{"id":13497135,"url":"https://github.com/jboone/gr-tpms","last_synced_at":"2025-03-28T21:32:02.922Z","repository":{"id":14190459,"uuid":"16896912","full_name":"jboone/gr-tpms","owner":"jboone","description":"Tire Pressure Monitor tools for GNU Radio","archived":false,"fork":false,"pushed_at":"2022-03-22T00:40:53.000Z","size":157,"stargazers_count":162,"open_issues_count":12,"forks_count":35,"subscribers_count":27,"default_branch":"master","last_synced_at":"2024-04-14T18:06:26.454Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"CMake","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jboone.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-02-16T23:36:52.000Z","updated_at":"2024-04-06T20:24:34.000Z","dependencies_parsed_at":"2022-09-23T20:41:23.877Z","dependency_job_id":null,"html_url":"https://github.com/jboone/gr-tpms","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jboone%2Fgr-tpms","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jboone%2Fgr-tpms/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jboone%2Fgr-tpms/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jboone%2Fgr-tpms/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jboone","download_url":"https://codeload.github.com/jboone/gr-tpms/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246105255,"owners_count":20724277,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-07-31T20:00:24.323Z","updated_at":"2025-03-28T21:32:02.616Z","avatar_url":"https://github.com/jboone.png","language":"CMake","funding_links":[],"categories":["GnuRadio Software"],"sub_categories":[],"readme":"# gr-tpms\n\nSoftware for capturing, demodulating, decoding, and assessing data from\nautomotive tire pressure monitors using GNU Radio.\n\nTire pressure monitoring systems (TPMS) are becoming common on automobiles,\nand in certain countries, are required as a condition of sale. Most TPMS\ndevices use simple wireless communication techniques such as:\n\n* ASK or FSK modulation\n* Manchester bit coding\n* Small CRCs or checksums\n* Unique device identifiers\n\n# Background\n\nFor more background on this project, please watch Jared Boone's talk from ToorCon 15:\n\n\"Dude, Where's My Car?: Reversing Tire Pressure Monitors with a Software Defined Radio\" [[video](http://www.youtube.com/watch?v=bKqiq2Y43Wg)] [[slides](http://sharebrained.com/downloads/toorcon/dude_wheres_my_car_toorcon_sd_2013.pdf)]\n\n...or this interview with Darren Kitchen of Hak5:\n\n\"Hak5 1511 – Tracking Cars Wirelessly And Intercepting Femtocell Traffic\" [[video](http://hak5.org/episodes/hak5-1511)]\n\n# Software\n\nSomeone has contributed [a Docker container](https://registry.hub.docker.com/u/nobis99/gr-tpms/) as a quick way to bring up gr-tpms on your computer.\n\nThis software was developed for and tested with:\n\n* [Python](http://python.org) 2.7\n* [FFTW](http://www.fftw.org) Fastest FFT in the West.\n* [GNU Radio](http://gnuradio.org) 3.7.3 (should work with earlier 3.7 releasese)\n* [rtl-sdr](http://sdr.osmocom.org/trac/wiki/rtl-sdr)\n* [gr-osmosdr](http://sdr.osmocom.org/trac/wiki/GrOsmoSDR)\n* [crcmod](http://crcmod.sourceforge.net), CRC library for Python.\n\nOptional dependencies (for tpms_burst_ping):\n\n* [Watchdog](http://packages.python.org/watchdog/) 0.6.0. Filesystem monitoring library for Python.\n* [portaudio](http://www.portaudio.com/) v19. Audio I/O abstraction library.\n* [pyaudio](http://people.csail.mit.edu/hubert/pyaudio/) 0.2.7. Python wrapper for portaudio.\n* [numpy](http://www.numpy.org) 1.8.0. Numerical Python library.\n\n# Hardware\n\nI used a variety of hardware for receiving tire pressure monitors. If you don't already\nhave a software-defined radio receiver, a $50 US investment is all you need to get started.\n\n### Quick Shopping List for The Impatient\n\nAside from a modern and fairly fast computer capable of running GNU Radio, here's what you'll need:\n\n* [NooElec TV28T v2 DVB-T USB Stick (R820T) w/ Antenna and Remote Control](http://www.nooelec.com/store/software-defined-radio/tv28tv2.html) or [Hacker Warehouse DVB-T USB 2.0](http://hackerwarehouse.com/product/dvb-t-usb2-0/)\n* [NooElec Male MCX to Female SMA Adapter](http://www.nooelec.com/store/software-defined-radio/male-mcx-to-female-sma-adapter.html)\n* [Linx Technologies ANT-315-CW-RH-SMA 315MHz 51mm (2\") helical whip antenna, SMA](http://mouser.com/Search/Refine.aspx?Keyword=ANT-315-CW-RH-SMA) or [Linx Technologies ANT-433-CW-RH-SMA 433MHz 51mm (2\") helical whip antenna, SMA](http://mouser.com/Search/Refine.aspx?Keyword=ANT-433-CW-RH-SMA)\n* [Johnson / Emerson Connectivity Solutions 415-0031-024 SMA male to SMA female cable, 61cm (24\")](http://mouser.com/Search/Refine.aspx?Keyword=415-0031-024), (Optional, if you don't want your antenna sticking straight out of your USB receiver dongle.)\n\n### Receiver\n\nIf you're just getting started with SDR, I highly recommend getting a DVB-T USB dongle,\nsupported by the [rtl-sdr](http://sdr.osmocom.org/trac/wiki/rtl-sdr) project. They cost\n$25 US, typically.\n\nRecommended DVB-T dongle vendors include:\n\n* [Hacker Warehouse](http://hackerwarehouse.com/product/dvb-t-usb2-0/)\n* [NooElec](http://www.nooelec.com/store/software-defined-radio.html)\n\nIf you're looking to do active attacks on TPMS (a topic I haven't explored), I recommend\nthe [HackRF](https://github.com/mossmann/hackrf/).\n\n### Antenna\n\nThe antenna that comes with your DVB-T dongle will work well, but you'll get more signal\nand less noise with a band-specific antenna.\n\nFor 315MHz:\n* Linx Technologies [ANT-315-CW-RH-SMA](http://mouser.com/Search/Refine.aspx?Keyword=ANT-315-CW-RH-SMA) 315MHz 51mm (2\") helical whip antenna, SMA.\n* Linx Technologies [ANT-315-CW-RH](http://mouser.com/Search/Refine.aspx?Keyword=ANT-315-CW-RH) 315MHz 51mm (2\") helical whip antenna, RP-SMA.\n* Linx Technologies [ANT-315-CW-HWR-SMA](http://mouser.com/Search/Refine.aspx?Keyword=ANT-315-CW-HWR-SMA) 315MHz 142mm (5.6\") tilt/swivel whip antenna, SMA.\n* Linx Technologies [ANT-315-CW-HWR-RPS](http://mouser.com/Search/Refine.aspx?Keyword=ANT-315-CW-HWR-RPS) 315MHz 142mm (5.6\") tilt/swivel whip antenna, RP-SMA.\n\nFor 433MHz:\n* Linx Technologies [ANT-433-CW-RH-SMA](http://mouser.com/Search/Refine.aspx?Keyword=ANT-433-CW-RH-SMA) 433MHz 51mm (2\") helical whip antenna, SMA.\n* Linx Technologies [ANT-433-CW-RH](http://mouser.com/Search/Refine.aspx?Keyword=ANT-433-CW-RH) 433MHz 51mm (2\") helical whip antenna, RP-SMA.\n* Linx Technologies [ANT-433-CW-HWR-SMA](http://mouser.com/Search/Refine.aspx?Keyword=ANT-433-CW-HWR-SMA) 433MHz 142mm (5.6\") tilt/swivel whip antenna, SMA.\n* Linx Technologies [ANT-433-CW-HWR-RPS](http://mouser.com/Search/Refine.aspx?Keyword=ANT-433-CW-HWR-RPS) 433MHz 142mm (5.6\") tilt/swivel whip antenna, RP-SMA.\n\nI'm using the Linx Technologies ANT-315-CW-RH-SMA and ANT-433-CW-RH-SMA with good\nresults, but you may prefer bigger antennas, or RP-SMA connectors.\n\nIdeally, I'd build a [Yagi-Uda antenna](http://en.wikipedia.org/wiki/Yagi-Uda_antenna). :-)\n\n### Cabling\n\nYou'll need a cable to connect the antenna to the DVB-T dongle. The DVB-T dongles\nfrom Hacker Warehouse and NooElec have a female MCX connector. The SMA antennas I\nuse have a male SMA connector. So you'll want a 50 Ohm cable with a male MCX\nconnector on one side, and a female SMA connector on the other.\n\n### Filtering\n\nI like to use a SAW filter between the antenna and receiver to further cut noise\nand interference. It's certainly not necessary (and likely overkill). The SAW\nfilter I use is built from a PCB I designed.\n\n# Building\n\nAssuming you have the above prerequisites installed, clone this repo and do the\nfollowing:\n\n    cd gr-tpms\n    mkdir build\n    cd build\n    cmake ..\n    make\n    sudo make install\n    sudo ldconfig   # only if you're using Linux\n\nIf you have trouble building or running gr-tpms, check that you have all the\ndependencies installed. Also, review your CMake configuration by running\n\"ccmake ..\" instead of \"cmake ..\" and reviewing the \"advanced mode\" options.\nFor example, using MacPorts on Mac OS X 10.9, I've had to adjust\nPYTHON_INCLUDE_DIR and PYTHON_LIBRARY to start with \"/opt/local\" instead of the\ndetected path.\n\nIf you're using Linux, and run into a SWIG exception thrown by Python,\nmetioning _tpms_swig, swig_import_helper, load_module, etc., you may have\nmissed running ldconfig.\n\n# Using\n\nOnce gr-tpms is installed, you may use it in two modes, a live capture mode, or\ndecoding from a file. To run live using an RTL-SDR dongle as a signal source:\n\n    tpms_rx --source rtlsdr --if-rate 400000 --tuned-frequency 315000000\n\nOr using a HackRF:\n\n    tpms_rx --source hackrf --if-rate 400000 --tuned-frequency 315000000\n\nTo detect and decode from a file:\n\n    tpms_rx --if-rate 400000 --file \u003cfilename of complex\u003cfloat32\u003e file sampled at 400kHz\u003e\n\nOptional arguments to tpms_rx include:\n\n    --bursts: Output a complex\u003cfloat32\u003e file of each burst of significant energy.\n    --raw: Output undecoded bits of detected packets.\n\nWhile gr-tpms is running, you should see a line printed for each TPMS transmission\nthat gr-tpms can successfully detect, demodulate, and decode. There are several\nmodulation and encoding schemes that gr-tpms can handle, but certainly many\nremain to be observed and reversed. The burst option is handy for capturing raw\nbaseband data for packets that gr-tpms doesn't recognize.\n\nThe output of gr-tpms is the recovered contents (bits) of the received packets.\nAt the moment, you're on your own as far as figuring out which bits represent a\nsensor's unique identifier, tire pressure or temperature, and checksum or CRC field.\nAs you accumulate more raw packets, you can observe statistics which indicate\nthe nature of bits in the many different types of packets. For more information on\nhow this is done, see my ToorCon talk (linked above) and check out my sister\nproject, [tpms](https://github.com/jboone/tpms), which contains some visualization\nand testing tools and techniques.\n\nIf you want to drive around, listening for TPMS signals, I recommend using the\noptional tpms_burst_ping utility. It takes a single, optional argument that \nspecifies a directory to watch for --burst files to appear. When a file appears\n(a burst occurs), tpms_burst_ping will emit a \"ping\" through your audio output.\n\n    tpms_burst_ping .\n\n# License\n\nThe associated software is provided under a GPLv2 license:\n\nCopyright (C) 2014 Jared Boone, ShareBrained Technology, Inc.\n\nThis program is free software; you can redistribute it and/or\nmodify it under the terms of the GNU General Public License\nas published by the Free Software Foundation; either version 2\nof the License, or (at your option) any later version.\n\nThis program is distributed in the hope that it will be useful,\nbut WITHOUT ANY WARRANTY; without even the implied warranty of\nMERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\nGNU General Public License for more details.\n\nYou should have received a copy of the GNU General Public License\nalong with this program; if not, write to the Free Software\nFoundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA\n02110-1301, USA.\n\n# Contact\n\nJared Boone \u003cjared@sharebrained.com\u003e\n\nShareBrained Technology, Inc.\n\n\u003chttp://www.sharebrained.com/\u003e\n\n\nThe latest version of this repository can be found at\nhttps://github.com/jboone/gr-tpms\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjboone%2Fgr-tpms","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjboone%2Fgr-tpms","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjboone%2Fgr-tpms/lists"}