/C++ Builder or .NET VB, C#. DetectItEasy can show PE32 info which usually and almost allways shows which development tool/framework is used. DetectItEasy strings function shows ASCII strings inside .EXE file. Sometimes there is code embedded inside exe, usually as Motorola S-Record format. E.g. with Python script is easy to extract it and remove unnecessary characters. import re re.sub(r'[^S0-9A-F\r\n]+', '', text) ...  or use Linux stings command.  Installers are usually msi or innoextract. Can be extracted e.g with unzip, msiexec, msiextract (Linux) or innoextract (Linux). Sometimes embedded code is inside in a one of the extracted files. SRecord is a set of tools for inspecting/converting etc. S-Record data. VB6 programs can be further examined e.g. with VB6 decompiler lite. .NET programs, dotPeek can export to VS solution. Even in deobfuscated .NET programs it is possible to find some quite clean code (...
Post a Comment
Read more