EC312 – SX20-EW Jamming
We are devoting a good portion of this course to learning about wireless communications systems and the
associated considerations, from modulation to gain to antennas and signal propagation. Why? Because “Cyber”
doesn’t exist solely in a single computer or a closed
network. You can have a significant impact by
using Electronic Warfare as an enabler for Cyber
effects. http://breakingdefense.com/2013/04/admgreenert-wireless-cyber-em-spectrum-changingnavy/
Now we’re going to put all that knowledge to the
test and apply your cyber skills in a wireless
environment.
Set-up.
Equipment required:
□ Your issued Laptop
□
□
□
□
□
□
□
□
MATLAB Code RCcode.m and getkey.m
o This code is available at U:\Cyber2\EC312\SX20
LeCroy “Wave Surfer” 104MXS 1GHz Oscilloscope
Anritsu MS2711D Spectrum Analyzer
Telescoping Antennas w/ BNC connector
RC Vehicle
Signal Generator & accessories (Instructor will set up)
TURN OFF YOUR CELL PHONE! (The next hour of your life will be easier if your cell phone isn’t
adding noise to the Electromagnetic Spectrum.)
Your instructor will divide into 4 groups.
Two groups will work with the 27MHz cars in the back of the lab (EW27 groups A and B)
and two groups will work with the 40MHz cars in the front of lab space (EW40 groups A and B)
A groups will perform Part I and II (pages 2-5 on lab) first and then do Part III (pp.6-10).
B groups will perform Part III (pages 6-10 on lab) first and then do Part I and II (pp.2-5).
Then both A and B will work on Part IV (pages 11-14 on lab), and you will have a splitter, so you will
work in different portions of your space.
1
EC312 – SX20-EW Jamming
Part I: Data Collection
Communications System. For this Security Exercise, we’ll explore the entire communications system employed
by a Radio Control (RC) vehicle… And then we’ll exploit it!
Answer the questions below to examine the RC vehicle’s communications.
a)
b) Coiled wire right under here!
Note: These images resemble the models in your classroom enough to give you the general idea. We can’t all
have Ferraris, after all!
Question 1: Which image most closely represents the transmitter?
Question 2: Where is the receiver?
Question 3: What type of channel does this communications system involve?
Question 4: What do you expect your “information” to be in this case?
Question 5: What will happen when the “information” is recovered at the receiver?
Question 6: What type of antenna does the transmitter use?
Question 7: What would you expect the beam pattern of this antenna to look like?
Question 8: Do the transmitter or receiver give any indication of carrier frequency? If so, what is fc?
( either 27.145 MHz or 40.680 MHz)
2
EC312 – SX20-EW Jamming
To verify the carrier frequency of the transmitted signal, use the Anritsu MS2711D Spectrum Analyzer.
□
□
□
□
□
□
Press “Recall Setup” (Hard Key
#6)
Ensure “Default” is highlighted
Press “Enter”
Set “Center” to the carrier
frequency determined
Question 8.
Set “Span” to 200 kHz
Transmit from RC vehicle
controller (ensure power is on);
signal will display on the
spectrum analyzer
Question 9: What is the carrier frequency? Draw the signal in the frequency domain.
Can you see any difference when you transmit forward vs reverse or any of the other directions?
3
EC312 – SX20-EW Jamming
Part II: Jamming
Now that we have some basic intel, think about what could happen if your instructor was to transmit ( from signal
generator) a signal at the carrier frequency?… The answer: It depends!
In lecture, we learned that the effectiveness of EA/Jamming is dependent upon the Jamming to Signal Ratio (JSR).
The JSR is dependent upon both the power of the jammer and the transmitter as well as the distance of the jammer
and the transmitter from the receiver.
In this lab, our scenario looks like this:
The JSR depends on the received signal power at the car and the received jamming power at the car:
JSR=
J PJ (W )
=
= PJ ( dB ) − PS ( dB )
S PS (W )
Generally, if the JSR is greater than 1 (or 0 dB), jamming will be effective.
□
Play time! Drive your vehicle around the classroom.
Question 10: What two conditions (with regards to frequency and received power) must exist for
4
EC312 – SX20-EW Jamming
jamming to be effective? Get your instructor’s signature to continue.
□
Your instructor will generate a 20 dBm FM signal at the carrier frequency.
Question 11: What is your instructor’s target?
□
While your instructor is transmitting the jamming signal, experiment! Attempt to control the RC car with
its transmitter at different distances from both the jammer and the RC car.
Question 12: When your instructor transmitted a jamming signal, were you still able to control the RC
car? When could you control it? When couldn’t you?
Question 13: Use the Anritsu MS2711D Spectrum Analyzer to draw the jamming signal in the frequency
spectrum. How does this change if you transmit while standing next to the Spectrum Analyzer? Move the
Spectrum analyzer away to see the effect of the transmit signal and jamming signal with distance.
Question 14: How could you increase the range of the jammer? (How is jamming range dependent on
signal power?)
5
EC312 – SX20-EW Jamming
Part III: Reverse Engineering
So now we know the carrier frequency and the effects of transmitting a higher signal power on that frequency, but
if we want to make a bigger impact, we need to know more about the RC car’s signal. What does the transmitted
signal look like? What type of modulation does it use? How do controls work? To accomplish this, we’re going
to look at the signal using the LeCroy “Wave Surfer” 104MXS 1GHz Oscilloscope.
Make sure you have the BNC telescoping antenna on Ch1 input.
Channel 1
6
EC312 – SX20-EW Jamming
First, some initial set-up for the O-Scope:
□ Touch yellow box on lower left corner of touch screen to configure Channel 1 with the following settings:
o Set Volts/div to 20 mV
o Set Coupling to DC50Ω
o Set “Trigger” to 25.0 mV
o Touch “Timebase” to set Time/Division to 5.00 ms/div
o Press “Close” (top right corner for Channel 1 menu)
Once you’ve set up your Channel configuration on the O-Scope, it’s time to capture the signal.
□
□
□
On “Trigger” section of O-Scope display, select “Normal”
Holding RC car transmitter close to the O-Scope, send the
“forward” signal by driving the car forward. Ensure antenna is
extended!
When your signal is displayed on the screen, press “Stop” on
Trigger menu, while still sending the “forward” signal.
If done correctly, your O-scope display should look similar* to this:
* Captured signal may vary – that’s ok for now!
7
EC312 – SX20-EW Jamming
Question 15: What type of modulation does this car use?
Question 16: What pattern of 0’s and 1’s does the transmitted signal represent?
Question 17: What does the baseband binary signal look like? (Draw the square wave.)
To be able to control the RC car, we want to be able to do more than just drive it forward. How does the signal
change for reverse, left, or right?
Think about the controls – how many different signals do you expect to control the car? In addition to driving
forward, the car can operate in reverse, as well as turning left and right… and any combination thereof! There are
actually 8 different combinations of signals, but in the interest of time we’re only going to worry about four:
Forward, Reverse, Forward & Right, and Forward & Left. Here’s the catch: The chips that process the signal
and control the vehicles motion aren’t necessarily wired the same way in every car, so you need to identify which
operation each transmitted signal represents!
Examine each transmitted signal by repeating the process you just followed to capture the signal:
□ On “Trigger” section of O-Scope display, select “Normal”
□ Transmit desired signal.
o Forward
o Reverse
o Forward AND Right (This is different from the signal to pivot the wheels to the right only!)
o Forward AND Left (This is different from the signal to pivot the wheels to the left only!)
□ When your signal is displayed on the screen, press “Stop” on Trigger menu.
Question 18: Match the transmitted signals to the operations they represent by circling the correct
response on the waveforms that follow. The signals can be distinguished by the number of 1’s being
transmitted after the 4 large sync pulses.
8
EC312 – SX20-EW Jamming
Forward or Reverse or Forward-Right or Forward-Left??
( # of 1’s: 10)
Forward or Reverse or Forward-Right or Forward-Left??
( # of 1’s: 40)
Forward or Reverse or Forward-Right or Forward-Left??
( # of 1’s: 34)
9
EC312 – SX20-EW Jamming
Forward or Reverse or Forward-Right or Forward-Left??
( # of 1’s: 28)
Question 19: Now that you’ve identified the modulated signal that controls the car, could you
determine the baseband binary signal (square wave) for each function?
We now know the bits that are transmitted to control the forward, turning, and reverse motions of the RC car. We
also know that we can’t transmit the baseband binary signal, so we need to modulate it on a high frequency
carrier. If we can generate the bits and mix it up with the high frequency carrier, do we need the “real” remote to
drive the RC car? Let’s find out!
10
EC312 – SX20-EW Jamming
Part IV: The Hook
In this section, you’ll use the MATLAB code provided and your laptop soundcard to generate and transmit control
signals to the RC car. You may have noticed that each transmitted signal consists of 4 wide “sync” pulses
followed by a trail of 0’s and 1’s. Since you’ve already matched the waveform to the driving direction, now all
you need to do is determine the number of 1’s in the trail following the sync pulses. For example, in the image
below represents 01110111011101110101010101010101010101110 in binary (check back to HW19 if
you’re not a believer yet!). For this sequence of bits:
01110111011101110101010101010101010101110
sync pulses
trail (of ten 1’s)
Question 20: Fill in the table by entering the number of 1’s trailing the sync pulses for each RC car
operation determined in Question 18. You must find the exact value!
Direction
Forward
Number of 1’s
in trail
Reverse
Right
Left
N/A
N/A
Fwd-Right
Fwd-Left
Rev-Right
N/A
Rev-Left
N/A
The MATLAB code takes input from the arrow keys on your laptop and generates the baseband binary signals to
control the RC vehicle. Since we only determined the binary waveform for 4 of the 8 possible operations, we’ll
be slightly limited in the operation of our RC vehicle – we won’t be able to turn while operating in reverse. (This
is solely in the interest of time… We really don’t want you stuck here counting 1’s until Graduation! Seriously.)
□
In MATLAB, update the “Setup Major Variables” section of your RCcode.m code (shown below) with
the number of 1s in the “trail” in preparation of taking over the RC vehicle.
%%%%%%%%%%%%%%%%
% RC CAR CODE %
%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%
11
EC312 – SX20-EW Jamming
% PRESS SPACE TO TERMINATE EXECUTION
%
%
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
% !!!!! NOTE !!!!!
% If you do something wrong and Matlab terminates unexpectedly (you get a
% lot of angry red Error messages) you will have to close out and restart
% Matlab in order to clear out the sound card buffer!!!
%
% Forward = Up Arrow
% Reverse = Down Arrow
% Forward Right = Right Arrow
% Forward Left = Left Arrow
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Clear out memory and initialize default settings
%
% DO NOT CHANGE THIS SECTION
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
clear all
close all
set(0, 'DefaultAxesFontSize', 14)
set(0, 'DefaultAxesFontWeight','Bold')
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Change
This
Section!
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Setup major variables
%
% CHANGE THIS SECTION ONLY!!! (FOLLOW LAB INSTRUCTIONS) %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
forward_1s = 01;
reverse_1s = 01;
Insert Number of 1’s from Question 20 table here!
right_fwd_1s = 01;
left_fwd_1s = 01;
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
sam_per_sym = 22; %fs/Rb = 44.1e3/(1/Tb), Tb ~ 500us
fs = 44.1e3;
% Set sampling rate to sound card rate
Rb = fs./sam_per_sym;
fif = 10e3;
% 10.0 kHz "baseband" (IF) Frequency
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Generate the original data to manipulate the car
%
% DO NOT CHANGE THIS SECTION
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
sync = [1 1 1 0 1 1 1 0 1 1 1 0 1 1 1 0];
forward = [sync repmat([1 0], 1, forward_1s)];
reverse = [sync repmat([1 0], 1, reverse_1s)];
right_fwd = [sync repmat([1 0], 1, right_fwd_1s)];
left_fwd = [sync repmat([1 0], 1, left_fwd_1s)];
pause = zeros(1,500);
key = 0; % Initial Keyboard Value
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Reads inputs once per second
%
% DO NOT CHANGE THIS SECTION
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
while key ~= 32 %Press space to stop
key = getkey(1);
if key == 30
data = [forward forward forward forward forward forward forward forward];
elseif key == 31
data = [reverse reverse reverse reverse reverse reverse reverse reverse];
elseif key == 29
data = [right_fwd right_fwd right_fwd right_fwd right_fwd right_fwd right_fwd right_fwd];
elseif key == 28
data = [left_fwd left_fwd left_fwd left_fwd left_fwd left_fwd left_fwd left_fwd];
else
data = [pause];
end
% Generate Polar NRZ
time_stop = length(data).*sam_per_sym;
12
EC312 – SX20-EW Jamming
up_data = zeros(1,time_stop);
time = linspace(0,(1/fs).*time_stop, length(up_data));
% Upsample
for i = 0:length(data)-1
up_data(sam_per_sym.*i + 1 : sam_per_sym.*i + sam_per_sym) = data(i+1);
end
% Generate the "baseband" (IF) waveform
s_lo = cos(2.*pi.*fif.*time);
s_if = s_lo.*up_data;
soundsc(s_if,fs)
end
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
□
When your code is updated, run it by pressing
□
You will get a grey flashing screen with the heading “Press a key”.
□
Press your arrow keys to simulate driving your vehicle. ( Forward right is 2 keys pressed together)
□
If you need to end program at any time to go back and edit or stop, hit the space key.
.
Question 21: What do you hear? What type of signal is being generated?
Question 22: What do you need to do to transmit this signal so that the car receives it? Get your
instructor’s signature to continue.
Your instructor will use the same signal generator that transmitted the jamming signal in Part II to transmit the just
the carrier this time to mix with our RC code baseband signal and create an ASK/OOK signal.
The set up looks like the figure on the next page. The output from the laptop (RC code signal) is from our audio
jack.You should investigate the parts and recognize that one is a mixer that mixes the carrier with our baseband
signal and then the next is an amplifier which uses 16VDC to power it. (Remember an amplifier can’t provide
gain unless it has its own power source. The op amps that you used in EE331 lab had separate power sources.)
13
EC312 – SX20-EW Jamming
□
Bring your laptop to your instructor and get ready to drive!
Question 23: Do you need the car’s transmitter to control the car? What just happened?
Question 24: List some examples of how this might be significant in a military setting.
Need ideas? Check this out! http://www.engr.utexas.edu/features/humphreysspoofing
LCDR Jennie Wood and Assoc. Prof. Chris Anderson
14
EC312 – SX20-EW Jamming
Name:
__________________________________________________________________________________________
Question 1:
__________________________________________________________________________________________
Question 2:
__________________________________________________________________________________________
Question 3:
__________________________________________________________________________________________
Question 4:
__________________________________________________________________________________________
Question 5:
__________________________________________________________________________________________
Question 6:
__________________________________________________________________________________________
Question 7:
__________________________________________________________________________________________
Question 8:
__________________________________________________________________________________________
Question 9:
__________________________________________________________________________________________
Question 10:
__________________________________________________________________________________________
Question 11:
__________________________________________________________________________________________
Question 12:
__________________________________________________________________________________________
Question 13:
__________________________________________________________________________________________
Question 14:
__________________________________________________________________________________________
15
EC312 – SX20-EW Jamming
__________________________________________________________________________________________
Question 15:
__________________________________________________________________________________________
Question 16:
__________________________________________________________________________________________
Question 17:
__________________________________________________________________________________________
Question 18:
Forward or Reverse or Forward-Right or Forward-Left?
( # of 1’s: 10)
Forward or Reverse or Forward-Right or Forward-Left?
( # of 1’s: 40)
Forward or Reverse or Forward-Right or Forward-Left?
( # of 1’s: 34)
Forward or Reverse or Forward-Right or Forward-Left?
( # of 1’s: 28)
__________________________________________________________________________________________
Question 19:
__________________________________________________________________________________________
Question 20:
Direction
Number of
1’s in trail
Forward
Reverse
Right
N/A
Left
N/A
Fwd-Right
Fwd-Left
Rev-Right
N/A
Rev-Left
N/A
__________________________________________________________________________________________
Question 21:
__________________________________________________________________________________________
Question 22:
__________________________
Instructor/Lab Tech Signature
__________________________________________________________________________________________
Question 23:
__________________________________________________________________________________________
Question 24:
__________________________________________________________________________________________
16