Antti Palosaari | 9 Feb 2012 16:01
Picon
Picon
Favicon
Gravatar

SDR FM demodulation

I have taken radio sniffs from FM capable Realtek DVB-T device. Looks 
like demodulator ADC samples IF frequency and pass all the sampled data 
to the application. Application is then responsible for decoding that. 
Device supports DVB-T, FM and DAB. I can guess  both FM and DAB are 
demodulated by software.

Here is 17 second, 83 MB, FM radio sniff:
http://palosaari.fi/linux/v4l-dvb/rtl2832u_fm/
Decode it and listen some Finnish speak ;)

Could someone help to decode it? I tried GNU Radio, but I failed likely 
because I didn't have enough knowledge... GNU Radio and Octave or Matlab 
are way to go.

I smell very cheap poor man's software radio here :)

regards
Antti
--

-- 
http://palosaari.fi/
Patrick Boettcher | 9 Feb 2012 16:11

Re: SDR FM demodulation

On Thursday 09 February 2012 16:01:12 Antti Palosaari wrote:
> I have taken radio sniffs from FM capable Realtek DVB-T device. Looks
> like demodulator ADC samples IF frequency and pass all the sampled
> data to the application. Application is then responsible for
> decoding that. Device supports DVB-T, FM and DAB. I can guess  both
> FM and DAB are demodulated by software.
> 
> Here is 17 second, 83 MB, FM radio sniff:
> http://palosaari.fi/linux/v4l-dvb/rtl2832u_fm/
> Decode it and listen some Finnish speak ;)
> 
> Could someone help to decode it? I tried GNU Radio, but I failed
> likely because I didn't have enough knowledge... GNU Radio and
> Octave or Matlab are way to go.

For someone to decode it, you would need to give more information about 
the format of the stream. Like the sampling frequency, the sample-format 
and then the IF-frequency.

I never did something like myself, but from what I saw in gnuradio there 
should be everything to make a FM-demod based on the data.

regards,
--
Patrick Boettcher

Kernel Labs Inc.
http://www.kernellabs.com/
Antti Palosaari | 9 Feb 2012 16:21
Picon
Picon
Favicon
Gravatar

Re: SDR FM demodulation

On 09.02.2012 17:11, Patrick Boettcher wrote:
> On Thursday 09 February 2012 16:01:12 Antti Palosaari wrote:
>> I have taken radio sniffs from FM capable Realtek DVB-T device. Looks
>> like demodulator ADC samples IF frequency and pass all the sampled
>> data to the application. Application is then responsible for
>> decoding that. Device supports DVB-T, FM and DAB. I can guess  both
>> FM and DAB are demodulated by software.
>>
>> Here is 17 second, 83 MB, FM radio sniff:
>> http://palosaari.fi/linux/v4l-dvb/rtl2832u_fm/
>> Decode it and listen some Finnish speak ;)
>>
>> Could someone help to decode it? I tried GNU Radio, but I failed
>> likely because I didn't have enough knowledge... GNU Radio and
>> Octave or Matlab are way to go.
>
> For someone to decode it, you would need to give more information about
> the format of the stream. Like the sampling frequency, the sample-format
> and then the IF-frequency.

You can see sampling format easily looking hexdump or open file in 
Audacity. It is 8bit unsigned samples, 2 channels (I & Q).

No knowledge about IF... For good guess is to try some general used IFs.

Sampling freq can be calculated using sample info and the fact it is 
about 17 sec. sample size = 86919168 Bytes, time 17 sec. 2 channels, 1 
byte sample => 2556446,11765 sample/sec (~2.5 MHz!)

> I never did something like myself, but from what I saw in gnuradio there
(Continue reading)

Andy Walls | 9 Feb 2012 22:47

Re: SDR FM demodulation

Antti Palosaari <crope <at> iki.fi> wrote:

>On 09.02.2012 17:11, Patrick Boettcher wrote:
>> On Thursday 09 February 2012 16:01:12 Antti Palosaari wrote:
>>> I have taken radio sniffs from FM capable Realtek DVB-T device.
>Looks
>>> like demodulator ADC samples IF frequency and pass all the sampled
>>> data to the application. Application is then responsible for
>>> decoding that. Device supports DVB-T, FM and DAB. I can guess  both
>>> FM and DAB are demodulated by software.
>>>
>>> Here is 17 second, 83 MB, FM radio sniff:
>>> http://palosaari.fi/linux/v4l-dvb/rtl2832u_fm/
>>> Decode it and listen some Finnish speak ;)
>>>
>>> Could someone help to decode it? I tried GNU Radio, but I failed
>>> likely because I didn't have enough knowledge... GNU Radio and
>>> Octave or Matlab are way to go.
>>
>> For someone to decode it, you would need to give more information
>about
>> the format of the stream. Like the sampling frequency, the
>sample-format
>> and then the IF-frequency.
>
>You can see sampling format easily looking hexdump or open file in 
>Audacity. It is 8bit unsigned samples, 2 channels (I & Q).
>
>No knowledge about IF... For good guess is to try some general used
>IFs.
(Continue reading)

Andy Walls | 11 Feb 2012 03:08

Re: SDR FM demodulation

On Thu, 2012-02-09 at 17:21 +0200, Antti Palosaari wrote:
> On 09.02.2012 17:11, Patrick Boettcher wrote:
> > On Thursday 09 February 2012 16:01:12 Antti Palosaari wrote:
> >> I have taken radio sniffs from FM capable Realtek DVB-T device. Looks
> >> like demodulator ADC samples IF frequency and pass all the sampled
> >> data to the application. Application is then responsible for
> >> decoding that. Device supports DVB-T, FM and DAB. I can guess  both
> >> FM and DAB are demodulated by software.
> >>
> >> Here is 17 second, 83 MB, FM radio sniff:
> >> http://palosaari.fi/linux/v4l-dvb/rtl2832u_fm/
> >> Decode it and listen some Finnish speak ;)
> >>
> >> Could someone help to decode it? I tried GNU Radio, but I failed
> >> likely because I didn't have enough knowledge... GNU Radio and
> >> Octave or Matlab are way to go.
> >
> > For someone to decode it, you would need to give more information about
> > the format of the stream. Like the sampling frequency, the sample-format
> > and then the IF-frequency.
> 
> You can see sampling format easily looking hexdump or open file in 
> Audacity. It is 8bit unsigned samples, 2 channels (I & Q).
> 
> No knowledge about IF... For good guess is to try some general used IFs.
> 
> Sampling freq can be calculated using sample info and the fact it is 
> about 17 sec. sample size = 86919168 Bytes, time 17 sec. 2 channels, 1 
> byte sample => 2556446,11765 sample/sec (~2.5 MHz!)

(Continue reading)

David Hagood | 11 Feb 2012 03:29
Picon

Re: SDR FM demodulation

On Fri, 2012-02-10 at 21:08 -0500, Andy Walls wrote:
> 
> Randomly checking some of the data with GNUplot, if 2.5 Msps is the
> sampling rate, then the fastest freq I saw was about 50 kHz.
How'd you analyze the data - assume it was baseband I/Q and do an FFT?
If so, and if this was digitized baseband, you should have seen the FM
stereo pilot tone at 19kHz.

If it's digitized IF, you should be able to run it through a rectangular
to polar conversion (compute mag = I^2+Q^2 and phase = arctan(I/Q) (use
a proper 4 quadrant arctan), then compute frequency by the delta between
the phase samples. Mag should be constant, frequency would then be your
audio.

Andy Walls | 11 Feb 2012 17:03

Re: SDR FM demodulation

On Fri, 2012-02-10 at 20:29 -0600, David Hagood wrote:
> On Fri, 2012-02-10 at 21:08 -0500, Andy Walls wrote:
> > 
> > Randomly checking some of the data with GNUplot, if 2.5 Msps is the
> > sampling rate, then the fastest freq I saw was about 50 kHz.
> How'd you analyze the data - assume it was baseband I/Q and do an FFT?
> If so, and if this was digitized baseband, you should have seen the FM
> stereo pilot tone at 19kHz.

Well,  I was examining the data in the time-domain using 'od' to decode
the bytes to text and using gnuplot to visualize.  I looked for "high"
frequency contant envelope cycles.  Pretty lame, I know.

I did this in octave this morning and noted a carrier/pilot of some
sort:

fid = fopen('rtl2832u_fm_sample_FIXED.bin');
N=2^20;
fseek(fid, N*10, SEEK_SET);
[v, count] = fread(fid,[2,N],'unsigned char');
v = (v-128)/128;
w = v(1,:) + j*v(2,:);
f = fft(v(1,:),N);
fw = fft(v(1,:),N);
Fs = 2.5e6;

freqs = [1:(N/24)-1]*Fs/N;
bins = [2:N/24];
plot(freqs, abs(f(bins))/N, '.');
plot(freqs, abs(fw(bins))/N, '.');
(Continue reading)

Alistair Buxton | 11 Feb 2012 08:00
Picon

Re: SDR FM demodulation

On 9 February 2012 15:01, Antti Palosaari <crope <at> iki.fi> wrote:

> Decode it and listen some Finnish speak ;)

Done. grc and output.wav here: http://al.robotfuzz.com/~al/rtl2832/

The trick was realising that the UChar to Float converter does not
adjust it's output to the range -1.0,1.0 that the wideband FM
demodulator block expects as input. Once I figured that out the rest
was easy. Just set the quadrature rate to the samples per second in
the source file, and the decimation to quadrature rate/output sink
rate. The source file appears to be about 2 to 2.2 million samples per
second. Any higher than that and the person speaking sounds like a
chipmunk. Maybe 22050 * 1000 or 1024? Does any Finnish station
broadcast "pips" like the BBC does? That could be used to determine
the actual rate.

--

-- 
Alistair Buxton
a.j.buxton <at> gmail.com
Daniel Glöckner | 11 Feb 2012 12:33
Picon

Re: SDR FM demodulation

On Sat, Feb 11, 2012 at 07:00:16AM +0000, Alistair Buxton wrote:
> The source file appears to be about 2 to 2.2 million samples per
> second. Any higher than that and the person speaking sounds like a
> chipmunk. Maybe 22050 * 1000 or 1024? Does any Finnish station
> broadcast "pips" like the BBC does? That could be used to determine
> the actual rate.

The stereo carrier is at 19kHz and RDS is centered around 57kHz.
I'd say this is 2048kHz sampling rate.

  Daniel
Antti Palosaari | 11 Feb 2012 13:46
Picon
Picon
Favicon
Gravatar

Re: SDR FM demodulation

On 11.02.2012 09:00, Alistair Buxton wrote:
> On 9 February 2012 15:01, Antti Palosaari<crope <at> iki.fi>  wrote:
>
>> Decode it and listen some Finnish speak ;)
>
> Done. grc and output.wav here: http://al.robotfuzz.com/~al/rtl2832/
>
> The trick was realising that the UChar to Float converter does not
> adjust it's output to the range -1.0,1.0 that the wideband FM
> demodulator block expects as input. Once I figured that out the rest
> was easy. Just set the quadrature rate to the samples per second in
> the source file, and the decimation to quadrature rate/output sink
> rate. The source file appears to be about 2 to 2.2 million samples per
> second. Any higher than that and the person speaking sounds like a
> chipmunk. Maybe 22050 * 1000 or 1024? Does any Finnish station
> broadcast "pips" like the BBC does? That could be used to determine
> the actual rate.

Cool!
I did that whole last night up to 6 am. I also ended up very similar 
blocks, but failed to convert bytes as UChar. I tried to add constant 
between Deinterleave and UChar To Float but it wasn't possible. So my 
first idea was to make Python script to make for the sample when I 
wake-up. But no need anymore :)

It was very good learning session and I am very impressed about GNU 
Radio capability. Idea tool for learning signal handling in practise. I 
see that device has big potential for students as it is very cheap SDR, 
everyone can get own!

(Continue reading)

Daniel Glöckner | 11 Feb 2012 16:15
Picon

Re: SDR FM demodulation

On Sat, Feb 11, 2012 at 02:46:34PM +0200, Antti Palosaari wrote:
> I did that whole last night up to 6 am. I also ended up very similar
> blocks, but failed to convert bytes as UChar. I tried to add
> constant between Deinterleave and UChar To Float but it wasn't
> possible. So my first idea was to make Python script to make for the
> sample when I wake-up. But no need anymore :)

I ended up writing a FM demodulator in C before I found Alistair's
mail in my inbox. Using a 65536 element table for arc tangent and
integer arithmetics, it is pretty fast.

> Now someone should make Linux driver that can tune that device to
> different frequencies and look what it really can do.
> 
> What kind of driver architecture should be used? Use device 100%
> userspace or make it working as Kernel driver? I suspect making it
> as Kernel driver could be too limited since V4L/DVB API
> restrictions?

There is also the CX23880/1/2/3 series with two 10 bit ADCs (usually)
sampling at 28.7MHz. The video part can be switched to raw mode, where
it provides 8 bit samples at full or 16 bit samples at half the sampling
rate from the luma ADC.

In non-Y/C mode the chroma ADC is used by the audio part, where the data
can be fed through a configurable chain of filters, demodulatos, and sample
rate converters. Just grep 0x320 cx88-reg.h to get a glimpse of its
capabilities. There is absolutely no documentation to be found about most
of these registers.

(Continue reading)

Antti Palosaari | 11 Feb 2012 16:33
Picon
Picon
Favicon
Gravatar

Re: SDR FM demodulation

On 11.02.2012 17:15, Daniel Glöckner wrote:
> All in all, I don't think there can be one API that fits all devices
> without limiting their functionality. Maybe a UVC or LabVIEW like interface
> with blocks for tuners, ADCs, decimators, DMA sinks, etc. is suitable,
> but then applications will end up being tailored to a small number
> of topologies or require manual configuration. For most people the
> only use would probably be to listen to FM radio.

For me I would like to see that more interesting SDR than FM radio :)
I should look how famous USRP/USRP2 are connected to the GNU Radio and 
maybe try similar approach. I think it is userspace interface but it 
fits fine. It is always possible load device us normal Kernel driven 
DVB-T and if user like to use it as SDR then user should blacklist just 
kernel driver.

I opened my device and there is Elonics E4000 [1] silicon tuner. That 
tuner seems to be a little crazy beast! Supports frequencies from 64 to 
1678 MHz and very many modulations. So for my eyes it is almost idea 
cheap SDR. No idea what is supported max bw ADC can sample...

DVB-T (174-240MHz, 470-854MHz)
ISDB-T (470-862MHz)
DVB-H (470-854MHz, 1672-1678MHz)
CMMB (470-862MHz)
D-TMB (470-862MHz)
T-DMB (174-240MHz, 1452-1492MHz)
DAB (174-240MHz, 1452-1492MHz)
MediaFLO (470-862, 1452-1492MHz)
GPS L1 band (1575MHz)
FM radio (64-108MHz)
(Continue reading)

Daniel Glöckner | 11 Feb 2012 16:55
Picon

Re: SDR FM demodulation

On Sat, Feb 11, 2012 at 05:33:05PM +0200, Antti Palosaari wrote:
> I opened my device and there is Elonics E4000 [1] silicon tuner.
> That tuner seems to be a little crazy beast! Supports frequencies
> from 64 to 1678 MHz and very many modulations. So for my eyes it is
> almost idea cheap SDR. No idea what is supported max bw ADC can
> sample...

I just tried to find the XC3028 product brief.
It seems XCeive has recently been bought by a company called CrestaTech
that have a USB/PCIe chipset for a small universal receiver and a PC
based SDR suite for TV/radio/GPS decoding.

  Daniel
Steve Markgraf | 12 Mar 2012 02:09
Picon

Re: SDR FM demodulation

Hi,

On 11.02.2012 13:46, Antti Palosaari wrote:
> Now someone should make Linux driver that can tune that device to
> different frequencies and look what it really can do.

I sniffed the Windows driver and wrote a small libusb-based program
[1], which can tune to a given frequency and record the I/Q-samples to
a file.

So far FM radio reception with GNU Radio, as well as GMR-1 satellite
(Thuraya) reception [2] at 1,525GHz with 1,8MHz bandwidth have been
tested. Despite the 8 bit ADC, the stick seems to perform quite well.

The program so far supports the "ezcap USB 2.0 DVB-T/DAB/FM stick" with
the Elonics E4000 tuner, and the "Terratec NOXON DAB/DAB+ USB-Stick"
with the Fitipower FC0013 tuner.

The code is still somewhat hackish and experimental, since not all of
the demodulator registers are known, and especially the tuner setup has
room for improvement.

Regards,
Steve

[1] http://cgit.osmocom.org/cgit/rtl-sdr/
[2] http://gmr.osmocom.org/


Gmane