Reversing Unknown Radio Transmitters - Page 1
Forum section: electronics / beginners

author: NotionalLabs
author_rank: Unknown
timestamp: January 10, 2014, 02:47:44 pm
content: Hey everyone,I'm brainstorming a new project to explore the communications protocol for my wireless toothbrush (a Braun Oral-B Triumph 5000). This model has a "Smartguide" receiver that gives you some high-level feedback on your brushing session (such as time spent, if you're applying too much pressure, etc...). I think it would be interesting to see how the the wireless portion of this works and maybe build a little hack to generate some stats on it, etc...Generally speaking, I'm interested in figuring out the techniques involved in identifying and reversing RF communications - the ideas I've had so far are:- see if there is an FCC product information for the device detailing radio info.- take the smartguide apart and probe to find the data bus from the receiver to whatever IC is in the thing (that way I don't have to worry about the signal at all, and just decoding the data-level protocol.Neither of these really help educate me about how to detect RF signals of unknown devices though. Would I need something like this:http://rfexplorer.com/models/to do it?Thanks for any advice,Jim

author: w2aew
author_rank: Super Contributor
timestamp: January 10, 2014, 03:14:48 pm
content: The likelyhood is that Braun didn't develop something on their own. They likely used an off-the-shelf RF solution that operates in one of the license free ISM bands. So, it's likely operating around 430MHz or 915MHz or 2.4GHz. A spectrum analyzer would be helpful to ID that. The transmissions are likely to be short bursts, catching them on the analyzer will require careful setup unless you have some realtime capability in the analyzer. Modulation type is likely to be simple, such as OOK/ASK or FSK. If it is OOK/ASK, and you've identified the frequency, then the modulation pattern can be observed using zero span on the spectrum analyzer. Do really capture and analyze it, you'd ultimately want a signal analyzer (also known as a vector signal analyzer, not to be confused with a vector network analyzer). The VSA can capture/record the RF signal over time, then give you the ability to observe spectral, amplitude, frequency and phase changes vs. time.Without this fancy equipment, you'll have to get creative. Building a simple broadband RF detector (using a short antenna and a few caps and signal diodes) and coupling it to a scope should at least give you an idea of the RF transmission duration, and possibly a view into the modulation (if it is a form of AM). That won't tell you about the frequency used though.Is this information/feedback being provided "live", as you're brushing, or is it available only when the brush is put back on the stand. If the latter, the data transmission might not be RF at all...

author: Rascal
author_rank: Contributor
timestamp: January 10, 2014, 03:57:50 pm
content: This is RFID taggingUK frequencies appear to be 100-500 kHz, 10-15 MHz, 850-950 MHz, and 2.4-5 ghz13.56mhz is a popular frequency giving up to 1.5 meters range

author: KJDS
author_rank: Super Contributor
timestamp: January 10, 2014, 04:33:37 pm
content: I'll guess that it's a Zigbee system

author: abyrvalg
author_rank: Frequent Contributor
timestamp: January 11, 2014, 10:37:36 am
content: Take it apart and check what chips are there - this way should be much-much-much easier than analyzing radio waves.