ShmooCon was, once again, a fantastic experience this year. One of many highlights of this year's event for me was hacking on some radio devices with Travis Goodspeed in the hotel bar for hours on end. This included playing with the IM-Me that he brought. As soon as I got home I ordered one. I found mine for $15.99 and free shipping on eBay.
Since then I've written custom firmware to turn my IM-Me into a pocket spectrum analyzer, shown here displaying activity of a frequency hopping system at a grocery store. The only change I've made to the hardware is the addition of a ribbon cable in order to easily connect to a GoodFET for programming, but this is simply creating a permanent connection to the debug contact points that are already exposed in the battery compartment. I've followed Travis's advice on how to develop for the platform.
The software tunes the IM-Me's radio chip to one frequency at a time, uses the chip's RSSI measurement function, and plots the result as one column on the LCD. It sweeps across the whole screen (132 columns) several times per second, showing a contiguous range of radio frequency activity. The technique works quite well, although there are a few defects. Most notably, harmonics of the IM-Me's 26 MHz crystal show up as spurs on the display.
The frequency ranges supported by my device are 281 - 361, 378 - 481, and 749 - 962 MHz. This is about 50% more than the chip is advertised to support and covers quite a bit of interesting activity in the US including ISM, LMR, television, amateur bands, pagers, and mobile phones. The edges of the bands supported by other batches of chips may differ but probably not by much.
The software supports three bandwidth modes: wide (default), narrow, and ultrawide. Wide mode displays 26.4 MHz of bandwidth in 200 kHz increments. Narrow mode displays 6.6 MHz of bandwidth in 50 kHz increments. Ultrawide mode, shown here with some mobile phone activity, displays 88 MHz of bandwidth in 667 kHz increments.
The code is open and available here. I'd love to hear from you if you give it a try. Huge thanks to both Travis and Dave who did the hard reverse engineering work!
Update: The code has a new home at github.
80 comments:
Beautiful work, Mike (and Travis and Dave). Repurposing mass-produced hardware and packaging for more interesting applications is so slick. I'm going shopping for a few IM-Mes, I think...
Hello, I am an amateur radio operator. Could this be tuned to a frequency and demodulated on the device to use as a receiver? and also, could an external antenna be used with the spectrum anylyzer?
Thanks, Nathanael.
Hey, Nate. Yes, demodulation can be done on the device for certain signals. Several variations of ASK and FSK are supported. See the cc1110 data sheet for details. It wouldn't be difficult to add an external antenna connector. The built-in antenna is a piece of wire (900 MHz quarter wave monopole) inside the case along the top of the LCD.
Hello everyone.
Do you think this would be possible with the original Zipit in the 2.4GHz spectrum? I have access to thousands at about this same price point.
Thanks in advance,
Brad
Although you said that it supports bands at 200 or 300MHz, the balun network of the device is likely only meant for one of these bands. Is performance degraded by this?
Yes, the balun (not to mention the antenna) is designed for 900 MHz, so the lower bands do not perform as well. They also suffer more from internal interference. Still, I did some testing in all three bands, and it is useful even down at the low end.
I don't think a similar hack would be possible on the Zipit as it uses a 802.11 chip. If you find a device with a cc2530 or similar, though, let me know. :-)
Nice indeed Michael, I had been trying to refrain from buying a cheap IM-ME from ePay... don't think I'll succeed in refraining any longer now!
As to sporious response from the 26 MHz XTAL, wouldn't it be possible to implement a sort of calibration routine in software?
Something like:
- disable the antenna input of the radio IC
- measure exact frequency of the XTAL
- calculate exact harmonic freqs. of the XTAL
- measure RSSI outputs on those harmonic freqs. and write them to memory
- re-enable the antenna input of the radio IC
- at last modify the spectrum analyzer firmware so that the values of harmonics get subtracted from actual measurements taken on those same harmonics.
Just an idea, and beware that I'm no software engineer... so please don't laugh if this sounds as a dumb proposition.
Cheers,
S.
Nice job Michael. I have ordered a IM-ME from ebay. But I wonder how to flash it with common tools/programmers. Any chance to program it using a PIC, AVR, or simmilar programmer? I'm not very familiarized with JTAG capabilities and GoodFET does not seem to be easily available. Any ideas?
Thank you!
I like the way you are thinking, Sebastiano, but there are drawbacks to your proposal.
If we normalize the output by subtracting the response without an antenna, then we show a reduced power level for signals at the same frequency as our spurs. For example, if we have a 10 dB spur from internal interference at 910 MHz and a 15 dB signal is detected, we would display it at 5 dB instead of 15 dB. You could argue that masking signals below 10 dB is also a problem, but at least there is an indication to the user that masking could occur. I'd rather have a visible defect than an invisible one. As an alternative, it might be worth trying to add some better internal shielding. The 26 MHz crystal is right next to the antenna path.
Frequency calibration would be nice too, but the only internal reference we have to measure the crystal is the crystal itself. It always appears to be perfect! We could calibrate to an external RF signal, but I haven't thought of a good one that would be available to most people. Something like WWVB would be nice, but it would have to be within the frequency range of the IM-Me.
Defaultito: I highly recommend the GoodFET. Travis is in the habit of handing out bare boards for free everywhere he goes (say, SOURCE Boston). The hardware is open source, so you could have boards printed yourself if you want. You could also build or buy a CC Flasher or a TI development kit. The serial debug protocol is well documented and could be implemented on other hardware. The Bus Pirate would be a good candidate. Travis's blog has some info that would be helpful if you wanted to try that.
Thnak you Michael! Since I usually work with AVR, I will try to build a CC Flasher. It would be nice to have a yahoo group or forum for all interested in turn the IM-ME into a handheld spectrum analyzer. Many hams would be interested!
Michael, your points seem definetely reasonable.
Maybe XTAL harmonics could be reduced by removing the internal antenna (cutting PCB traces I suppose), and replacing it with a thin coax pigtail. Extra shielding for the XTAL would certainly help as well.
I'll have to experiment - in the end I surrendered to the temptation and ordered a cheap IM-ME :))
An external antenna connector would also be useful for connecting attenuators, signal generators etc.
Finally: a friend will be able to lend JTAG<->USB interfaces (based on Ark Pioneer or Prolific chips), I hope one of this interfaces will be able to load your firmware on the IM-ME.
I'll let you know....
Hey Guys this is crazy impressive! Excellent hack! FYI there are some gpl drivers for the pc side of this device posted below
http://im-megpldrivers.sourceforge.net/
Thanks for this work - I've just managed to get my IM-ME running this as well.
http://www.flickr.com/photos/cybergibbons/5162938944/
Ewwww... What kind of person puts his grubby pocket device that's been god-knows-where on everyone's bell peppers like that?
I assume the companion USB dongle also contains a CC1110 and that comparable tricks might be possible from the PC side?
I would have expected the dongle to contain a CC1111, but it has a CC1110. See Joby's blog for some great info.
Can this gizmo display FM analogue signals too, or just digitallly modulated signals?
Lawz: it will detect any radio signal in the supported frequency range. The modulation doesn't matter. I'm not doing any demodulation or decoding here.
Is this idea adaptable for HF? I'm thinking something like a mixer with a 280 MHz LO to convert the entire HF spectrum 0-30 MHz to 280-310 MHz, plus a lowpass filter to remove the image response. I'm interesed in measuring the harmonics of a homebrew 7 MHz CW rig.
Also, what's the dynamic range?
It ought to be possible to hack this for Wifi using a simple mixer and L.O. to downconvert the 2.4 to 2.5 GHz band (and for that matter any other band all the way up to 15 GHz i.e, satellite TV) into a suitable band.
Ghetto TCXO can be made using any old cheap 433MHz xtal or other oscillator, tap off the 2nd harmonic at 866 MHz and use temperature feedback circuit :-)
Sorry, that should be 3rd harmonic at 1732 MHz, leaving a difference frequency centred on 668 MHz at 2400 MHz and 768 MHz at 2500 MHz.
A simple tuned circuit bandpass filter would do the trick here.
I want to build a POCSAG receiver from the im-me. This should be super fun.
Hi you please tell me which ebay dealer yu got your IM-Me from?
I am also aHam Radio operator
Thank you
regards Gary VK2KYP
Hi, can you please tell me the ebay seller you brought your IM-ME from? I am also a ham radio operator
regards Gary VK2KYP
Gary you can still buy it via Amazon, I just bought one.
Speaking of which I was curious if the device could be flashed with the bus pirate? The device is 3.3v tolerant, And I've wired it to my bp and been able to supply it power. However that's as far as I've gotten. Amy ideas?
Hi guys,
Now Im feeling left out!!! How brilliant you all are. Im looking for one myself. As an Aussie Ham Im crossing my fingers someone on Amazon will sell me one. (hard to find anyone on Amazon willing to ship to Australia).
Jason
VK2WAR.
hi michele
i am very ig fan of u, will u plz send me deatild info on how to make rolljam and its bild instructions. i wil b very much thnak fll to you.
Nice share. Please share this too.
1. Troy-Bilt XP Squall 2160 XP 21-in Single-stage Gas Snow Blower : http://www.toolsbuff.com/products/Troy%252dBilt-XP-Squall-2160-XP-21%252din-Single%252dstage-Gas-Snow-Blower.html
2. SIMPSON 4200-PSI 3.5-GPM Water Gas Pressure Washer : http://www.toolsbuff.com/products/SIMPSON-4200%252dPSI-3.5%252dGPM-Water-Gas-Pressure-Washer.html
3. Briggs & Stratton PowerSmart 2600-Running-Watt Inverter Portable Generator with Briggs & Stratton Engine : http://www.toolsbuff.com/products/Briggs-%26-Stratton-PowerSmart-2600%252dRunning%252dWatt-Inverter-Portable-Generator-with-Briggs-%26-Stratton-Engine.html
4. Toysmith Caterpillar Cat Take A Part Wheel Loader : http://www.toolsbuff.com/products/Toysmith-Caterpillar-Cat-Take-A-Part-Wheel-Loader.html
5. Tamiya M3 GT2 2009 RC BMW Vehicle : http://www.toolsbuff.com/products/Tamiya-M3-GT2-2009-RC-BMW-Vehicle.html
6. Agilent HP 8714ES 30KHz to 3GHz RF Network Analyzer : http://www.toolsbuff.com/products/Agilent-HP-8714ES-30KHz-to-3GHz-RF-Network-Analyzer.html
Thanks
a
Permainan Sabung Ayam tentunya sudah pada tahu ya, yang dimana ayam melawan ayam pertandingan yang sangat seru ini bisa kalian nonton secara live lohh, banyak yang bermain di situs kami dan merasa sangat nyaman, bagi kalian yang ingin bermain bisa kunjungi situs kami, dijamin kalian akan merasa sangat senang.
http://www.s128daftar.org
http://www.s128daftar.org/cara-daftar-sabung-ayam-online-daftar-s128/
http://www.s128daftar.org/aplikasi-s128-terbaru-download-apk-s128/
http://www.s128daftar.org/link-login-s128-login-sabung-ayam-s128/
http://www.s128daftar.org/deposit-s128-via-pulsa-s128-deposit-pulsa/
http://www.s128daftar.org/withdraw-s128-sabung-ayam-online-cara-wd-s128/
http://www.s128daftar.org/fasilitas-tanya-jawab-s128-livechat-s128/
http://www.s128daftar.org/daftar-mma-s128-situs-daftar-mma-online/
http://www.s128daftar.org/agen-resmi-s128-s128-deposit-pulsa/
http://www.s128daftar.org/daftar-s128-indonesia-agen-s128-deposit-pulsa/
Manfaat Pemberian Teh Krisan Pada Ayam Aduan
Pakan Ayam Aduan
CrownQQ Agen DominoQQ BandarQ dan Domino99 Online Terbesar
Yuk Buruan ikutan bermain di website CrownQQ
Sekarang CROWNQQ Memiliki Game terbaru Dan Ternama loh...
9 permainan :
=> Poker
=> Bandar Poker
=> Domino99
=> BandarQ
=> AduQ
=> Sakong
=> Capsa Susun
=> Bandar 66
=> Perang Baccarat (NEW GAME)
=> Bonus Refferal 20%
=> Bonus Turn Over 0,5%
=> Minimal Depo 20.000
=> Minimal WD 20.000
=> 100% Member Asli
=> Pelayanan DP & WD 24 jam
=> Livechat Kami 24 Jam Online
=> Bisa Dimainkan Di Hp Android
=> Di Layani Dengan 5 Bank Terbaik
=> 1 User ID 9 Permainan Menarik
Ayo gabung sekarang juga hanya dengan
mengklick daftar crownqq
Link Resmi CrownQQ:
Idcrownqq,com
Idcrownqq,net
Idcrownqq,org
Idcrownqq,info
BACA JUGA BLOGSPORT KAMI:
CrownQQWIN
Berita dan Info Dunia
Entertainmensartis
Info Lebih lanjut Kunjungi :
WHATSAPP : +6287771354805
LINE : CS CROWNQQ
TELEGRAM : +855882357563
Selling USA FRESH SSN Leads/Fullz, along with Driving License/ID Number with good connectivity.
**PRICE FOR ONE LEAD/FULLZ 2$**
All SSN's are Tested & Verified. Fresh spammed data.
**DETAILS IN LEADS/FULLZ**
->FULL NAME
->SSN
->DATE OF BIRTH
->DRIVING LICENSE NUMBER
->ADDRESS WITH ZIP
->PHONE NUMBER, EMAIL
->EMPLOYEE DETAILS
->Bulk order negotiable
->Minimum buy 25 to 30 leads/fullz
->Hope for the long term business
->You can asked for specific states too
**Contact 24/7**
Whatsapp > +923172721122
Email > leads.sellers1212@gmail.com
Telegram > @leadsupplier
ICQ > 752822040
Selling USA FRESH SSN Leads/Fullz, along with Driving License/ID Number with good connectivity.
**PRICE FOR ONE LEAD/FULLZ 2$**
All SSN's are Tested & Verified. Fresh spammed data.
**DETAILS IN LEADS/FULLZ**
->FULL NAME
->SSN
->DATE OF BIRTH
->DRIVING LICENSE NUMBER
->ADDRESS WITH ZIP
->PHONE NUMBER, EMAIL
->EMPLOYEE DETAILS
->Bulk order negotiable
->Minimum buy 25 to 30 leads/fullz
->Hope for the long term business
->You can asked for specific states too
**Contact 24/7**
Whatsapp > +923172721122
Email > leads.sellers1212@gmail.com
Telegram > @leadsupplier
ICQ > 752822040
Menangkan ratusan juta rupiah dengan mudah, dengan bermain judi slot online di agen judi online terpercaya di Indonesia hokiasia, dapatkan juga Promo Menarik dari hoki asia dan raih keuntungan sebesar-besar nya, jadi tunggu apalagi ayo daftar segera si hokiasia!
What a information of un-ambiguity and preserveness of precious know-how on the topic of unpredicted feelings.
Thanks for posting this info. I just want to let you know that I just check out your site and I find it very interesting and informative. Now sharing some information about How to DownloadSpectrum TV App for PC
Mengenal Pengertian Tentang Ayam Bangkok Lancuran
Hello I would be interested in buying the Im-Me since it’s sold out nearly everywhere. Would you be willing to sell it!
Cheers Nicola
Pkv Games
Slot Online Pulsa
What an amazing guide! Can’t wait to use this when I travel to Amsterdam. This was very informative. newsforpc.com
CIHUY88 adalah situs taruhan terpercaya dengan Bonus terbanyak di Indonesia
Thankfully, in the 11 years since this exploit became widely known, I've been able to sell an ass-and-a-half-load of these on eBay for 300 bucks a pop.
Of course, I think thanks to some coverage by the more "mainstream" tech rags, (the Wired article in particular was helpful)who are big on the big stuff but shy on the details; like the detail that you do NOT just...what? pick one of these up off the shelf and start hacking with it.
There's a learning curve....you must actually...READ some shit and....STUDY!
You will screw up. And if you are anything less than slavishly dedicated to the research part of this, you WILL brick your device. Not because the info you needed was not there just as easily reached as the info for how and what to use; but because YOU did not bother to READ it.
So...since you do not read? You may pay. And pay.
Some folks have purchased a dozen of these over the course of years.
And they STILL have never bothered to read....anything.
How would I know that? Because I get to read the e-mails, the messages, the complaints.
I can tell by the language of same that those who run into these issues are:
1) Not very studious;
2) Are most likely [wannabe]criminals; and
3) Have money to blow.
All three of these, in most cases.
Hey. If I can grift a few idiots out of their battle chests without breaking the law or doing anything even slightly dishonest? I'll take a bow for it.
Excellent information
Thanks you so much for this wonderful article
you written it looks great an unique.
Kalyan starline
Starline games
satta king
https://sattaking.chat
What has your government done to help save you from your financial instability? you strive to survive and yet you hear stories of how your leaders have become terror in your entities... is time to make a different. for will have made money, and we have also come to help you out from your long time of financial suffering. clearing of credit card is made available, software for hacking ATM machines, bank to bank hacking and transfer, change your school grade and become something useful in the society. we also have other form of services such as Facebook hack, whats-app hack, twitter hack, i cloud hack, tracking of smart phones, hacking CCTV, installation of software on desktop and PC, snap-chat hack, Skype hack, wire wire, bitcoin account hack, erase your criminal record and be free for ever. database hack and many more. e-mail: cyberhackingcompany@gmail.com for your genuine hacking services and we shock we your findings.
Excellent information
Thanks you so much for this wonderful article
you written it looks great an unique.
Kalyan starline
Starline games
satta king
Satta matka 143
Satta tv
Sattamatka
Sattaking
https://sattaking.chat
Thanks for sharing your thoughts. I look forward to your further postings.
Accurate 1680 Smokeless Gun Powder
Accurate 2015 Smokeless Gun Powder
Accurate 2520 Smokeless Gun Powder
Accurate 4100 Smokeless Gun Powder
Accurate 5744 Smokeless Gun Powder
Accurate MagPro Smokeless Gun Powder
Accurate Nitro 100 Smokeless Gun Powder
Accurate No. 11FS Smokeless Gun PowderAccurate No. 7 Smokeless Gun Powder
Alliant 20/28 Smokeless Gun Powder
Alliant 2400 Smokeless Gun Powder
Alliant 410 Smokeless Gun Powder
Alliant American Select Smokeless Gun Powder
Alliant AR-Comp Smokeless Gun Powder
Alliant Blue Dot Smokeless Gun Powder
Alliant Bullseye Smokeless Gun Powder
Alliant Clay Dot Smokeless Gun Powder
Alliant Extra Lite Smokeless Gun Powder
Alliant Herco Smokeless Gun Powder
Alliant Power Pistol Smokeless Gun PowderAlliant Promo Smokeless Gun Powder 8 lb
Alliant Reloder 10X Smokeless Gun Powder
Alliant Reloder 15 Smokeless Gun Powder
Alliant Reloder 16 Smokeless Gun Powder
Yeah this card sounds great almost as good as the time I saw a mermaid blowing Santa claus
That's got to be some trick turn a card into a KTM crash cart just by applying some numbers to a Max strip that miraculously works on every ATM I guess all the banks got together one day and said we're all going to use the same code on our different ATMs man if you're getting money off this praise to you something more original! Then again I'm pretty sure you're getting somebody stupid to pay it
For me not to bust on this card anymore I only have one request if people have paid you please send them a card stating how stupid they really are to think something like this really exists and the $5,000 they came off of that's a Life learning lesson! And you can always sweeten the deal by I got saying your nose like our parents did when we were little kids!
Or better yet tell them they need to stop doing drugs right now if they want to have any brain left before they die they're already given $5,000 away for fairy tales.
But seriously enough joking it's time for me to be real and actually generous I'm going to tell you guys how to get $5,000 out of the ATM for free no magical card or anything like that what you do is you go to the ATM that you want the money out of you pull your phone out and you take a picture of the ATM then you look at the rifle on the screen and you'll get to make and model of it then go to eBay put in the make and model of that ATM and you'll get the key to open the front cover that's right the exact key but you're not done there you have to get one more key that opens up the cash box two keys cost $30 you're welcome criminals
Hej ven jeg har også købt en im me ka du hjælpe mig lidt
Jeg har lige købt en im me ka du hjælpe mig med at få den lidt sjovere
I’ve been absent for a while
but now I remember why
I used to love this web site
thank you terima kasih
saya sudah bekerja dibidang ini selama 2 tahun terakhir
ingin memberikan salah satu karya terbaik saya disini
terima kasih sudah menulis info yang bermanfaat ini, akan saya bagikan pada teman saya
artikel yang sangat bagus kepada teman saya
untuk kamu yang sering nonton film
nonton film online secara gratis
bisa langsung klik link dibawah ini
terima kasih sudah membagikan informasi ini ya
I really enjoyed this post and hope you write more like this
harusnya kamu membuat lebih banyak yang seperti ini
dengan kemampuan seperti ini harusnya kamu sudah terkenal
Quality articles is the important to invite the people to visit the web site, that’s what this web page is providing.
It’s truly very complex in this busy life to listen news on TV, so I
just use world wide web for that purpose, and get the newest information.
I just like the helpful information you supply to your articles. I will bookmark your blog and take a look at once more here regularly. I’m slightly certain I will learn a lot of new stuff proper here! Best of luck for the next!
This is my first time pay a quick visit at here and i am really pleassant to read all at single place.
I recently purchased a $16 pocket spectrum analyzer, and I must say it exceeded my expectations. Despite its compact size and budget-friendly price, the device delivers impressive performance. The interface is user-friendly, allowing for easy navigation and quick access to essential functions. I was pleasantly surprised by its accuracy in analyzing various frequency ranges, making it a handy tool for both hobbyists and professionals alike. The build quality is decent for the price, and the pocket-sized design adds to its portability. Overall, this spectrum analyzer is a great value for the money, providing reliable functionality without breaking the bank. Highly recommended for anyone looking for an affordable yet effective solution for spectrum analysis. Most students are drawn to these types of articles and information, but they are unable to prepare for their exams, If you have been struggling with your e-commerce project and want assistance, students can visit web design company - web design company near me and get the best performance on their website by providing them with the most excellent available resources, including quality web design services.
A career as a photographer can be an exciting avenue for creative expression, as photographers have the opportunity to work in many settings and meet diverse
Row feature. The blog comes with 6 modules including an advanced Posts Module that allows you to display articles on any page within your store and in any position.
Thanks For Sharing https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3112&partner_device_id=8e534f41-4137-4767-9526-ed207bb27c2d&partner_url=https://telkomuniversity.ac.id/
Great blog! Learned a lot, thanks for keeping it simple!
IIT JAM Physics Syllabus
Post a Comment