2017-09-12 19:15:55 +08:00
Firstly if you use this code or are doing anything with ADS-B broadcast, I would be interested in hearing what you are up to. Get in touch on @nzkarit on twitter or adsb (AT) karit [dot] nz
2017-06-15 21:53:42 +08:00
# "ADS-B Out" add-on for SoftRF-Emu, Stratux, etc...
This repository contains "ADS-B Out" encoder for Tx-capable SDR hardware.
2017-06-16 19:59:40 +08:00
It is currently written in architecture independent Python language and can be used as an add-on for existing
2017-06-15 21:53:42 +08:00
open source "ADS-B In" solutions. One known good example is [Stratux ](https://github.com/cyoung/stratux ).
2017-06-16 18:26:28 +08:00
## Disclaimer
2017-06-15 21:53:42 +08:00
The source code is published for academic purpose only.
2017-06-16 18:26:28 +08:00
## Instructions
2017-09-08 20:09:27 +08:00
1. Execute *ADSB_Encoder.py* all the options have defaults so none are needed to generate with defaults. Running help will show you the optiosn you can change:
2017-06-16 18:26:28 +08:00
```
2017-09-12 19:15:55 +08:00
$ ./ADSB_Encoder.py
$ ./ADSB_Encoder.py -h
usage: ADSB_Encoder.py [-h] [-i ICAO] [--lat LATITUDE] [--lon LONGITUDE]
[-a ALTITUDE] [--ca CAPABILITY] [--tc TYPECODE]
[--ss SURVEILLANCESTATUS] [--nicsb NICSUPPLEMENTB]
[--time TIME] [-s SURFACE] [-o OUTPUTFILENAME]
[-r REPEATS] [--csv CSVFILE]
2017-09-08 20:09:27 +08:00
2017-09-12 19:15:55 +08:00
This tool will generate ADS-B data in a form that a hackRF can broadcast. In
addition to providing the information at the command the defaults can be
changed in the config.cfg file and the the loggin config changed in
logging.cfg.
2017-09-08 20:09:27 +08:00
2017-09-12 19:15:55 +08:00
optional arguments:
2017-09-08 20:09:27 +08:00
-h, --help show this help message and exit
2017-09-12 19:15:55 +08:00
-i ICAO, --icao ICAO The ICAO number for the plane in hex. Ensure the ICAO
2017-09-08 20:09:27 +08:00
is prefixed with '0x' to ensure this is parsed as a
hex number. Default: 0xABCDEF
2017-09-12 19:15:55 +08:00
--lat LATITUDE, --latitude LATITUDE
2017-09-08 20:09:27 +08:00
Latitude for the plane in decminal degrees. Default:
12.34
2017-09-12 19:15:55 +08:00
--lon LONGITUDE, --long LONGITUDE, --longitude LONGITUDE
2017-09-08 20:09:27 +08:00
Longitude for the place in decminal degrees. Default:
56.78
2017-09-12 19:15:55 +08:00
-a ALTITUDE, --alt ALTITUDE, --altitude ALTITUDE
2017-09-08 20:09:27 +08:00
Altitude in decminal feet. Default: 9876.5
2017-09-12 19:15:55 +08:00
--ca CAPABILITY, --capability CAPABILITY
2017-09-08 20:09:27 +08:00
The capability. (Think this is always 5 from ADSB
2017-09-12 19:15:55 +08:00
messages. More info would be appreciate). Default: 5
--tc TYPECODE, --typecode TYPECODE
2017-09-08 20:09:27 +08:00
The type for the ADSB messsage. See https://adsb-
decode-guide.readthedocs.io/en/latest/content/introduc
tion.html#ads-b-message-types for more information.
Default: 11
2017-09-12 19:15:55 +08:00
--ss SURVEILLANCESTATUS, --surveillancestatus SURVEILLANCESTATUS
2017-09-08 20:09:27 +08:00
The surveillance status. (Think this is always 0 from
ADSB messages. More info would be appreciate).
Default: 0
2017-09-12 19:15:55 +08:00
--nicsb NICSUPPLEMENTB, --nicsupplementb NICSUPPLEMENTB
The NIC supplement-B.(Think this is always 0 from ADSB
messages. More info would be appreciate). Default: 0
--time TIME The time. (Think this is always 0 from ADSB messages.
More info would be appreciate). Default: 0
-s SURFACE, --surface SURFACE
2017-09-08 20:09:27 +08:00
If the plane is on the ground or not. Default: False
2017-09-12 19:15:55 +08:00
-o OUTPUTFILENAME, --out OUTPUTFILENAME, --output OUTPUTFILENAME
2017-09-08 20:09:27 +08:00
The iq8s output filename. This is the file which you
will feed into the hackRF. Default: Samples_256K.iq8s
2017-09-12 19:15:55 +08:00
-r REPEATS, --repeats REPEATS
How many repeats of the data to perform. Default: 1
--csv CSVFILE, --csvfile CSVFILE, --in CSVFILE, --input CSVFILE
Import a CSV file with the plane data in it. Default:
2017-06-16 18:26:28 +08:00
```
2017-09-08 17:30:02 +08:00
2. Transmit the signal into air:
2017-06-16 18:26:28 +08:00
```
2017-09-12 19:15:55 +08:00
$ hackrf_transfer -t Samples_256K.iq8s -f 915000000 -s 2000000 -x 10
2017-06-16 18:26:28 +08:00
call hackrf_sample_rate_set(2000000 Hz/2.000 MHz)
call hackrf_baseband_filter_bandwidth_set(1750000 Hz/1.750 MHz)
2017-09-12 19:15:55 +08:00
call hackrf_set_freq(915000000 Hz/915.000 MHz)
2017-06-16 18:26:28 +08:00
Stop with Ctrl-C
2017-09-12 19:15:55 +08:00
3.9 MiB / 1.000 sec = 3.9 MiB/second
2017-06-16 18:26:28 +08:00
0.5 MiB / 1.000 sec = 0.5 MiB/second
User cancel, exiting...
2017-09-12 19:15:55 +08:00
Total time: 2.00039 s
2017-06-16 18:26:28 +08:00
hackrf_stop_tx() done
hackrf_close() done
hackrf_exit() done
fclose(fd) done
exit
$
```
2017-09-06 15:30:06 +08:00
* -t is the input file to transmit
* -f is the frequency in hertz. In the real world this would be 1090000000 but do not use that
* -s is the sample rate in hertz
* -x is the gain
2017-06-16 18:26:28 +08:00
## Validation
```
2017-09-12 19:15:55 +08:00
$ sudo ./dump1090 --net --freq 915000000
2017-06-16 18:26:28 +08:00
...
```
2017-06-16 18:50:15 +08:00
2017-06-16 18:26:28 +08:00
## References
2017-06-16 19:32:05 +08:00
1. "*Gr-Air-Modes*", **Nick Foster** , 2012
2017-06-17 06:31:19 +08:00
2. "*EXPLOITING THE AUTOMATIC DEPENDENT SURVEILLANCE BROADCAST SYSTEM VIA FALSE TARGET INJECTION*", **Domenic Magazu III** , 2012
2017-06-16 19:32:05 +08:00
3. "*ADS-B out by HACKRF and received over the air by rtl-sdr dongle and dump1090*", **Jiao Xianjun** , 2014
4. "*Ghost in the Air(Traffic): On insecurity of ADS-B protocol and practical attacks on ADS-B devices*", **Andrei Costin and Aurelien Francillon** , 2015
5. "*ADS-B Decoding Guide*", **Junzi Sun** , 2017
2017-06-16 19:29:14 +08:00
2017-09-05 17:16:02 +08:00
# History
This is a fork orginally from https://github.com/lyusupov/ADSB-Out in September 2017.
