1
00:00:00,000 --> 00:00:06,320
good morning everyone we deeply appreciate you collecting our session

2
00:00:06,320 --> 00:00:10,220
amidst the array of impressive presentations happening concurrently in

3
00:00:10,220 --> 00:00:16,520
other tracks and today we'll delve into the pivotal role that SDR plays in the

4
00:00:16,520 --> 00:00:22,420
realm of military drones let's now turn to my colleague David who will lead us

5
00:00:22,420 --> 00:00:34,600
further in this topic so we are gabriela garcia and david melendez in that case

6
00:00:34,600 --> 00:00:42,320
gabriela aka gaps is the first time in DEF CON for her and she's a security

7
00:00:42,320 --> 00:00:48,820
developer and a hacker and a hacking community co-organizer she is also coding

8
00:00:48,820 --> 00:00:51,920
and cyber security instructor and mentor and

9
00:00:53,080 --> 00:01:00,640
She is helping me to present this presentation because my English is from Zaragoza, Spain.

10
00:01:03,480 --> 00:01:13,680
She is attending several conferences like CodeMotion, GSD in Canarias, it's a good place

11
00:01:13,680 --> 00:01:14,960
to go to the beach.

12
00:01:16,540 --> 00:01:24,840
And in my case, it's not my first time at DEF CON, but it's like this with the shoot

13
00:01:24,840 --> 00:01:25,180
the noob.

14
00:01:25,360 --> 00:01:28,680
I'm still processing the Jack Daniels, maybe.

15
00:01:30,580 --> 00:01:38,900
So it's not my first time in DEF CON, also in several places, like the most famous conference

16
00:01:39,520 --> 00:01:42,060
in Spain, as RouterCon.

17
00:01:42,280 --> 00:01:44,680
And I am a book author about drones.

18
00:01:44,680 --> 00:01:48,100
Hacking with Drones is a very original name.

19
00:01:50,580 --> 00:01:56,440
And just to show how old I am, I am very fan of Cappus Party.

20
00:02:03,120 --> 00:02:05,080
So Caps, let's go.

21
00:02:06,320 --> 00:02:06,960
Okay.

22
00:02:07,600 --> 00:02:08,700
The context.

23
00:02:09,000 --> 00:02:14,660
As some of you may have accidentally heard, we are in a war time.

24
00:02:14,660 --> 00:02:20,620
There is currently an alarming high number of conflicts occurring around the globe and

25
00:02:20,620 --> 00:02:26,500
military equipment manufacturers emphasize in one primary objective, which is to minimize

26
00:02:26,500 --> 00:02:27,100
casualties.

27
00:02:29,080 --> 00:02:34,460
This is what drones take on particular significance as an instrument of warfare.

28
00:02:37,240 --> 00:02:38,080
Next.

29
00:02:39,080 --> 00:02:39,440
Okay.

30
00:02:41,000 --> 00:02:41,840
Drone.

31
00:02:43,180 --> 00:02:44,020
Sorry.

32
00:02:44,120 --> 00:02:44,640
Drone.

33
00:02:44,660 --> 00:02:45,060
Yeah.

34
00:02:45,350 --> 00:02:45,760
Let's go.

35
00:02:45,960 --> 00:02:46,160
Yeah.

36
00:02:47,460 --> 00:02:52,800
Drones have evolved into essential instruments of warfare due to various factors.

37
00:02:53,160 --> 00:02:55,600
They enable precision strikes in combat.

38
00:02:55,880 --> 00:03:02,480
They eliminate the need for onboard personnel, and they are perfectly suited for symmetrical

39
00:03:02,480 --> 00:03:08,840
warfare and are crucial in executing tactics and strategies for real-time covert operations.

40
00:03:11,920 --> 00:03:12,700
Drone.

41
00:03:12,800 --> 00:03:13,000
Drone.

42
00:03:13,060 --> 00:03:13,780
Drone.

43
00:03:13,780 --> 00:03:14,420
Drone.

44
00:03:14,420 --> 00:03:17,560
These automated weapons offer numerous advantages.

45
00:03:18,160 --> 00:03:25,440
They ensure greater accuracy in attacks, resulting in reduced collateral damage in fewer civilian

46
00:03:25,440 --> 00:03:25,980
casualties.

47
00:03:26,400 --> 00:03:31,660
They minimize human risk as they are remotely operated.

48
00:03:31,980 --> 00:03:38,400
And their operational duration is extended, since they're not concern for fatigue.

49
00:03:38,940 --> 00:03:42,500
Additionally, their versatility is show-

50
00:03:42,500 --> 00:03:44,400
Showcased by the continued ease.

51
00:03:44,420 --> 00:03:50,000
capability to be equipped by a rank of weaponry from missiles to bombs.

52
00:03:52,600 --> 00:04:00,060
In symmetrical warfare, drones offer cost-effectiveness when compared to traditional manned aircraft,

53
00:04:00,460 --> 00:04:06,680
and this is evident through cost reductions in drone production methods such as cargo

54
00:04:06,680 --> 00:04:11,720
drones, wooden drones, 3D printing, and the use of affordable chipsets.

55
00:04:14,400 --> 00:04:20,420
In strategic terms, drones offer tools for real-time covert operations and tactics, and

56
00:04:20,420 --> 00:04:29,400
additionally they enhance surveillance capabilities, alien data collection, and intelligence purposes.

57
00:04:31,540 --> 00:04:35,740
Drones also serve as a powerful asset for SIGINT.

58
00:04:35,860 --> 00:04:36,660
Given the importance of drones, drones can be used as a powerful asset for SIGINT, given

59
00:04:36,660 --> 00:04:36,820
the importance of drones, drones can be used as a powerful asset for SIGINT, given

60
00:04:36,820 --> 00:04:41,900
their ability to gather information, intercept and analyze enemy communications and electronic

61
00:04:41,900 --> 00:04:43,220
signals, and their ability to gather information, intercept and analyze enemy communications

62
00:04:43,220 --> 00:04:48,460
They can access challenging regions, operate continuously for extended periods, and transmit

63
00:04:48,460 --> 00:04:51,420
data in real time for prompt threat response.

64
00:04:52,680 --> 00:04:58,280
Furthermore, they can execute covert missions for high altitudes or using discrete flight

65
00:04:58,280 --> 00:04:58,840
patterns.

66
00:05:00,060 --> 00:05:06,640
Some prevalent anti-drones measures include utilizing thermals and scopes, and a few

67
00:05:06,660 --> 00:05:08,120
standard cameras for shape recognition,

68
00:05:08,860 --> 00:05:12,480
detecting heat emissions for engines and electronics,

69
00:05:12,820 --> 00:05:16,120
analyzing distinct drone noise characteristics,

70
00:05:16,560 --> 00:05:19,320
employing radio frequency and waveform detection,

71
00:05:19,700 --> 00:05:22,640
and identify unique radio signatures.

72
00:05:25,240 --> 00:05:28,280
To counteract detection measures,

73
00:05:28,600 --> 00:05:31,360
operators employ several strategies

74
00:05:32,520 --> 00:05:34,720
like using frequency hopping,

75
00:05:34,720 --> 00:05:40,500
engaging jammers that operate on unconventional frequencies,

76
00:05:41,040 --> 00:05:43,480
implement robust communication protocols,

77
00:05:43,940 --> 00:05:47,320
and so much more, but it's important to highlight

78
00:05:47,320 --> 00:05:49,320
that regardless of the advancement,

79
00:05:49,840 --> 00:05:53,300
no drone can effectively withstand

80
00:05:53,300 --> 00:05:58,260
a direct physical attack like a gunshot or a stun.

81
00:06:00,050 --> 00:06:01,860
Okay, guys, thank you.

82
00:06:06,220 --> 00:06:12,600
So, I want to talk about this type of drone,

83
00:06:12,720 --> 00:06:14,520
drones as war elements.

84
00:06:15,320 --> 00:06:16,940
So, we're going to start,

85
00:06:21,380 --> 00:06:22,620
well, excuse me.

86
00:06:25,580 --> 00:06:28,620
The use of drones for seeing signals,

87
00:06:29,460 --> 00:06:31,100
they are used to collect information,

88
00:06:32,320 --> 00:06:34,480
extend reach to hard access areas,

89
00:06:34,720 --> 00:06:35,560
prolong the operations,

90
00:06:36,340 --> 00:06:39,760
retrieve transmissions as Gab said,

91
00:06:42,360 --> 00:06:44,780
and cover operations for high attitudes

92
00:06:44,780 --> 00:06:46,060
and discreet flight patterns.

93
00:06:46,560 --> 00:06:51,440
So, the typical anti-drones measures

94
00:06:53,980 --> 00:06:54,620
they are

95
00:06:54,620 --> 00:07:00,340
distributed to thermal and standard cameras

96
00:07:00,340 --> 00:07:01,400
for safe detection.

97
00:07:01,660 --> 00:07:04,340
So you detect the drones as,

98
00:07:04,340 --> 00:07:12,980
the shape of the drone. It's like a drone, it must be a drone. Detecting the heat of

99
00:07:12,980 --> 00:07:21,600
the electronics, especially the motors. So you see four spots, four heat spots in the

100
00:07:22,120 --> 00:07:30,960
sky, maybe it's not a pigeon, so it's a drone. So using artificial intelligence or natural

101
00:07:30,960 --> 00:07:40,500
intelligence, maybe. So you can detect those drones simply by seeing them or by sight or by

102
00:07:40,500 --> 00:07:50,840
cameras. Another technique is characterization of drone noise. If it sounds like brrr, it's a

103
00:07:50,840 --> 00:08:00,940
drone. But it's, you know. Also, the most typical way to detect the heat of the electronics is

104
00:08:00,960 --> 00:08:08,800
by radio frequency and waveform detection. So we have here the most important way to detect

105
00:08:08,800 --> 00:08:21,880
a drone and the most cheap also. Just because most drones works with Wi-Fi devices, Wi-Fi

106
00:08:21,880 --> 00:08:30,840
communications. And if we have a Wi-Fi detector, it's not very expensive. So we have to

107
00:08:32,620 --> 00:08:40,660
detect the drones by Wi-Fi characterization. So most of the drones nowadays has the

108
00:08:40,660 --> 00:08:50,920
capability to transmit through Wi-Fi or 2.4 gigahertz and 5. So it's very easy to detect a

109
00:08:50,920 --> 00:08:59,460
drone with this method. And the last one is radio signal. Using SDR devices with the typical

110
00:08:59,460 --> 00:09:00,820
waterfall that went up and down. So it's very easy to detect a drone with this method. And the

111
00:09:00,840 --> 00:09:01,280
most typical way to detect a drone is by radio frequency and waveform detection. So we have to

112
00:09:01,280 --> 00:09:07,160
identify the different kinds of media spaces that we are going to see. So in last DEF CON, I

113
00:09:07,160 --> 00:09:21,880
talked about this topic. The topic is the same as the last one. So the counter measures are

114
00:09:21,880 --> 00:09:30,820
very, very, is the same. Is the frequency hoping? And the unexpected frequencies. So as I

115
00:09:30,840 --> 00:09:43,440
typically police devices state state force devices tries to jam the signal of the drones with the

116
00:09:44,980 --> 00:09:55,780
with jammers using the same fixed frequencies they are the the typical wi-fi jammer and the

117
00:09:55,780 --> 00:10:01,980
five giga gigahertz jammer and they are very constrained to tough frequencies

118
00:10:02,720 --> 00:10:09,700
and the last one is the most funny is the just shoot the drone right

119
00:10:10,680 --> 00:10:19,000
this is the best one but it's the more expensive one and it's not very it's not very subtle

120
00:10:24,540 --> 00:10:24,880
well

121
00:10:27,200 --> 00:10:32,140
i want to explain the evolution of the atropos if you play a starcraft 2

122
00:10:32,960 --> 00:10:43,440
as i am you will know you will not know that's at the banshee atropos is banshee in spain in spanish

123
00:10:43,440 --> 00:10:49,380
so i like i am original right i know

124
00:10:52,260 --> 00:10:52,620
yeah

125
00:10:54,080 --> 00:11:04,660
the atropos is a very very old drone that i made like a decade ago more than a decade

126
00:11:04,660 --> 00:11:14,060
i was young i must i was in my 20s just not to notice that i i'm not still in my 20s so

127
00:11:16,440 --> 00:11:21,080
well it's a it's a homemade router it's a homemade quadcopter

128
00:11:22,620 --> 00:11:28,500
with a wi-fi router it's a it was made when the raspberry pi didn't exist

129
00:11:31,980 --> 00:11:41,400
luckily and when the arduino was starting so i use a microcontroller from microchip

130
00:11:41,760 --> 00:11:52,000
the peak the big one for generate the public udm signal to the motors and the the stabilization unit

131
00:11:52,620 --> 00:12:02,080
is from a y9 chuck and motion plus from nintendo so they are glued inside the drone

132
00:12:02,800 --> 00:12:10,460
without the case obviously yeah so i use i use the the web page of the router

133
00:12:11,940 --> 00:12:19,760
as a as a telemetry console so for control and telemetry of the drone i've used that method so

134
00:12:19,760 --> 00:12:22,440
the first approach to control the drone was

135
00:12:22,620 --> 00:12:29,820
indeed wi-fi so the first the first attack i i suffered in a conference was at the authentication

136
00:12:29,820 --> 00:12:42,560
attack long time ago and so we are here for for from that uh as as years past i was equipped the

137
00:12:43,620 --> 00:12:52,060
the drone with several tools like a wps attack will you bully inside the with all

138
00:12:52,620 --> 00:12:57,180
with extra onboard hardware and so on

139
00:12:59,780 --> 00:13:06,060
so the first approach with this drone is to avoid authentication attacks with using beacon frames

140
00:13:06,760 --> 00:13:15,260
that was the first approximation so just a lateral

141
00:13:18,700 --> 00:13:22,240
just just just another functionality was to

142
00:13:22,620 --> 00:13:29,640
uh inspect all the frames all the beacon frames of the environment so just for second

143
00:13:31,600 --> 00:13:33,220
and to jump to

144
00:13:35,860 --> 00:13:43,780
for distraction so i've always generated a lot of frames of fake drones just to hide the the right

145
00:13:43,780 --> 00:13:44,000
one

146
00:13:48,820 --> 00:13:51,640
so the evolution of the atropos was the

147
00:13:51,640 --> 00:13:59,660
the stage 2, so I decided to make another drone called Interceptor that was presented

148
00:13:59,660 --> 00:14:12,100
here at DEFCON, and maybe I was tired to travel with a big drone, I love the iPods, so I decided

149
00:14:12,100 --> 00:14:23,680
to make a tiny drone like this, just with the same system, with the same system to transmit the

150
00:14:24,190 --> 00:14:36,680
commands. So, the last approximation that I made with this drone was to use FM radio to send the

151
00:14:36,680 --> 00:14:42,080
commands to the drone, just to hide, as a magic trick, the commands to the drone. So, I made a

152
00:14:42,080 --> 00:14:51,280
new method to hide the communications from to the jammers. It was not enough for me, and for us.

153
00:14:53,500 --> 00:15:02,980
So, that was the first approximation, eh I had a USB trainer, it's not a drone command, it's too

154
00:15:02,980 --> 00:15:11,960
expensive. So, I decided to put USE V router to that trainer and to connect to, ehhh, through

155
00:15:11,960 --> 00:15:12,060
the drone.

156
00:15:12,080 --> 00:15:13,880
about the Wi-Fi, standard Wi-Fi.

157
00:15:13,960 --> 00:15:15,040
That was the first approximation.

158
00:15:15,940 --> 00:15:18,580
The second one was to send

159
00:15:20,220 --> 00:15:23,880
forged beacon frames from one router to another.

160
00:15:24,200 --> 00:15:28,560
So, and the authentication attack was not possible here.

161
00:15:29,100 --> 00:15:33,200
So, that was the second approach,

162
00:15:33,500 --> 00:15:37,780
but I'm still vulnerable to jamming Wi-Fi attacks.

163
00:15:40,840 --> 00:15:45,580
Well, the third approximation was with the interceptor.

164
00:15:45,620 --> 00:15:50,160
That is a, it has a two-way communication.

165
00:15:51,080 --> 00:15:55,580
I have, I am able to send the comments

166
00:15:55,580 --> 00:15:59,360
and receive telemetry from the drone using the same system.

167
00:16:03,120 --> 00:16:05,200
That was the last one.

168
00:16:05,280 --> 00:16:06,480
Two are,

169
00:16:07,780 --> 00:16:11,000
redundant system with FM every частay load.

170
00:16:12,000 --> 00:16:15,540
This is used to, for example, with the Raspberry Pi,

171
00:16:15,740 --> 00:16:16,060
you know,

172
00:16:16,640 --> 00:16:18,340
maybe you know that is a Gold

173
00:16:21,080 --> 00:16:22,520
that did use,

174
00:16:22,580 --> 00:16:28,340
a one to generate a FM radio,

175
00:16:28,660 --> 00:16:33,100
so you are able to create your,

176
00:16:33,220 --> 00:16:36,480
your own radio station with its own name.

177
00:16:36,760 --> 00:16:37,760
So, in this scenario, where, like, this is really possible,

178
00:16:37,760 --> 00:16:44,900
In the name of the radar station, it travels the USB commands to the drone.

179
00:16:45,780 --> 00:16:54,080
So you can see the talk, or the several experiments with the interceptor.

180
00:16:58,300 --> 00:17:06,600
That was the AirBDS FM, and I used the AirBDS part.

181
00:17:07,140 --> 00:17:08,980
So the right one.

182
00:17:09,280 --> 00:17:14,680
The audio, the mono audio and the stereo audio just was for fun.

183
00:17:18,960 --> 00:17:22,340
So we reached the stage three.

184
00:17:22,760 --> 00:17:24,000
To the whirlwind.

185
00:17:29,780 --> 00:17:35,680
So the last approach was to control the drone through the arbitrary frequency generation.

186
00:17:36,340 --> 00:17:39,160
So how can we do that?

187
00:17:42,820 --> 00:17:45,840
We generate a custom frequency.

188
00:17:46,320 --> 00:17:51,780
So the drone receives that frequency throughout SDR software-defined radio.

189
00:17:54,900 --> 00:18:04,420
And the last one, I'm able to change the frequency dynamically from the transmitter to the receiver.

190
00:18:07,600 --> 00:18:08,520
So.

191
00:18:08,920 --> 00:18:11,660
This is the current approach.

192
00:18:12,120 --> 00:18:14,600
I use a V-Core 2.

193
00:18:14,800 --> 00:18:19,240
It's a teeny board of OpenWRT.

194
00:18:20,520 --> 00:18:21,760
So that's the data.

195
00:18:21,760 --> 00:18:34,940
So, I use the USB with the same metal, so I generate through I2S bus and to ASK modulation,

196
00:18:35,460 --> 00:18:36,360
I'm going to explain that.

197
00:18:36,740 --> 00:18:46,700
So with SDR dongle on board the drone, I can receive that command in an arbitrary frequency.

198
00:18:46,700 --> 00:18:53,340
So, no police guns works with this.

199
00:19:08,400 --> 00:19:10,920
So what this is practice spectrum.

200
00:19:11,280 --> 00:19:13,620
Practice spectrum is a modulation.

201
00:19:14,060 --> 00:19:14,760
Uh.

202
00:19:17,920 --> 00:19:31,100
That I'm able to change the frequency very fast to disturb any metal to receive a jammer.

203
00:19:31,240 --> 00:19:39,160
So the jammer doesn't know what's the next frequency that I'm going to use.

204
00:19:39,420 --> 00:19:42,940
So the jammer is useless in this case.

205
00:19:43,080 --> 00:19:43,440
Okay.

206
00:19:44,720 --> 00:19:48,680
May I use the chip explanation?

207
00:19:50,600 --> 00:19:51,540
Excuse me?

208
00:19:53,180 --> 00:19:53,980
Oh.

209
00:19:54,220 --> 00:19:59,460
Spread spectrum is a modulation technique that broadens the signal across a frequency

210
00:19:59,460 --> 00:20:02,480
band much wider than the original information requires.

211
00:20:03,160 --> 00:20:08,760
By employing spread spectrum, resistance to noise and interference is enhanced.

212
00:20:09,340 --> 00:20:13,320
This is because the signal is spread over a broader spectrum.

213
00:20:13,320 --> 00:20:13,420
This is because the signal is spread over a broader spectrum.

214
00:20:13,440 --> 00:20:18,820
And can more effectively manage noise concentrated at a particular frequency.

215
00:20:21,000 --> 00:20:25,320
Um, there's two key terms inside the spread spectrum.

216
00:20:25,860 --> 00:20:31,120
First, the FHSS, which stands for frequency hoping spread spectrum.

217
00:20:31,340 --> 00:20:36,540
And second, DSSS, an acronym from direct sequence spread spectrum.

218
00:20:36,840 --> 00:20:42,940
We credit the remarkable innovation of the spread spectrum to Hedy Lamarr, not just a

219
00:20:42,940 --> 00:20:50,160
Hollywood actress, but also a brilliant inventor, in collaboration with George Amstel, the

220
00:20:50,160 --> 00:20:53,040
pioneer of the spread spectrum system.

221
00:20:53,340 --> 00:20:59,840
Contrary to popular belief, while Lamarr didn't invent Wi-Fi, their work laid the

222
00:20:59,840 --> 00:21:03,660
groundwork for today's Wi-Fi, CDMA, and Bluetooth technology.

223
00:21:04,640 --> 00:21:05,520
Go ahead.

224
00:21:09,760 --> 00:21:12,840
So, uh, the frequency hoping spread spectrum.

225
00:21:12,840 --> 00:21:12,920
So, uh, the frequency hoping spread spectrum.

226
00:21:12,920 --> 00:21:15,260
Uh, the frequency hoping spread spectrum is, is the technique, uh, that we use here.

227
00:21:16,480 --> 00:21:25,960
So, uh, we generate the, the signal by toggling, uh, a general purpose input-output pin of

228
00:21:25,960 --> 00:21:26,780
the vCore.

229
00:21:26,860 --> 00:21:31,920
That is, uh, that this is on board of the I2S, uh, bus.

230
00:21:33,520 --> 00:21:41,600
So if we, if we toggle the pin very fast, we can generate, uh, a radio signal if, if

231
00:21:41,600 --> 00:21:42,240
we solder.

232
00:21:42,240 --> 00:21:47,100
Uh, wire in that pin, uh, we have an antenna.

233
00:21:47,460 --> 00:21:53,920
So you, you have, uh, a more, uh, a raw modulation of that, of that signal.

234
00:21:54,120 --> 00:22:02,300
So if you change the frequency of that toggling, you, uh, can transmit in a lot of, in, in

235
00:22:02,300 --> 00:22:07,080
an arbitrary frequency to, uh, to control the drone.

236
00:22:07,260 --> 00:22:11,160
So this technique use the frequency hoping spread spectrum.

237
00:22:12,240 --> 00:22:18,060
So I transmit a message with, uh, with a given signal, with a given frequency, and

238
00:22:18,060 --> 00:22:21,700
the next, uh, message is transmitted with another frequency.

239
00:22:21,980 --> 00:22:23,160
That is arbitrary.

240
00:22:23,420 --> 00:22:27,620
It's, uh, pre-established, uh, between the transmitter and the receiver.

241
00:22:30,640 --> 00:22:38,100
So this is, uh, this is, uh, a combination of techniques, uh, starting from, uh, have

242
00:22:38,100 --> 00:22:39,360
you heard about Tempest?

243
00:22:39,620 --> 00:22:42,100
So is, this is the same technique.

244
00:22:42,240 --> 00:22:44,540
But changing the frequency constantly.

245
00:22:45,180 --> 00:22:52,980
So will it, will it be possible with, uh, uh, 15 bucks, uh, board instead of a Raspberry

246
00:22:52,980 --> 00:22:53,300
Pi?

247
00:22:53,460 --> 00:22:57,960
Like the MT7628, uh, chipset?

248
00:22:58,320 --> 00:22:59,000
Maybe.

249
00:22:59,800 --> 00:23:00,800
Hold my beer.

250
00:23:03,620 --> 00:23:06,240
So what is the I2C bus?

251
00:23:06,580 --> 00:23:12,220
The I2C bus is, it's not the I, the I2, the I2S bus.

252
00:23:12,220 --> 00:23:13,120
Excuse me.

253
00:23:13,460 --> 00:23:15,100
It's not the I2C bus.

254
00:23:16,740 --> 00:23:22,860
Uh, the I2S bus is used to transmit and receive, uh, digital audio.

255
00:23:23,360 --> 00:23:28,340
But we are not using, uh, this bus, uh, for that here.

256
00:23:30,160 --> 00:23:32,120
So we have two wires.

257
00:23:32,600 --> 00:23:41,840
Uh, one wire is a clock pine, is a clock pin, and, uh, we, we have, uh, uh, uh, uh, data

258
00:23:41,840 --> 00:23:43,760
transmission and a data receiving.

259
00:23:44,240 --> 00:23:48,180
We, we, we're not, we're not to use the, the receiving data.

260
00:23:48,560 --> 00:23:52,320
So we only, we only use the clock pin for the moment.

261
00:23:52,560 --> 00:23:54,140
So what is the clock pin?

262
00:23:54,320 --> 00:23:56,800
The, the only one that is toggling constantly.

263
00:23:57,260 --> 00:24:00,280
So this is the, this is the method.

264
00:24:03,620 --> 00:24:10,600
Well, if, if we see the, the data sheet of the Mediatek, uh, MT7628.

265
00:24:10,600 --> 00:24:18,720
We see, uh, where, where, uh, what address, uh, we found, uh, the device, the I2S device.

266
00:24:19,080 --> 00:24:27,720
So we can write directly, uh, to the, the registers to, uh, turn on and off the clock,

267
00:24:27,760 --> 00:24:29,080
uh, the clock pin.

268
00:24:31,760 --> 00:24:38,720
So this is the clock plan of the, of the SOC, and we have, uh, a primary clock that, and

269
00:24:38,720 --> 00:24:39,820
we can, uh.

270
00:24:40,680 --> 00:24:47,080
We, we can, uh, lower the frequency of that pin by, uh, configuring the clock dividers.

271
00:24:47,240 --> 00:24:53,200
So by configuring the clock dividers, uh, we, uh, we are able to change the frequency

272
00:24:53,200 --> 00:24:55,020
constantly and seamlessly.

273
00:24:59,100 --> 00:25:08,200
So, uh, we have to config, uh, we have to set up our I2S, uh, device like we are, uh,

274
00:25:08,380 --> 00:25:09,420
with a new driver.

275
00:25:09,420 --> 00:25:16,940
So, uh, with this project, it's a new driver, uh, to, uh, to the I2S, uh, device for this

276
00:25:16,940 --> 00:25:26,720
chipset that, uh, enables the I2C, uh, bus, but, uh, what I'm doing here is, uh, to enable

277
00:25:26,720 --> 00:25:35,260
and disable the clock constantly to generate, uh, high-level and low-level, uh, modulation.

278
00:25:36,900 --> 00:25:39,400
And, uh, when I, when I want to change the clock, uh, I, uh, I, uh, I, uh, I, uh, I,

279
00:25:39,420 --> 00:25:39,920
uh, change the weight.

280
00:25:40,240 --> 00:25:44,260
so I, I changes the last one, theCome, Config.

281
00:25:45,860 --> 00:25:51,840
So, uh, uh, we gonna choose a very wide set of frequencies.

282
00:25:51,840 --> 00:26:03,440
frequencies. So, if I turn on the clock, I, I am transmitting in a frequency, right? Uh,

283
00:26:03,580 --> 00:26:09,340
configured by the, uh, clock dividers. So, if I turn on, I am transmitting in that

284
00:26:09,340 --> 00:26:15,620
frequency, and if I turn off, I'm not transmitting. So, the most simple, uh,

285
00:26:15,620 --> 00:26:23,440
uh, modulation is to amplitude shift gauging. It's the same like, uh, garage doors, uh,

286
00:26:23,520 --> 00:26:33,120
remotes, and so on. But, here, I'm, uh, creating the modulation, uh, just turning on and down the

287
00:26:33,120 --> 00:26:40,760
clock of the bus. So, if I, if I want to transmit one, zero, one, one, zero, I want to turn

288
00:26:40,760 --> 00:26:45,600
on and off the clock. And I even see, and I, I, I even see frequency. So, if I, if I want to

289
00:26:45,620 --> 00:26:50,500
transmit one, zero, one, zero, I want to transmit frequency. So, how to receive that? In the, in

290
00:26:50,500 --> 00:27:00,780
the drone, uh, side, we can, uh, use our S, SDR USB to, uh, receive that, uh, uh, modulation.

291
00:27:05,000 --> 00:27:14,860
So, if I, if we tune the, the SDR in that frequency, we received all, uh, each packet, uh,

292
00:27:15,620 --> 00:27:23,360
like, we, we see each packet like a high blue bar. So, that's, uh, one command of the drone,

293
00:27:23,520 --> 00:27:32,120
of the transmitter, transmitting to the drone. So, this is the rock command, uh, seen by, uh,

294
00:27:32,500 --> 00:27:42,880
amplitude, uh, as the, the receiver receives that packet. So, we have a preamble here, just to,

295
00:27:42,880 --> 00:27:45,600
to, to tell the, the receiver, uh, to, to, to, to, to, to, to, to, to, to, to, to, to, to, to, to, to, to,

296
00:27:45,620 --> 00:27:52,520
that, this is a valid packet. So, the receiver has tea, uh, starts recording all the IQ values

297
00:27:52,520 --> 00:28:04,020
from SDR. And, uh, it, uh, decodes, uh, if, if it's in the high level or low level two

298
00:28:04,020 --> 00:28:15,040
decode, the binary, the binary transmission. So, how the works. And, it's an extra poured

299
00:28:15,040 --> 00:28:25,120
a board of the drone that accepts bitstream from the device from the file system so it modulates

300
00:28:26,000 --> 00:28:40,440
2sk and the ads and crc8 by two timers i have two timers here one timer is triggered every packet

301
00:28:40,440 --> 00:28:49,460
and one and the other one is triggered in every symbol so we have one timer one timer up down up

302
00:28:49,460 --> 00:28:59,860
down up down up down on each symbol and i have a timer up down up down on each packet so i can

303
00:28:59,860 --> 00:29:06,460
transmit the symbols in a very specific time and every symbol in a very specific time

304
00:29:10,440 --> 00:29:20,440
so the receiver is another vcore attached to an sdr dongle that this receives in that frequency the

305
00:29:20,440 --> 00:29:28,660
all the all the data from the sdr and how i did it by from constant

306
00:29:31,090 --> 00:29:39,520
well this is made entirely in c no python here sorry so

307
00:29:40,440 --> 00:29:45,140
to receive the data i i change the frequency constantly

308
00:29:46,880 --> 00:29:54,760
to receive the commands so i have to use the live isdr library that is the same that use

309
00:29:56,600 --> 00:30:02,300
rtls tcp and so on so i have to to make my own program

310
00:30:02,300 --> 00:30:09,640
i have to i have to program my own driver to transmit and i have to to do my own program to

311
00:30:11,120 --> 00:30:14,180
to last collect the data and get that information so let's see in this in this

312
00:30:14,180 --> 00:30:22,000
approximation i have a list of frequencies right so the transmitter transmit one packet

313
00:30:22,000 --> 00:30:30,520
in in one frequency and change the to the next frequency so the receiver has to synchronize

314
00:30:30,520 --> 00:30:35,140
have to find the first packet in in

315
00:30:35,140 --> 00:30:37,160
in a given frequency so

316
00:30:38,680 --> 00:30:40,420
if if both sides made samerence whenever theины villas i know plus and minus five by three on there the other answer uh is zero people this transmакти at least one packet in one frequent and change it into the another frequency so the receiver has to synchronize the receiver has to find the first packet in in in in a given frequency so if the receiver has to synchronize the first packet in in given frequency so if both sides 동 coll recommendation of important pl atr avec dcsالcher smacoo i have four systems you have to consider is.

317
00:30:40,440 --> 00:30:50,060
have the list of the frequencies the receiver knows where is in the what step in the in the

318
00:30:50,060 --> 00:31:01,240
list of the frequencies is currently so the receiver is able to continue to change the

319
00:31:01,240 --> 00:31:12,840
frequency taking account at least so for this setup i decide to to make our own transmitter

320
00:31:21,440 --> 00:31:26,160
this is a pcb board with a custom

321
00:31:28,020 --> 00:31:30,800
controller so with with the typical

322
00:31:31,240 --> 00:31:34,460
joysticks of the drone so using the v core

323
00:31:36,380 --> 00:31:47,840
we attach a linear amplifier to make some much more noise that is that makes the v core itself

324
00:31:51,740 --> 00:31:57,940
so this is this is the transmitter so this part is the antenna attached to

325
00:31:57,940 --> 00:32:01,120
the i2s gpo

326
00:32:04,600 --> 00:32:06,160
that is a peak

327
00:32:09,620 --> 00:32:12,620
so hope how we generate

328
00:32:27,480 --> 00:32:31,160
well as you see i can transmit

329
00:32:31,240 --> 00:32:39,620
in a in a very wide range of frequencies i make this demo in my house in spain because

330
00:32:39,620 --> 00:32:47,140
as you see i'm transmitting with the frequency military air so

331
00:32:47,140 --> 00:32:56,080
if i go to prison i like to go to the spanish prison just to let my mom to bring me cigarettes

332
00:33:02,180 --> 00:33:09,340
so if you if you see that uh this is the difference between the b core with with without

333
00:33:09,340 --> 00:33:15,560
the amplifier at with the amplifier so there is big difference right

334
00:33:18,240 --> 00:33:26,860
it's it's up and down is one packet right and as you see i i zoom out as you see i'm transmitting

335
00:33:26,860 --> 00:33:27,540
but

336
00:33:31,240 --> 00:33:32,440
let's let's see again

337
00:33:47,560 --> 00:33:52,540
well you see two signals here because the spread spectrum

338
00:33:53,080 --> 00:33:59,520
is transmitting in that frequency and this changing to the to the to a neighbor frequency

339
00:33:59,520 --> 00:34:09,500
frequency. This is a demo just to demonstrate that the transmitter jumps from one frequency

340
00:34:09,500 --> 00:34:17,980
to another. Well, I am able to jump in a very wide area, in a very wide range of frequencies

341
00:34:17,980 --> 00:34:34,940
that are very far from each other. So, from a jammer, this is a nightmare. Indeed, we can skip

342
00:34:34,940 --> 00:34:44,420
the frequency hopping technique and simply transmitting with a fixed frequency, but unexpected

343
00:34:44,420 --> 00:34:47,960
by the jammers. So, it's much more difficult.

344
00:34:47,980 --> 00:34:55,300
Reliable and the transmitter doesn't have to jump from one frequency to another, but because it

345
00:34:55,300 --> 00:35:05,180
takes time for the chip. The SDR dongle is very cheap, 20 bucks, and it takes time to change the

346
00:35:05,180 --> 00:35:15,820
tuning frequency from one frequency to another. So, we can use simply this frequency and almost

347
00:35:15,820 --> 00:35:17,960
no jammer will take it.

348
00:35:17,980 --> 00:35:24,780
I want to share about this, because what about I am transmitting in military frequency and the jammer

349
00:35:24,780 --> 00:35:32,600
tries to jam my own drone, jamming indeed military frequencies, right?

350
00:35:43,440 --> 00:35:46,040
This is the web page of the drone.

351
00:35:49,640 --> 00:36:06,180
So, I still using a Wi-Fi transmission as a primary method. So, I use this modulation as a fallback.

352
00:36:08,140 --> 00:36:17,620
So, the receiver decides which command use. If the receiver receives a Wi-Fi command, it use them.

353
00:36:17,980 --> 00:36:26,820
But if the Wi-Fi doesn't work, the receiver uses the alternative method.

354
00:36:32,700 --> 00:36:39,420
So, the last one is to demonstrate that the drone flies indeed.

355
00:36:45,980 --> 00:36:49,420
Please don't kill anyone, please don't kill anyone.

356
00:37:31,540 --> 00:37:32,940
.

357
00:37:34,820 --> 00:37:37,080
So, maybe...

358
00:37:37,080 --> 00:37:38,320
I...

359
00:37:39,420 --> 00:37:41,920
I'm not allowed to fly the drone here, sadly.

360
00:37:47,000 --> 00:37:48,760
I don't know what...

361
00:37:49,280 --> 00:37:51,720
But the drone killed very few people.

362
00:37:54,340 --> 00:37:55,760
Like, only three people.

363
00:38:02,340 --> 00:38:06,260
As you see, it's an outside drone.

364
00:38:06,540 --> 00:38:08,000
It's not an inside drone.

365
00:38:08,000 --> 00:38:10,780
But let's make a little noise, right?

366
00:38:10,960 --> 00:38:11,960
Just to...

367
00:38:12,760 --> 00:38:13,680
Just to make noise.

368
00:38:17,360 --> 00:38:17,960
.

369
00:38:43,820 --> 00:38:43,860
.

370
00:38:43,860 --> 00:38:43,880
.

371
00:38:43,880 --> 00:38:43,900
.

372
00:38:43,900 --> 00:38:43,920
.

373
00:38:43,980 --> 00:38:44,020
.

374
00:38:44,020 --> 00:38:44,620
.

375
00:38:46,220 --> 00:38:47,420
.

376
00:38:47,420 --> 00:38:47,520
.

377
00:38:47,520 --> 00:38:47,720
.

378
00:38:47,720 --> 00:38:48,700
.

379
00:38:48,700 --> 00:38:49,360
.

380
00:38:50,620 --> 00:38:51,220
.

381
00:38:51,820 --> 00:38:51,840
.

382
00:38:51,840 --> 00:38:51,940
.

383
00:38:56,380 --> 00:38:57,580
.

384
00:38:57,580 --> 00:38:57,600
.

385
00:38:57,600 --> 00:38:57,620
.

386
00:39:01,480 --> 00:39:02,680
.

387
00:39:24,660 --> 00:39:27,260
It's too far.

388
00:40:01,080 --> 00:40:02,660
It's too far.

389
00:40:16,920 --> 00:40:17,440
It's too far.

390
00:40:36,240 --> 00:40:51,820
Well, it's jumping, but if you slow motion the video, you can see flying, but seriously,

391
00:40:51,960 --> 00:40:57,120
guys, I know what I'm doing, not flying it, right?

392
00:41:00,220 --> 00:41:02,560
So we are fine with the time?

393
00:41:11,440 --> 00:41:18,240
Okay, so thank you for coming here, and if you have any questions, we will be glad to

394
00:41:18,240 --> 00:41:19,060
answer it.

395
00:41:19,200 --> 00:41:20,020
Thank you very much.