• Using a Program as audio source under Linux with Pulseaudio

    04/26/2018 at 05:56 0 comments

      Suppose you want to record the audio of just one program or want to redirect it into another program (e.g. GNU Radio) and don't want to use weird third party software that does everything in a black box. That is easily done with a pulseaudio module-combine.


      The tools I will be using here are pactl, pacat and pavucontrol. Under Arch Linux you need to install the packages libpulse pavucontrol.


      1.  load the module-combine into the running sound server and give it a nice name.
        1. pactl load-module module-combine sink_name=combine
      2. Open pavucontrol and set the output of the program which's audio you want to the "Simultaneous output" and the output of the "Simultaneous output" to you default output.
      3. Use pacat or parec to get the samples out of stdout.
        1. pacat -r -d combine.monitor


      In my case i wanted to be able to access the samples via a local UDP connection to use it with the GNU Radio UDP source.

      pacat -r -d combine.monitor | while true; do nc -u localhost 1337; done

      The while loop makes it so that I can stop and start the listening side without having to restart this sending line of code.

      Because this is stereo audio, the samples come in as 2-tuples (aka. vectors) so i need to convert them into to streams and add the streams.

      I seemed to have glitches with a Payload Size of 1472 so I changed it to 2**18


      The audio samples you get are signed 16 bit LE stereo pairs. Sometimes you need mono. You can do the conversion with sox.

      pacat -r -d combine.monitor | sox -r 44100 -t raw -e signed-integer -L -b 16 -c 2 - -c 1 -e signed-integer -b 16 -t raw -

      The long flag version for better understanding is

      pacat -r -d combine.monitor | sox --rate 44100 \
      --type raw \
      --encoding signed-integer \
      --endian little \
      --bits 16 \
      --channels 2 \
      - \
      --channels 1 \
      --encoding signed-integer \
      --bits 16 \
      --type raw \

  • Decoding SIM card bitstreams

    10/13/2016 at 22:50 0 comments

    This acts just as a little help and notepad for me, because reading the PDFs is a little bit of a PITA. It's base on some links:



    The waveform I captured:


    just the start (ATR)

    When you sniff on the pins of a SIM card while the phone is booting up, you get something like this. The first thing I learned wat that the CLK line is not for the data bus, but acts as a clock for the processor in the card. After bootup, the CLK will start to oscillate and the reset pin will go high. Then the SIM an "answer to reset" (ATR).

    The I/O port can be interpreted as a bidirectional (half duplex) UART. The baud rate at the start is about 9600, but in my case it was 8739. Even parity.

    The firs byte of the ATR decides which bit is first.

    11011100 -> LSB first
    11000000 -> MSB first
    | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
    |   bit mask    | Hist. count   |
    The higher nibble says which of the next four bytes will be send.
    If bit 7 is set, then byte 2 will be send, bit 6 byte 3 and so on.

    The lower nibble says how many bytes of the historical field will be send.
    | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
    | Freq nibble   | Divid. nibble |