Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/637 Thanks!
So to our next talk,
imagine a world where information
is spread across the whole globe,
even to authorities.
And that's for free.
That's a company that does this,
that's called Ultranet.
They do it through satellites.
Unfortunately, part of their distribution
channel is closed source.
So Danielle Estévez
reverse engineered the system
to signal the protocol.
And the receiver,
please welcome with an anniversary
edition of Plus Daniel Aceves.
Or is it working?
Yeah, so thank you very much for the
introduction. I would also like to thank
the organizers are
on. Let's go.
So first of all, a brief introduction
about myself, because it's the first time
I speak into this conference, so
I come from mathematics, I'm finishing my
Ph.D. It's pure mathematics.
It doesn't have anything to do with
AlterNet or radio stuff.
But I also have a background in computer
science.
And since 2.5
years ago, I took amateur radio
as a hobby, and that's
my Spanish callsign for anyone into
amateur radio.
And I also have a UK callsign
because I've been living in the UK for a
while.
So all this is
related to the talk.
In my amateur radio activities,
I started to decode some
satellites which are orbiting low
earth and they transmit into
amateur frequencies.
So what's the deal
behind this?
In amateur radio, encryption
is forbidden.
All this is just mostly because a
security measure and
that's like part of
the community, also because
it's useful for amateur operators
to just listen across the band and
listening to whoever speaking,
having, well, not so private
conversations, but it's
common to go on and listen,
listen, listen and decode whatever
you want.
So that's kind of the amateur radio
philosophy.
And there are these small satellites,
most of them all launched by universities
or educational projects.
They transmit some data telemetry
mostly.
And the thing is that
while these specifications for how to
decode the telemetry,
many times they they release
incomplete specifications.
So you have to
to do some work in order to get
a working decoder.
So I have been doing this for
like two years ago and
that gave me some experience when
I started working with AlterNet.
So enough of the introduction.
Let's first go with what is all
about Oughton, that
essentially you have a geostationary
satellite, so it's fixed in
one part of the sky as you look at it
from Earth, and that's transmitting
files from the Internet.
I think Wikipedia files
or weather information or
or miscellaneous information, small
files, because the bandwidth
is not so much.
So then you have this signal and
well, you have these the from the
alternate, but the specifications
are not open.
So we want to construct a fully working
decoder.
And I'm going to explain how it works
in two parts.
First, we have our RF signal and
we're going to turn that into bits or
more precisely, frames.
And then what do we do with this
frames? We want to turn those into
files and after that, some
miscellaneous.
OK, so what is your thoughts on that?
It's a start up company and
its goal is, well, there are many
places in the world where it's not so
easy to get Internet access.
And even if you could have
a downlink, only access to some
Internet content, that would
be interesting.
So picture yourself in the middle
of Africa. It's impossible to get
a proper Internet connection.
The best thing you can achieve is
satellite. But that's very expensive.
What if you could just put
it down, link only satellite receiver
and start getting information
from Wikipedia, newsworthy
content and so on.
So that's the goal of
this company, which is called out on it.
And they started broadcasting
using digital television
satellites so you could use
all the same equipment
that you would use in Europe,
for instance, to receive
digital TV from geostationary
satellites.
And indeed, you had this set top
box. And this works because in
DVD or DVD
to it, usually you embed
digital video, MBG
or whatever, but you can embed all
sorts of content.
So the embedded or
files into that are.
But the problem with this scheme is that
these satellites use beams
which cover only a region.
For instance, you could have Astra
satellite and the beam only covers part
of Europe.
You have satellites broadcasting to
the Middle East, but
you have you need
many, let's say, 10 or 20
satellites like these with their beams
covering all the world if you want
to have worldwide access.
So that was very difficult for them to
achieve, if not impossible.
And they switch it to Albon broadcast.
So Albon is around one point five
gigahertz, the same as GPS,
more or less.
And they now broadcast exclusively
through el-Banna and they do it
through three. Inmarsat satellite
says this is a really large
satellite company which
also broadcast differential
GPS information,
information for air traffic
and so on.
So they have this satellite in orbit
and it's just a matter of money
to go to Inmarsat and say, well, I want
a really small channel on your satellite
to to broadcast my data.
So that's what they did.
And they have three satellites.
One covers the Americas, the
other one covers Europe and Africa on the
old one conversation, the Pacific.
So this is worldwide coverage except
near the Poles where, of course,
the geostationary satellites, which
are on the equator, are almost
all out of view, but almost
worldwide coverage.
What do you need to receive out on it?
Let's first go with hardware.
You need an 11 antenna, so
typically you would use a patch
antenna. This is like a square
this big. You can also make it slightly
smaller. But picture
a flat square like this size
and that works fine.
But if you have a dish like
a satellite TV dish,
it's one meter
diameter or 60 centimeters
diameter. You can use that.
They will give you a much, much better
signal. There are now people using a dish
and it's absolutely fantastic.
You need an LNA that's a pre amplifier.
So unless your
radio receiver is just
next to your antenna,
you need some sort of amplification
into the signal. And usually
you do it with a small piece of hardware,
which is called LNA and just
fits between the antenna and the receiver
for the receiver.
You can use any as the receiver you
want, but the software from Ultranet
only supports this really popular
artle as the are dongles.
I think many of you in the audience
have known about these
artlessly are dongles.
They're really popular on Chip.
And of course, you could run
the software in any computer
you like, but the software from out
on it is intended
to work on a single board on computers
such as the chip, which
is five dollars or so, I think,
or the Raspberry Pi three.
So the idea is that you have a
self-contained kit where you have these
software running on
a dedicated
small computer and then
it does all you want.
So it gets the files from the satellite
and then it acts as a Wi-Fi
hotspot.
You can log in to the Wi-Fi
hotspot and copy the files to your
devices or whatever you want.
And doujin that sells these items
as a kit from the Web page.
Or you can go anywhere online and
buy them because they were really
inexpensive stuff
for the software.
There is these are X
OS.
It's really a Linux IMH image.
You put it on your flashcard
on your computer.
And then he does all the decoding
and as I said, you can log
in via Wi-Fi hotspot
and get your files on whatever.
So most of the software in our
service is open source.
The only problem is that the key parts
of the receiver, the most important
parts that you need to get the files
are closed source and distributed only
as a binary.
Actually, there is kind
of an issue because this binary
link, some GPL libraries,
the ones that had to do with the
Artlessly are a dongle.
So these are GPL only, not L
DPL and
well, I'm not a lawyer, but I think
it's possible GPL violation
to link GPL libraries
from closed source code.
I told AlterNet about this.
They don't seem to care.
So anyway, and
most important, the protocols,
the modulation on the format of
the signals of how everything works
is secret. It's hidden behind
these closed salts receiver.
So why did I decide to
reverse engineering out on that?
Well, first of all, that
idea of spreading into the content
just via broadcast
from satellites is really nice.
But I don't think that using
a secret protocol and closer's
software is a good idea for that.
You should really use open
standards or open information,
whatever you want to call it.
Also, some amateur radio operators
had started playing without net
or it's really fun because,
well, most real
one point two gigahertz.
It's one point to the nearest amateur
band.
So most one point two gigahertz
equipment for amateur radio.
It's expensive.
It gets some money
to get into that.
But this is some very cheap
way to start playing with microwaves.
So amateur radio operators
started with that.
And as I said before,
well, a close source and secret
protocols are also very bad from
a for amateur radio.
So what do they have before
starting what the
receiver is like a black box
where you have the binary running
and the RF goes in and then
magically you have files coming
out of the other and so
on. And, you know, this is figures
from out on that, that the bitrate of
the signal is two kilobits per second.
So that's not so much.
But if you are running for
the whole day and you're expected to
leave it running, like for many
days, you get 20 megabytes
of content per day.
I also had access to these
clotheshorse software.
It's free to download, but
it's clotheshorse.
And I mostly looked at
the AMD 64
bit version of the software.
It's an older version because now they've
dropped support for
Intel machines and now
everything is only for ALM.
So the clotheshorse receiver has
two parts. One is called SDR 100.
That's the SDR receiver,
which talks to the Artlessly
are dongle and gets
the bits from the RF
and then those bits get sent
into something called own.
That's a Sandeman which is running and
that's all the work of reconstructing
the files and so on.
And I also had access to some
AQ recordings by my
fellow amateur operators, Cochairmen
Kilo for Kilo, Delta, Romeo.
So in fact I don't have myself
a receiver for that.
I could set up one very easily, but
in these days it's much, much easier
to go to some amateur operator
who already has a disagreement on
it.
Well, can you give me an IQ recording?
I want to play with it.
And in a couple of days
I had my IQ recordings and I could
start working.
So let's see how
we get from RF to bits,
when I look at an RF signal, I
do it with my favorite as a star
receiver. This is Leandra's.
It's not very popular, but most
of you have heard of is the R
sharp or whatever.
So this is the waterfall on
the left hand side.
I don't know if I have.
Yes, the mouse cursor.
This is the alternate signal.
This is these are stronger
signals which are I'm not sure
either GPS or
air traffic somewhat.
And here you can see some pocket data.
So this is the first you see
just the waterfall
and in the waterfall, the only thing we
can see, apart from signal strength,
which is OK in this recording,
is that it's four point eight kilohertz
wide and there's no
FITA, there's no pattern in the
waterfall. So it just looks like a hump
in the noise floor is something which is
four point eight kilohertz wide and just
above the noise floor.
So I like this quote from Phalcon
very much.
It says that if you use a good enough
modulation or protocol, then
there are really no features in the
spectrum or in the waterfall.
So what do we do?
Well, we have some experience
and satellite communications.
Most of the time they use
modulation, single channel
know of of D.M.
That's for terrestrial.
But we don't know
if it's Biskupski.
It could also be KWAM.
But we suspect that either PBSC
or Kupinski are the
most likely candidates.
So we use Ganu Radio for the signal
processing. Anyone here familiar
with radio?
Well, that's good.
Yeah, so if
you're into DSB
or signal processing, it's really easy to
get started with a radio.
If not, you
need to learn a bit, but you can start
playing without knowing too much
of the signal processing.
There are lots of examples.
Some things you can do and are
things you can run.
Sorry.
So here I open my recording
with a radio.
The first step is just to filter out
the signal so the filters signal
is in red and
not so much. To talk about this, I
also shifted to baseband, so
I sent her my signal
about the frequency of zero
hertz. Here you can see it, zero
kilohertz.
So that I use the
usual procedure in signal processing.
You center your signal and you
filter.
Now we want to find the upscaled.
So there are some standard way to
do this is you take your seat.
This is my filter signal.
It comes in here and I multiply
it by itself.
So that's like raising the signal to the
power to.
And what happens
when I look at the spectrum, I
get a DC spike.
So there's a strong frequency component
next to zero on.
This means that the signal is PBSC.
If the signal would be Kupinski,
I wouldn't get a spike
for the power to I would
have to go to compete in the fourth
power. So that's multiplying the signal
with itself four times in
order to get a decent
spike in the middle.
And you can sort of go
on, do it for higher
order. GSK, for instance, ETPs
K, it's also popular.
So there's a fairly simple mathematical
reason why this works, but I don't want
to go too much into it.
If anyone is if anyone's interested,
please ask me later.
We also want to know the board's rate.
So how many symbol's per second?
There's also standard way to do this
analysis. It's called cycler,
stationary analysis.
And this involves the following
computation, which is much better
described in these
GANU radio flow graph.
You take your signal and you multiply
it with the conjugate of the delayed
signal.
It's not critical how many samples
you're delaying your signal.
One sample works, OK?
In this case, perhaps ten samples
would work as well, or even better,
but you must delayed a little bit
and then you look at the frequency
components so you
get a DC frequency component.
But that's not what we're interested
into. We're interested into
the next strong frequency component,
and that happens at four point
two kilohertz.
So that tells me that's the symbol rate.
The symbol rate is four point
two kilowatt.
All right.
Now that I know that I have a big
beeps signal and it's
four point to kill a bot,
I can do the beeps modulation.
This is fairly standard.
There's a really nice radio
tutorial about how to do this.
If anyone, starting with a radio
after doing two or three very
basic things, I recommend
you should go and do these tutorial.
So again, really stand
for beeps. Shady modulation.
You have an AGC
just to maintain a constant signal level
which makes signal processing work best.
Then you have a clock recovery
with the polar face clock
recovery algorithm.
And this is where our four point
two kilobits enters the picture
here. Samples per symbol works
out to.
Well, I have so many samples
per second in my recording.
I don't recall how many.
I have four point to kill samples per
kilo. Symbol's per second in
my signal.
So that's the quotient.
And then this recovers
the clock and gets like
the symbols and then
Acosta's loop for frame
frequency tuning, so the frequency
is slightly out and
it's always going to be
this constellation diagram wouldn't
be steel. It would rotate like
this. And you don't want that.
So close the loop takes care
of that.
And this is the Constellation diagram
for any one which is not used to
these diagrams.
Each dot is one of the symbols
we're receiving and they cluster
around this point, which is, let's say,
the big one and
the point on the left, which is the big
zero. So if you have
two clouds which are really well
separated, then your signal is
very good. You draw Lenny here
in the middle and everything which is
on the left is rather than as a zero,
everything on the right is the one.
So the problem is when these
two clouds start to merge and you
have some Beta's
OK, so in this case,
it's more or less good.
We can proceed.
Doing things are
what happens with the coating.
Well, I have four point to clear board,
but the bitrate is only about half.
It's only two kilobits per second.
That's a number taken from
out on that Web page.
So we suspect that
Faik is in use and our equal
one half a code.
What does that mean?
That means that half of
the bits are spent for error
decoding. If you get some errors,
there's no problem.
You're spending half of your bitstream
in using a code which is able to
resolve those beta errors.
So once again, we have no idea
about which forward error
correction code is in use.
We try first whatever is most
popular and this is really, really
popular.
Artists use any were the
DS Convolutional Code.
It's a convolutional code.
And anywhere armatures sitilides
long range space probes out
on that as well.
But there are some parameters, so this
code has some variations
to find the proper parameters.
There's a very nice tool from Balin
Siva, it's called or Tofik.
You just block this block into your
radio flow graph and he tries
to use different parameters for
the Viterbi decoder for
Fassie, and
it tries on different parameters until
it finds the combination, which
makes the bit error rate go
very, very low somewhere when the
bit error rate goes low.
Then, you know, you have the correct
parameters.
So using that,
I found that the CCDs
code used is the standard one,
albeit with the two polynomial swopped.
That's a technical detail.
There are two polynomials which are used
to obtain the code.
So those are called usually Poly A
and B.
First you go with Polya, then you go with
Jollibee out and it does the opposite
thing. You first use Polybius and
then you use poly.
So you have to know that otherwise
you are not going to get anything from
the stream.
OK, so knowing that we
can use the stock radio
Viterbi Decoder and it
goes like this first
we have to swap every pair
of symbols
because of the Polya and B thing
which are swapped.
Then this is the stock radio
decoder there
which spits bytes.
It's each of them has
eight valid bits or symbols.
So this just
takes each byte and outputs
eight different bits
because we want to look at the B stream
to see if there's an important.
And I have to Viterbi
decoders running in parallel,
one is running on the stream
and the other one is running on the
delayed stream.
Why?
Because when you do,
Viterbi, decoding the symbols
are going to be in.
So you want to process them in person
and you are looking at a symbol and you
don't know whether its fur is a symbol
coming just before it or just after
it.
So you just
try something in one branch
of processing and you try the
other thing. You're the branch of
processing and one of them is going
to succeed and the other one would fail
completely. But you don't care, you know,
at some point in the chain.
OK, so I have
to decoders.
I'll put in the bitstream.
And while it just looked garbage,
it's completely random.
So that that means we need
a descrambler that was
expected because if not,
patterns from the data can
can be seen in the waterfall.
And we had no pattern.
So there's some scrambling
which takes our data, which is
full of patterns into something which
looks random.
And that's much better for radio
transmission.
But we have to reverse the process.
OK, so now what do you do?
Again, you try the most popular,
the scramblers, you know, but in this
case, none of which I know
did work.
What can I do? Oh, let's recall,
I have been working
a binary for the receiver
so I can look at the assembler code.
And this is the
AMD 64 bit.
I don't know if it
can be read fairly well.
So this is the assembler code
for the descrambler
in the clotheshorse receiver.
Well, you just take your assembler code
and you start in writing a C code
translation and of
course you simplify your code until it's
human readable.
And then there's
a really nice descrambler
function.
Anyone who seem to descrambler could
go on and understand what's going on.
So this is nothing
I had seen before.
But actually it turns out
it's really popular in the geostationary
satellite industry.
It's called ISIS
three zero eight.
It's from standard from Intelsat.
And actually, this thunder, it's
not open, they only
give it to our partners
or business partners or whatever.
This is from a data sheet of
whatever component.
I find this randomly on the
Internet. I have a very nice
description.
So if anyone anyone's into the scramblers
this piece in the middle with a shift
register, oh, it just
looks like a multiplicative descrambler
and that's what it is.
But the new thing in this
scrambler is that these counter.
So this is just like a multiplicative
descrambler, but with a counter.
And once we have
the code and how it works,
we go implement it into a radio
block.
Plug it into the processing chain in
there and now we look at the data
and you can start seeing some
patterns, there are some.
So this must be read from
left to right, from top to bottom.
So you have some
like some pieces of bits which are
constantly you can see there.
Right.
So this looks fairly good.
OK, the next step is
framing, we have to know where
frame start and where they end
and so on.
So once again, you
could look at the bitstream and
start looking to see if
you figure out any patterns which
might indicate start of frame or
something else.
But that's in this case, it's much
easier.
So I was looking at the as
the 100 binary, I can read
the names of the functions in the
assembler code and several
of those have the name etched DLC
in them. So DLC is
a framing protocol.
It's using amateur radio, Puckett's
radio and many,
many other things.
So, well, we suspect
a DLC framing and
there are tools in radio
to frame it.
Still see there's a stock
defamer, but I prefer to use my
own jerkies pocket
to the frame
HPLC.
So this is what we do.
This is the output of this of the
descrambler.
We feed it into the DLC,
the framer. And the nice thing about my
own Defamer is that you have this check
if six Parmeter.
So HPLC uses said
CCRC 16 bit
to check the integrity of the frames.
Many times when you're doing these sort
of things, you want to skip the check
and get frames even if they have some
errors. So if you put it to false,
it's handy, it spits, frames,
whatever this reality check might
be.
And slight thing here.
When Ussery when you're receiving PBSC,
there is a phase ambiguity of
one hundred and eighty degrees.
You don't know if you're looking at
a one or a zero.
So either you're looking at the good
bitstream or the inverted
bitstream.
So you have to take and
again, you assume it's the
good bitstream on one branch of the
chain. You assume it's the inverted
bitstream. So you inverted once more in
the other branch and only one branch
is going to succeed at one time, but you
don't care.
So any one of
these two will output frames at
the end. And of course, recall that
we had to Viterbi decoder
branches.
So each of those has
to Defamer.
So we are running for different means in
parallel.
And with this,
I start, we get frames.
So now what do we do with the frames?
Well, the Knicks just look at the
hex dumps for the frames
very carefully and something
much clever you can do.
You have the own binary.
It gets frames from as they are
100 with a unique socket,
so you can feed frames into
the unique socket and see what happens.
So you can figure out that way.
And well, the protocols
that it used in Tonette,
they are custom or they look that
I haven't seen anything like those.
So I have named them as I
liked.
And this is a typical frame, can anyone
see any instructor in here,
please?
No.
OK, this five
thing at the very beginning is
so really caught my attention, this
looks like a broadcast Ethernet
address.
This is a broken Ethernet address.
It makes very much sense.
This is a broadcast network.
So, in fact, this is an
Ethernet frame.
You have the broadcast destination,
the source mark of whatever
PC is running on outand
out on its ground station.
And the effort I discuss them
all the frames or the largest
frames, which are most of the frames
are two hundred and seventy six bytes.
And I think that's chosen because
it takes approximately one second to
transmit such a frame of the year
with the modulation in use by outlet.
So that's really handy if you're setting
up your antenna within one second,
you know, if you're getting friends or
not.
So let's look first at the level
three protocol.
It's called the Alternate Protocol, or
OPIS.
And since this is a broadcast
network, it's only role
is the kind of fragmentation.
So, in fact, it's a very convoluted
way of handling fragmentation.
But we do have one byte
which indicates whether this
is the last fragment or not.
And in case you have
a fragmented packet,
you have one byte which indicates
the number of fragments
in the packet or the
number of the last fragment.
And you also have a bite which
goes contin up from zero to the
total number of fragments in
your pocket. So this only handles
fragmentation.
You have also a packet size
in there, 16 bits,
the layer four protocol.
It's called LDP and it's really
similar to UDP.
So you have some concept of
ports. They're used to identify
different services within the network.
I'm not sure. And it's really hard to
tell with the data we have.
If there is the concept of source
port and destination port,
I really don't care.
So I have two ports and
the power of two ports identifies
the service and I call those the A field
and the B field.
And you have packet size
on a checksum. So very much like UDP.
Apart from transferring files,
something out of the dust
is to broadcast time packets,
and these are used to sell the receiver
clock because it's intended
to run without Internet access.
So you cannot use A.P.
and these are very
easy. They have here
the ASCII code for in this
case, Odissi two.
That means alternate datacasting to
it's the ID for
the ground station in the America
satellite. This comes from Scott's
recording in the East Coast.
You have something which I don't know
what it is, but you have the Unix
timestamp.
So any time the receiver gets
a packet such as this, it reads the
Unix timestamp and updates updates
it clock.
And there is some padding in the
end because pockets
have to be at least 46
bites. This is some limitation
of the Ethernet fiscal protocol.
Let's go to how files are broadcast,
so one file, one file, it's
broadcast at its time,
this need not be so.
The protocol allows for simultaneous
broadcast.
Every file gets split into 242
byte blocks. So you have many, many
blocks.
There's LDC codes used
to recover the file, even if you
failed to receive some of
the blocks. So if you have holes, you can
feel them using the LDP code.
And there are three types of packets.
First comes the file announcement,
which tells you all the details about
the file.
Then you have a bunch of file
blocks, which are the contents of the
file.
Lastly, you have the
fact box, which are the party
tech bytes for the LDP codes,
and these are used to
fill in blocks in case you
missed some of the file blocks.
So these five books and
books are sent interleaved.
The file enhancement packets
contain an XML in ASCII
with information about the file
and they are signed with an X five
nine certificate Y, probably
to prevent spoofing.
So the outliner receiver has
the certificate for out on
it and it checks
that the file announcement is properly
signed. And if not, I
don't know what happens.
Probably it discards the file.
So the information you want
in here, the idea, the
size, the name of the file,
Hosch to check and some
information about the LDP code
in use for the file and the block size
is always two hundred and forty two
so far, but it's very
easy. You have in blue the file ID
in green the block number.
It goes counting from zero to
whatever number and then the
block contents. Two hundred and forty two
bytes.
So that's how podcasts are
transmitted, and once we
have all of these information together,
we can just go and code
a Python implementation that
gets the frames and recovers
files.
So we haven't been able to reverse
engineering LDP codes yet.
That means you need to get all
the blocks for the file.
If you miss a single block, you have a
hole in your data and you can get
the file, but otherwise you're fine.
So this is the Python implementation.
It prints out a lot of
debugging, informational curiosities.
You may want to know the mark
of the ground station or whatever,
but the nice thing is that
here where is it?
There's a new file announcement for
Amazon.com Wikipedia page,
and that's around
eight 03.
And 20 minutes later, that's what it
takes to transmit
that Wikipedia page.
You get all your file blocks and
these managed to recover the file
and save it onto your hard drive.
So what do we have now?
Well, there's lots of documentation on
everything I've talked about here
and a little bit more
in my blog.
There's the a radio receiver.
You can put frames
in real time with UDP or you
can do a case recording.
And then you have the Python code,
which takes either real time
frames from the UDP socket
or the Keys file recording and
gets the files from from those.
So what about all the decoding?
We've done some progress, not so
much.
There's some track of the progress
on GitHub if anyone's interested
to come talk with me.
Currently, I don't have much motivation
to go into the binary code on reverse
engineering, but we might
be able to do something.
So some miscellaneous fun
stuff.
Well, the satellite modem,
so the X five or nine certificates
they use are seeing
these addresses, Odissi to dot alternate
is for you say Odissi
three is for Europe.
So what's in there?
You can think that machine, it thinks
you can go by HTP.
Why not?
And now the TDP port,
it's blocked.
So they've noticed.
But before I swear,
I got the login page of
the satellite modem they use
on the ground station to upload
the data to satellite.
So huge security flow.
Of course, I didn't get past that.
It was open probably for week.
Well, surely for weeks, perhaps
even for more than a month.
Huge security for what
I'm interested is what's
the model of the modem, it's an M7
modem and now you go
Google it and there's
lots of documentation and some pictures
for your modem fans.
This is the data sheet from the moment
I've marked in yellow what
is used in AlterNet.
Let's see if I can zoom in here.
Yes, so.
Yeah, probably not a very good
idea to do it like this.
So visas for the FCC,
which they used to be modulation
and so on, as you can see, only the
most basic are
options of the modem are in use.
They could have used Khyam
and there are very nice LDC
codes, probably much harder
to reverse engineer.
It are a much better
performance that they could have used
instead of the really simple Cissie,
the 60s or
Viterbi code.
What else?
Well, you have the eyepiece
for the ground stations
so you can look them, use
any old line to maybe you want
to know where the ground stations are.
So the Americas is in Toronto.
The Europe. Africa is in Amsterdam.
I don't know if there's anyone from
Amsterdam in this room.
It would be. Yes, yes.
So it would be very, very nice.
If you can listen on the uplink signal, I
don't know the frequency, but maybe you
can search or maybe you can manage to
do it. So listen on the uplink
signal and see if you can
just receive the uplink signal.
The format is the same.
The satellite is like a bent
pipe transponder.
Whatever goes up goes down.
So if you're in Amsterdam or anywhere
near all the ground stations, see if
you can receive the uplink.
And another thing you can do
if you can receive the uplink is go
on, do some radio direction,
finding maybe you can find the
ground station. Probably it has very,
very large satellite dishes.
So the actually Asia-Pacific,
it's in some small village in
New Zealand.
What else? Finally, the data
throughput, so 20 megabytes
of content per day, that's what
it promises.
Is this true?
Well, let's run the numbers.
So we have files which are syncing
242 blocks,
bytes per block,
and they feed inside
Ethernet frames, which are two hundred
and seventy two bytes each.
So that's a 12 percent overhead
for headers Arsène
Ethernet headers, opis
on LDP headers.
Then most of the files
use LDP codes as well.
The rate is around zero point
eighty three. So this is a 20
percent overhead on top of the
12 percent overhead that works
out to a total overhead of 30
percent.
And the bitrate is only two point
one kilobits per second.
And that's at most you would have
to factor in the bit stuffing
done by SDLC.
So when you work out how many
information per day you have, it's
only 15 megabytes
per day with the
invention that one megabyte
is 124 kilobytes
and so on. If you was if you
use the 1000 convention, you would get,
I don't know, 16 megabit,
but nothing near the 20
megabit we were promised.
So thank you very much.
Thank you, Danielle,
do we have questions
for questions, please use the microphones
provided over here, here and here and
here, one to four.
And we also have a signal.
Angel, do we have questions from the
Internet?
Yes, we have, um,
actually the scrambler
is that basically encryption
or is it for, you
know, another RF purpose?
You mean like this whole reverse
engineering work,
so it's it's most
of the techniques are useful for
for many other stuff in
in RF, the RF processing,
most of it, it's thunder in
armor to satellites or there are
commercial satellite communication.
So I'm not sure if that was the question.
The question was you build a
descrambler.
So why is the signal's scrambled at all?
Why is the signal scrambled at all,
sir? It happens like this.
If you have data most of the time
the data is going to have some pattern
in it. For instance, in here, every
time we have the Ethernet header, we
have this whole bunch of
F data, which is the
broadcast mark.
So any any time you have
patterns in your bitstream,
if you modulate with any sort of
modulation, beat beeps
or anything else, that
means some pattern in the
frequency in the frequency domain.
So that's not very good from the
performance point of view of
RF engineering.
You get less
performance with respect to
Signal-to-noise performance,
also interference to other
channels. So when you want to
transmit some digital data on RF,
you want that your data looks completely
random. And what you do is you use
some simpler scramble function,
which takes your data on outputs,
something which is easily recoverable
but looks random enough
so that you don't get any patterns
in your RF spectrum.
Thank you.
Question for Michael.
One high, I understand
the overhead for the forward error
correction, but why do they use
14 bytes for the Internet header
and the idea?
Well, the thing is that if you go back
to the documentation about the
satellite modem
or were presented
probably here,
I hear so on the top,
it supports like
several different input
formats.
So you're going to have a PC, your PC
like machine, which is running
all the broadcast
software in the alternate station,
and then you plug that into the satellite
modem. And of course,
they have to talk to each other.
So they have to know a common protocol
that should be simple enough for
them to implement an Ethernet is
OK.
It's very easy to wiretap
via Ethernet.
Why do the Ethernet headers
go over the air?
So this is intended in the commercial
application, as far as I understand,
for you to have like an Ethernet,
a real Ethernet network, but
over satellite where you can have
many different stations on, it acts
just like another bridge.
So that's why
you microphone number two, please.
Hey, did you see any
packages with this nation, which is
the broadcast destination, like unicast
packets or.
I think I did.
So I can I can go back
to my recordings
by Scott and do have done dumps
of these messages. And we're sort of
not in my head, but yes, in my computer.
So in my computer, I have
all the files I've used.
I think I saw something which
was not broadcast or at least
which was not like this
scheme where you have your customers
type and you feed your
alternate pocket inside.
So maybe AARP
or something else,
which was probably not intended to be
broadcast over there.
So, yeah, I saw some
of that. I'm not sure from the top
of my head what it was.
I can look it afterwards.
So yes, they happen sometimes.
Unintended broadcast.
Thanks. And I think we have a question
from the Internet.
Thank you.
First, I have a comment before four
in front of the UNIX timestamp.
Is it possible that this might be a 64
bit timestamp?
So that was not a question, just just
a comment from the Internet.
The question is, there's no user
based uplink.
So so what is broadcasted?
Who is deciding what is broadcasted?
OK, so the thing goes more
or less like this, I'm not really
sure, but at least this is what they
say.
And in fact, there are some people which
are interesting in monitoring what
is being broadcast because there's
not like a public list of what
goes out and when it goes out.
So the idea is that most of the content
regarding bandwidth is Wikipedia
files, and this is from
the most popular Wikipedia
files.
So this seems somewhat random.
But Wikipedia files, they also broadcast
some weather information
which is most useful for
sailors. Sailing on the high seas.
Are some small files for
amateur radio apress?
Anyone heard of April?
So some apress whatever
goes with the Ultranet tagging
it, it goes sent back
and the users can also
propose content to be broadcast.
So files at most 10
kilobytes each and they
get screened before
and moderated to prevent
whatever malicious or
whatever. So they moderate and
the process of moderation and so
on is not open.
So that's a very interesting question.
What gets sent and why?
Thank you.
Another question from the Internet.
OK, so in this case,
thank you, Dana,
thanks for your time.
Thank you for your interesting talk and
I hope we see each other again.
Thank you very much indeed.
Please with an applause tonight
as.