Mystery Recording - Not really recognized by DSDPlus Fastlane/DSD FME

[noamlivne]

Hopefully some DMR experts can have a listen to

Strange4655625.wav

drive.google.com

DSDPlus Fastlane and DSD FME seem to be clueless. They do not indicate that it is encrypted. But it sounds encrypted. There is no indication of Talk Groups or UIDs. Looking at the Log that DSD FME gives, there are indeed strange readings but also known "Silence" frames of F801A9.

Perhaps it is some kind of OTA Encryption that obfuscates the data (but also the voice)?
Did someone encounter this?

It is not from North America, so there is no listing about this frequency.
Any clue would be helpful. (Of course no need for the Key. I just want to know the format).

Thank you in advance.

 

[tobbe-sweden]

Just a guess... Motorola Smartnet. It sounds similar...

Try Unitrunker for decode.

 

[noamlivne]

Just a guess... Motorola Smartnet. It sounds similar...

Try Unitrunker for decode.

Thanks for the tip. But that's not right. It's DMR, as shown by DSDPLUS and DSD FME (and SDRTrunk)

 

[DaveNF2G]

Misidentified EDACS?

In the US, a 465 MHz frequency would be a repeater input. Have you tried 460.5625?

 

[noamlivne]

Misidentified EDACS?

In the US, a 465 MHz frequency would be a repeater input. Have you tried 460.5625?

Thanks for the tip. But that's not right. It's DMR, as shown by DSDPLUS and DSD FME (and SDRTrunk)

 

[rbrtklamp2]

Maybe DSD is showing DMR in error and something else like dpmr sorry im on my way to work and havent gotten to listen to it

 

[noamlivne]

Maybe DSD is showing DMR in error and something else like dpmr sorry im on my way to work and havent gotten to listen to it

It is real DMR with real DMR frames as far as I can tell.

 

[racingfan360]

It looks a lot like Hytera Over the Air Encrypt (Protected LC and lack of TG/RIDs), with an unknown encryption applied to some voice traffic. But then some voice is unencrypted by silent PTTs (the prevalance of silence frames)

 

[noamlivne]

It looks a lot like Hytera Over the Air Encrypt (Protected LC and lack of TG/RIDs), with an unknown encryption applied to some voice traffic. But then some voice is unencrypted by silent PTTs (the prevalance of silence frames)

Thank you for your reply.
Never encountered this.
Even though the unencrypted silent frame is there - all seems to be encrypted, nonetheless.
Quite strange. Always there is a first time, I guess.

 

[mtindor]

Thank you for your reply.
Never encountered this.
Even though the unencrypted silent frame is there - all seems to be encrypted, nonetheless.
Quite strange. Always there is a first time, I guess.

With DSDPlus FastLane I do see references to RC4, but only on BS DATA. Very little information on the voice frames.

+DMR slot2 BS DATA DCC=1 PI Header ECC/RAS Alg=RC4 KID=164 MI=4024D620 Tgt=9553569
+DMR slot2 BS DATA DCC=1 PI Header ECC/RAS Alg=RC4 KID=208 MI=CBC609EA Tgt=2833839
+DMR slot2 BS DATA DCC=1 PI Header ECC/RAS KID=90 MI=D6D34F33 Tgt=12547006

And at the very end:

+DMR slot2 BS DATA DCC=1 CSBK ECC/RAS [LB=1 CSBKO=55 (?) FID=D9 v16=78FA id1=7087812 id2=1899094]
37 D9 78FA 6C26C4 1CFA56
111101111101100101111000111110100110110000100110110001000001110011111010010101101010011000010010
+DMR slot1 BS DATA DCC=1 CSBK ECC/RAS [LB=1 CSBKO=55 (?) FID=26 v16=9806 id1=2938304 id2=291420]
37 26 9806 2CD5C0 04725C
111101110010011010011000000001100010110011010101110000000000010001110010010111001101001010001101
Null SLCO
+DMR slot2 BS DATA DCC=1 CSBK ECC/RAS [LB=0 CSBKO=58 (?) FID=4E v16=C180 id1=4123810 id2=988692]
3A 4E C180 3EECA2 0F1614
011110100100111011000001100000000011111011101100101000100000111100010110000101000101111100100110
+DMR slot1 BS DATA DCC=1 CSBK ECC/RAS [LB=0 CSBKO=44 (?) FID=EC v16=D522 id1=11353170 id2=13466338]
2C EC D522 AD3C52 CD7AE2
011011001110110011010101001000101010110100111100010100101100110101111010111000100010101110111001
+DMR slot2 BS DATA DCC=1 CSBK ECC/RAS [LB=1 CSBKO=25 (Aloha) FID=6D v16=E2D2 id1=9553306 id2=1867310]
19 6D E2D2 91C59A 1C7E2E
100110010110110111100010110100101001000111000101100110100001110001111110001011100101011101111001
+DMR slot1 BS DATA DCC=1 CSBK ECC/RAS [LB=1 CSBKO=4 (PC Req) FID=FC v16=2230 id1=15474006 id2=12280536]
04 FC 2230 EC1D56 BB62D8
100001001111110000100010001100001110110000011101010101101011101101100010110110000010001111100111
Null SLCO
+DMR slot2 BS DATA DCC=1 CSBK ECC/RAS [LB=0 CSBKO=17 (?) FID=F3 v16=3498 id1=15524450 id2=3614322]
11 F3 3498 ECE262 372672
000100011111001100110100100110001110110011100010011000100011011100100110011100101010111001001100
+DMR slot1 BS DATA DCC=1 CSBK ECC/RAS [LB=0 CSBKO=60 (?) FID=65 v16=5345 id1=9465121 id2=14980120]
3C 65 5345 906D21 E49418
011111000110010101010011010001011001000001101101001000011110010010010100000110001101101011010011
+DMR slot2 BS DATA DCC=1 CSBK ECC/RAS [LB=1 CSBKO=57 (?) FID=0C v16=0BA6 id1=10482202 id2=821023]
39 0C 0BA6 9FF21A 0C871F
101110010000110000001011101001101001111111110010000110100000110010000111000111110100011011000101
+DMR slot1 BS DATA DCC=1 CSBK ERR4 ECC FAIL
Null SLCO
Sync: no sync

 

[noamlivne]

With DSDPlus FastLane I do see references to RC4, but only on BS DATA. Very little information on the voice frames.

+DMR slot2 BS DATA DCC=1 PI Header ECC/RAS Alg=RC4 KID=164 MI=4024D620 Tgt=9553569
+DMR slot2 BS DATA DCC=1 PI Header ECC/RAS Alg=RC4 KID=208 MI=CBC609EA Tgt=2833839
+DMR slot2 BS DATA DCC=1 PI Header ECC/RAS KID=90 MI=D6D34F33 Tgt=12547006

And at the very end:

+DMR slot2 BS DATA DCC=1 CSBK ECC/RAS [LB=1 CSBKO=55 (?) FID=D9 v16=78FA id1=7087812 id2=1899094]
37 D9 78FA 6C26C4 1CFA56
111101111101100101111000111110100110110000100110110001000001110011111010010101101010011000010010
+DMR slot1 BS DATA DCC=1 CSBK ECC/RAS [LB=1 CSBKO=55 (?) FID=26 v16=9806 id1=2938304 id2=291420]
37 26 9806 2CD5C0 04725C
111101110010011010011000000001100010110011010101110000000000010001110010010111001101001010001101
Null SLCO
+DMR slot2 BS DATA DCC=1 CSBK ECC/RAS [LB=0 CSBKO=58 (?) FID=4E v16=C180 id1=4123810 id2=988692]
3A 4E C180 3EECA2 0F1614
011110100100111011000001100000000011111011101100101000100000111100010110000101000101111100100110
+DMR slot1 BS DATA DCC=1 CSBK ECC/RAS [LB=0 CSBKO=44 (?) FID=EC v16=D522 id1=11353170 id2=13466338]
2C EC D522 AD3C52 CD7AE2
011011001110110011010101001000101010110100111100010100101100110101111010111000100010101110111001
+DMR slot2 BS DATA DCC=1 CSBK ECC/RAS [LB=1 CSBKO=25 (Aloha) FID=6D v16=E2D2 id1=9553306 id2=1867310]
19 6D E2D2 91C59A 1C7E2E
100110010110110111100010110100101001000111000101100110100001110001111110001011100101011101111001
+DMR slot1 BS DATA DCC=1 CSBK ECC/RAS [LB=1 CSBKO=4 (PC Req) FID=FC v16=2230 id1=15474006 id2=12280536]
04 FC 2230 EC1D56 BB62D8
100001001111110000100010001100001110110000011101010101101011101101100010110110000010001111100111
Null SLCO
+DMR slot2 BS DATA DCC=1 CSBK ECC/RAS [LB=0 CSBKO=17 (?) FID=F3 v16=3498 id1=15524450 id2=3614322]
11 F3 3498 ECE262 372672
000100011111001100110100100110001110110011100010011000100011011100100110011100101010111001001100
+DMR slot1 BS DATA DCC=1 CSBK ECC/RAS [LB=0 CSBKO=60 (?) FID=65 v16=5345 id1=9465121 id2=14980120]
3C 65 5345 906D21 E49418
011111000110010101010011010001011001000001101101001000011110010010010100000110001101101011010011
+DMR slot2 BS DATA DCC=1 CSBK ECC/RAS [LB=1 CSBKO=57 (?) FID=0C v16=0BA6 id1=10482202 id2=821023]
39 0C 0BA6 9FF21A 0C871F
101110010000110000001011101001101001111111110010000110100000110010000111000111110100011011000101
+DMR slot1 BS DATA DCC=1 CSBK ERR4 ECC FAIL
Null SLCO
Sync: no sync

Thank you very much for your answer.
All of this data seem very stochastic, as if they are fictional (and cannot really be useful).

 

[racingfan360]

Thank you very much for your answer.
All of this data seem very stochastic, as if they are fictional (and cannot really be useful).

Agreed, these are all highly likely to be false positives

 

[kroostye32]

Sounds like classic DMR with some Hytera-style OTA protection - frames look normal but everything’s still scrambled. Those silent PTT frames popping up usually mean the channel is active but locked down. Pretty interesting catch though. Kinda reminds me of those mystery-signal moments in movies like Snowden or The Bourne Legacy where the tech just doesn’t behave like it should.

 

[RaleighGuy]

All of this data seem very stochastic, as if they are fictional (and cannot really be useful).

Actually, I keep a list of the Key IDs I find, this way if it pops up somewhere else I know who is using it. Also, keeping a record of the RID/UID listed as Tgt in the info helps discover patterns as well.

 

[noamlivne]

Actually, I keep a list of the Key IDs I find, this way if it pops up somewhere else I know who is using it. Also, keeping a record of the RID/UID listed as Tgt in the info helps discover patterns as well.

For sure. But not in this case.
Here, the Key IDs, TGIDs (if any) and UIDs (if any) are fictional, and probably don't mean nothing, unfortunately.

 

[mtindor]

For sure. But not in this case.
Here, the Key IDs, TGIDs (if any) and UIDs (if any) are fictional, and probably don't mean nothing, unfortunately.

Is fictional the wrong word? Are you meaning that you don't believe in the code? I think that you are simply meaning that you do not trust the decode, and I would understand that. If you are meaning that the information indicated is bogus, then it would only be bogus if the person who set up the repeater put it there.

I'm guessing you are just meaning that it likely isn't being decoded properly because one or more reasons, errors, RAS, encrypted control channel information, or something like that.

 

[noamlivne]

Is fictional the wrong word? Are you meaning that you don't believe in the code? I think that you are simply meaning that you do not trust the decode, and I would understand that. If you are meaning that the information indicated is bogus, then it would only be bogus if the person who set up the repeater put it there.

I'm guessing you are just meaning that it likely isn't being decoded properly because one or more reasons, errors, RAS, encrypted control channel information, or something like that.

Sorry for the misunderstanding.
No issues with DSDPlus here.
If it is really OTA Encrypted, then even if the reception was 100% fine, the Key IDs, TGIDs (if any) and UIDs (if any) would not be real/authentic. OTA Encryption, as far as I know, shows fictional data as a mean to obfuscate the real data (that is somehow encrypted).

 

[mtindor]

Got it. Thanks for the clarification. I suspected it was just simply me not quite understanding what you meant by fictitious.

Sorry for the misunderstanding.
No issues with DSDPlus here.
If it is really OTA Encrypted, then even if the reception was 100% fine, the Key IDs, TGIDs (if any) and UIDs (if any) would not be real/authentic. OTA Encryption, as far as I know, shows fictional data as a mean to obfuscate the real data (that is somehow encrypted).

Got it. Thanks for the clarification. I suspected it was just simply me not quite understanding what you meant by fictitious.

Interesting signal for sure. Clearly that voice is encrypted, but as if somebody else also suggested it looks like there’s more than just the voice encrypted. Of course I had heard about this type of thing. Eventually, there would be systems out there that had encryption on more than just voice frames.

Keep in mind I’m a dumbass, I really know nothing about reading a lot of the raw information that the various software’s produce

Mike