Back to basics: Decoding Audio Modems with Audacity
By: Maxime Leblanc
Tags: Technology, Hacking, Sdr, Modem, Mathematics

Hello there! It has been a while since my last post; If you have been following me lately, you know that in my last stories, I explored a bit what you could do with a very simple Software-Defined Radio (SDR) dongle like the ones based on the RTL2838 chipset that are sold for about 25$ at your favorite online store. We learned how to use it to listen to the commercial radio, intercept airplane and pager messages (yes, they are still used nowadays by some professions) and to transmit radio signals using a Raspberry Pi.

I also recently bought a HackRF One, so in order to make good use of it, I had the ambition to learn some GNU Radio and create my own radio protocol… With all of this free software ecosystem decoding and encoding radio waves, how hard could-it be?

Well, it turns out it is indeed pretty hard if you don’t have a background in signal processing and are just a curious geek such as me 😅. So I had to take a step back get to the basics: Instead of directly transmitting over the electromagnetic medium, I started exploring the transmission of data by sound.

What are audio fax modems exactly?

If you are from my generation or above, do you remember the sound of the early Internet connecting to the AOL servers, emitting a screeching sound from what seemed to be another world? That was your 56k modem

The typical sound of an audio modem connection (Source: absorbtions blog)

So, a modem is the device your computer uses to communicate with the other computers of the world: In order to transmit numeric bytes over an analog medium, one has to use digital modulation. The act of modulating a signal is to enrich it with information in a way that a message can be extracted (demodulated) by the recipient. A modem does just that: it is actually the abbreviation for “Modulator/Demodulator”

Morse Code Modulation

The simplest example of that would be Morse code: Imagine you and a friend are separated by a conductive wire: You could exchange messages just by turning the current on and off; In the case of Morse code, you both agree that there are two “symbols” that can be used to transmit “letters” which assemble into human-understandable “words”: A short pulse (•) and a long pulse (−):

Morse code is a simple form of modulation

Great, we just modulated the word HELLO into our on-and-off electric signal!

Now, considering that Morse has been invented in the 1830s, you can imagine it is not quite suitable for modern computers: While Morse code has been made to be easily translatable to human-readable letters, our computers need bits and bytes.

Digital Modulation

In order to transmit computer-understandable bytes instead of human-understandable letters, you could agree that those pulses are to represent 0s and 1s, which would lead your “words” to become bytes when arranged eight by eight and then suitable to be processed by a computer.

Congratulation: You just turned your Morse code machine into a digital modem! Here is what it would look like to modulate the ASCII representation of the letter “H” (first letter of our HELLO message) in Audacity using this invented modulation technique. The letter H is represented in hexadecimal notation with 0x48, so in binary it is represented by 01001000 :

Morse code used to transmit digital data (the ASCII representation of “H”)

Waves as a medium

Now, in the real world, it is not practical to have a signal that has to rely on “silence” on the medium you share with your friend: It does not scale to have a dedicated hard-wire for every destination you would want to reach (which is what the early telegraph systems and very early phone systems were actually doing).

What we will want to use for more flexibility are wave frequencies, so instead of alternating between “noise” and “ no noise” to isolate the signal, we will use something more like “this sound” and “that sound”, usually expressed as simple-frequency tones.

Let’s look at the same data, but this time we use tones of 1 hertz to represent zeros and 5 hertz to represent ones:

Frequency modulation used to transmit the ASCII representation of “H” — Generated using GeoGebra

Alright, we now have a frequency-modulated signal, generally more known under its acronym “FM”, the same modulation technique used analogically to send sound to your car radio! Now, since we used it to transmit a digital signal instead of an analog one, we call it a Frequency Shift Key signal (FSK), meaning that we shift frequencies to represent different symbols/bits.

This is just a toy example to illustrate the principle: If these were sound waves, they would be inaudible to the human ear, which is typically able to hear sounds from 20hz to 20khz. But we now have a model realistic enough for us to understand a real-life legacy audio modems 📠!

Realistic Example

A Bell-103 modem using Audio FSK modulation through the phone lines

So, I wanted to test a realistic example, and after playing with GNU Radio for a while with mixed results, I found a really neat piece of software called minimodem that could transmit and receive all kinds of real-life Audio FSK protocols. The output of the software can be a WAV file, ready to be read (or “listened”) on the receiving end of the transmission.

I generated a sample that encodes the “HELLO” message in ascii and sends it using Audio FSK at the rate of 8 baud; The baud rate is the number of “symbols” sent per second, and since in this case the modem encodes only symbols of “1” and “0”, it is equivalent for us to the bit rate, but keep in mind that it will not always be the case.

After you have installed minimodem on your favourite distro, here is the code to use for generating the very simple message we are to analyse:

echo “HELLO” | minimodem --tx --ascii --startbits 0 --stopbits 0.0 -f minimodem_hello.wav 8

(Warning: This might be LOUD in some headphones 🔊)

Now, what does that look like when opened with Audacity, an open-source audio visualization and manipulation software?

The default view is not super useful to analyze realistic modem communications

Well, that is not super useful; The slight difference between tones, even if audible when listening to it, cannot be easily differentiated from one another. But we are in luck: Audacity also has the capacity to represent wave in time-frequency manner instead of the classic time-amplitude. To do so, it uses a Fast Fourier Transform (FFT), a mathematics transformation frequently used in signal processing, but that also has plenty of very useful other applications that I will keep for another time 😏.

A Fast Fourier Transform is used to shift from a time-amplitude view to a frequency view. — Source: https://commons.wikimedia.org/wiki/File:FFT-Time-Frequency-View.png

In Audacity, there is what is called the Spectrogram View, that uses the aforementioned Fast Fourier Transforms in order to display frequencies detected at certain points in time. Lets try:

A second track has been added and switched to the spectrogram view; Now we can clearly see the two tones used in the modem communication.

Oh, that looks promising! Logically, the first letter to be transmitted should be “H”, which again is represented in ascii with 0x48, so 01001000 ; Let’s zoom-in and check:

Zoomed into the first byte

Bingo! What I discovered with this analysis is that the least significant bit is sent first for each byte, which for sure can seem counter-intuitive when we look at it with this visualization, but could be logical since the first bit of each byte is to be sent first.

There are other interesting options we can set on the spectrogram view; For example, we see that the scale on the right indicates that our two interesting tones are comprised between 1000hz and 2000hz, so we could “zoom” to these frequencies and have an even clearer difference between tones.

Conclusion

So, I just wanted to conclude by pointing-out a very interesting fact about the Spectrogram View: The more precise you want to be about the frequencies you observe, the less you will be precise about the time these frequencies were observed at:

You cannot be precise about the frequency of a sound wave and the time of “measurement” at the same time

I find that there is a kind of poetry that this is due to the same underlying mathematical principles as the infamous Heisenberg’s uncertainty principle at the heart of quantum mechanics, because fundamental particles are wave-like objects and as such, this is part of their nature. If you are interested in this topic, I can only recommend this video from 3Blue1Brown who finds ways to explain with much more clarity than I ever could how a Fourier analysis of wave signals demonstrates almost intuitively the uncertainty principle:

In the meantime, happy hacking!