800 Bd / 800 Hz (critical) FSK and STANAG-4285 Transmissions on 16289.5 kHz (UK DHFCS)

Analysis and TDoA geolocation of an unusual binary FSK transmission recorded on 16.2 MHz, highlighting its modulation properties, bitstream framing, and identification as part of the UK DHFCS network in St. Eval, Cornwall (UK).

A rather unusual FSK transmission was heard on 16289.5 kHz CF (tuning 16288.0 kHz/USB + 1500 Hz offset), which later turned out to be transmitted by the UK Defence High Frequency Communications Service (DHFCS) in St. Eval (see below). Every now and then I tune to 16288 kHz, but — so far —  I have not had the opportunity to catch it again. The transmission (shown in Figure 1) employs an 800Bd/800 Hz FSK modulation. The spectral display clearly shows the two characteristic tone rails, with a measured shift (Δf) of approximately 800.88 Hz.

Figure 1: Spectrum analysis showing FSK modulation at 800 Bd with 800 Hz shift

It is interesting to note that when the symbol rate (Br​=800 Bd) equals the frequency shift (Δf=800 Hz), as in this case, the transmission operates in a critical condition yielding an exact modulation index of h=​Δf/Br​=1.0 (Figure 2). For non-coherent demodulation, this condition represents the non-coherent orthogonality threshold, eliminating inter-symbol interference (ISI) without requiring phase recovery. In a coherent receiver setup, it operates at twice the minimum spacing required for orthogonal reception (h=0.5, typical of Minimum Shift Keying / MSK), providing a wider noise margin and lower Bit Error Rate (BER).

Figure 2: Critical FSK conditions (Br=Shift). Image credit: https://radioscanner.ru/

The autocorrelation function (ACF) yields a primary peak at approximately 1280 ms, which at a symbol rate of 800 bps(1) corresponds precisely to a 1024-bit frame length. This periodic structure is clearly confirmed by the bitmap alignment shown in Figure 3.

Figure 3: Autocorrelation (ACF) analysis and bitmap display

It is worth noting that a similar FSK transmission was heard in November 2025 on several frequencies, running in 800Bd/850 mode — thus with an 850 Hz shift matching the classic 50-75Bd fleet broadcast [1]. Notably, besides sharing the same ACF (1280 ms), period (1024 bits), and frame architecture, both FSK signals originate from the same site.

The structure of the 1024-bit frames is clearly visible in the bitstream resulting from demodulation and subsequent synchronization to a common 10-bit sequence (Figure 4). Structurally, this framing resembles the 1536-bit period previously observed in UK DHFCS transmissions [2] and, as mentioned above, is very similar to that used in the 800Bd/850 FSK transmission.
The layout in Figure 4 highlights six distinct recurring blocks (numbered 1 to 6) plus a final seventh block within the 1024-bit frame structure. As detailed in the lower insets, each of the seven blocks is further subdivided into specific sub-fields. For readability and descriptive purposes, I have arbitrarily labeled the static delimiter fields consisting of all-one bits as 'F' (Framing) and the variable payload sections as 'D' (Data) — for instance, F1–D1, F2–D2, F3–D3, and so on. Note that these designations are purely my working labels.

Figure 4: The 1024-bit frame structure aligned to the chosen sequence

Table 1 summarizes the bit-length distribution across the six primary blocks. As shown, each block consists of alternating framing fields (F1, F2, F3, composed of all-one sequences) and data fields (D1, D2, D3). TABLE I highlights a clear, repeating structural pattern:

[F1] → [D1] → [F2] → [D2] → [F3] → [D3]

* Framing bit lengths: While most delimiter fields are fixed at 5 bits, a single 6-bit delimiter shifts diagonally across the frame structure following a cyclical pattern (F3 in blocks 1 & 4, F2 in blocks 2 & 5, and F1 in blocks 3 & 6, as indicated by the shaded cells).
*  Data bit lengths: The first two data sub-fields (D1 and D2) consistently contain 16 bits per block, whereas D3 carries 37 bits in blocks 1, 2, 4, and 5, expanding to 38 bits in blocks 3 and 6 (just when the 6-bit delimiter is in F1 fields) to compensate for the framing arrangement.

In total, these six blocks account for 512 bits (half of the full 1024-bit frame structure), evenly divided into 96 bits of framing overhead (static '1s') and 416 bits of variable data payload.

Table I: Bit allocation and field breakdown across Blocks 1–6. Shaded cells denote the 6-bit delimiter fields

As detailed in Table II, and according to the chosen synchronization, Block 7 acts as a tail or termination sub-frame. Unlike the standard 6-field blocks, Block 7 consists of only four sub-fields—F4 (5 bits), D4 (16 bits), F5 (5 bits), and D5 (11 bits) — resulting in a reduced length of 37 bits. Here, the fixed 5-bit delimiters (F4, F5) frame a standard 16-bit data register (D4), while the shortened 11-bit data field (D5) likely serves to pad the frame to its exact required total length of 512 bits.

Table II: Structure of the terminal sub-frame (Block 7), showing a reduced 37-bit total allocation across four fields

At a later stage, the same frequency was observed hosting a STANAG-4285 transmission (operating at a 1200 bps data rate). Comparing the two distinct captures revealed that despite the transition in physical modulation (FSK vs PSK), both waveforms carry an identical framing structure. Similar to what was observed with the 800Bd/850 FSK transmission, the STANAG-4285 signal appeared briefly before disappearing.
Once demodulated, the STANAG-4285 transmission reveals a 1536-bit period, structurally identical to the 1024-bit bitstream identified in the FSK transmissions — differing by exactly 512 bits.The layout in Figure 5 illustrates the 1536-bit frame structure. As with the FSK signal, the bitstream resulting from demodulation was synchronized to a common sequence (specifically, a common 16-bit sequence at the start of the frame). 

Despite the expanded period, it preserves the exact same sub-framing architecture identified in the 1024-bit FSK signal. The right portion of the frame features six recurring standard blocks (numbered 1 to 6) followed by the terminal seventh block. As shown in the lower insets, the working labels 'F' (Framing) and 'D' (Data) apply identically here: Blocks 1 through 6 follow the F1–D1, F2–D2, F3–D3 sequence, while Block 7 retains the shortened F4–D4, F5–D5 structure. The key distinction lies in the overall frame length, where an expanded 1024-bit framed segment is paired with the initial unstructured section, accommodating the higher bit rate of the PSK (STANAG-4285) signal.

The structural identity between the 800 Bd / 850 Hz FSK signal and the 1200 bps STANAG-4285 signal demonstrates that the framing scheme operates at a higher Data Link / TDM layer, independently of the underlying Physical layer.

 

Figure 5: 1536-bit bitstream of the STANAG-4285 transmission, aligned to the chosen sequence

Unlike the FSK transmission, the field lengths within the 1536-bit STANAG-4285 bitstream exhibit a remarkably strict byte-aligned regularity. As shown in Table III, all static delimiters (F1–F5) are fixed at exactly 8 bits (1 byte), while the data fields (D1–D3) in Blocks 1 through 6 are uniformly sized at 56 bits (7 bytes) each, resulting in perfectly symmetric 192-bit sub-frames. Similarly, the terminal Block 7 consists entirely of byte multiples — F4 (8 bits), D4 (24 bits / 3 bytes), F5 (8 bits), and D5 (16 bits / 2 bytes) — totaling 56 bits. This rigid, byte-oriented structure strongly suggests that the framing hardware operates on standard 8-bit word boundaries when processing higher-throughput PSK streams.

Table III: Field layout and bit-length distribution for Blocks 1–7 of the 1536-bit STANAG-4285 bitstream

While the frame lengths differ to match the respective physical layer throughputs — 1024 bits for the FSK waveform versus 1536 bits for the 1200 bps STANAG-4285 transmission — the internal frame architecture remains structurally equivalent.
 
As shown in Figure 6, the left section of the STANAG-4285 1536-bit bitstream contains three parallel 7-bit counters, which yield 128 possible states (0-127) before resetting. Note that the highlighted field reads "1001100" — equivalent to 76 in decimal — whereas the bit editor displays "line 77". This apparent discrepancy arises because the initial state is "0000000" (0), which the editor counts as line 1 (meaning the values from 0 to 76 encompass 77 discrete lines). While the exact function of the three parallel 7-bit counters (cnt1–cnt3) cannot be definitively confirmed, their synchronized 128-state cycle suggests they may be used for frame numbering, sequence tracking, or TDM sub-channel control. These interpretations remain unverified hypotheses based solely on bitstream pattern analysis.

 

Figure 6: Detail of the left section of the STANAG-4285 bitstream showing three parallel 7-bit counters

Another similarity worth highlighting is observed in the initial regions of the bitstreams, immediately following the used synchronization sequence (Figure 7). As shown in the comparative analysis, both waveforms exhibit a structurally identical pattern before transitioning into the main section.
These initial segments could serve as a frame header or control region, potentially containing protocol signaling flags, operational mode indicators, or a Frame Check Sequence / CRC (Cyclic Redundancy Check) to ensure header integrity, alongside a short stabilization pattern for receiver synchronization. It must be emphasized, however, that all the above functional interpretations remain strictly my own speculative hypotheses, derived solely from visual bitstream observation.

Figure 7: Visual comparison of the initial bitstream regions following the used sync sequence in FSK (top) and STANAG-4285 (bottom)

For the sake of completeness, a statistical test on the use of encryption within the data fields was performed (Figure 8), although — in truth — it was not strictly necessary.

Figure 8: Statistical randomness and encryption test on the data fields

Attempts to locate the geographic emission site point decisively to the St. Eval site in Cornwall (Figure 9)(2). Direction finding was performed using three independent TDoA (Time Difference of Arrival) runs using different KiwiSDR receiver clusters to validate spatial convergence.

Figure 9: Geolocation analysis combining KiwiSDR TDoA results with DHFCS infrastructure maps

The following figures provide an aerial view of the St. Eval site (Figure 10) and a ground-level view (Figure 11); images are credited to Google Earth. The white-circled signs visible in Figure 11 are warnings posted by the UK Ministry of Defence (MOD):

Left circle (main entrance/fence):
Upper sign (white):
MOD St Eval
Lower sign (red/white):
MOD PROPERTY KEEP OUT NO ACCESS OR TIPPING

Right circle (side fence):
Warning sign (red/yellow):
MOD Property Keep Out Multi hazard area Danger of death

 

Figure 10: Aerial view of the former RAF St Eval airfield, currently housing the DHFCS transmitter site (Image credit: Google Earth)

Figure 11: Ground-level view of the St. Eval site entrance. Highlighted are the UK Ministry of Defence (MOD) warning signs (Image credit: Google Earth)

I have referenced the likely use of a Time-Division Multiplexer (TDM). This hypothesis stems from the observation that 1536-bit bitstreams — featuring a layout similar to those analyzed here — have been observed in transmissions from both the UK DHFCS and the Australian Modernised High Frequency Communications System (MHFCS) [3]. Although the reported transmissions not employing FSK modes, these systems utilized various other modulation schemes, such as MIL-STD-188-110A (MS-110A) and STANAG-4285. Furthermore, reliable sources confirm that the MHFCS specifically employs the DRS GA-205 multiplexer(3).

The fact that 16289.5 kHz is monitored periodically without observing a constant presence — nor any activity on the frequencies previously used for the 800 Bd / 850 Hz FSK transmission — suggests that this is not an active operational service (such as standard STANAG 4481/4285 broadcasts on allocated frequencies). Rather, it seems that they are conducting targeted waveform tests, activated only during specific time windows to evaluate different shift parameters.
 

Furthermore, the analysis demonstrates that the DHFCS system employs a scalable Data Link framing protocol, capable of adapting to different physical layer standards operating on the exact same frequency.

Downloads & Technical Materials

---

📄⬇️ For a quick technical reference, you can download a concise sheet: https://disk.yandex.com/i/fe0IMS3UW8xr9Q

🧮⬇️ Download Octave script check_encryption.m:  https://disk.yandex.com/i/aOq8QUFe6w2mqQ

📡⬇️ Download signal recording: https://disk.yandex.com/d/fMIqmmzOSwKK2Q

Notes

---

1. In a binary FSK modulation (FSK-2), the baud rate (Bd), or symbols rate, value is exactly equal to the speed in bits per second (bps). Since in FSK-2 each signal transition (1 baud), or one symbol, corresponds to the transmission of exactly 1 bit of data, the mathematical relationship is: Bit Rate (bps)=Baud Rate (Bd)×log2​(M) where M is the number of possible states/tones. For a conventional FSK modulation (M=2): Bit Rate=Baud Rate×log2​(2)=Baud Rate×1 Consequently, for an 800 Bd signal, the signal frequency shifts 800 times per second, carrying exactly 800 bps.

2. DHFCS St. Eval is a strategic military high-frequency radio transmitter site located at the former RAF St Eval airfield in Cornwall, England. Part of the UK South region network, it acts as a key transmission facility for the UK Defence High Frequency Communications Service (DHFCS), providing long-range communication for military aircraft and ships. Operated under contract by Babcock International.
3. GA-205 is a 12-channel Time Division Multiplexer (TDM) that provides full-duplex and half-duplex transmission and reception of data at selectable user port rates up to 9600 bps. The system accommodates user data that do not share common timing sources and provides for isochronous, bit stuff, synchronous and asynchronous operation.

References

---

[1] https://i56578- swl.blogspot.com/2025/11/unid-fsk-800bd850.html
[2] http://i56578- swl.blogspot.com/search/label/1536-bit%20TDM
[3] http://i56578- swl.blogspot.com/2019/07/110a-2400bps-modem-carrying-1536-bit.html

Tunisian MFA HF Link: 128-bit AES Encryption and a Modified MS-110A Waveform

This post provides a breakdown of an HF diplomatic link between Tunisian MFA nodes using a modified MS-110A waveform. Based on audio subcarriers and bitstream measurements, the post analyzes the complete message-frame structure: from the initial 4-tone preamble and framing overhead to the COMSEC preamble protecting the AES payload.

A transmission session was logged at 16285.0 kHz USB on July 29, starting from 0855 UTC, and recorded thanks to linkz' remote KiwiSDR[1]. The exchange began with a standard 3-way link setup using the 141A (2G ALE) waveform, followed by 15 data bursts using MS-110A at 1200 bps (Short Interleave), and concluded with a formal link termination (Figure 1). The traffic was identified as belonging to the Tunisian Ministry of Foreign Affairs (MFA). Given that all bursts are of equal duration (~3500 ms), the session does not appear to employ an ARQ mechanism, which would typically involve data packets interspersed with short return ACKs.

Fig. 1: Spectrogram of the complete transmission.

Looking at the MS-141A ALE exchanges, the link setup follows the usual 3-way handshake:

TO [STAT155] TIS [STAT16]
TO [STAT16] TIS [STAT155]
TO [STAT155] TIS [STAT16]

where the used ALE addresses stand for:

STAT16: MFA Tunisian Embassy in Riyadh (caller node)
STAT155: MFA HQ in Tunis (called node)

The identification of the above callsigns is derived from verified loggings within the utility monitoring community such as UDXF[2].

In the vast majority of operational cases, the caller node (STAT16 in this sample) is also the station that switches to a traffic waveform first. The only exception occurs if the initial ALE call is an "Orderwire" type (1) or a reverse traffic request, where, for instance, STAT16 calls STAT155 essentially saying: "I am ready to receive your traffic". As in most cases, the link termination is signaled by the caller node (2):

TO [STAT155] TWS [STAT16]

1. Waveforms Analysis

The transmission operates in a simplex "turn-taking" structure. Each pair of bursts (excluding burst #13, which is standalone) functions as a bidirectional message exchange between the two nodes (Figure 2). 

Fig. 2: Simplex turn-taking sequence diagram illustrating the bidirectional burst exchange between STAT16 (Riyadh) and STAT155 (Tunis).

 

This is supported by the differing fading profiles observed within each pair, indicating that the two bursts in a pair travel along different propagation paths and therefore originate from different transmitting sites (nodes). As shown in Figure 3, the longer path for STAT16 introduces multipath propagation, resulting in frequency-selective fading. In contrast, the path for STAT155 is much shorter and exhibits negligible fading (flat channel), with the signal arriving stable and without significative attenuation.

Fig. 3: Spectral signatures and geographic paths of STAT16 and STAT155

Furthermore, the distinction between the two nodes was confirmed by measuring the audio subcarrier frequency in the pairs of MS-110A bursts against the nominal 1800 Hz frequency (Figure 4):

- 1787 Hz (-13 Hz offset) identifies the caller (STAT16, which switches to MS-110A first)
- 1770 Hz (-30 Hz offset) identifies the called station (STAT155)

Fig. 4: Subcarrier frequency comparison

It is worth noting that while the MS-110A standard specifies a clock accuracy of ±1 Hz for the generation of the 1800 Hz subcarrier (§ 5.3.2.3.9), the observed frequency offsets are slightly higher (−13 Hz and −30 Hz). This discrepancy is primarily attributed to overall transceiver local oscillator (LO) drift, frequency calibration tolerances, and ionospheric Doppler shifts. Despite these deviations, demodulation proceeds correctly as modern MS-110A DSP implementations employ carrier-tracking loops capable of acquiring and compensating for subcarrier offsets well within this range.

As shown in Figure 5, each burst begins with four initial unmodulated tones lasting ~80 ms with asymmetric spacings (700 Hz, 500 Hz, and 900 Hz), a variant of the MS-110A modem typically associated with tactical telecommunication systems (3) which is not specified in the standard MIL-STD-188-110A. These four tones form an "all-in-one" synchronization burst that serves to identify the network signature (700/500/900 Hz pattern) and acts as a channel probe and CW sync probe.

Fig. 5: 4-tone preamble preceding the burst, with asymmetric frequency spacings.

To better understand the physical characteristics of an MS-110A transmission at 1200 bps, it is worth looking at the relationship between the symbol rate, channel coding, and actual throughput. Over the air, the modem always transmits at a fixed symbol rate using 8-PSK, resulting in a physical channel capacity of:
2400 baud × 3 bits/symbol = 7200 bit/s
Out of the 7200 bit/s physically radiated, the required user data rate in this capture is 1200 bit/s. Therefore, the total channel overhead (accounting for FEC, framing, and preamble/sync bits) is:
(7200 - 1200) / 7200 = 83.33%

2400 baud × 3 bits/symbol (8-PSK) = 7200 bit/s physical channel capacity

This means that only 16.67% of the theoretical over-the-air capacity is dedicated to useful data coming from upper-layer protocols (4). Alternatively, if efficiency is evaluated simply against the 2400 baud symbol slots (rather than the full 3 bits/symbol capacity of 8-PSK), the useful rate of 1200 bps corresponds to exactly half the symbol rate — highlighting a symbol throughput efficiency of 50%.

2. Data Link Bitstreams Analysis

To allow a thorough analysis of the payloads originating from the Data Link layer, each burst was demodulated individually, yielding 15 distinct bitstreams (Figure 6). The most immediate observation — though expected — is that all bitstreams have an identical length of 436 bytes or 3488 bits.

Fig. 6: Demodulated binary files from the session.

Furthermore, the frame structure is identical across all bitstreams — exhibiting a uniform format (regardless of reception polarity):

[Frame Sync]→[IVs]→[01... Reversals]→[Payload/Data]→[EOM]→[01... Reversals]

Data Link frame layout with COMSEC preamble and encrypted payload (not in scale).

In greater detail:

- Frame Sync: 64 bits (8 bytes), 0001100001000001110001011110010110111011010010010111110101011001
- Initialization Vector (IV): 128 bits (16 bytes), repeated 5 times (640 bits total)
- Reversals: 64 bits of alternating sequence (0101...)
- Encrypted MSG Payload: Ciphertext message
- EOM/Postamble: 64-bit followed by reversals (0101...), totaling 2000 bits*

(*) the 2000-bit value assigned to the final "EOM & Reversals" block in the calculations above is derived directly from the bitstream analysis of the frame's closing sequence (see Figure 7).

 

Fig. 7: Bitstream view of the post-payload section, highlighting the 2000-bit block containing the EOM marker and trailing reversals.

 

As noted above, the total frame length accounts for exactly 3488 bits. Breaking down the bit distribution across the frame:

64 (Sync) + 640 (IVs) + 64 (Preamble REVs) + [MSG] + 2000 (EOM & REVs) = 3488 bits
Solving for the actual encrypted payload [MSG]:
[MSG]=3488−(64+640+64+2000)=720 bits (90 bytes)

Consequently, the Data Link layer frame efficiency for this transmission is:
(720:3488)​×100 ≈ 20,64%

Frame efficiency = 720 / 3488 × 100 ≈ 20.64%

    

This 20.64% frame efficiency means that nearly 80% of the Data Link layer space is consumed by overhead (synchronization, repeated IVs, and postambles) to ensure robust reception. Consequently, only 90 bytes out of each 436-byte burst carry actual encrypted user payload.

The following figures provide the visual bitstream analysis that substantiates the numerical values used above to define the specific frame structure.
Figure 8 shows the first 128 bits of all bitstreams and highlights the initial 64-bit frame sync:

Fig. 8: Bitstream alignment showing the 64-bit frame sync header.

 

Figure 9 relates to a single bitstream after the removal of the initial frame sync. The figure shows the 128-bit Initialization Vector repeated 5 times:

Fig. 9: Fivefold repetition of the 128-bit IV following initial frame sync removal.

Figure 10 shows 128-bit segments of all bitstreams after the removal of frame syncs and Initialization Vectors, highlighting the 64-bit reversal sequences that precede the MSG payloads:

 

Fig. 10: Bitstream alignment showing the 64-bit reversal sequences after frame syncs and IVs stripping.

 

Figure 11 shows 128-bit segments from all bitstreams, highlighting the End of Message (EOM) sequence followed by reversals:

Fig. 11: Bitstream view of the EOM sequence and trailing reversals.

One might speculate that the initial 64-bit sync sequence preceding the Initialization Vectors (Figure 8) serves as a cryptodevice synchronization header — similar to what is observed in KG-84/KIV-7 encrypted transmissions (5). However, this remains a tentative hypothesis with no definitive confirmation at present.
Furthermore, it is plausible that the 64-bit sequence of reversals "0101" immediately following the Initialization Vectors (Figure 10) acts as a buffering or timing window, granting the cryptodevice sufficient time to process and load the IVs into the key generator before the encrypted payload stream begins.

Regarding the payload itself, the 128-bit Initialization Vector strongly points to the use of AES (Advanced Encryption Standard). Since the encrypted payload length (90 bytes / 720 bits) is not a multiple of the 128-bit (16-byte) block size, it is reasonable to hypothesize that AES is implemented in a stream cipher mode (such as AES-CTR or AES-OFB) or utilizes ciphertext stealing, thereby eliminating the need for block padding[3].
As a side note, the Tunisian Navy also utilizes MS-110A waveform, but strictly in its standard-compliant form i.e., without the initial 4-tone preamble discussed earlier. Furthermore, while the Navy relies on the L3Harris Citadel suite to secure its communications[4], the Ministry of Foreign Affairs, as seen above, employs a distinct approach to protect its message traffic.

Figure 12 presents the output of the Octave[5] script check_encryption.m as an additional statistical verification of the payload encryption. Given the earlier identification of the 128-bit Initialization Vectors, the presence of encryption is already taken for granted(!): running this script serves primarily as a proof-of-concept to demonstrate and validate its execution on real-world data. The script was generated with the assistance of Claude AI[6] and is available for download at the bottom of this post for anyone interested in testing it.

Fig. 12: Output of the Octave script check_encryption.m confirming encrypted payload statistics.

I have previously observed these same characteristics — frame structure, 128-bit IVs, and modified MS-110A waveform — in transmissions from the Royal Navy of Oman, Croatian Military, and the Swiss Emergency Network[7]. This suggests that neither the waveform nor the encryption device are custom-built for a single user, but are rather off-the-shelf solutions available on the commercial market.

Despite previous studies on these kinds of transmissions, this post offers a more detailed and comprehensive analysis, made possible by access to a complete 15-burst session.

Downloads

---

📄⬇️ For a quick technical reference, you can download a concise sheet: https://disk.yandex.com/i/nXoBWW1cclhixQ

🧮⬇️ Download Octave script check_encryption.m:  https://disk.yandex.com/i/aOq8QUFe6w2mqQ

📡⬇️ Download signal recording: https://disk.yandex.com/d/arsiZ8bRhwvv8Q

Notes

---

1. An Orderwire call in military and diplomatic HF radio systems (such as MIL-STD-188-141 ALE) is a special signaling message used for channel management, control, or raw text exchanges between operators, rather than for transmitting standard payload data. Instead of negotiating a link to open a traffic channel for user data, an Orderwire transmission carries specific embedded instructions—such as frequency channel tests, status commands, radio control messages, or operator-to-operator short text notes.

2. In MIL-STD-188-141A (2G-ALE) terminology, TIS (This Is) is used in the preamble/header to identify the transmitting station during link establishment, whereas TWS (This Was) is transmitted at the end of a session to signal explicit link termination (teardown).
3. Israeli Navy hybrid MS-110A modems also feature a four-tone preamble, but with symmetrical tone spacing.
4. In the OSI model and HF data transmission stacks, what the physical layer (the modem) considers "useful data" is precisely the payload delivered by upper layers (such as STANAG 5066, PPP, or other application/DTE protocols).
5. Additionally, the KG-84/KIV-7 device also uses 128-bit Initialization Vectors (transmitted as two 64-bit strings) preceded by a 64-bit sync sequence header.

References

---

[1] http://linkz.ddns.net:8074/?f=16285.00usbz9
[2] Utility DXers Forum (UDXF) home page: https://www.udxf.nl/
[3] General overview and theory of AES https://en.wikipedia.org/wiki/Advanced_Encryption_Standard
[4] https://i56578-swl.blogspot.com/2025/07/tunisian-navy-using-l3harris-citadel.html
[5] GNU Octave official site https://octave.org
[6] Claude (AI) https://claude.ai/login
[7] https://i56578-swl.blogspot.com/2021/11/again-about-crypto-devices-with-5x-128.html

CIS-Navy FSK 50Bd/700 Flash Messages

This post presents a technical analysis of an HF radio intercept recorded on July 22. The analysis focuses on the structure of a 50 Baud FSK signal transmitted by the CIS Navy, highlighting both standard transmission characteristics and distinctive operational features, such as the use of a specific frequency shift (700 Hz) and the inclusion of a Morse-FSK preamble indicative of high-priority message traffic.

A very interesting FSK 50 Bd / 700 Hz signal was intercepted on 16199.75 kHz (cf) on July 22. The signal transmits almost continuous "01" reversals, occasionally interrupted by a Morse-FSK preamble prior to an encrypted payload. The preamble likely serves as a signaling sequence indicating the priority/precedence level of the upcoming transmission. As shown in Figure 1, the payload of the recorded transmission consists of two concatenated messages framed by short reversal segments before returning to continuous reversals. In ordinary or low-priority traffic, the payload directly follows the reversals (without a preamble), consists of multiple concatenated messages and can last for some minutes.

Fig. 1: the intercepted signal

As confirmed by fellow monitor cryptomaster, the intercepted signal belongs to the family of 50 Bd FSK waveforms used by the CIS Navy with various shift values such as 75, 200, 250, 500, and even 1000 Hz [1] likely generated by the T-600 system, while maintaining the same message format. This is the first time I have observed a CIS Navy 50 Bd FSK modulation with a 700 Hz shift, which is another remarkable aspect of this sample.

Fig. 2: FSK parameters

Transmitting a Morse coded preamble typically indicates an incoming message of high priority. In Russian military radio doctrine, top-priority traffic (equivalent to FLASH or MONOLITH) is preceded by repeated letter sequences to alert operators and trigger automated equipment (1). In this instance, the preamble consists of the string 'UUUUU XXX XXX'. This sequence likely functions as a two-stage marker: 'UUUUU' for initial synchronization/attention, followed by 'XXX XXX' to signal an incoming long or high-precedence message prior to switching to FSK data modulation. Notably, while these markers are unconfirmed by official Russian Navy sources, they are well-established through decades of independent SIGINT monitoring. A similar preamble was previously documented in CIS Navy 50 Bd/75 transmissions on 18.1 kHz (submarine communications) [2].

Fig. 3: the Morse-FSK preamble

The two messages in this sample are identical, likely to improve system reliability through message redundancy.
Below is the bitstream analysis of the intercepted sample (700 Hz shift), demonstrating the above—namely, that both the message's format and the symbol rate of 50 Bd are shared across CIS Navy FSK waveforms, even when using different shift values.

The 'standard' format of CIS Navy 50 Bd FSK messages usually consists of:

 ⦁ 42-bit initial sequence / Unique Word (usually 100001010010111110000101001101011010101101)
 ⦁ 70-bit Initialization Vector, repeated twice)
 ⦁ 7-bit word ciphered payload arranged in a 4:3 ratio with parity check
 ⦁ five 7-bit "0001000" words as End of Message (EOM)

(the 0/1 values of the sequences above depend on the reception polarity)

(not in scale)

42-bit sync sequence
It is worth noting that the transition from idle to traffic condition is signaled by a break in the bit reversal structure, where a '1' is inserted instead of a '0' when the system transitions to traffic i.e., ending in '01011' rather than '01010', as shown in Figure 4. Using intentional protocol deviations for signaling is a common practice across many standards, such as Ethernet LAN protocols (2).
The initial 42-bit sync sequence also represents a "violation" of the 4:3 ratio (see below), ensuring reliable synchronization.

Fig. 4: 42-bit initial sequence sent after reversals

70-bit Initialization Vector
Figure 5 displays the identical pair of messages aligned in 70-bit blocks, emphasizing the probable Initialization Vector (IV) sequences, repeated twice, prior to the encrypted payload.

Fig. 5: 70-bit sequence, repeated twice

4:3 ratio with parity check
The payload data consists of 5-bit characters encoded into a 7-bit sequence with a fixed 4:3 ratio of '1's to '0's (or vice versa, depending on reception polarity). Naturally, the constant presence of four '1's per character also provides parity-based error detection. 

Fig. 6: 4:3 ratio and parity check

End of Message (EOM)

The End-of-Message (EOM) sequence in Figure 7 consists of five identical 7-bit words "0001000", again violating the constant bit ratio of the payload section. This figure also clearly demonstrates that the two messages are identical. 

Fig. 7: the EOM sequence

It appears that the format of the CIS-Navy 50Bd transmissions revolves around the number "7": an initial 42-bit synchronization sequence (6x7), 70-bit Initialization Vectors (10x7), and a payload structured into 7-bit words. In fact, it can be argued that the entire message (sync sequence, IVs, payload, EOM)  is fundamentally structured into 7-bit words.

Attempts to geolocate the transmitter site proved challenging, likely due to the nature of the signal and potential multi-hop propagation. Nonetheless, as shown in Figure 8, the KiwiSDR receivers used for Time Difference of Arrival (TDoA) measurements point to an area southwest of Moscow (likely the RDL site?), though this cannot be established with a high degree of certainty (3).

Fig. 8: direction finding attempts (TDoA)

All recordings thanks to linkz's KiwiSDR [3].

Downloads

---

📄⬇️ For a quick technical reference, you can download a concise Fact Sheet summarizing the full frame architecture and other features here.
📡⬇️ Download signal recording: https://disk.yandex.com/d/4uBK5oJYGYtMVg

Notes

---

1. In NATO military communications (as ACP-126 standard), FLASH precedence is represented by the letter indicator Z (Prosign). To alert operators and trigger automated terminal alarms, the precedence sequence is repeated at the start of the transmission (e.g., ZCZC ZZZZ), followed by a Z time-stamp designator and the text header FLASH FLASH FLASH. In strategic/command contexts, it functions similarly to Russian high-priority or MONOLITH-type alerts.
2. In traditional 10 Mbps Ethernet networks (10BASE-T), data is transmitted using Manchester encoding. Transmission begins with a 7-byte preamble consisting of alternating 1s and 0s (10101010...), used to synchronize the receiver's clock. Immediately following this is the SFD (Start Frame Delimiter) value, where the alternating sequence breaks with two consecutive 1 bits (10101011). This break in the alternating rhythm signals the network chip: "Attention: the preamble has ended; the very next bit marks the actual start of the Ethernet packet" (IEEE 802.3 Standard, Clause 3).
3. Rather than a single fixed mast, HF transmissions under the call sign RDL are routed through naval communications hubs primarily tied to naval headquarters/command nodes in Central Russia such as the Moscow military region hub. Just for example, Naro-Fominsk area hosts major command posts and communications infrastructure for the Russian Armed Forces, including high-power HF transmitter facilities and receiver centers used for strategic naval command broadcasts and central military district communications.

References

---

[1] http://i56578-swl.blogspot.com/2016/12/unid-fsk-50bd1000-prob-cis-navy.html
[2] http://i56578-swl.blogspot.com/2020/08/cis-navy-vlf-50bd75-fsk-t600-75hz.html
[3] http://linkz.ddns.net:8075/?f=16198.00usbz9

Voice Coordination & FSK 300Bd/500 Tactical Bursts (Russian Navy)

This is not the first time I have had the opportunity to study the 300Bd/500Hz FSK waveform (of Russian/CIS origin), which I have encountered in different configurations — for instance, with 255/366-bit framing, or with reversal preambles transmitted at 150 baud [1]. This time, the opportunity was provided by my friend Mario, who kindly sent me some recordings of his intercepts, captured via KiwiSDRs located in Japan (Nagano and Hokkaido). The intercepts were recorded on June 23rd, between 0848 and 0944 UTC. These are almost certainly Russian Navy voice and data transmissions, likely between the Russian Pacific Fleet HQ in Vladivostok or the Sovetskaya Gavan Naval Station (a submarine base) and a vessel. The traffic consists of voice coordination followed by tactical data bursts using FSK 300Bd/500Hz modulation on a negotiated frequency (Figure 1).

Fig. 1: Voice link setup on 8439 kHz (top) followed by FSK 300Bd/500Hz data bursts on 9100 kHz (bottom)

The voice comm intercept occurred on 8439 kHz, which is probably a primary calling/hailing frequency. In a naval net, a major shore station or flagship (the NCS, Net Control Station) monitors this frequency continuously, acting as a guard station for the net. Subordinate mobile units check in briefly on this primary frequency just long enough to establish initial contact. Because the primary frequency must remain clear for other assets to report in, the calling unit requests a shift to a discrete tactical channel to send the follow-on data traffic.
Below, the text transcript and corresponding translation of the voice communication. 

Russian (original)	English (translation)
Волнобой, я Грейдер. Волнобой, я Грейдер. Волнобой, я Грейдер. Как слышно? Прием.	Volnoboy, this is Greyder. Volnoboy, this is Greyder. Volnoboy, this is Greyder. How do you read? Over.
Волнобой, я Грейдер. Волнобой, я Грейдер. Следи. Вызови меня на червячке девять-один-ноль-ноль, девять-один-ноль-ноль. Как понял?	Volnoboy, this is Greyder. Volnoboy, this is Greyder. Keep listening. QSY to vernier* nine-one-zero-zero, nine-one-zero-zero. How copy?
Я Грейдер. Прием.	This is Greyder. Over.

*"Vernier" (червячок, lit. "little worm") — Russian radio slang for the fine-tuning dial, here indicating the secondary frequency.

Callsign: Volnoboy (Волнобой - "Breakwater") — Called Station, likely Net Control Station (NCS).The callsign evokes a fixed, protective structure, consistent with a shore-based command facility or a flagship unit acting as the control node.
Callsign: Greyder (Грейдер - "Grader") — Calling Station / Initiator. The callsign references mobile equipment, suggesting a an auxiliary/support vessel or a subordinate combatant establishing a tactical link.

In Soviet/Russian doctrine, callsigns are not fully arbitrary but follow category-based semantic conventions, "heavy/permanent/protective" nouns for fixed command stations or flagship units, and "mobile/task-oriented" nouns for subordinate tactical units. This reinforces the assessment of Volnoboy as NCS and Greyder as the mobile calling unit.

If my guess is correct (!), i.e. Volnoboy is the ashore NCS, there is an ideological and technological divergence between NATO and the Russian Navies:
1. The NATO Paradigm: Continuous Broadcasts (FAB). NATO utilizes the BRASS (Broadcast, Ship-Shore and Maritime Rear Link System) architecture. Shore-based Net Control Stations broadcast continuously and use FAB (Frequency Availability Broadcast) to tell the fleet exactly which frequencies are currently free for ship-shore comms. The Philosophy: Maximum protection for the ship. By listening passively to the broadcast, ships maintain total EMCON (Emission Control). The ship only transmits a brief burst to establish the link on the best available frequency. The fixed shore station takes 100% of the RF exposure.
2. The Russian Paradigm: Tactical Shadowing ("The Worm"). The intercept between Greyder and Volnoboy shows the exact opposite workflow. The Russian Navy relies heavily on "skedy" (rigidly scheduled radio appointments) and paper matrixes. Stations meet on a known primary calling frequency simply to confirm mutual contact and readability. The mobile unit (Greyder) immediately directs the shore station (Volnoboy) to transition to a secondary tactical channel ("the little worm 9100").

Shortly after the voice link setup on 8439 kHz, tactical data bursts utilizing FSK 300Bd/500Hz modulation were intercepted on the negotiated secondary frequency of 9100 kHz. Because no voice response from Volnoboy was detected (1), this data traffic is assessed with high confidence as originating from Greyder. This fits the classic profile of a mobile naval asset transitioning from a public voice channel to an FSK burst transmission on a tactical shadow frequency to pass encrypted operational traffic.

Figures 2, 3 show the main parameters and the 80 ms period of the FSK bursts.

 

Fig. 2 : main FSK parameters (300 Bd/500Hz)

Fig. 3: 80 ms period

The demodulated bitstream shows a 24-bit period (corresponding to the 80 ms duration visible in the bitmap in Figure 3), the last of which is the phasing bit (the final column of "0s"). The data are preceded by a 240-bit sequence generated by the polynomial x^12+x^10+x^9+x^3+1.

Fig. 4: demodulated bitstream

After removing the preamble/sync sequence and inverting the 9th column of the stream, a clear H(24,16) coding was found, ie 16-bit data followed by a 8-bit CRC. Coding is performed using the following Hamming parity check (8,24) matrix:

1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0   1 0 0 0 0 0 0 0
0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0   0 1 0 0 0 0 0 0
0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0   0 0 1 0 0 0 0 0
0 0 0 1 0 1 1 0 0 1 0 1 1 1 1 1   0 0 0 1 0 0 0 0
0 0 1 1 1 0 0 1 1 1 0 1 0 1 1 1   0 0 0 0 1 0 0 0
1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1   0 0 0 0 0 1 0 0
0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1   0 0 0 0 0 0 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0   0 0 0 0 0 0 0 1

As demonstrated in Figure 5, the received CRC (left) matches the computed CRC (right). The latter is obtained by applying the (8,16) check sub-matrix shown above to the 16-bit data portion of the demodulated bitstream.

Fig. 5: received CRC (left) vs computed CRC (right)

Coding verification is carried out by comparing each line of encoded data with every row of the check sub-matrix: for each row #n, the number of vertical matches between the "ones" in the encoded line and the "ones" in that row is counted. If the count is even, CRC bit #n will be "0"; if the count is odd, CRC bit #n will be "1".

Example: CRC computation for the first row of the encoded data:

DATA                               CRC
1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1    1 0 1 1 0 0 1 0
1 1 1 0 0 0 0 0 1 0 1 0 1 1 0 1    1 0 1 1 0 1 1 0
0 0 1 0 0 0 1 1 0 0 0 1 0 0 0 0    1 0 0 0 1 1 1 0
0 1 1 1 1 1 0 1 0 0 1 0 1 1 0 0    0 1 0 0 1 1 1 0
1 1 0 0 1 0 1 1 1 1 0 1 1 1 0 1    0 1 1 0 1 1 0 0
1 0 1 1 1 0 1 0 1 0 0 0 1 0 0 1    0 1 0 0 1 1 1 0
0 0 1 0 0 0 0 1 0 1 1 1 0 1 0 0    0 1 0 1 1 0 1 0
1 0 1 0 1 1 1 1 1 1 0 0 0 0 0 0    1 1 0 1 1 1 1 0
1 1 0 1 1 0 1 1 1 1 0 1 1 0 1 1    1 1 1 1 0 0 0 0
0 0 1 0 1 0 0 0 1 0 1 0 0 0 0 1    1 0 0 1 0 1 0 0
1 1 0 0 1 1 1 0 0 0 0 1 0 0 0 0    1 1 1 1 0 1 1 0
0 0 0 1 1 1 0 0 0 1 0 1 1 0 0 0    0 1 0 1 0 1 1 0

CHECK SUB-MATRIX
1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0
0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0
0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0
0 0 0 1 0 1 1 0 0 1 0 1 1 1 1 1
0 0 1 1 1 0 0 1 1 1 0 1 0 1 1 1
1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1
0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 check sub-matrix row #1
7 matches (odd), CRC bit #1 value: 1

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 check sub-matrix row #2
6 matches (even), CRC bit #2 value: 0

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 check sub-matrix row #3
7 matches (odd), CRC bit #3 value: 1

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 check sub-matrix row #4
7 matches (odd), CRC bit #4 value: 1

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 0 1 1 1 0 0 1 1 1 0 1 0 1 1 1 check sub-matrix row #5
6 matches (even), CRC bit #5 value: 0

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1 check sub-matrix row #6
8 matches (even), CRC bit #6 value: 0

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1 check sub-matrix row #7
7 matches (odd), CRC bit #7 value: 1

1 1 1 0 1 1 1 0 0 1 1 1 1 0 1 1
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 check sub-matrix row #8
no matches (zero is even), CRC bit #8 value: 0

By the way, I used a short Octave script to compute the CRC string.

This intercept illustrates a type of Russian Fleet HF procedure: a brief voice hail on 8439 kHz to establish contact and negotiate a shift frequency, followed by short FSK 300Bd/500Hz data bursts on 9100 kHz carrying the operational traffic. The callsign roles and QSY direction are consistent with a doctrine that differs structurally from the NATO FAB/BRASS model, with the mobile unit dictating the shift and the shore station absorbing the RF exposure.
Thanks to Mario for sharing the KiwiSDR recordings that made this analysis possible.

https://disk.yandex.com/d/mgLcnpLJOLGS9Q

(1) Greyder asked the question and Volnoboy answered it. Greyder heard the response and moved to 9100 kHz to transmit its data traffic, but most likely the HF skip zone completely hid Volnoboy's voice from the KiwiSDR in Japan. The Japanese receiver was likely sitting in a dead zone where Volnoboy's signal skipped over the antenna, while Greyder's signal — transmitted from a different position — had a more favorable propagation path.

[2]  http://i56578-swl.blogspot.com/search/label/FSK%20300Bd%2F500

CIS 20Bd/7000 Wide FSK

In the world of HF, spectral efficiency is usually the gold standard. Modern digital modes strive to pack as much data as possible into narrow bandwidths. However, when monitoring tactical networks originating from the CIS (Commonwealth of Independent States) region, we may encounter a signal that flips this paradigm entirely: the 20Bd/7000 Wide FSK waveform. Operating at a "glacial" 20 Baud but utilizing a massive 7000 Hz frequency shift, this waveform intentionally sacrifices spectral real estate.
On a standard SDR waterfall display, the CIS 20Bd/7000 is highly distinctive yet easily misidentified by automated classification algorithms. Instead of a single coherent data stream, it appears as two completely detached Continuous Wave (CW) carriers separated by a 7 kHz void (Figure 1).
I recently heard this waveform on 25th June at about 2235 UTC on 6945.0 kHz (CF) using the remote AirSpy SDR receiver managed by EA1FAQ in Spain, whom I wish to thank. 

Fig. 1: CIS 20Bd/7000 Wide FSK

Technical Specifications & RF Fingerprint (Figure 2):
Modulation: Frequency Shift Keying (FSK / F1B), Lower tone: 6941.5 kHz, Upper tone: 6948.5 kHz, Center freq: 6945.0 kHz
Symbol Rate: 20 Baud (Symbol duration: 50 ms)
Shift (Δf): 7000 Hz (±3500 Hz from center)
Modulation Index β = fm/​Δf ​= 20/7000 ​= 350
Primary Users: Russian / CIS Military and Diplomatic Networks

Fig. 2: main FSK technical parameters (shift & speed)

Apart from the center frequency noted here (6945.0 kHz), this same transmission can be observed on various other frequencies around 7 MHz, acting as an intruder and causing interference within the corresponding amateur radio band, as regularly documented by the IARU Monitoring System (IARUMS). Specifically, I observed a "twin" transmission at 9966.5 kHz. While it is difficult to establish whether both originate from the same transmitter site, their signal strengths on the waterfall display are nearly identical, suggesting they might be emitted from antennas with different take-off angles.

An intriguing aspect captured in Figure 3 is the simultaneous ±1500 Hz offset from the center frequency of both transmissions, with the signals returning to their baseline values within a few minutes.

Fig. 3 : simultaneous ±1500 Hz offset from the center frequencies

Such a deterministic and simultaneous shift points to two likely scenarios. The first is that this offset is pre-programmed by design, requiring the receiving modem to have prior knowledge of the transition to maintain carrier lock and ensure uninterrupted demodulation. Alternatively, if no prior agreement exists, the receiving system must employ an aggressive Automatic Frequency Control (AFC) or a wide DSP tracking loop capable of instantly detecting the energy shift and re-synchronizing within milliseconds.

By appropriately filtering the signal, it can be easily demodulated using the Signals Analyzer (SA) FSK demodulator. The resulting bitstream—at least in this sample—features a continuously repeating 255-bit pattern (typical of an 8-bit LFSR, 2^8 −1), as shown in Figure 4. However, the pattern does not appear to be generated by a polynomial.

Fig. 4: 255-bit period demodulated bitstream

To confirm this finding, I retrieved two additional recordings of this signal from separate YouTube channels. In both samples, the demodulated bitstreams exhibited the exact same characteristic (a 255-bit pattern length). However, analyzing further recordings could help to better characterize the payload.

Fig. 5: comparison of 3 demodulated bitstreams

Why Spend 7 kHz on 20 Baud?
This signal is engineered for high-availability survivability in contested environments. Using a massive 7000 Hz shift in HF FSK modulation deliberately trades away channel space to achieve near-indestructible reliability. Here is the breakdown of why it is used:

- Beating Ionospheric Fading. The ionosphere often creates narrow "dead zones" in the spectrum. By separating the two signaling tones by 7 kHz, it is statistically impossible for a single ionospheric drop-out to wipe out both frequencies at the same time. If one tone dies, the other gets through.

- Crushing Electronic Jamming. Spreading a slow data rate across such a massive frequency gap creates a huge modulation index. To block the signal, an adversary has to dilute their jamming power across a wide 7 kHz swath, making the jamming highly ineffective.

- Immunity to Doppler Drift. In unstable conditions (like polar regions or solar storms), frequencies can drift by tens of Hertz. For narrow shifts, this blends the tones together; for a 7,000 Hz shift, a 50 Hz drift is completely negligible.

- Signal Obfuscation (Stealth). Because it spans a bandwidth wider than a normal 3 kHz HF intercept receiver's window, an operator or automated classifier looking at a standard waterfall display will simply see isolated, alternating CW (Continuous Wave) pulses separated by a massive gap. It effectively hides its identity as a unified, synchronized FSK data stream, making it harder to automatically classify, intercept, or parse unless the intercepting party knows exactly what to look for.

The CIS 20Bd/7000 is a textbook example of Soviet-legacy military engineering surviving into the modern era. It prioritizes absolute link reliability and Electronic Counter-Countermeasures (ECCM) over spectral efficiency, providing a robust, jam-resistant command link that remains a frequent sight on the HF bands for modern SIGINT monitors.

https://disk.yandex.com/d/iwfwZCwjPiNq9Q