Android Fragment RX TX

This tab is used to:

• Capture data from your PandwaRF
• Transmit data via your PandwaRF

Parameters to be defined before use

Using synchronous mode

• [RX & TX] Frequency in Hz: The range is [300-348]MHz, [391-464]MHz and [782-928]MHz.
• [RX] RX filter BW in KHz [Valid when expert mode is activated]: Receiver Channel Filter Bandwidth : To optimize performance, it's recommended to select a channel filter bandwidth where the signal bandwidth occupies at most 80% of the channel filter bandwidth. If the RX capture with Auto value produces incorrect results (a lot of 0), it likely indicates that the frequency value is not centered on the signal you are trying to capture. The solution may involve adjusting the frequency or increasing the RX Filter BW, though the latter may capture additional side signals. The acceptable range is [54-750 KHz].
• [RX] RX RSSI threshold in dBm: This parameter establishes the target RSSI threshold, allowing data capture when its RSSI surpasses this specified value.
• [RX & TX] Modulation: 2-FSK, 4-FSK, GFSK, MSK, ASK, and OOK modulation formats are supported.
• [RX & TX] Deviation in Hz: In the case of FSK/GFSK modulation, the DEVIATN register specifies the anticipated frequency deviation of the incoming signal in RX. It is crucial for this deviation to match the RX deviation of the incoming signal to ensure reliable and robust demodulation.
• [RX & TX] Data rate in bps: When performing data capture, ensure the data rate does not exceed 10,000 Bits/s. It's crucial to be aware of the target device's data rate for optimal results. For additional information, refer to Data Rate Measurement.
• [TX] Repeat: 0 (no repetition)
• [RX] Desired Payload: Specify the number of bytes you wish to capture. This parameter is only applicable for RX. The capture duration will be : Desired Payload x Data rate seconds.
  • If value is too low, captured sequence may not be complete.
  • If value is too high, PandwaRF app will not stop the capture by itself and you will have to stop it manually.

The Desired Payload is only used to indicate to PandwaRF how many bytes to capture. When PandwaRF transmits data, it sends all data currently present in the Data section.

• Captured Payload: indicates the number of bytes already captured
• Frame Length:
  • In RX mode: you can specifiy the size of the packet that the CC1111 transceiver needs to capture before sending it to Android Application.
  • In TX mode: This indicates how data present in the Data section will be split into smaller chunks and sent to CC1111 for RF transmission. Be aware that there will be some blank data between 2 split chunks.

Using asynchronous mode (Only for V4)

• [RX & TX] Frequency in Hz: The range is [300-348]MHz, [391-464]MHz and [782-928]MHz.
• [RX] RX filter BW in KHz [Valid when expert mode is activated]: Receiver Channel Filter Bandwidth : To optimize performance, it's recommended to select a channel filter bandwidth where the signal bandwidth occupies at most 80% of the channel filter bandwidth. If the RX capture with Auto value produces incorrect results (a lot of 0), it likely indicates that the frequency value is not centered on the signal you are trying to capture. The solution may involve adjusting the frequency or increasing the RX Filter BW, though the latter may capture additional side signals. The acceptable range is [54-750 KHz].
• [RX] RX RSSI threshold in dBm: This parameter establishes the target RSSI threshold, allowing data capture when its RSSI surpasses this specified value.
• [RX & TX] Modulation: 2-FSK, ASK, and OOK modulation formats are supported.
• [RX & TX] Deviation in Hz: for 2-FSK modulation.
• [TX] Repeat: 0 (no repetition)

When using asynchronous mode for data capture, the data rate will be automatically determined and displayed for each capture block.

Capture and transmit data

• Capture: Send a capture data order to the PandwaRF dongle using the specified setup parameters.
• Transmit All: Transmit the data displayed below this button using the specified setup parameters.
• Clear: Erase RX/TX data buffer (Android side)

Details on RF data reception

It's important to note that every RF data requested for capture by PandwaRF will then be transmitted to the phone using a Bluetooth Smart (BLE) connection. This connection is relatively slow and depends on what smartphone you have (see Measuring the throughput of the BLE link between your Android phone and PandwaRF).

So, capturing data at the correct rate is crucial. A correct rate entails balancing it:

• Not too high to avoid wasting bandwidth and potentially overloading the BLE link.
• Not too low to prevent capturing inaccurate data (missing bits due to under-sampling).

To measure the data rate of the RF device you want to sniff, check Rx Data Rate Measurement.

Step by step for capturing RF data from a keyfob

Find the frequency of the keyfob to capture

• Always try to know the center frequency onto which the keyfob is transmitting (!).
• Setting the correct frequency has an impact on RX data (of course). The less you know the exact frequency, the more you need to increase the RX channel filter bandwidth to get a chance to capture the keyfob signal. But you also get more RF noise...
• For example 433 MHz is not enough information, you need to know if it is 433.42 MHz, 433.92 MHz, etc...
• If you don't know exactly the frequency, you will need to fine tune the RX channel filter bandwidth and increase it step by step until you receive correct data. Data is assumed correct when it is not all zeros.
• As a general rule, 80% of the signal to capture shall be within Frequency +/- RX channel filter bandwidth. Quoting the CC1111 specification: "For best performance, the channel filter bandwidth should be selected so that the signal bandwidth occupies at most 80% of the channel filter bandwidth."

If you think it is around 433.x, but don't know really, I suggest try 433.92 with a RX filter bandwidth set to 150KHz.

Note: You can measure the exact frequency by using the PandwaRF Spectrum analyzer. You can measure the exact frequency by using the PandwaRF Spectrum analyzer. It is less precise than a SDR, but it should do the trick.

Modulation

You also need to know what is the modulation. Keyfobs are mostly OOK, but we have also seen PSK or 2-FSK.

Data rate

• Measure the keyfob data rate by pressing the data rate "Measure" button. Press keyfob button to force transmission until data rate stops changing.
• Increase desired payload to 250 bytes to be sure to receive enough data. You can always reduce it later if you see your keyfob transmits less than 250 bytes.

Start the capture

Press Sniff button and wait until PandwaRF is ready (status is "Receiving") Force transmission by pressing the keyfob button

The data captured should look like some random data.

• If there is no data captured, it means that the frequency is not correct at all.
• If you get all zero, it means that frequency is almost correct, or RX filter bandwidth is too small. In both cases, try again with another frequency/RX filter bandwidth as described previously.

Note: You need to be out of range of the keyfob receiver (aka car), as you don't want the code to be sent by the keyfob to be captured and used/invalidated by the car. Otherwise it will no more be valid when replayed by the PandwaRF.

What to do with your captured data

• Link to button: pressing a button will copy a previously captured data into the PandwaRF internal memory associated to a button (1 to 4 slots). You can then use this data by pressing the physical button on the PandwaRF board (not convenient since you have to open the enclosure, or navigate to Bus Service Extended page (not very easy too since you have to enable GodMode). Todo: make this button usage easier.
• Post to API: you can send the captured data to your own server for processing. Cf. RX Data Post Rest API
• Save: save captured RX data to Android data storage
• Load: load RX data from Android data storage
• Delete all: erases previously saved RX data from internal storage. Be careful if you want to keep some data...

Captured data

For sync capture, the whole data is divided according to different criteria:

• The length of suit of 0 exceed 150ms
• 2 seconds of latencies between 2 radio signals received
• Max size of a chunk is reached (512 bytes)

For async capture data is divided when:

• When a pulse bigger than 20ms is received, that value could be configured from the settings
• 500ms of latencies between 2 radio signals received
• Max size of a chunk is reached (sum of received pulses reach 1 second)