SkyOFDM, still on air

Since some days I'm following transmissions on 14693.0 KHz/USB consisting of exchanges of messages between two nodes, as the different fading patterns in Figure 1 suggest.

Fig. 1

Messages are sent using OFDM modulation occupyng a 2400 Hz bandwidth and consisting of 28 tones with a frequency spacing of ~86 Hz, each tone is modulated using PSK2 at the symbol rate of 62.6 Bd (Fig. 2). The same results are obtained/verified by analyzing a single channel as shown in Fig. 3 (lowest tone).

Fig. 2 - OFDM parameters

Fig. 3 - single tone (yhe lowest) analysis

The parameters resulting from the analysis are very similar to those of the Skysweep Technologies proprietary "SkyOFDM" waveforms family (Table I). Quoting the SkySweeper Reference Manual #82.2 General Description: "SkyOFDM is a state of art high speed modem based on the OFDM and turbo coding technologies. It offers several baud rates (300 -9600 bps) and two different interleaving options (short and long). Also there are two bandwidth options: 2.0 (OFDM-22) and 2.4 kHz (OFDM-28)".

Table I

Note the different number, position and duration of the header tones compared to the values ​​of the "original" waveform: this is probably an improved version of the previous SkyOFDM waveforms (Figure 4). 

Fig. 4

The signal has an ACF value of approximately 957.8 ms which identifies a super-frame composed of 11 frames, the latter with an ACF value of approximately 79.8 ms (Figure 5).

Fig. 5 - ACF values

Direction Finding tests using TDoA algorithm (Figure 6) indicate an area north of Helsinki as the site of the transmitter (or rather, the radiating antenna): this makes sense because, acccording to some DXers, SkyOFDM waveforms were/are used by Finnish MFA and SkySweep Technologies was a Finnish high tech company. By the way, although there are still many references in the web to SkySweep, their official website is no longer online since SkySweeper software was discontinued on June 1st 2009.

Fig. 6 - Direction Finding

 https://disk.yandex.com/d/A9UHdyMAXeOUlA

CIS FTM-4 transitions

CIS FTM-4 (FTM stands for Frequency-Time Matrix) is an unknown Russian "domestic" system, also known as CIS 4FSK 150 Bd, using MFSK4 150Bd/4000Hz modulation.
The recorded transmission consists of two alternating FTM-4 sets (L = lower set, H = higher set) with a total bandwidth occupation slightly over 25 KHz, the separation between the two sets (i.e. H1-L4) is 1 KHz. It's worth noting that when the L set is transmitted, the signal on the H1 frequency (i.e. the lowest of the H set) is continuous; vice versa, when the H set is transmitted the signal on the L1 frequency (i.e. the lowest of the L set) is continuous (Figure 1). Also note that the two sets are transmitted simultaneously forming a sort of MFSK-8 "construct" for a period of about 3 seconds.

Fig. 1 - the two FTM-4 "sets"

As for FMT-4 specifications, both the MFSK4 sets are modulated at the rate of 150 Baud with a spacing of 4000 Hz (Figure 2).

Fig. 2 - CIS FTM-4 main parameters

The L set has an ACF value of ~718 ms which corresponds to a repeated sequence of 216 bits length (assuming that MFSK4 uses 2 binary digits (dibit) per modulation symbol (0-3), the ACF value of 718 ms @150 symbols/sec corresponds to a period of 108 dibit symbols or 216 bits). I could not find a specific generator polynomial for that sequences.

Fig. 3

The study of the ACF value of the set H can be done on three different intervals: main, intermediate and unitary (Figs. 4, 4b). 

Fig. 4

 

Fig. 4b

 

The main ACF measures about 1920 ms which corresponds to a period of 288 symbols or 576 bits (Figure 5).

 

Fig. 5

The intermediate ACF measures about 480 ms which corresponds to a period of 72 symbols or 144 bits (Figure 6).

 

Fig. 6

The unitary ACF has a value of ~80 ms which corresponds to a period of 12 symbols or 24 bits (Figure 7).

Fig. 7

In this case (H set) it is possible to see that the demodulated bitstream consists of a repeated scheme formed of 4 patterns, as in Figure 8:

(MSB first)
P1: 0x21BE41
P2: 0xB1BE41
P3: 0xB8D727
P4: 0x28D727 

Fig. 8

 

N.B. all the the "designations" I used here are only mine; the first pattern P1 is chosen just for convenient reference, choosing a different initial pattern the "logic" does not change.

A possible interpretation (just a guess) is that the L set is transmitted as "idle" or alignment sequence for the receiving modem and the transition to the H set occurs when sending data, even if, as in this case, the data are repetitive sequences. In this regard, remaining in the realm of hypotheses, the P1-P4 patterns could be telemetry data or tele-commands.

The recording was made using a remote Airspy HF+ Located in Haapavesi, Finland (belonging to the Airspy server network) [1].

https://disk.yandex.com/d/Flr5-Ops8dRBJQ

[1] sdr://178.55.138.222:5000

unid PSK2/FSK2 combined bursts

This is a very interesting transmission heard on 14736.5 KHz/USB which consists of repetitive bursts lasting about 12.6 s and separated by an interval of 1300 ms. The most interesting aspect is that a "combined" waveform is used, that is, a first segment with PSK2 modulation followed by a second segment with FSK2 modulation: both the segments are modulated at the same rate of 31 bps (Figure 1).

Fig. 1 - PSK2/FSK2 "combined" waveform

An interesting feature that my friend cryptomaster pointed out is the PSK2 mode, where the bitstream is transmitted in single bits: this feature can be seen in Figure 2 using both the "oscilloscope" function and the AM demodulator of SA. The demodulation of this bit-keying mode is complicated, apparently due to the division of the carrier into separate bits.

Fig. 2 - PSK2 segment

The FSK2 segment modulation uses a shift of about 370 Hz (measured 373) and the resulting bitstream after demodulation has an 8N1 framing which appears to be transmitted in reverse polarity (Figure 3).

Fig. 3 - FSK2 segment

The interesting things about this curious transmission don't end here: going back to the previous posts I discovered that the FSK2 segment carries exactly the same content as the 50Bd/612 FSK2 bursts analyzed some months ago [1] and compared in Figure 4.

Fig. 4 

So, it's likely the same (unid) user, maybe experimenting with different waveforms... who knows.

The PSK2 segment too probably carries the same content of the FSK2 segment, unfortunately demodulation with SA was not successful due to the particular mode which is here used.

https://disk.yandex.com/d/HV3j9zdSSRqLww

[1] http://i56578-swl.blogspot.com/2024/11/unid-fsk-50bd612-bursts.html

unid FSK 6Bd/50

No, it's not a typo: this FSK signal (kindly sent me by my friend cryptomaster) is really modulated at the speed of 6 Bd and 50Hz shift (Figs. 1,2).

Fig. 1 - modulation speed

Fig. 2 - 50Hz shift

The demodulated bitstream has a period of 696 bit (Figure 3): we do not know the source and the user.

Fig. 3 - 696 bit period

https://disk.yandex.com/d/d3Arg5sX2rXwhA

 

T-219 "Yachta", analog voice scrambler

Thanks to my friend Mario, who recently sent me some recordings, I had the opportunity to study the Russian T-219 system, codenamed "Yachta" (Russian: ЯХТА). Yachta is a Russian analog voice scrambler featuring a Frequency Shift Keying (FSK) signal transmitted in the center of the spectrum, with the encrypted voice stream split above and below the FSK signal (Figure 1). Although dating back to the Cold War era, the system is still used for tactical communication in the combat field as recordings are only a few days old and heard in the lower VHF range (just above the upper HF limit). The stream consists of unequal time segments, within which the two voice subchannels are swapped and inverted.

Fig. 1 - T-219 "Yachta" signal

The FSK signal is used as a synchronization sequence and is transmitted at a rate of 100 bps with a 150 Hz shift (Figure 2).

Fig. 2 - T-219 FSK parameters

As shown in Figure 3, after FSK demodulation the resulting synchronization bitstream is an M-sequence based on the irreducible polynomial x^52+x^49+1.

Fig. 3 - the M-sequence based on the irreducible polynomial x^52+x^49+1

It turned out that during the formation of the FSK signal the pahses of the two frequencies are preserved after each "shift" (Figure 4 shows two periods): that suggests that it's formed by switching (mechanically or electronically) two independent F1 F2 frequency generators which bear some inter-relationships or by using a VCO system.

Fig. 4 - two periods of the FSK frequencies

By the way, looking at the durations of two periods:
F1 = (2:0.001285470) = 1555,851167277338
F2 = (2:0,001422470) = 1406,005047558121
the shift is just about 150 Hz

https://disk.yandex.com/d/M60fqwh32SbNFQ