HackerBoxes HackerBox 0034 User manual

instructables
HackerBox 0034: SubGHz
by HackerBoxes
Step 1: HackerBox 0034: Box Contents
This month, HackerBox Hackers are exploring Software Dened Radio (SDR) and radio communications on
frequencies below 1GHz. This Instructable contains information for getting started with HackerBox #0034, which
can be purchased here while supplies last. Also, if you would like to receive a HackerBox like this right in your
mailbox each month, please subscribe at HackerBoxes.com and join the revolution!
Topics and Learning Objectives for HackerBox 0034:
Conguration and Use of SDR Radio Receivers
Mobile SDR Operations
Assembling the CCStick Sub-GHz Transceiver
Programming the CCStick using Arduino ProMicros
Assembling FM Audio Transmitters and Receivers
Ha cke r B oxe sHa cke r B oxe s is the monthly subscription box service for DIY electronics and computer technology. We are
hobbyists, makers, and experimenters. We are the dreamers of dreams. HACK T HE PL ANE T !HACK T HE PL ANET !
HackerBox 0034: SubGHz: Page 1

Step 2: Welcome to Sub-GHz Radio
USB Software Dened Radio (SDR) Receiver
MCX Antenna for SDR Receiver
Two CCStick Printed Circuit Boards
Two CC1101 Transceivers with Antennas
Two Arduino ProMicros 3.3V 8MHz
FM Audio Transmitter Kit
FM Audio Receiver Kit
MicroUSB Cable
Exclusive Radio Oscillator "Hertz" Pin
Some other things that will be helpful:
Soldering iron, solder, and basic soldering tools
Computer for running software tools
Most importantly, you will need a sense of adventure, DIY spirit, and hacker curiosity. Hardcore DIY electronics is
not a trivial pursuit, and HackerBoxes are not watered down. The goal is progress, not perfection. When you persist
and enjoy the adventure, a great deal of satisfaction can be derived from learning new technology and hopefully
getting some projects working. We suggest taking each step slowly, minding the details, and don't be afraid to ask
for help.
There is a wealth of information for current, and prospective, members in the HackerBoxes FAQ.
https://youtu.be/ABysQY03y0g
HackerBox 0034: SubGHz: Page 2

Step 3: Software Defined Radio (SDR) Reciver
Cue music: Radio KAOS
Sub-GHz technology is an ideal choice for wireless
applications requiring long range and low power
consumption. Narrowband transmissions can transmit
data to distant hubs, often several miles away,
without hopping from node to node. This long-range
transmission capability reduces the need for multiple
expensive base stations or repeaters. Proprietary sub-
GHz protocols allow developers to optimize their
wireless solution to their specic needs instead of
conforming to a standard that might put additional
constraints on network implementation. While many
existing sub-GHz networks use proprietary protocols,
the industry is slowly adding standards-based,
interoperable systems. For example, the IEEE 802.15.4g
standard is gaining popularity worldwide and is being
adopted by various industry alliances such as Wi-SUN
and ZigBee.
Some interesting frequencies to explore include:
88-108 MHz FM Broadcast
NOAA Weather Radio
Air Trac Control
315 MHz Keyless Entry Fob (most American Cars)
2m Ham Calling (SSB: 144.200 MHz, FM: 146.52 MHz)
433 MHz ISM/IoT
902-928 MHZ ISM/IoT
Various Modulation Schemes are used for dierent
types of radio communications on these frequencies.
Take a few minutes to familiarize yourself with the
basics.
Traditional radio components (such as modulators,
demodulators and tuners) are implemented using a
collection of hardware devices. The advent of modern
computing and analog-to-digital converters (ADCs)
allows most of these traditionally hardware based
components to be implemented in software instead.
Hence, the term software dened radio (SDR).
Computer-based SDR aords implementing
inexpensive, wide band radio receivers.
The RTL-SDR is a USB dongle that can be used as a
computer based radio receiver for receiving live radio
signals. A wide range of information is available online
for experimenting with RTL-SDR technology including
a quick start guide.
HackerBox 0034: SubGHz: Page 3

Step 4: RTL-SDR USB Dongle Hardware
Step 5: SDR Software - GNU Radio
The RTL2832U is a high-performance DVB-T COFDM
demodulator that supports a USB 2.0 interface. The
RTL2832U supports 2K or 8K mode with 6, 7, and
8MHz bandwidth. Modulation parameters, e.g., code
rate, and guard interval, are automatically detected.
The RTL2832U supports tuners at IF (Intermediate
Frequency, 36.125MHz), low-IF (4.57MHz), or Zero-IF
output using a 28.8MHz crystal, and includes
FM/DAB/DAB+ Radio Support. Embedded with an
advanced ADC (Analog-to-Digital Converter), the
RTL2832U features high stability in portable
reception. The R820T2 Digital Tuner supports
operation in the range of 24 – 1766 MHz.
Note that the SDR dongle features an MCX coaxial RF
input to couple with the included MCX whip antenna.
Since many common signal sources and antennas use
SMA coaxial connectors, an MCX-SMA Coupler may be
useful.
HackerBox 0034: SubGHz: Page 4

Step 6: Mobile SDR
Step 7: Microphone Transmitter Kit
GNU Radio is a free and open-source software
development toolkit that provides signal processing
blocks to implement software radios. It can be used
with readily-available external RF hardware to create
software-dened radios. GNU Radio is widely used in
hobbyist, academic, and commercial environments to
support both wireless communications research and
real-world radio systems.
There are many avors and implementations of GNU
Radio. GQRX is a nice variant for OSX and Linux users.
SDR Touch can turn your mobile phone or tablet into
an aordable and portable software dened radio
scanner. Listen to live on air FM radio stations,
weather reports, police, re department and
emergency stations, taxi trac, airplane
communications, audio of analogue TV broadcasts,
HAM radio amateurs, digital broadcasts, and many
more.
An on-the-go (OTG) USB cable or adapter is required
to connect the SDR USB dongle to a mobile device. An
OTG cable with an extra (auxiliary) power port may be
required to power the dongle. An extra power port
may be a good idea regardless, as an app like SDR
Touch is prone to rapidly draining the batteries pf
mobile devices.
https://www.youtube.com/watch?v=KBygxaLthZ8
This soldering kit is a simple three-transistor frequency modulating (FM) audio transmitter. It operates in the
frequency range of 80MHz-108MHz allocated for FM broadcast radio. The working voltage of the transmitter is
1.5V-9V and it will transmit over 100 meters depending upon supplied power, antenna conguration, tuning, and
ambient electromagnetic factors.
Kit Contents:
HackerBox 0034: SubGHz: Page 5

Step 8: Design of the Microphone Transmitter Kit
PCB
ONE 500KOhm Trimmer Pot
TWO NPN 9018 Transistors
ONE NPN 9014 Transistor
ONE 4.5 turn Inductor (4T5)
TWO 5.5 turn Inductors (5T5)
ONE Electret Microphone
ONE 1M Resistor (BrownBlackGreen)
TWO 22K Resistors (RedRedOrange)
FOUR 33ohm Resistors (OrangeOrangeBlack)
THREE 2.2K (2K2) Resistors (RedRedRed)
ONE 33uF Electrolytic Cap
FOUR 30pF Ceramic Capacitors “30”
FOUR 100nF Ceramic Capacitors “104”
ONE 10nF Ceramic Capacitor “103”
TWO 680pF Ceramic Capacitor “681”
TWO 10pF Ceramic Capacitor “10”
Antenna Wire
9V Battery Clip
Header Pins (break to 2 and 3 pins)
Note that the three transistors, the microphone, and the one electrolytic capacitor must be oriented as shown on
the PCB silkscreen. The inductors and ceramic capacitors are not polarized. While the values and types are not
interchangeable, each one can be inserted in either orientation.
If y ou are new t o s o lde ring :If y ou are new t o s o lde ring : There are a lot of great guides and videos online about soldering. Here is one
example. If you feel that you need additional assistance, try to nd a local makers group or hacker space in your
area. Also, amateur radio clubs are always excellent sources of electronics experience.
HackerBox 0034: SubGHz: Page 6

Step 9: Frequency Modulation (FM) Receiver Kit
An input audio signal can be collected by the onboard
electret microphone or provided from another
electrical source into the input header pins. The
microphone leads can be extended using wire or
trimmed leads from other components to allow
connection to the PCB. The microphone lead
connected to the outer housing of the microphone is
the negative lead as shown in the image.
At transistor Q1, Frequency Modulation is achieved
when a carrier oscillator frequency is modied by the
audio signal. The trimmer potentiometer may be used
to adjust input attenuation of the audio signal. The
audio signal is coupled to the base of transistor Q1 via
C2.
Transistor Q2 (along with R7, R8, C4, C5, L1, C8, and
C7) provides the high frequency oscillator. C8 is the
feedback capacitor. C7 is the DC-blocking capacitor. C5
and L1 provide the resonant tank for the oscillator.
Changing the values of C5 and/or L1 will change the
transmit frequency. After initial assembly, the default
transmit frequency will be about 83MHz. Gently
spreading the turns of coil L1 a tiny bit will change
the value of the inductor L1 and shift the
transmission frequency accordingly. Keeping the
frequency around 88MHz-108MHz will allow the
signal to be received using any FM radio, including
the SDR receiver.
Transistor Q3 (along with R9, R10, L2, C10, and C1)
forms a high frequency power amplier circuit. The
modulated signal is coupled to the amplifying circuit
through capacitor C6. C10 and L2 form an
amplication tuning tank. Maximum output power is
achieved when the amplication loop of C10 and L2
are tuned to the same frequency as the carrier
oscillator loop of C5 and L1.
Finally, C12 and L3 provide antenna turing where the
amplied signal is driven into a wire antenna for
transmission as radio frequency electromagnetic
waves.
This FM receiver kit is based on the HEX3653 chip, which is a highly integrated FM Demodulator.
The kit includes:
HackerBox 0034: SubGHz: Page 7

Step 10: Design of the HEX3653 FM Receiver Kit
PCB
U1 HEX3653 Chip SMD 16pin
Q1 SS8050 NPN Transistor
L1 Inductor 100uH
Y1 32.768KHz Crystal
R1, R2, R3, R4 Resistors 10KOhm
C1, C2 Electrolytic Capacitors 100uF
C3, C5 Ceramic Capacitors (104) 0.1uF
C4 Ceramic Capacitor (33) 33pF
D1, D2 1N4148 Diodes
Yellow LED
Audio Phone Jack 3.5mm
Four-Pin Header with Jumper
Five Momentary Pushbuttons
Dual AA Battery Holder
The HEX3653 receiver chip operates over the 76MHz-108MHz frequency range, which is allocated to FM broadcast
radio.
The kit includes ve pushbuttons:
Frequency tuning (SEEK +, SEEK-)
Volume control (VOL +, VOL-)
Power (PW )
The circuit has a working voltage of 1.8-3.6V, which is easily supplied by two 1.5V cells.
HackerBox 0034: SubGHz: Page 8

Step 11: Assembling the HEX3653 FM Receiver Kit
Step 12: CCStick
There are two options for an antenna input.
A wire can be attached to the "A" pad on the PCB or
the shielding of the headphone wire can serve as the
antenna.
The four-pin header serves as an antenna switch
(labeled ASW ). Placement of the shorting jumper on
ASW selects between the two antenna inputs.
Shorting pins 1 and 2 routes the external antenna "A"
signal to pin four of the HEX3653 chip. Alternatively,
shorting pins 2 and 3 routes the shield pin of the
headphone jack to pin four of the HEX3653 chip.
Pin four of the HEX3653 chip is the radio frequency
(RF) input to the receiver chip. The selected RF signal
rst goes through L1 and C4 which act as a lter. Then
two clipping diodes are used to limit excessive input
voltage.
The ve-pin header (labeled B) allows the receiver
module to be integrated into another system. There
are two pins for power supply input (+V, ground) and
three for audio output (right, left, ground).
The three ceramic capacitors and the crystal and not
polarized and may be inserted in any orientation. They
are not interchangeable, but they may each be
rotated in their orientation. All of the other
components must be mounted according to the
orientation indicated on the PCB silkscreen. As usual,
it is best to start with the SMD chip, and then move to
the smallest/shortest components working from the
center of the PCB towards the edges. Attach the
headers, audio jack, and battery holder last.
https://youtu.be/-gX_-XVz3KI
HackerBox 0034: SubGHz: Page 9

Step 13: Arduino ProMicro 3.3V 8MHz
The CCStick is a Texas Instruments CC1101 sub-GHz
radio transceiver module coupled to an Arduino
ProMicro. Two CCStick kits are included in HackerBox
#0034 for use as two endpoints of a communications
link or in some other communications conguration.
The Texas Instruments CC1101 (datasheet) is a low-
cost sub-GHz transceiver designed for very low-power
wireless applications. The circuit is mainly intended for
the Industrial, Scientic, and Medical (ISM) and Short
Range Device (SRD) frequency bands at 315, 433, 868,
and 915 MHz, but can easily be programmed for
operation at other frequencies in the 300-348 MHz,
387-464 MHz and 779-928 MHz bands. The RF
transceiver is integrated with a highly congurable
baseband modem. The modem supports various
modulation formats and has a congurable data rate
up to 600 kbps.
HackerBox 0034: SubGHz: Page 10

Step 14: Design and Operation of the CCStick
The Arduino ProMicro is based on the ATmega32U4
microcontroller which has a builtin USB interface. This
means that there is no FTDI, PL2303, CH340, or any
other chip acting as an intermediary between your
computer and the Arduino microcontroller.
We suggest rst testing out the Pro Micro without
soldering the pins into place. You can perform the
basic conguration and testing without using the
header pins. Also, delaying soldering on the module
gives one less variable to debug should you run into
any complications.
If you do not have the Arduino IDE installed on your
computer, start by getting downloading the IDE form
arduino.cc. WARNING: Be s ure t o s elect t heWARNING: B e sure t o s elect t he
3.3V v ers io n unde r t o ols > pro ce s so r prior3.3V v ers io n unde r t o ols > pro ce s so r prior
t o pro gram ming t he Pro M icro.t o pro gram ming t he Pro M icro. Having this set
for 5V will work once and then the device will appear
to not ever connect to your PC until you follow the
"Reset to Bootloader" instructions in the guide
discussed below, which can be a little tricky.
Sparkfun has a great Pro Micro Hookup Guide. The
Hookup Guide has a detailed overview of the Pro
Micro board and then a section for "Installing:
Windows" and a section for "Installing: Mac & Linux."
Follow the directions in the appropriate version of
those installation instructions in order to get your
Arduino IDE congured to support the Pro Micro. We
usually start working with an Arduino board by
loading and/or modifying the standard Blink sketch.
However, the Pro Micro does not include the usual
LED on pin 13. Luckily, we can control the RX/TX LEDs
and Sparkfun has provided a neat little sketch to
demonstrate how. This is in the section of the Hookup
Guide entitled, "Example 1: Blinkies!" Verify that you
can compile and download this Blinkies! example
before moving on.
The CC1101 Module and the Arduino ProMicro are inserted onto the silkscreen side of the CCStick PCB. In other
words, the two smaller modules are on the side of the red PCB that has white paint on it and the pins stick out from
the side that has no white paint on it. The white paint is called the PCB silkscreen.
The traces in the red PCB connect the CC1101 Module and Arduino ProMicro like so:
HackerBox 0034: SubGHz: Page 11

CC1101 Arduino ProMicro
------ ----------------
GND GND
VCC VCC (3.3V)
MOSI MOSI (16)
MISO MISO (14)
SCK SCLK (15)
GD02 A0 (18)
GD00 A1 (19)
CSN A10 (10)
A quick start for the CC1101 is to use the library from Elechouse. Download the library by clicking the "get code"
link on that page.
Create a folder for CC1101 in your Arduino Libraries folder. Place the two ELECHOUSE_CC1101 les (.cpp and .h) into
that folder. Also create an examples folder within that folder and place the three demo/example folders in there.
Update the pins denitions in the le ELECHOUSE_CC1101.h like so:
#define SCK_PIN 15
#define MISO_PIN 14
#define MOSI_PIN 16
#define SS_PIN 10
#define GDO0 19
#define GDO2 18
Then place the example le CC1101_RX on one CCStick and the example le CC1101_TX on the second CCStick.
There are a number of other interesting resources and projects for the CC1101 transceiver including the following
example:
TomXue Arduino CC1101 Arduino Library
SmartRF Studio
Electrodragon CC1101 Project
CUL Project
CCManager Project
DIY nanoCUL
Another CC1101 Microcontroller Setup
NOT E ABOUT USING INT ERRUPT S:NOT E ABOUT USING INT ERRUPT S:
To sample the Elechouse example sketch CC1101_RXinterruprt, connect two pins of the Arduino ProMicro on the
bottom side of the CCStick PCB. These are pins 7 and 19 (A1) which connects the transceiver GDO0 signal to pin 7 of
the microcontroller, which is one of the external interrupt pins. Next, update one of the pin dene lines discussed
above to "#dene GDO0 7 //and 19" since GDO0 is now jumpered from pin 19 to pin 7. Next, in the
CC1101_RXinterruprt le, nd the line calling function attachInterrupt() and change the rst parameter (interrupt
number) from "0" to "4". This is done because pin 7 of the ProMicro is associated with interrupt #4.
HackerBox 0034: SubGHz: Page 12

Using the RTL-SDR quick start guide was much better for Windows. https://www.rtl-sdr.com/rtl-sdr-
quick-start-guide/
Step 15: HACK THE PLANET
If you have enjoyed this Instructable and would like
to have a cool box of hackable electronics and
computer tech projects descend upon your mailbox
each month, please join the revolution by surng over
to HackerBoxes.com and subscribing to receive our
monthly surprise box.
Reach out and share your success in the comments
below or on the HackerBoxes Facebook Page.
Certainly let us know if you have any questions or
need some help with anything. Thank you for being
part of HackerBoxes!
HackerBox 0034: SubGHz: Page 13

The Airspy software is much easier to use than GNU radio (in my opinion).
The FM transmitter took a while to figure out which frequency it transmitting on. Ultimately mine
was transmitting at about 96Mhz (I found the transmission frequency using Airspy).
Assembled and got the first Pro Micro working a couple of days ago. Can upload the Blink program
and functions fine. However when trying to upload the CC1101_RX or TX program, I get a compile
error indicating WProgram,
from C:\Program Files (x86)\Arduino\libraries\CC1101/ELECHOUSE_CC1101.h:13, then
C:\Program Files (x86)\Arduino\libraries\CC1101/ELECHOUSE_CC1101.h:14:22: fatal error:
WProgram.h: No such file or directory
#include <WProgram.h>
Try replacing "WProgram.h" with "Arduino.h"
Had to replace WProgram.h in both programs (.h and .cpp) . They compile and upload after fixing
the BYTE command in the receiver. Now that they are both uploaded, it just sits and increments a
counter in the receiver from the xmitter. interesting.
what did you do to "fix the BYTE command in the receiver"?
yeah but make sure you do it in both the /ELECHOUSE_CC1101.h and the
/ELECHOUSE_CC1101.cpp files.
I had an awesome time soldering the HEX3653 FM Receiver Kit. After it was done I popped in the
batteries and then fired it up using the jumper to set the headphones as the antenna and at once I
was listening to the local FM stations around here. But as I walked around the house I somehow
managed to cause a short due to exposed batter wires and then after that all that my little Receiver
receives is static and once I press the seek button it receives nothing. I will start troubleshooting
soon but work to the wise be careful with this unit once you add power because you can short it out
any number of ways using the header pins or the power terminals. And this little guy will not hold
up well to shorts!
I'm up and running with the RTL-SDR using SDRSharp. The quick-start quide is spot on. I'm
listening to an old familiar freind on NFM 162.390. If you are in HackerBoxes territory you know
who that is! ;) Now on to GNURadio... Soldering tommorow...
Tim, what machine are you running SDR# on, and where did you get the driver? I tried to install it
on a raspberry pi 3, and a windows vista machine and can't seem to get the proper driver.
Thanks
Joe, after going back and reading it again myself, I see right at the beginning in bold lettering that
XP and Vista are not compatible. :(
I am using Windows 10. I followed the instruction in the guide here ->
https://www.rtl-sdr.com/rtl-sdr-quick-start-guide/
Pay very close attention to steps 7 thru 11 regarding the driver.
Further down below those steps are some additional troubleshooting steps.
HackerBox 0034: SubGHz: Page 14

The frequency of the fm transmitter was all over the place in my kit. It DOES work, but touching it
or moving it I could interfere with the entire FM spectrum.
Now you can speak from experience as to why we use crystal oscillators.
My first box of my first annual subscription. Very exited !
Awesome box again.
HackerBox 0034: SubGHz: Page 15