TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Show HN: I reverse engineered my cable modem and turned it into an SDR

357 pointsby 0x00000000over 4 years ago

27 comments

Scoundrellerover 4 years ago
&gt; I chose to overcome this by heating the VCC pin with my soldering iron and very carefully lifting it off the pad. This is a convenient, but rather crude solution which may result in snapped off leads so use at your own risk!<p>If that mishap on an SOIC chip occurs, don’t fret, you can usually shave off a bit of the plastic and get enough pin surface to solder a jumper to VCC.<p>An alternate method is to follow the VCC trace and cut it, then solder your own wire to the unlifted lead and a nearby capacitor with a switch. Beware that you might power more than the chip if the trace continues, but that’s usually fine. Sometimes this is a good thing because you still power pull-up resistors.<p>Yet another option is to place a glob of solder across 4 pins, heat them all up, and lift half the chip. The other 4 legs will be hot and soft enough to bend easily.<p><i>Finally</i> for the non-VCC connections, could follow the traces and find easier places to solder to rather than a bunch of side-by-side leads.
评论 #24725805 未加载
Scoundrellerover 4 years ago
&gt; Found image 1 at offset 20000<p>&gt; Enter &#x27;1&#x27;, &#x27;2&#x27;, or &#x27;p&#x27; within 2 seconds or take default...<p>Wait, tens or hundreds of millions of cable modem startups are delayed by 2s on each start just in case somebody has soldered up a serial interface and wants to load a different image?
评论 #24725906 未加载
评论 #24725149 未加载
评论 #24725191 未加载
评论 #24725448 未加载
0xCMPover 4 years ago
I only recently understood that my Coax cables are basically like an RF spectrum similar to Wifi except inside the cables. It appears this is taken as obvious because I had a really hard time finding someone explain it like that.<p>I bought these boxes which use the Coax at very high frequencies to do Ethernet between sides of my house using MoCa which is used by TiVos and newer set top boxes. I had trouble understanding &quot;how is this secure&quot; when my modem is also connected to the same coax and this is clearly not behind my firewall. Well, of course, you filter out the signal from leaving through the Coax which provides you cable!<p>I would rather just run ethernet and keep it behind a firewall, but this reduces punching holes in the walls for now.
评论 #24724367 未加载
评论 #24725725 未加载
chromatinover 4 years ago
Absolutely outstanding work, truly worthy of the moniker &quot;hacker&quot; news =)
bityardover 4 years ago
This would have been (and still might be?) a fantastic submission to the International Journal of PoC||GTFO: <a href="https:&#x2F;&#x2F;www.alchemistowl.org&#x2F;pocorgtfo&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.alchemistowl.org&#x2F;pocorgtfo&#x2F;</a>
评论 #24725561 未加载
StillBoredover 4 years ago
This is quite an accomplishment!<p>A buddy an I had this idea ~6-7 years ago, and had a couple of the zoom docsis 3 modems handy. They have something like a 100Mhz fairly high bit depth A&#x2F;D on them. At the time the price&#x2F;bandwidth was crazy (and still is if someone managed to pull it off with a modern docsis 3.1 system). I got some boot logs&#x2F;etc but didn&#x27;t get very far into reverse engineering the chip. Its too bad that the chip vendors go to such lengths to hide what is basically mostly repackaged 3rd party IP from designware&#x2F;arm&#x2F;etc.<p>Current DOCSIS has ~200Mhz sampling per OFDM channel, given a 3rd party tuner in front of it, the results might be pretty crazy.
ssfrrover 4 years ago
Super cool hack and great write up. It’s nice to see this go all the way from poking at hardware to decompiling binaries and then some signal processing. Kudos.<p>You mentioned you were getting distortion&#x2F;noise when downsampling below 928kHz. Are you lowpass-filtering before you decimate (but after you demodulate)? Otherwise you will get all kinds of aliasing.<p>Looks like FM radio stations have a bandwidth of 200kHz so you should be able to lowpass with a cutoff of around 50kHz then decimate to 232kHz.
评论 #24725537 未加载
bsergeover 4 years ago
SDR stands for Software Defined Radio in this case.<p>That&#x27;s some amazing work in my eyes, how long did it take?
评论 #24721824 未加载
评论 #24722425 未加载
评论 #24723882 未加载
ArtWombover 4 years ago
Kudos! LimeSDR has found its niche in &quot;hobbyist&quot; radio astronomy. It&#x27;s entirely within the realm of possibility. That a civilian using a low budget board. Discovers the next big meteor approaching our planet. Or even a faint signal from advanced alien life ;)
评论 #24724517 未加载
评论 #24725788 未加载
leecarraherover 4 years ago
Cool hack, however i agree with the poster, since it appears to only have a 500KHz usable bandwidth(less than rtl-sdr) at an albeit faster (5x) sample rate, i probably won&#x27;t have much use for it. Definitely a great reverse engineer and discovery journey though.
Scoundrellerover 4 years ago
&gt; Note that this can only be done because both systems are 3.3v<p><i>Glares at system that ran RS232 levels (-12 &amp; +12) into 5V Atmel MCU 24&#x2F;7 for a couple years successfully</i>
评论 #24724895 未加载
londons_exploreover 4 years ago
You might be able to solve the &quot;lost data&quot; problem by telling the hardware to start capturing again to a new buffer before it&#x27;s done with the old one.<p>Sure, the buffers will have some random amount of data in, but by pre-erasing them, it ought to be possible to figure out where it got up to.<p>Failing that, just keep poking registers - there will certainly be a continuous capture mode, since that&#x27;s what it will use for real operations.
snopsover 4 years ago
The command line interface eCos has to call any C function sounds interesting, I wonder if there is a standalone library to do this on other platforms.<p>To further boost performance, it might be worth skipping past interrupts and going straight for DMA, as the CPU probably doesn&#x27;t need to be doing anything. I imagine figuring out how that works on an undocumented chip would be quite tricky though.
评论 #24725434 未加载
foofoo55over 4 years ago
SDR: Software Defined Radio
abstractbaristaover 4 years ago
This is so neat! I&#x27;m only a Tech level amateur radio user but now I&#x27;m hunting through parts boxes for an old modem...
mdipover 4 years ago
I love this sort of stuff -- does anyone know of a solid forum&#x2F;place for these kinds of projects (outside of searching <i>here</i>)?<p>Specifically, I have a basement full of old (some non-working) hardware for various gadgets&#x2F;computers&#x2F;electronics and I&#x27;d love to upcycle them into ... <i>something else</i>. Instructables and WikiHow are the usual places, but it&#x27;s usually things that require &quot;the thing you&#x27;re building&quot;[0] to build or require buying so many new components that by the time your done you&#x27;ve bought a product minus a few motors.<p>I yearn for the &quot;Make X do Y&quot; with a small number of inexpensive tools (preferably ones I own, but that&#x27;s a tricky proposition) where &quot;X&quot; is something common, or obsolete and &quot;Y&quot; is something outside of or is an upgrade to it&#x27;s design[1]. I love doing this sort of thing and I find that about half the time when I&#x27;m working on Pi&#x2F;Arduino projects I have way more <i>parts</i> than I realize -- I can&#x27;t believe I purchased <i>any</i> loose low power LEDs (IR, colored...) I have a whole box of remotes&#x2F;miscellania that should really be in the <i>garbage</i> for how useless it is ... until I need a 1.5V LED, have only 5V+, and can&#x27;t wait a day for shipping. I started salvaging electronics before trashing them. It&#x27;d be nice if I could look up the whole obsolete device and see what I can use more of it in... plus, at least for me, I&#x27;d throw less away (and store less in boxes).<p>[0] My go-to is the small number of &quot;Blu-Ray Engraver&#x2F;Laser Cutters&quot;. Every one I could find (A) required a laser cutter, or (B) many of the laser-cut parts required a laser cutter that was <i>bigger</i> than the one being built, so you couldn&#x27;t even <i>sell</i> the more expensive laser cutter if you wish to be able to produce a second one. It&#x27;s a small issue in that there are still other parts that need to be purchased, but you have to <i>buy a laser cutter</i> to make the custom, $0.01 in pressed board, set of parts. The others are nearly every upcycled RC-Car.<p>[1] I had a friend who designed custom sub-woofers for cars when I was younger. He had a Yamaha off-the-shelf sub that he modified to the tune of $250 and some of his own time. It put my $1000 sub to shame. I can&#x27;t remember <i>all</i> the specifics of the modification, but I know he used the original amp board and some upgraded MOSFETS but didn&#x27;t touch the 10&quot; speaker or the cabinet (which was what he spent most of his time on, typically).
quercusaover 4 years ago
SDR (Software-Defined Radio)is cool. RTL-SDR use a $25 USB TV tuner dongle to do all kinds of cool things like catching weather satellite downloads, listening to local emergency services, and software-controlled RF scanners.<p><a href="https:&#x2F;&#x2F;www.rtl-sdr.com&#x2F;about-rtl-sdr&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.rtl-sdr.com&#x2F;about-rtl-sdr&#x2F;</a> <a href="https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;RTLSDR&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.reddit.com&#x2F;r&#x2F;RTLSDR&#x2F;</a>
tn1over 4 years ago
&gt; Some quick searching brought me to a thread on a web forum where people were discussing the built in spectrum analyzer feature used for diagnostics<p>I tried to search for this forum thread, but my google-fu must be failing me. Does anyone know where it is?
评论 #24725684 未加载
segmondyover 4 years ago
One of the most exciting things I have read on HN in a long time. :). Thanks for sharing.
loa_in_over 4 years ago
With your use of threading you can instead of using one semaphore and buffer do two half as big, so one thread can always read one while the other us written. That potentially can remove all useless idling from your solution
评论 #24723049 未加载
superkuhover 4 years ago
Is the serial cable the interface used to transfer the saved sampled data to the PC? What does,<p>&gt;It can currently stream I&#x2F;Q data to a peer via TCP<p>mean? Does it somehow stream data over the modem&#x27;s ethernet connection?
评论 #24723076 未加载
aberohamover 4 years ago
“Then using some dd commands I would rather not think about” ! lol
ColanRover 4 years ago
I&#x27;m looking forward to when we find some common piece of hardware like this that can also transmit.
评论 #24723706 未加载
heavyset_goover 4 years ago
This is really cool. If you had a blog I could find, I&#x27;d follow it.
egberts1over 4 years ago
Cool. A digital spectrum oscilloscope!!!<p>And a cheap one too!!!
6510over 4 years ago
I much enjoyed this adventure story.
mdipover 4 years ago
&gt; With so few firsts available in life, take those that present themselves and have a crack, even if failure is always an option.<p>About two years ago I realized I was doing the opposite sort-of without realizing it. I&#x27;d <i>want</i> to do something given a set of constraints (say, create some app in some specific programming language or for some platform), google it, find that there was some loose chatter <i>around</i> the idea and I&#x27;d dismiss it thinking &quot;well, &#x27;The Internet&#x27; hasn&#x27;t done it&#x2F;doesn&#x27;t think it&#x27;s possible, so I shouldn&#x27;t bother&quot;.<p>Maybe it&#x27;s a form of imposter syndrome. For me, I think it&#x27;s more complicated:<p>I&#x27;d reach a point in a framework&#x2F;subset of &quot;whatever stack&#x2F;language I was focused on at that time&quot; where I was running out of obvious &quot;new things to try&quot;, so I&#x27;d Google and find the same list; &#x27;The Internet&#x27; decided for me that there&#x27;s really not anything else of use to do with these this framework, let&#x27;s learn a new one.<p>I need to &quot;do X with Y&quot;, I Google it and find &quot;Y&quot; nowhere, but find &quot;Z&quot; everywhere. It&#x27;s a bad fit but that&#x27;s how &#x27;The Internet&#x27; does it.<p>The most common, and one I specifically guard against and it happens <i>consistently</i> with endeavors like this: I want to make &quot;X&quot; do &quot;Y&quot; knowing full well that &quot;Y&quot; is not designed for (or more frequently specifically designed to prevent me from) doing &quot;Y&quot;. After wading through replies to countless other people daring to ask the question in a forum -- the usual: &quot;You don&#x27;t know what you&#x27;re talking about, can&#x27;t be done, you shouldn&#x27;t try it&quot;, &quot;Why would you even want to do that when you can get &#x27;Y&#x27; for $.$$ on eBay?&quot;, &quot;Google it&quot; (I did, that&#x27;s why I&#x27;m here after 4 pages of clicking). Lovely how every question has 3-4 unhelpful-non-answers in one of these categories.<p>I changed my approach more than a decade ago while trying to reverse engineer the obfuscation a large telecom vendor used for their mobile broadband password storage in the Windows Registry[0] and succeeded in writing an &quot;obfuscator&quot; in a day from first introduction to deployed solution. Ever since then, I trust my instinct when I have expertise. When I do not, I read a very positive signal when &quot;a lot of are people asking if something can be done&quot; IIF there isn&#x27;t a good answer to why it &quot;can&#x27;t be done&quot; and any reasons why it &quot;shouldn&#x27;t be done&quot; don&#x27;t apply to the issue at hand.<p>[0] I recall, at the time, most of the answers were some form of &quot;IANAL... but...&quot; -- our purpose was to assign a random password to a user&#x27;s account, then install the client to the user&#x27;s company-assigned laptop with that password pre-populated (I didn&#x27;t come up with the idea, I just had to figure out how to do it). The remainder of the answers were variants of &quot;you can&#x27;t crack AES&quot; and &quot;IM L33t H4x0R - WiLl CrAcK 4U&quot;. It was <i>very clearly</i> not AES or anything resembling a hash. It took so little effort to figure out that I would have <i>saved</i> time by &quot;Starting Before Googling&quot;. Nobody (searchable) had tried. Probably nobody had a (legitimate) reason to try. It was just surprising how many people had a reason to &quot;not try&quot; <i>while also</i> discouraging others from trying with either wrong information or no information at all.