"Hack" an Commercial Airline Groundstation Radio? - Page 1
Forum section: electronics / rf-microwave

author: Lord of nothing
author_rank: Super Contributor
timestamp: March 28, 2016, 08:11:40 pm
content: HeyAn crcy German sold me on Ebay an Commercial Airline Radio for less than noting.Its from "Harris". There areNOinformation about the Box in on the Internet.Thankfully the also send me the Manual.Chaing Channel and all that stuff work. The should supprt "Digital" (ACARS, VDL) but i cant swtich to digital mode.The have an ROM?! You know that small chip who is removal and a square.So its possible to hack that stuff and unlock the digital processing?THX!

author: Lord of nothing
author_rank: Super Contributor
timestamp: April 17, 2016, 03:04:30 pm
content: can someone help me to get the Data out?I have no idea how to do it.

author: uncle_bob
author_rank: Unknown
timestamp: April 17, 2016, 03:17:36 pm
content: HiWell, Harris has been making various radios for over 50 years now. They have made at least a few hundred different models of radios and possibly over a thousand. *Some* sort of information on the radio you have will be needed to track things down. Is it bigger than a small car (some of theirs are)? Is it smaller than a shoe box? Maybe a picture? A shot of the name plate would help quite a bit. If the name plate and all ID have been stripped from the radio (they *were* there at one time), you will probably need to shoot a number of pictures of the radio.Bob

author: Howardlong
author_rank: Super Contributor
timestamp: April 17, 2016, 03:46:19 pm
content: The other question is, what are your intentions to do with it?It will be of no surprise that a dim view is taken of unlicensed operation particularly when safety of life is on the cards.For example I have an FRTOL but I am only licensed to use it as crew, I am not even authorised to operate on the ground unless I am in an aircraft as crew.

author: Lord of nothing
author_rank: Super Contributor
timestamp: April 17, 2016, 04:39:58 pm
content: Its an Commercial Radio everyone here should understand that not an good idea say exactly what kind of freq the Radio could receive.Maybe the Data outout work when i put something one other "Serial" Ports?QuoteGet the Data out of the Box who are transmitted over the Air. Yes there are Software for SDR Dongle but hey it an commercial Radio the work 100x better than an Cheap SDR Dongle.Quotehmm its just an receiver and nothing special with (expect that someone sold it who have no idea what the actual sold.). If the Company who sold it would know what a product like that cost one the free Market the would drive insane.QuoteYou know that ADSB Reception are ilegal in quite all EU Country? So look on FR24 and other sides. Million People share it. The same with AIS its illegal to receive and share in many Country but hey...So trust me that what i want to do is what i also could do with SDR Software but with less effort. I dont want to share that data or give it out of my Hand. Its just for Recording. When i cold modified the Data to make it an Format who can be read by another program it will be fine.

author: Howardlong
author_rank: Super Contributor
timestamp: April 17, 2016, 07:51:16 pm
content: You did not state it was a receiver only, nor much else for that matter in your OP, just saying.

author: janoc
author_rank: Super Contributor
timestamp: April 17, 2016, 08:27:47 pm
content: Quote from: Lord of nothing on April 17, 2016, 04:39:58 pmThe frequencies are public information, there you really don't need to worry. The bandplans are published and you can even get the specific frequencies in use from the airport maps, frequently even from the websites of the airports.Quote from: Lord of nothing on April 17, 2016, 04:39:58 pmIt is certainly not illegal to receive these signals. However, you are not allowed to share/disclose the communication not intended for you because then you may be breaking the telecommunication secrecy. Which *is* illegal. Some countries also prohibit possessing the radio equipment without the corresponding license, but that is rare.Don't know about FR24, but I think they operate under the premise that the ADSB signals are broadcasts (not a "communication" having a specific recipient), so they are a free game, being public information. But that's just my speculation - do check the telecom rules in your area if not sure!Their forum also seems to confirm this:http://forum.flightradar24.com/threads/5685-Is-Feeding-ADS-B-Signals-LegalBut again, IANAL. Do check your local laws.

author: Lord of nothing
author_rank: Super Contributor
timestamp: April 17, 2016, 08:41:42 pm
content: Sure I know the Freq but its better not to talk about that. For the Radio Box is not necessary on which freq is run.Quotesure but receiving is ilegal also sharing is highly illegal. Some People ask the Authoriys in different European Country and you can think what the say....So back to Topic. How can I see what kind of Data the Box send out over the Physical Ports?

author: Howardlong
author_rank: Super Contributor
timestamp: April 17, 2016, 08:50:41 pm
content: It depends on the local laws, certainly in the UK the default is that it is technically illegal to receive anying which you don't have a licence for. In practice, certainly for aviation stuff such as AM VHF and secondary radar on L band a blind eye is turned.However this is why, for example, LiveATC generally doesn't cover the UK.You don't need a licence to be in possession of equipment capable of receiving or indeed transmitting anywhere in the spectrum, it's only an offence if you use it without an appropriate licence.I'm well aware there are different rules in other jusrisdictions, that's just how it's applied in the UK.

author: janoc
author_rank: Super Contributor
timestamp: April 17, 2016, 09:00:00 pm
content: Quote from: Lord of nothing on April 17, 2016, 08:41:42 pmSorry, that's just BS. The frequencies are public information posted by the government and coordinated worldwide. For example:http://www.erodocdb.dk/docs/doc98/official/pdf/ERCRep025.pdfYou get also info like this:http://ourairports.com/airports/LFPG/pilot-info.html#comm5 seconds of googling. That info has to be public, because, surprise, the pilots need to actually know which frequency to use when coming into that airport. It is not like the tower or ground handling frequencies are some sort of security sensitive information.There is nothing secret or taboo that must not be talked about there.Quote from: Lord of nothing on April 17, 2016, 08:41:42 pmSorry, you are just making wild assumptions based on hear-say. Do actually check the law and you will be surprised. I have actually taken an exam from the telecom regulations for my HAM license, so I guess I should know something about the regs.If your country allows owning the receiver without license (some don't - e.g. Belgium, I believe), then you shouldn't have any issues as long as you don't disclose the information received - that is the only thing where you could theoretically have problems.

author: janoc
author_rank: Super Contributor
timestamp: April 17, 2016, 09:06:23 pm
content: Quote from: Howardlong on April 17, 2016, 08:50:41 pmI think the difference here is that AM VHF (and the ATC chatter in general) are covered under the communication secrecy - it is not something intended for you. So something like LiveATC cannot legally operate there because it would be breaking the law by disseminating that information.ADS-B are automatic beacons carried by the aircraft broadcasting their identification and position. There is no "communication" happening normally and the signals are intended for anyone who can receive them. So it isn't exactly apples to apples comparison. I would say that these fall under the "weather and navigation transmissions" as it is mostly collision avoidance info:http://stakeholders.ofcom.org.uk/enforcement/spectrum-enforcement/guidanceBut I am certainly no expert on UK law.

author: Lord of nothing
author_rank: Super Contributor
timestamp: April 17, 2016, 09:12:58 pm
content: Quotehahado you realy think the Authority can control who buy which Hardware?Baofengs, SDRs, Ebay,... Some People sneak SDR Hardware into North Korea.The Point is the Receiver is made for something I should not receive but. So can we return back to Topic? I will get "Data" out of this thing.

author: janoc
author_rank: Super Contributor
timestamp: April 17, 2016, 09:26:32 pm
content: Quote from: Lord of nothing on April 17, 2016, 09:12:58 pmYou will be surprised, but yes, they can. Ignorance does not make it any more legal. It used to be like that in the former Czechoslovakia - you could buy HAM radio gear only if you brought a valid license in store with you. Earlier it was like that for CB too - you had to register it and have a permit for it. And if the police found a radio in your car or home, you could have been heavily fined if you didn't have the proper papers for it, simply based on possession, e.g. because a "helpful" neighbor didn't like the shadow of your antenna over their property. You didn't need to actually operate it.Fortunately this has changed in the late 90s. However, there are still many places forbidding the ownership of communication receivers ("scanners") and you will get fined if caught with one.QuoteNo point in ranting if you don't actually post photos or description of what exactly you have, as asked before. Without that pretty much nobody can help you.

author: Lord of nothing
author_rank: Super Contributor
timestamp: April 17, 2016, 09:32:45 pm
content: QuoteMy Dad was born there.Quotesure but nowadays I could travel across the Boarder without any Passport Check or so.I could smuggle anything in Europe.The same at the Airport the last time I saw someone from the Custom it was on a TV Show.QuoteWhy should a Police visit my House? The Stasi Time (ok ok it was East Germany...) are over.QuoteSo there are no Information about the Receiver. It was part on an bigger Solution.

author: janoc
author_rank: Super Contributor
timestamp: April 18, 2016, 10:01:44 pm
content: Quote from: Lord of nothing on April 17, 2016, 09:32:45 pmYou have obviously no idea and have never had to deal with neighbors, for example. Try to erect an antenna in your house or apartment and you will discover "new world" of human relationships very quickly.Quote from: Lord of nothing on April 17, 2016, 09:32:45 pmToo bad then.

author: Lord of nothing
author_rank: Super Contributor
timestamp: April 18, 2016, 10:05:42 pm
content: I have some Antenna on the Rooftop but nobody care about.Anyone here have experience with readout some unknown data?!

author: Melt-O-Tronic
author_rank: Frequent Contributor
timestamp: April 18, 2016, 10:57:06 pm
content: If we ignore all the off-topic noise about legal & illegal stuff, it's still not clear what exactly you're trying to do. Are you asking how to connect to the serial port and look at the data coming out of it? If so, I believe the images you posted provide the information you need. If that is not helpful to you, it sounds like you may need very introductory-level education on the topic.

author: Lord of nothing
author_rank: Super Contributor
timestamp: April 18, 2016, 11:23:49 pm
content: I need some application to see what going over the ports. Also the Cabling. That isnt that easy for an beginner.

author: janoc
author_rank: Super Contributor
timestamp: April 19, 2016, 10:09:12 pm
content: Well, the pins of the connector seem to be described well. Seems like regular RS232 is available - good old serial port.Software - RS232 can be handled using any terminal emulator. Putty, Hyperterminal, RealTerm - all can do it.And the protocol - if it isn't described in the documents you have, then you will either need to google more or reverse engineer it. It is fairly likely it is going to be something ASCII text based, though.However, you may not be able to get the actual received data over RS232 - that signal is on the maintenance connector, so it is possible you will have only diagnostics/service info there and the data are available only through RS-422/485. Nothing a microcontroller with a receiver chip couldn't handle, though.There is also audio output there - that would be probably the first thing to connect to make sure you are actually receiving anything to begin with.You will likely have to make your own cable based on those documents unless you can source an original one somewhere (but then it is likely to have a normal serial port which today's PCs don't have).

author: Lord of nothing
author_rank: Super Contributor
timestamp: April 19, 2016, 10:19:56 pm
content: changing to an Audio Channel work also Audio.Serial do also work but have no real output.

author: Lord of nothing
author_rank: Super Contributor
timestamp: June 01, 2016, 11:48:07 am
content: So i found out that i have this inside:http://pdf1.alldatasheet.com/datasheet-pdf/view/93786/MOTOROLA/MC68HC711P2CFN4.htmlwww.ic37.com/AMD/AM29F010-120_datasheet_1065184/so its possible to read out the program and edit it?

author: uncle_bob
author_rank: Unknown
timestamp: June 01, 2016, 11:48:06 pm
content: Quote from: Lord of nothing on June 01, 2016, 11:48:07 amHiIt probably is. It's likely written in assembly language with no symbol tables. Unless you do a lot of HC11 code, figure on it taking a while to work out what's what. For somebody who does HC11 all the time, a couple of months should do the trick. Maybe 4X that if you only have done firmware on other MCU's.Bob

author: Lord of nothing
author_rank: Super Contributor
timestamp: June 02, 2016, 12:08:14 am
content: ...I want to figure out which funktion checks what kind of licence is using or so.

author: uncle_bob
author_rank: Unknown
timestamp: June 02, 2016, 12:14:54 am
content: Quote from: Lord of nothing on June 02, 2016, 12:08:14 amHiHow much experience do you have doing firmware on small MCU's?How much time have you spent working with the output of reverse assemblers?For that matter, how familiar are you with assembly language programming?Bob

author: Lord of nothing
author_rank: Super Contributor
timestamp: June 03, 2016, 12:08:54 am
content: 0, 0, 0So is that so hard to find the function who desired what run?

author: uncle_bob
author_rank: Unknown
timestamp: June 03, 2016, 12:16:09 am
content: Quote from: Lord of nothing on June 03, 2016, 12:08:54 amHiWhat you will dump is a bunch of binary numbers. They correspond to Motorola assembly language primitive operations. The first task is to work out where the program actually starts .... From there you use a reverse assembler to convert the binary into text op codes like STA,X and CMPA,I or something similar. From there you begin to figure out what does what in the program. I do this stuff for a living. It would take me months....No, that's not part time months. That's full time 40 hour a week months.Bob

author: Lord of nothing
author_rank: Super Contributor
timestamp: June 03, 2016, 12:21:48 am
content: i have enough time. What is the best way to start?

author: uncle_bob
author_rank: Unknown
timestamp: June 03, 2016, 12:30:00 am
content: Quote from: Lord of nothing on June 03, 2016, 12:21:48 amHiStart with a course in computer programming at your local school. After that there are generally about three courses before you get to assembly language programming principles. That will give you the basics to understand what you are looking at. Next step would be to reverse assemble some code you are already familiar with and get the hang of looking at things backwards. It is unlikely that they will teach you HC11 coding since it's basically an "over the hill" part. Yes, we use them, but not a lot. I'd get a couple of demo boards and start doing code on them. That will get you up to speed with the tools. Figure that there's about $500 in the tools so far. For the reverse assemble part of it, you *might* find code out there. You may have to write your own. For a simple machine like the one on that board, it's not all that hard to do. From there it's just working out what each and every line of code in the machine does. Also consider that there are other chips on the board that get into the act. The HC11 is only one of the devices you have to dig into.Bob

author: Lord of nothing
author_rank: Super Contributor
timestamp: June 05, 2016, 09:54:31 pm
content: hmm so what can I do now?

author: uncle_bob
author_rank: Unknown
timestamp: June 05, 2016, 10:02:09 pm
content: Quote from: Lord of nothing on June 05, 2016, 09:54:31 pmHiWhat you are trying to do is in the "can be done" category. It's not 100% certain it can be done, but it's quite likely. Doing it is not in the "simple weekend project" category. It is likely the people who made the radio did some things to make it hard to do. If it was really simple, nobody would ever pay for a license for this or that on the radio.Bob

author: Lord of nothing
author_rank: Super Contributor
timestamp: June 05, 2016, 10:04:18 pm
content: the company must void the Warranty to Hack it.This Product is made for an huge Solution so nobody would ever touch it.

author: uncle_bob
author_rank: Unknown
timestamp: June 05, 2016, 10:09:20 pm
content: Quote from: Lord of nothing on June 05, 2016, 10:04:18 pmHiWhich company must void the warranty to hack it?Why would people never touch it?Bob

author: Lord of nothing
author_rank: Super Contributor
timestamp: June 05, 2016, 10:10:36 pm
content: ähm? How do you want replace the Main Memory without open the Case?

author: uncle_bob
author_rank: Unknown
timestamp: June 05, 2016, 10:27:53 pm
content: Quote from: Lord of nothing on June 05, 2016, 10:10:36 pmHiYou use a boot loader.Bob

author: uncle_bob
author_rank: Unknown
timestamp: June 05, 2016, 10:35:03 pm
content: Quote from: Lord of nothing on June 05, 2016, 10:33:05 pmHiYou use a custom program that uploads the code to the MCU after doing some custom validation against the firmware already in the MCU.Again, fairly basic firmware stuff. Not something that most people do every day.Bob

author: Lord of nothing
author_rank: Super Contributor
timestamp: June 05, 2016, 10:37:31 pm
content: So let me try it.What kind of Hardware does I need to read the Data out?I ordered today an Tool to get the Chip out.When I learn something from the Videos never use an Screwdriver for.

author: uncle_bob
author_rank: Unknown
timestamp: June 05, 2016, 10:50:11 pm
content: Quote from: Lord of nothing on June 05, 2016, 10:37:31 pmHiOk, so first step:Identify the chips on the board and take a look at how they are interconnected. That will give you a basic idea how the code may be accessed and where the information you are looking for may be stored. Possible locations:1) EEPROM2) Outboard FLASH3) Outboard mask ROM4) Re-loaded into RAM after pull from external memory5) On the MCUIt's a pretty good bet that what you are after (license keys) is not in the MCU it's self. Of course without ever seeing the board or the radio, this is all 99% guesswork.Bob

author: Lord of nothing
author_rank: Super Contributor
timestamp: June 05, 2016, 10:52:08 pm
content: How can i see this?

author: uncle_bob
author_rank: Unknown
timestamp: June 06, 2016, 12:31:09 pm
content: Quote from: Lord of nothing on June 05, 2016, 10:52:08 pmHiOpen up the radio and make a list of all the major chips.Look up each chip and see what sort of chip it is.Bob

author: Lord of nothing
author_rank: Super Contributor
timestamp: June 08, 2016, 07:28:12 pm
content: ok i will do it tomorrow. I have some good pics but the are not that good for "reverse engineering".