QuadRF can spot drones and see WiFi through my wall

QuadRF can spot drones and see WiFi through my wall

QuadRF 可以探测无人机并透过墙壁“看见” WiFi

The QuadRF (pictured above) is a phased-array radio built around a Raspberry Pi 5 and an FPGA board with picosecond-level timing. It does advanced signal processing and beamforming. It can see WiFi through walls and track drones in flight. If the open source community can come up with something like this, just imagine what governments are capable of.

QuadRF(如上图所示)是一款基于树莓派 5 (Raspberry Pi 5) 和具备皮秒级定时功能的 FPGA 板构建的相控阵无线电设备。它能够进行高级信号处理和波束成形。它不仅能透过墙壁“看见” WiFi 信号,还能追踪飞行中的无人机。如果开源社区都能开发出这样的设备,那么政府的能力可想而知。

When you plug a computer into a network, tools like Wireshark can show all the hidden traffic you might not even know is there. WiFi packets are the same, but those travel through the air, allowing snooping without physical access. The QuadRF has built-in software that can stream and decode RF, and you can pipe it out to a more powerful computer for things like WiFi traffic analysis.

当你将电脑接入网络时,Wireshark 等工具可以显示出你可能根本察觉不到的隐藏流量。WiFi 数据包也是如此,但它们在空气中传播,这使得无需物理接触即可进行监听成为可能。QuadRF 内置了可以流式传输和解码射频信号的软件,你可以将其输出到性能更强的计算机上,用于 WiFi 流量分析等任务。

I mention this not to scare you—governments have had tools like these for years. It’s just better to know what’s possible and expose bad security practices than to ban useful tools like these. So if you’re in the CIA, don’t get any ideas.

我提到这一点并不是为了吓唬你——政府多年来一直拥有此类工具。了解可能发生的情况并揭露糟糕的安全实践,远比禁止这些有用的工具要好。所以,如果你是 CIA 的人,别动什么歪脑筋。

To the Moon

奔向月球

After spotting QuadRF on Hackaday, I reached out to Martin McCormick, who’s been working on QuadRF as part of a bigger project: a Moon-scale antenna array, capable of EME (Earth-Moon-Earth) radio experiments and radio astronomy. I think Martin took inspiration from Dishy, SpaceX’s original Starlink terminal. (Makes sense, since Martin worked at SpaceX on the team that built Dishy!)

在 Hackaday 上发现 QuadRF 后,我联系了 Martin McCormick。他一直在开发 QuadRF,这是他更大项目的一部分:一个“月球级”天线阵列,能够进行 EME(地月地)无线电实验和射电天文学研究。我认为 Martin 的灵感来源于 SpaceX 最初的星链终端 Dishy。(这很合理,因为 Martin 曾在 SpaceX 的 Dishy 开发团队工作!)

Instead of locking this phased array antenna system into a proprietary satellite system, licensed operators will ideally be able to chain multiple QuadRF modules together for interesting radio experiments, with up to 1.15 MW EIRP—basically, a massive amount of directional antenna gain, for high power RF fun.

与其将这套相控阵天线系统锁定在专有的卫星系统中,不如让持证操作员能够将多个 QuadRF 模块串联起来,进行有趣的无线电实验,其等效全向辐射功率 (EIRP) 可高达 1.15 兆瓦——这基本上意味着巨大的定向天线增益,可以享受高功率射频带来的乐趣。

But QuadRF is scaled down to handheld-size, and while it isn’t powerful enough to send a signal to the moon, it’s still quite useful in local SDR applications and visualizing the RF environment—at least in its frequency range of 4.9-6 GHz.

不过,QuadRF 被缩小到了手持尺寸。虽然它的功率不足以向月球发送信号,但在本地软件定义无线电 (SDR) 应用和射频环境可视化方面仍然非常有用——至少在其 4.9-6 GHz 的频率范围内是如此。

Testing QuadRF

测试 QuadRF

But I specifically asked Martin if he’d be willing to send over a prototype QuadRF for my Dad (a retired broadcast radio engineer) and I to test. I had already placed a pre-order on Crowd Supply (where a basic kit is $499), but I wanted to see if QuadRF was really as useful or intuitive as it seemed from the videos ScaleRF posted.

我特意询问 Martin 是否愿意寄送一台 QuadRF 原型机给我和我父亲(一位退休的广播无线电工程师)进行测试。我已经在 Crowd Supply 上预订了一台(基础套件售价 499 美元),但我还是想亲眼看看 QuadRF 是否真的像 ScaleRF 发布的视频中看起来那样有用且直观。

Spoilers: it’s still a little rough in the UI department, but I was blown away by how well it works. Especially considering everything’s running on a Raspberry Pi 5. When you turn it on, the Pi boots up and creates a WiFi hotspot. You connect to that, and visit http://quadrf/. That page runs a VNC session in your browser, where you can launch apps from GNU Radio to SDR software, and even their custom AR (Augmented Reality) RF visualizer.

剧透一下:它的用户界面 (UI) 还有点粗糙,但它的工作效果让我大吃一惊。考虑到所有功能都是在树莓派 5 上运行的,这尤其令人印象深刻。当你打开电源时,树莓派会启动并创建一个 WiFi 热点。你连接该热点并访问 http://quadrf/,页面会在浏览器中运行一个 VNC 会话,你可以在其中启动从 GNU Radio 到 SDR 软件的各种应用程序,甚至包括他们定制的 AR(增强现实)射频可视化工具。

The AR visualizer is the most interesting included software, despite being less useful for real-world SDR applications. The UI is a little rough, but you can adjust the alignment between your camera and the phased array, and the gain of the receiver. Then it will visualize frequencies from 4.9-6 GHz as colorful ‘blobs’.

AR 可视化工具是内置软件中最有趣的一个,尽管它在实际的 SDR 应用中实用性稍弱。UI 虽然有些粗糙,但你可以调整摄像头与相控阵之间的对齐方式以及接收器的增益。随后,它会将 4.9-6 GHz 的频率可视化为彩色的“斑点”。

The scale is not shown on the display in this early version, but from my testing around the studio, my 5 GHz WiFi network (which was running on Channel 100, or around 5.5 GHz) showed up light blue. Neighboring WiFi networks were showing up red or green.

在这个早期版本中,显示屏上没有标尺,但根据我在工作室周围的测试,我的 5 GHz WiFi 网络(运行在 100 信道,即 5.5 GHz 左右)显示为浅蓝色。邻近的 WiFi 网络则显示为红色或绿色。

If you order the Mobile Expansion Pack, it incorporates a battery power pack, and a handheld phone mount, so you can walk around analyzing part of the C-band in real-time. My Dad and I flew his DJI Mini Pro 4 behind the studio, and the QuadRF had no trouble picking it out of the sky. As it flew away, I had to increase the gain to keep seeing it; it would be nice to have AGC or an easier gain control as the UI was a little clunky when carrying around the contraption.

如果你订购了移动扩展包,它会包含一个电池组和一个手持手机支架,这样你就可以四处走动,实时分析 C 波段的部分频段。我和父亲在工作室后面放飞了他的 DJI Mini Pro 4,QuadRF 毫不费力地就在天空中捕捉到了它。当无人机飞远时,我必须增加增益才能继续看到它;如果能有自动增益控制 (AGC) 或更简便的增益调节方式就更好了,因为在携带设备走动时,UI 操作显得有些笨拙。

It sounds like the crowdfunding campaign is already beyond expectations, and they’ll be switching the enclosure to an injection mold (the version I have is 3D printed).

听起来众筹活动已经超出了预期,他们将把外壳改为注塑成型(我手里的版本是 3D 打印的)。

Raspberry Pi 5 MIPI for high-bandwidth RF

用于高带宽射频的树莓派 5 MIPI 接口

One aspect that intrigued me was the use of the Raspberry Pi’s MIPI lanes for low latency SDR streaming I/Q (In-phase/Quadrature) at data rates over 5 Gbps. From the QuadRF Documentation: The novel approach of streaming I/Q over the Pi’s camera and display FFC MIPI connectors has many benefits. MIPI can handle >5 Gbps, low-latency, full-duplex data transfer through the Pi’s RP1 chip. It is simpler and more reliable than USB, adds almost zero hardware cost to the RF board, and can sustain hundreds of MSPS of I/Q with no hiccups or sample loss.

有一个方面引起了我的兴趣,那就是利用树莓派的 MIPI 通道进行低延迟的 SDR I/Q(同相/正交)流传输,数据速率超过 5 Gbps。根据 QuadRF 的文档:通过树莓派的摄像头和显示器 FFC MIPI 接口流式传输 I/Q 数据的新颖方法有很多好处。MIPI 可以通过树莓派的 RP1 芯片处理超过 5 Gbps 的低延迟、全双工数据传输。它比 USB 更简单、更可靠,几乎不会增加射频板的硬件成本,并且可以维持每秒数百兆采样 (MSPS) 的 I/Q 数据流,且不会出现卡顿或采样丢失。

Considering cameras and displays are the ultimate form of high-bandwidth signal streaming, it makes sense their standard digital interface is a great match for SDR! We think the industry should adopt it more widely!

考虑到摄像头和显示器是高带宽信号流传输的终极形式,它们的标准数字接口非常适合 SDR,这很有道理!我们认为业界应该更广泛地采用这种方案!

It sounds like they had to reverse-engineer the MIPI protocol used on the Pi 5 to do this (since it goes through the RP1 chip), and the way it’s architected, you can daisy-chain multiple QuadRF modules together, letting each module calculate its own phase shift. I’m not sure how that will work in practice, but it sounds pretty neat. PCIe could probably work in a pinch, too, but this implementation frees up the PCIe connector in case you want high speed storage or even higher speed networking than the Pi offers.

听起来他们为了实现这一点,不得不对树莓派 5 上使用的 MIPI 协议进行逆向工程(因为它通过 RP1 芯片)。按照这种架构,你可以将多个 QuadRF 模块串联起来,让每个模块计算自己的相移。我不确定这在实践中效果如何,但听起来非常巧妙。PCIe 在紧急情况下可能也能用,但这种实现方式释放了 PCIe 接口,以备你需要高速存储或比树莓派原生接口更快的网络连接。

Conclusion

结论

As with all pre-production gear I test, take everything I’ve shown with a grain of salt. And with any crowdfunding campaign, if you back it, don’t expect the QuadRF to show up on your doorstep overnight. I was initially skeptical about how useful and fun this little handheld phased array could be, but after using it for a week, I can’t wait until the one I pre-ordered ships!

和所有我测试的预生产设备一样,请对我的展示内容保持审慎态度。对于任何众筹活动,如果你参与了支持,也不要指望 QuadRF 会在一夜之间送到你家门口。起初,我对这个小型手持相控阵的实用性和趣味性持怀疑态度,但在使用了一周后,我已经迫不及待地想收到我预订的那台了!