12 November 2026

FSK signals with 24/32-bit frames and a constant last bit: a possible Russian origin

tags: ,
Cryptomaster kindly provided a recording of an FSK signal at 250/500 Bd with a mark/space shift of 1000 Hz. After reading the analysis of that signal published on the blog [1], he sent a second email: he had forgotten to send another recording, made on the same frequency a few hours earlier. This too turns out to be an FSK signal with a shift of 1000 Hz, at 150/300 Bd. Both signals are binary FSK with the same 32-bit frame structure. Moreover, in both signals the initial portion, consisting of a repeated "01" sequence, is modulated at half the rate of the data segment.
This second email prompted a search of the blog for those FSK signals characterized by a frame length of 24 or 32 bits with the peculiarity of having the last bit at 0 or, equivalently, the last column of the demodulated bitstream with all bits at 0; the purpose of this post is to provide an up-to-date overview of these types of signals. The results are reported in Table I (ordered by date) where, for ease of reading, the waveforms encountered are labeled as WFn; the first and the second recording received from Cryptomaster are WF6 and WF5, respectively. In this post the analysis of WF5, not yet published, is reported in full, while that of WF6, already published on the blog, is summarized here for completeness. The results for WF1-WF4, also published on the blog, are not repeated.

Note: the table does not claim to be exhaustive by any means, since the signals studied are those occasionally encountered or sent by friends and colleagues. A search for the coding has not yet been carried out for WF5 and WF6 (empty cells in the Code column).

Figure 1: Spectrograms of WF5 (top) and WF6 (bottom), recorded on the same frequency and in same date

WF6
The data segment and the trailing portion, presumably sync since it carries no information, are modulated at 500 Bd, while the initial "01" portion is modulated at 250 Bd. Both the keying rates and the function of each segment are confirmed by the demodulated signal. In particular, the data segment exhibits a periodicity of 64 ms, which at 500 Bd corresponds to a period of 32 bits. This periodicity is produced by a constant bit position, visible as a solid column of identical bits, while the trailing segment shows a fixed pattern repeating every 32 bits. The bitstream of WF6 was obtained with the generic FSK demodulator of SA (Signals Analyzer), so both the bit shift (i.e., "where does the frame start?") and the polarity ambiguity must be taken into account. Once the polarity is inverted and the bits are shifted accordingly, the data segment reveals a phasing bit, i.e., a bit with a fixed value at a fixed position in every frame, which appears as the last column of 0s. The bitstream, already published on the blog, is reproduced in Figure 2 for ease of reading.

Figure 2: Demodulated bitstream of WF6 displayed with a 32-bit period, one frame per row. The last column has a constant value of 0 (phasing bit).

Since the information lies in the transitions between consecutive bits rather than in absolute mark/space values, the question arises of whether differential decoding should be applied. Differential decoding removes the polarity ambiguity, and it could reveal a hidden structure if the transmitter uses differential (NRZI-like) encoding. It does not solve the bit shift, though.
A parity test over the full 32-bit frame of the differentially decoded bitstream of WF6 returns 100% success for even parity at a single start-bit offset, the one aligned with the phasing bit column. This is not an independent confirmation: XORing all the differential bits of a frame leaves only the XOR of the two bits at the frame boundary, which lie in the same column. If that column is constant, as the phasing bit is, the parity is necessarily even. The two readings are therefore equivalent: a raw bitstream with a constant bit position, or differentially encoded frames carrying an even parity bit (31 data bits plus 1 parity bit). Both produce the same raw bitstream, so the data alone cannot distinguish between them.
A rank test over the differentially decoded 32-bit frames of WF6 reveals a single parity relation, the even parity over the whole frame, and no other, so no further structure is evident in this capture. As discussed above, this relation is equivalent to the constant last bit. The number of captured frames is not sufficient to test longer or interleaved codeword structures, and therefore to formulate more consistent hypotheses on the coding.

WF5
This is also a dual-rate FSK signal (see Figure 3): the initial "01" sequence is sent at 150 Bd, followed by the payload transmitted at 300 Bd. The shift is constant across WF5 and WF6, namely 1000 Hz.

Figure 3: Spectrograms of the dual-rate FSK transmission WF5, with a 1000 Hz mark/space shift. Top: full capture. Middle: detail showing the keying-rate lines at 150.15 Hz and 299.93 Hz, corresponding to the 150 Bd "01" preamble and the 300 Bd payload. Bottom: keying-rate measurement (Br = 150.15 Bd) on the preamble segment, with a measured shift dF = 999.41 Hz.
 
Once WF5 is demodulated, the frame structure emerges clearly: a 32-bit period characterized by a last bit with a constant value of 0 (Figure 4). This is exactly the same framing as WF6. After differential decoding, the parity test on WF5 also returns 100% success for even parity at a single start-bit offset, the one aligned with the constant last-bit column (Figure 5), as for WF6.

Figure 4: Demodulated bitstream of WF5 displayed with a 32-bit period, one frame per row. The last column has a constant value of 0 (phasing bit), as in WF6.

Figure 5: Parity test on the differentially decoded bitstream of WF5, computed over the full 32-bit frame. Left: decoded bitstream, one frame per row. Right: parity success rate versus start-bit offset, peaking at 100% for even parity at a single offset, the one aligned with the constant last-bit column.

Discussion
All six FSK waveforms have a frame length of 24 or 32 bits and a constant last bit (0); in all of them a parity relation is found after differential decoding: the parity over the whole frame is even. As discussed above for WF6, this relation is equivalent to the constant last bit and is not an independent confirmation of a parity bit. A common coding is established only for the four 24-bit signals (WF1-WF4), which share the H(24,16) code (1); for the 32-bit signals (WF5 and WF6) only the framing is shared.
The keying rate, the shift and the frame length do not appear to be tied to one another. The same keying rates (150/300 Bd) occur with different shifts and frame lengths (WF2, WF3, WF5), and the same shift (1000 Hz) occurs with different frame lengths (WF3, WF5).
Moreover, each of the following pairs differs in a single parameter among keying rate, shift and frame length:

- WF2 and WF3: shift only (500 Hz versus 1000 Hz)
- WF3 and WF5: frame length only (24 versus 32 bits)
- WF5 and WF6: keying rates only (150/300 Bd versus 250/500 Bd, a factor of 5/3)

The single keying rates reported for WF1 (500 Bd) and WF4 (300 Bd) coincide with the higher rate of WF6 and of WF2, WF3 and WF5, respectively.

The 32-bit frames of WF5 and WF6 are the only ones observed with this length, and these are also the most recent signals. It might be tempting to interpret the 32-bit frame as an evolution of the 24-bit one, but this would be premature. WF5 and WF6 were recorded on the same frequency on the same day, so they represent a single observation rather than two independent ones. WF4, a 24-bit signal, was recorded only a few months earlier, so the two frame lengths are not clearly separated in time. Moreover, Table I contains no FSK captures with 24/32-bit frames between WF3 and WF4 (an interval of nearly four years), so it is not possible to exclude that 32-bit frames were already in use during that period. Further captures would be needed to test this possibility.

The two frame lengths differ by exactly one byte (24 bits = 3 bytes, 32 bits = 4 bytes). This may simply reflect a byte-oriented framing, but it could also be related to the coding used, for instance an additional data or check byte. In WF1-WF4 the 24-bit frame carries an H(24,16) code, i.e. 16 information bits and 8 check bits. A code search has not yet been carried out for WF5 and WF6 (Table I), so whether the additional byte carries information or check bits remains an open question.

In the dual-rate signals (WF2, WF3, WF5 and WF6) the ratio between the two rates is 2:1 and the "01" preamble is sent at half the payload rate. This is consistent with a synchronization purpose: longer symbols make carrier and bit-clock acquisition easier on a noisy HF channel, and the alternating pattern maximizes transitions for timing recovery. This is an interpretation, not something the data demonstrates.
 
These observations are consistent with a family of configurations of a single transmission system in which keying rate, shift and frame length (and, possibly, the code) can be selected independently. They are also consistent with different systems sharing the same framing convention, and Table I does not allow distinguishing between the two cases. WF5 and WF6 were recorded on the same frequency and differ only in keying rate, which is what one would expect from experimentation, i.e. trials of different configurations of the same system. This remains a hypothesis: two recordings cannot rule out alternatives such as speed selection by the operator or adaptation to propagation conditions, which would produce the same observations. The other signals were observed on different frequencies, so the configurations are not tied to a single channel. 

As for the origin, two of the signals provide direct evidence. WF2 was located in the Kaliningrad Oblast by TDoA. WF4 was preceded by a voice op-chat in Russian, on a different frequency, in which two operators agree on the frequency to be used for the following FSK message; the message was then received on the agreed frequency (Table I), as a 300 Bd signal with a 500 Hz shift and the 24-bit frame. The language of the operators indicates Russian-speaking users, but by itself it does not locate the transmitter. No direct evidence of origin is available for WF1, WF3, WF5 and WF6. For WF1 and WF3, the H(24,16) code shared with WF2 and WF4 makes a Russian origin more plausible. For WF5 and WF6 only the framing and the relationships among the parameters can be invoked, so a Russian origin remains a hypothesis. A naval user cannot be excluded, but no element in the available data supports it.

Conclusion
The six signals of Table I share a 24- or 32-bit frame with a constant last bit and even parity after differential decoding (a consequence of the constant last bit), and the four 24-bit signals (WF1-WF4) also share the H(24,16) code. The signals differ in keying rate, shift and frame length. WF5 and WF6 share frequency, shift and framing, and differ only in keying rate. The most likely interpretation is a family of configurations of one transmission system, but different systems with a common framing convention cannot be excluded. Direct evidence of a Russian origin is available only for WF2 (TDoA) and WF4 (Russian-language op-chat). Further captures, ideally with direction finding, and a larger number of frames per signal are needed to confirm the hypothesis of a single transmission system and to identify the coding of the 32-bit frames.

To be continued...

Notes
1. The check matrix for the H(24,16) code is generated with the polynomial x^7+x^3+x^2+x+1 
 
1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0   1 0 0 0 0 0 0 0
0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0   0 1 0 0 0 0 0 0
0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0   0 0 1 0 0 0 0 0
0 0 0 1 0 1 1 0 0 1 0 1 1 1 1 1   0 0 0 1 0 0 0 0
0 0 1 1 1 0 0 1 1 1 0 1 0 1 1 1   0 0 0 0 1 0 0 0
1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1   0 0 0 0 0 1 0 0
0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1   0 0 0 0 0 0 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0   0 0 0 0 0 0 0 1

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)