How would I go about analyzing this SDR-captured 300 MHz radio signal?

Question

I am attempting to reverse engineer the signal from a 300 MHz garage signal as a learning experience rather than an exercise in efficiency. My intent is to purchase a 300 MHz broadcaster IC and connect it with a microcontroller so that I can have a neat gadget that controls a few gates. My quest has led me to software defined radio. I purchased the recommended dongle, the R820T, and fired it up. After much tweaking I was able to isolate the frequency.(much happy)

I found the signal, then recorded and extracted the .wav. Then I zoomed into the desired signal from the .wav file in Audacity.

I've heard the 10 digit key (each one in one of two positions) should be readily apparent from the signal.

Can anyone help me understand how I can get the key from this signal or any other tips on deciphering?

Here is the current remote config for this signal:

1. Here is the Multicode 3089 remote that i received the signal from: http://multicoderemotesonline.com/Multi-Code_Remote_3089-11.html

2. Here is the quick start guide I used: http://www.rtl-sdr.com/rtl-sdr-quick-start-guide//

Answer 1

Good work getting a sample into audacity for visual inspection. If I understand correctly, your screenshot shows the raw waveform without demodulation (as opposed to baseband audio after FM/AM/USB/etc demodulation). Some folks mentioned PSK and FM modulations which are similar, so you could try setting your demodulator to FM and capturing a new "baseband" audio sample and putting that into your sound program.

FFT analysis is quite helpful as well against an FM waveform. Depending on your receive software, I like Gnuradio - depending on your technical goals you may or may not find gnuradio palatable but I still recommend it if you will be spending some time doing this sort of work. You can do just about anything with signals in gnuradio.

There's a wonderful signal identification wiki here (link). Most of the pictures shown on the wiki are snapshots of waterfall FFT analyzers, such as those found on GQRX, SDRSharp, gnu radio, etc. Waterfall analysis is hugely valuable because it lets you visualize a FFT over time and observe signal characteristics that are periodic or otherwise hard to see on a 1-d FFT.

In addition to listening to your signal with an FM demodulator, try an AM demodulator, and there's even simpler modulations, some being self-timed, like pulse code modulation. PCM won't have much of a sound but will be easy to pull apart visually in audacity.

One thing that's easily spotted on your signal when viewed in audacity is the phase shift, where the wave crest/trough makes what looks like a reversal or a little wave on top of a wave which indicates a phase shift. This phase shift, when demodulated with an FM/Quadrature demodulator should result in an interesting audio output.

Answer 2

Can anyone help me understand how I can get the key from this signal or any other tips on deciphering?

Well, since you have access to the transmitter, play around with it! What does the signal look like if the code is set to all-0, when individual switches are on 1, when you have two switches at 1 and so forth.

Then, from the signal's shape it's a bit hard to tell, but I think we're clearly seeing phase shifting. This might actually be a design flaw in the transmitter, but it's more likely we're looking at PSK.

The lower frequency component at the beginning of your capture seems to be phase-continous, which makes me wonder whether the changing frequency is actually just due to imperfections (ie. the oscillator of the remote not being really stable); on the other hand, it might be a preamble, so fire up a spectrogram and look at the change in frequency over time.