Java program to decode DMR

[jeremym70]

Mike it looks like to really figure out this system I need to figure out the LCN's of this Connect Plus system. When I watch the "control channel" that broadcasts constantly, I see talkgroup assignments going to specific LCN channels. When I monitor voice channels that I believe are affiliated with this system I do not see any LCN channel information broadcast. Any ideas? I have figured out one LCN of one site by watching the "control channel" and then listening to a conventional channel programmed into my XPR6550 that happened to have that TG id in it.

Jeremy,

I don't want to hijack this thread. But, if the TrboWest system isn't in the RadioReference database (and it doesn't look like it is -- I didn't look real close though), then please submit your findings to an appropriate county where you know one of the transmitters is active and ask an admin to start the process of getting that trunked system created.

In DMRDecode you should be able to see the Network ID show up on one of the lines. If you could submit the Network ID (which should be the same for all TrboWest) and then any/all active control channels you've found, the process can be started for an admin in that area to start populating the DB with info.

If you would like to dialog with me about this, feel free to PM me.

Thanks!

Mike

 

[mtindor]

Mike it looks like to really figure out this system I need to figure out the LCN's of this Connect Plus system. When I watch the "control channel" that broadcasts constantly, I see talkgroup assignments going to specific LCN channels. When I monitor voice channels that I believe are affiliated with this system I do not see any LCN channel information broadcast. Any ideas? I have figured out one LCN of one site by watching the "control channel" and then listening to a conventional channel programmed into my XPR6550 that happened to have that TG id in it.

I'm going to respond to you in PM, Jeremy.

Mike

 

[radioprescott]

Just started playing with DMR seriously as I appear to have found a Fisher Capacity Plus system running in Central Arizona.

As I understand it I am listing to System 119, Site 72, Control Ch 1, Colur Code 1.

I have a couple of questions:

Is the 'Control Channel Neighbor List : 6,9,10,17,19' the CC LCNs or the Site numbers?

Its been consistently showing just idles, and DSD shows both 1/2 and 3/4 data rates. What would I expect to see if I have voice comms?

Here's a sample:

DMR Decoder (Build 64)
You have selected only to display frames without errors
8:25:45 PM DMR Data Frame
CACH : TACT Ch 1 First fragment of LC
Slot Type : Colour Code 1 CSBK
Connect Plus CSBK : CSBKO=1
Control Channel Neighbour List : 6,9,10,17,19 (0100011001001001010010100101000101010011000000000000000000000110)
8:25:45 PM DMR Data Frame
CACH : TACT AT=1 Ch 2 Continuation fragment of LC
Slot Type : Colour Code 1 Idle
8:25:45 PM DMR Data Frame
CACH : TACT Ch 1 Continuation fragment of LC
Slot Type : Colour Code 1 CSBK
Connect Plus CSBK : CSBKO=1
Control Channel Neighbour List : 6,9,10,17,19 (0100011001001001010010100101000101010011000000000000000000000110)
8:25:45 PM DMR Data Frame
CACH : TACT AT=1 Ch 2 Last fragment of LC
Slot Type : Colour Code 1 Idle
8:25:45 PM Short LC : Connect Plus Control Channel SLCO=10 Network: 119 Site: 72
8:25:45 PM DMR Data Frame
CACH : TACT Ch 1 First fragment of LC
Slot Type : Colour Code 1 CSBK
Connect Plus CSBK : CSBKO=1
Control Channel Neighbour List : 6,9,10,17,19 (0100011001001001010010100101000101010011000000000000000000000110)
8:25:45 PM DMR Data Frame

 

[mtindor]

Is the 'Control Channel Neighbor List : 6,9,10,17,19' the CC LCNs or the Site numbers?

Site numbers. Sounds like a ConnectPlus to me. I am often wrong though.

Mike

 

[IanWraith]

Hello
Firstly my thanks to Grosminet for his info regarding ident 64250. I see data to and from this ident all the time on my local shopping centres Capacity Plus system.

It has occurred to me that one thing we are missing from our Capacity Plus understanding is how radios register with the network. All the other types of trunked networks I have come across require a radio to register with a base station the first time it is turned on or mores into a new area. The base then allows access or tells it to go away. But so far we have none of that.

Also for everyone's info I am working on decoding the 3/4 rate PDUs but it is complex and isn't going to be a quick job.

Regards

Ian

 

[IanWraith]

Hello All

Just a quick note to let you know I have cracked the Trellis coded rate 3/4 PDUs and am now extracting 144 actual payload bits from the 196 frame contents. If you are interested the source code is here ..

https://github.com/IanWraith/DMRDecode/blob/Trellis/src/com/dmr/Trellis.java

with a test case here ..

https://github.com/IanWraith/DMRDecode/blob/Trellis/src/test/com/dmr/TrellisTest.java

Next I need to some basic decoding of the outer layers and will hopefully have a new build out in the next week. After that we need to get people analyzing the contents.

Regards

Ian

 

[Forts]

Sounds great Ian, can't wait to give it a try!!

 

[radioprescott]

Thanks Mike it appears you are right. Had my modes mixed up

The system seems to be switching CC daily. No obvious difference between the freqs when looking at the log...should I see a difference?

Still learning this ConnectPlus stuff ...

Site numbers. Sounds like a ConnectPlus to me. I am often wrong though.

Mike

 

[IanWraith]

Hello All

OK DMRDecode build 68 is now available for download from the usual place ..

DMRDecode Download

Now the big new feature of build 68 is that it decodes rate 3/4 data PDUs. Well not decode as such but it does display the binary data that the radio was sending (previously it displayed the encoded data). With what is called "Confirmed Data" it displays the serial number encoded into each data block. So really this is just the start of the battle.

On my local Capacity Plus system I see two kinds of data exchange. First we see the confirmed data type ..

15:03:00 DMR Data Frame
Slot Type : Colour Code 6 Data Header
Confirmed Data
Destination Logical Link ID : 15 Source Logical Link ID : 64249
3 blocks follow : FSN=8 N(S)=0
15:03:00 DMR Data Frame
CACH : TACT Ch 2 Continuation fragment of LC
Slot Type : Colour Code 6 Rate ¾ Data Continuation
R_3_4_DATA (data block serial number=0)
0100010100000000000000000010000000110111001111100000000000000000
1000000000010001111011111000011000001101000000001111101011111001
15:03:00 DMR Data Frame
Slot Type : Colour Code 6 Rate ¾ Data Continuation
R_3_4_DATA (data block serial number=1)
0000110000000000000000000000111100001111101001010000111110100101
0000000000001100000011011000000100000000000000101011111100000000
15:03:00 DMR Data Frame
Slot Type : Colour Code 6 Rate ¾ Data Continuation
R_3_4_DATA (data block serial number=2)
0000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000001001010111111000101011010011111

Note the header says three blocks follow and sure enough we see 3 x R_3_4_DATA blocks numbered 0,1 and 2.

The other type are Proprietary Data exchanges which being proprietary aren't defined in the standard but made up by the good folks at the big M. An example is ..

15:03:01 DMR Data Frame
Slot Type : Colour Code 6 Data Header
Proprietary Data : MFID=16 (Motorola)
0000001000000001001000100000000000111100000000000111001000111001
15:03:01 DMR Data Frame
Slot Type : Colour Code 6 Rate ¾ Data Continuation
0000000000101110110110000000000000000101000000000000000100000000
0000001100010111011100100000000000000001000101110001100000000000
0000000000000000

Now encoded somewhere in that data header is a number that describes the number of data blocks , or bytes to follow.

Also we need to see when Cap Plus systems send these data exchanges then we can look into understanding them.

So there we go please download build 68 and start your analysis !

As ever questions to this forum please.

Regards

Ian

 

[inigo88]

Thanks for your hard work Ian, and I can't wait to give the new version a try. You are absolutely right... we are still missing:

- Text Messaging (but we're close!)
- Emergency Button/Man Down Alarm Activation
- Registration / De-Registration
- GPS Automatic Vehicle Location Data

Among others. Still plenty to figure out!

 

[inigo88]

Hey guys,

This was taken from a TRBO conventional repeater using Ian's latest build 68. The repeater belongs to a hotel, and the data messages repeat every 30 seconds or so, always from source 64250 on talkgroup 109.

Anyone want to try and make heads or tails of it?

------------------------------------------------------------------------------

Preamble CSBK : Data content 19 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Continuation fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 Continuation fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 18 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Last fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM Short LC : Act_Updt - Individual data activity on BS time slot 1 Hashed Addr 126 : No activity on BS time slot 2
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 First fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 17 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Continuation fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 Continuation fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 16 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Last fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM Short LC : Act_Updt - Individual data activity on BS time slot 1 Hashed Addr 126 : No activity on BS time slot 2
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 First fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 15 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame - Error !
CACH : TACT AT=1 Ch 2 Continuation fragment of LC
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 Continuation fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 14 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Last fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM Short LC : Act_Updt - Individual data activity on BS time slot 1 Hashed Addr 126 : No activity on BS time slot 2
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 First fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 13 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Continuation fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM DMR Data Frame - Error !
CACH : TACT Ch 1 Continuation fragment of LC
10:39:55 AM DMR Data Frame - Error !
CACH : TACT AT=1 Ch 2 Last fragment of LC
10:39:55 AM Short LC : Act_Updt - Individual data activity on BS time slot 1 Hashed Addr 126 : No activity on BS time slot 2
10:39:55 AM DMR Data Frame - Error !
CACH : TACT Ch 1 First fragment of LC
10:39:55 AM DMR Data Frame - Error !
CACH : TACT AT=1 Ch 2 Continuation fragment of LC
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 Continuation fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 10 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Last fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM Short LC : Act_Updt - Individual data activity on BS time slot 1 Hashed Addr 126 : No activity on BS time slot 2
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 First fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 9 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Continuation fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 Continuation fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 8 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Last fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM Short LC : Act_Updt - Individual data activity on BS time slot 1 Hashed Addr 126 : No activity on BS time slot 2
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 First fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 7 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Continuation fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 Continuation fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 6 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Last fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM Short LC : Act_Updt - Individual data activity on BS time slot 1 Hashed Addr 126 : No activity on BS time slot 2
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 First fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 5 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Continuation fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 Continuation fragment of LC
Slot Type : Colour Code 3 CSBK
Preamble CSBK : Data content 4 Blocks to follow
Target Address : 64250 Source Address : 109
10:39:55 AM DMR Data Frame - Error !
CACH : TACT AT=1 Ch 2 Last fragment of LC
10:39:55 AM Short LC : Act_Updt - Individual data activity on BS time slot 1 Hashed Addr 126 : No activity on BS time slot 2
10:39:55 AM DMR Data Frame - Error !
CACH : TACT Ch 1 First fragment of LC
10:39:55 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Continuation fragment of LC
Slot Type : Colour Code 3 Idle
10:39:55 AM DMR Data Frame
CACH : TACT Ch 1 Continuation fragment of LC
Slot Type : Colour Code 3 Rate ¾ Data Continuation
R_3_4_DATA (data block serial number=0)
01000101000000010000000000100110011111110000001000000000000000000100000000010001111001110101110000001100000000000000000001101101
10:39:56 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Last fragment of LC
Slot Type : Colour Code 3 Idle
10:39:56 AM Short LC : Act_Updt - Individual data activity on BS time slot 1 Hashed Addr 126 : No activity on BS time slot 2
10:39:56 AM DMR Data Frame
CACH : TACT Ch 1 First fragment of LC
Slot Type : Colour Code 3 Rate ¾ Data Continuation
R_3_4_DATA (data block serial number=1)
00001101000000001111101011111010000011111010010100001111101001010000000000010010101010001000010100000000000010001111000000100000
10:39:56 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Continuation fragment of LC
Slot Type : Colour Code 3 Idle
10:39:56 AM DMR Data Frame
CACH : TACT Ch 1 Continuation fragment of LC
Slot Type : Colour Code 3 Rate ¾ Data Continuation
R_3_4_DATA (data block serial number=2)
00000011001100010011000000111001000000000000000000000000000000000000000000000000000000000000000001000111000110011101100001000101
10:39:56 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Last fragment of LC
Slot Type : Colour Code 3 Idle
10:39:56 AM Short LC : Act_Updt - Individual data activity on BS time slot 1 Hashed Addr 126 : No activity on BS time slot 2
10:39:56 AM DMR Data Frame
CACH : TACT Ch 1 First fragment of LC
Slot Type : Colour Code 3 Terminator with LC
Terminator Data Link Control PDU
Destination Logical Link ID : 64250 Source Logical Link ID : 109
10:39:56 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Continuation fragment of LC
Slot Type : Colour Code 3 Idle
10:39:56 AM DMR Data Frame
CACH : TACT Ch 1 Continuation fragment of LC
Slot Type : Colour Code 3 Terminator with LC
Terminator Data Link Control PDU
Destination Logical Link ID : 64250 Source Logical Link ID : 109
10:39:56 AM DMR Data Frame
CACH : TACT AT=1 Ch 2 Last fragment of LC
Slot Type : Colour Code 3 Idle
10:39:56 AM Short LC : Act_Updt - Individual data activity on BS time slot 1 Hashed Addr 126 : No activity on BS time slot 2
10:39:56 AM DMR Data Frame
CACH : TACT Ch 1 First fragment of LC
Slot Type : Colour Code 3 Terminator with LC
Terminator Data Link Control PDU
Destination Logical Link ID : 64250 Source Logical Link ID : 109

 

[grosminet]

hello

It s a trbonet network -using a dispatch network PC
Home - TRBOnet. Dispatcher Console, Data Application, IP Site Connect, Connect Plus, Capacity Plus, Telephone Interconnect, 800 mhz, MOTOTRBO software, motorola, GPS, telemetry, mototrbo system planner

 

[inigo88]

Thank you very much! Just out of curiosity, what about my log file tipped you off to this being a TRBOnet system? This log was recorded from a freq licensed to a large Marriott hotel.

 

[nycap]

please excuse my question as i must be remiss; but why cant we convert the binary data into octal, hex or dec to try to get the ascii characters?

 

[krokus]

I do not understand what you are asking. There is no reason to add an intermediate step, when you can go directly from binary to ASCII.

 

[mkewman]

WHOA. You guys have been working hard on DMRD, I confess I haven't checked out the latest builds. What can I do to help? There's a ton of DMR/MotoTrbo systems here.

I'd love to be able to help with text messaging and AVL

 

[Forts]

That would be the next progression I think.. getting into text and data. Not very much is known about that so far, although some guys are coming up with some pretty slick 3rd party apps for that stuff.

 

[IanWraith]

Hi All
Limited progress with DMRDecode of late due to work and home commitments but I haven't forgotten it.

The big problem with decoding DMR data is that the data itself can be sent in many different ways according to the data. So although I know (thanks to the people here) that text on big M systems appears to be encoded using 16 bit Unicode (which can be decoded and displayed easily) the problem is how do we know that the data in a certain PDU is text ? If we decode the data in every data transport PDU as text we are going to see a lot of crud and miss data that could be decoded into something meaningful which isn't ASCII.

To get further we need to understand the data in say the prop data headers. Also if anyone fancies the challenge understanding the data sent using the TRBOnet data (source 64250) would be a big step forward.

 

[Joe91]

Ian I'd like to thank you very much for the software, and also to anyone who has anything to do with SDR#, DSD, and VB-Audio Cable

I'm getting good results with a cheap RT dongle with SDR#, fed via VB-Audio Cable to both DMRDecode and DSD at the same time, audio out (on the un-encrypted DMR here) and watching the Colour/Group/Source data - very interesting!

 

[nycap]

Hi All
Limited progress with DMRDecode of late due to work and home commitments but I haven't forgotten it.

The big problem with decoding DMR data is that the data itself can be sent in many different ways according to the data. So although I know (thanks to the people here) that text on big M systems appears to be encoded using 16 bit Unicode (which can be decoded and displayed easily) the problem is how do we know that the data in a certain PDU is text ? If we decode the data in every data transport PDU as text we are going to see a lot of crud and miss data that could be decoded into something meaningful which isn't ASCII.

To get further we need to understand the data in say the prop data headers. Also if anyone fancies the challenge understanding the data sent using the TRBOnet data (source 64250) would be a big step forward.

the error protection code is known and is decoding right and the logical link data position is known. are the header and data block formats unknown? is there no way to know where in the block the user data octets are?

i hear a ton of encoded audio and see on the screen that it is data. its got to be gps data becuase it is going on all the time.