Events – Daniel Estévez

Analysis of the CAMRAS Venus radar experiment

On March 22, CAMRAS performed a Venus radar experiment (or Earth-Venus-Earth bounce, as it is more commonly known in Amateur radio) in collaboration with Astropeiler Stockert, the Deep Space Exploration Society, and the Open Research Institute. The experiment was done in L-band, at 1299.5 MHz, using the 25 m Dwingeloo radiotelescope as transmitter and receiver and the Stockert 25 m telescope as a receiver. The experiment was done during the Venus conjunction, as this minimizes the distance between the Earth and Venus. The round-trip time to Venus was approximately 280 seconds. The radar waveform was a CW carrier with a duration of 278 seconds. It was transmitted a total of 4 times every 600 seconds. Thus each period was composed by:

278 second transmission
~2 second TX/RX guard time
278 second echo reception
~42 second wait

More transmissions were planned, including some spread-spectrum signals designed by the Open Research Institute. However, the transmitter started failing and they had to stop.

Update 2025-04-21: I have been informed that the spread-spectrum signal for this experiment was designed by CAMRAS. The waveform that the Open Research Institute is designing will potentially be used in future experiments.

CAMRAS has published an analysis of the recorded IQ data, showing successful echo detections with Dwingeloo and Stockert. There is an example Jupyter notebook that shows how to Doppler correct the echo and detect it with an FFT. All the recorded IQ data has been published.

In this post I will do my own analysis of the experiment. The goal is not to confirm the successful detection with an independent analysis, since I believe that the analysis published by CAMRAS is correct and leaves no doubt about this. It is to expand this analysis and to touch on other topics that this analysis has not covered:

Calculation of the Doppler. CAMRAS has published CSV files containing the expected Doppler at each receiver, but they have not published the code to calculate this. Here I will do all the relevant calculations with SPICE.
Doppler correction with the gr-satellites Doppler correction block, which performs linear interpolation of the Doppler frequency to calculate the frequency shift applied to each sample.
High-quality spectral analysis with a polyphase filterbank.
Try to estimate the Doppler spread and compare with some results in the literature.

BGM-1 Doppler during the lunar landing

On Sunday March 2, Firefly Aerospace’s Blue Ghost Mission 1 successfully landed on Mare Crisium, becoming the first NASA CLPS mission to perform a fully successful lunar landing. Congratulations to all the team at Firefly for this huge achievement.

Both AMSAT-DL and CAMRAS covered this event live, by receiving the S-band beacon from the lander with the 20 m antenna in Bochum Observatory and the 25 m Dwingeloo radiotelescope respectively, and streaming the waterfall of the signal in YouTube.

In this post I do a quick analysis of the Doppler of the signal received at Bochum and Dwingeloo. Part of the goal of this is to try to answer a question of Jonathan McDowell, who asked if it was possible to determine the exact second of the touchdown from this data. The answer is that this is probably not possible, since for a soft touchdown there is no significant acceleration at touchdown that can be identified in the Doppler curve.

The raw IQ data recorded by AMSAT-DL is not publicly available. The data recorded by CAMRAS can be found here.

Tianwen-1 second apoapsis raise

Some weeks ago I reported about an apoapsis raise manoeuvre done by Tianwen-1, the Chinese Mars orbiter. This has now happened again. Using state vectors from the telemetry decoded with the 20 m antenna in Bochum observatory by AMSAT-DL, we have detected an apoapsis raise manoeuvre done on 2025-01-08. This new apoapsis raise is much larger than the previous one. I have done the same kind of calculations as in the previous post, and also corrected a bug in my Keplerian elements plots (the periapsis and apoapsis passings were being paired incorrectly, which caused the SMA and eccentricity not to change in the plots I did in the previous post).

Tianwen-1 apoapsis raise

For a long time, AMSAT-DL has been using the 20 meter antenna in Bochum observatory to receive some telemetry from Tianwen-1, the Chinese Mars orbiter, almost daily. Since the telemetry includes the spacecraft’s state vectors, we can use this to monitor the spacecraft’s orbit. In 8 November 2021, Tianwen-1 entered its remote sensing orbit. This is an elliptical orbit with a period approximately 2/7 Mars sidereal days plus 170 seconds. This causes a ground track that is almost repeating, but drifts slowly to cover all the surface area of the planet.

I have been posting yearly updates about Tianwen-1’s orbit, the last of them this summer. In these updates, we can see that no manoeuvres have happened, and the changes in the Keplerian elements correspond to orbital perturbations caused by external forces. The orbit is in fact designed to cause the latitude of the periapsis to precess. In this way, all the surface of Mars can be scanned from low altitude.

Now we have some news. In the telemetry of the last few days we have detected that Tianwen-1 has raised its apoapsis radius from about 14134 km to 14489 km. All the data we have indicates that a propulsive burn has happened recently. In this post I give the details about this apoapsis raise manoeuvre.

Not-LoRa GRCon24 CTF challenge

This year I submitted a track of challenges called “Not-LoRa” to the GRCon 2024 Capture The Flag. The idea driving this challenge was to take some analog voice signals and apply chirp spread spectrum modulation to them. Solving the challenge would require the participants to identify the chirp parameters and dechirp the signal. This idea also provided the possibility of hiding weak signals that are below the noise floor until they are dechirped, which is a good way to add harder flags. This blog post is an in-depth explanation of the challenge. I have put the materials for this challenge in this Github repository.

To give participants a context they might already be familiar with, I took the chirp spread spectrum parameters from several common LoRa modulations. These ended up being 125 kHz SF9, SF11 and SF7. LoRa is somewhat popular within the open source SDR community, and often there are LoRa challenges or talks in GRCon. This year was no exception, with a Meshtastic packet in the Signal Identification 7 challenge, and talks about gr-lora_sdr and Meshtastic_SDR.

Trying to decode LEV-1

LEV-1 is a small lunar hopper that was carried by the SLIM lunar lander. It was released a few metres above the surface on January 19, as part of the lunar landing of SLIM. LEV-1 transmits telemetry in the 435 MHz amateur satellite band (it has an IARU satellite coordination approval), and also in S-band. Shortly after the landing, CAMRAS received the 437.410 MHz signal from LEV-1 using the 25 m radiotelescope at Dwingeloo. They have published a couple of IQ recordings in their directory of miscellaneous recordings (see the filenames starting by slim_).

The information about the telemetry signal of LEV-1 is scarce. Its website just says

Telemetry format of LEV-1 stands on CCSDS. The contents of telemetry are under developing.

The IARU coordination sheet contains other clues, such as the mention of PCM/PSK/PM, CW, and bitrates of 31, 31.25 and 32 bps, but not much else. Regardless of the mention of CCSDS, I have found that the signal from LEV-1 is quite peculiar. This post is an account of my attempt to decode the data.

BSRC REU GNU Radio tutorial recordings

Since 2021 I have been collaborating with the Berkeley SETI Research Center Breakthrough Listen Summer Undergraduate Research Experience program by giving some GNU Radio tutorials. This year, the tutorials have been recorded and they are now available in the BSRC Tech YouTube channel (actually they have been there since the end of August, but I only realized just now).

These tutorials are intended as an introduction to GNU Radio and SDR in general, focusing on topics and techniques that are related or applicable to SETI and radio astronomy. They don’t assume much previous background, so they can also be useful for GNU Radio beginners outside of SETI. Although each tutorial builds up on concepts introduced in previous tutorials, their topics are reasonably independent, so if you have some background in SDR you can watch them in any order.

All the GNU Radio flowgraphs and other materials that I used are available in the daniestevez/reu-2023 Github repository. Below is a short summary of each of the tutorials.

DVB-S2 GRCon23 CTF challenge

This year I submitted a challenge track based around a DVB-S2 signal to the GRCon CTF (see this post for the challenges I sent in 2022). The challenge description was the following.

I was scanning some Astra satellites and found this interesting signal. I tried to receive it with my MiniTiouner, but it didn’t work great. Maybe you can do better?

Note: This challenge has multiple parts, which can be solved in any order. The flag format is flag{...}.

A single SigMF recording with a DVB-S2 signal sampled at 2 Msps at a carrier frequency of 11.723 GHz was given for the 10 flags of the track. The description and frequency were just some irrelevant fake backstory to introduce the challenge, although some people tried to look online for transponders on Astra satellites at this frequency.

The challenge was inspired by last year’s NTSC challenge by Clayton Smith (argilo), which I described in my last year’s post. This DVB-S2 challenge was intended as a challenge with many flags that can be solved in any order and that try to showcase many different places where one might sensibly put a flag in a DVB-S2 signal (by sensibly I mean a place that is actually intended to transmit some information; surely it is also possible to inject flags into headers, padding, and the likes, but I didn’t want to do that). In this sense, the DVB-S2 challenge was a spiritual successor to the NTSC challenge, using a digital and modern TV signal.

Another source of motivation was one of last year’s Dune challenges by muad’dib, which used a DVB-S2 Blockstream Satellite signal. In that case demodulating the signal was mostly straightforward, and the fun began once you had the transport stream. In my challenge I wanted to have participants deal with the structure of a DVB-S2 signal and maybe need to pull out the ETSI documentation as a help.

I wanted to have flags of progressively increasing difficulty, keeping some of the flags relatively easy and accessible to most people (in any case it’s a DVB-S2 signal, so at least you need to know which software tools can be used it to decode it and take some time to set them up correctly). This makes a lot of sense for a challenge with many flags, and in hindsight most of the challenges I sent last year were quite difficult, so I wanted to have several easier flags this time. I think I managed well in this respect. The challenge had 10 flags, numbered more or less in order of increasing difficulty. Flags #1 through #8 were solved by between 7 and 11 teams, except for flag #4, which was somewhat more difficult and only got 6 solves. Flags #9 and #10 were significantly more difficult than the rest. Vlad, from the Caliola Engineering LLC team, was the only person that managed to get flag #10, using a couple of hints I gave, and no one solved flag #9.

When I started designing the challenge, I knew I wanted to use most of the DVB-S2 signal bandwidth to send a regular transport stream video. There are plenty of ways of putting flags in video (a steady image, single frames, audio tracks, subtitles…), so this would be close to the way that people normally deal with DVB-S2, and give opportunities for many easier flags. I also wanted to put in some GSE with IP packets to show that DVB-S2 can also be used to transmit network traffic instead of or in addition to video. Finally, I wanted to use some of the more fancy features of DVB-S2 such as adaptive modulation and coding for the harder flags.

To ensure that the DVB-S2 signal that I prepared was not too hard to decode (since I was putting more things in addition to a regular transport stream), I kept constantly testing my signal during the design. I mostly used a Minitiouner, since perhaps some people would use hardware decoders. I heard that some people did last year’s NTSC challenge by playing back the signal into their hotel TVs with an SDR, and for DVB-S2 maybe the same would be possible. Hardware decoders tend to be more picky and less flexible. I also tested gr-dvbs2rx and leandvb to have an idea of how the challenge could be solved with the software tools that were more likely to be used.

What I found, as I will explain below in more detail, is that the initial way in which I intended to construct the signal (which was actually the proper way) was unfeasible for the challenge, because the Minitiouner would completely choke with it. I also found important limitations with the software decoders. Basically they would do some weird things when the signal was not 100% a regular transport stream video, because other cases were never considered or tested too thoroughly. Still, the problems didn’t get too much in the way of getting the video with the easier flags, and I found clever ways of getting around the limitations of gr-dvbs2rx and leandvb to get the more difficult flags, so I decided that this was appropriate for the challenge.

In the rest of this post I explain how I put together the signal, the design choices I made, and sketch some possible ways to solve it.

Blockstream Satellite: decoding Bitcoin transactions

In my previous post I wrote about the protocols used by Blockstream Satellite. This was motivated by a challenge in GRCon22’s CTF. In that challenge, muad’dib sent the flag as a Blockstream API message and recorded the Blockstream Satellite DVB-S2 downlink as the message was broadcast. The recording was used as the IQ file for the challenge.

In my post, I gave a look at how all the protocol stack for the Blockstream API works: DVB-S2, MPE, IPv4, UDP, plus a custom protocol that supports fragmentation and application-level FEC. However, I didn’t give any details about how the protocols used to broadcast the Bitcoin blockchain work. This runs on another UDP port, independently of the Blockstream API. At that time I didn’t understand much about it, even though during the CTF I was trying to search for the flag in a Bitcoin transaction and looking at the source code of bitcoinsatellite to try to figure out how it worked.

After my previous post, Igor Freire commented some details of the FEC used in bitcoinsatellite. This is quite interesting by itself. Two FEC libraries by Chris Taylor are used: the Wirehair O(N) fountain code for larger blocks, and the CM256 MDS code based on Cauchy matrices over GF(256) (this is very similar to Reed-Solomon used as erasure coding). This motivated me to continue studying how all this works.

Now I have been able decode the Bitcoin transactions in the CTF recording. These don’t use any FEC, since transactions are small. I believe that there aren’t any blocks fully contained in the 35 second recording, so to see how the FEC codes work (which could be quite interesting) I would need a longer recording.

In this post I’ll show how to decode the Bitcoin transaction in Blockstream Satellite. The materials can be found in this repository.

Anatomy of Blockstream Satellite

This is another post about GRCon22’s Capture The Flag (see my previous post). One of the challenges in the Dune track submitted by muad’dib was called Heighliner. It consisted of a short recording of Blockstream Satellite, as we might guess from the challenge description below, especially if we had watched Igor Freire‘s talk about gr-dvbs2rx and Blockstream Satellite (I’ve heard that the fact that the talk and the challenge had the same topic was just a coincidence).

A heighliner just passed through “folded space” and it has sent a secret message to the remaining members of House Atreides on the surface of Arrakis. The communication protocol was historically used for sending visual propaganda films and archival files, recently however, Duke Leto had his engineering guild repurpose the transmission unit for financial transactions. It’s the perfect place for a covert message, the Harkonnens would never think to look there… The original transmission was on Frequency 12.0164GHz. Our groundstation receiver downconverted to 1.2664GHz.
Heighliner challenge description

I didn’t manage to solve this challenge, mainly because I was looking in the wrong place. I was focused on looking at the Bitcoin blockchain chunks, but the flag was in a Blockstream Satellite API message, and I wasn’t aware of the existence of API messages back then. After the CTF ended, a few of us were discussing this challenge in the chat. None of us really understood all the details about how the Blockstream Satellite system works. Since the intended way of solving the challenge was setting up and running the Blockstream Satellite receiver tools, an in-depth understanding wasn’t really necessary.

I have some interest in satellite filecasting systems since I reverse-engineered Outernet back in 2016, so I’ve been taking some time after the CTF to look at the details of how Blockstream Satellite works. While attempting to solve the challenge, I found that detailed enough documentation wasn’t available. There is some high-level documentation, but for the details you need to go to the source code (which is a typical situation).

In this post I describe the details of how Blockstream Satellite works, using the recording from the CTF challenge as an example. I will mainly focus on the Blockstream Satellite API, since I haven’t been able to understand all the details of the Bitcoin blockchain FEC blocks.