Reversing Unknown Radio Transmitters

[NotionalLabs]

Hey everyone,

I'm brainstorming a new project to explore the communications protocol for my wireless toothbrush (a Braun Oral-B Triumph 5000). This model has a "Smartguide" receiver that gives you some high-level feedback on your brushing session (such as time spent, if you're applying too much pressure, etc...). I think it would be interesting to see how the the wireless portion of this works and maybe build a little hack to generate some stats on it, etc...

Generally speaking, I'm interested in figuring out the techniques involved in identifying and reversing RF communications - the ideas I've had so far are:
- see if there is an FCC product information for the device detailing radio info.
- take the smartguide apart and probe to find the data bus from the receiver to whatever IC is in the thing (that way I don't have to worry about the signal at all, and just decoding the data-level protocol.

Neither of these really help educate me about how to detect RF signals of unknown devices though. Would I need something like this: http://rfexplorer.com/models/ to do it?

Thanks for any advice,

Jim

[w2aew]

The likelyhood is that Braun didn't develop something on their own.  They likely used an off-the-shelf RF solution that operates in one of the license free ISM bands.  So, it's likely operating around 430MHz or 915MHz or 2.4GHz.  A spectrum analyzer would be helpful to ID that.  The transmissions are likely to be short bursts, catching them on the analyzer will require careful setup unless you have some realtime capability in the analyzer.  Modulation type is likely to be simple, such as OOK/ASK or FSK.  If it is OOK/ASK, and you've identified the frequency, then the modulation pattern can be observed using zero span on the spectrum analyzer.  Do really capture and analyze it, you'd ultimately want a signal analyzer (also known as a vector signal analyzer, not to be confused with a vector network analyzer).  The VSA can capture/record the RF signal over time, then give you the ability to observe spectral, amplitude, frequency and phase changes vs. time.

Without this fancy equipment, you'll have to get creative.  Building a simple broadband RF detector (using a short antenna and a few caps and signal diodes) and coupling it to a scope should at least give you an idea of the RF transmission duration, and possibly a view into the modulation (if it is a form of AM).  That won't tell you about the frequency used though.

Is this information/feedback being provided "live", as you're brushing, or is it available only when the brush is put back on the stand.  If the latter, the data transmission might not be RF at all...

[Rascal]

This is RFID tagging

UK frequencies appear to be 100-500 kHz, 10-15 MHz, 850-950 MHz, and 2.4-5 ghz 

13.56mhz is a popular frequency giving up to 1.5 meters range

[KJDS]

I'll guess that it's a Zigbee system

[abyrvalg]

Take it apart and check what chips are there - this way should be much-much-much easier than analyzing radio waves.