How does one know how a signal has been modulated

Question

I am trying to intercept signals from a drone remote controller and decode them. Before I can do this I need to demodulate the signals. All I have is radio data from the transmitter's operating frequency. Is there any way for me to tell how the signal is modulated by looking at the radio data or some other source?

Answer 1

Yes, you'll have to look at it.

I can't go into detail about every possible modulation, because there's just too many. But typically, a look at the spectral representation gives you an idea of whether you're dealing with

• a straightforward single-carrier signal
• a spread-spectrum signal or
• a multicarrier signal.

One place to see some examples is the Signal Identification Wiki's "All Identified Signals" database page, paying attention mostly to the "Modulation" and "Waterfall image" columns.

For example, if the spectrum looks nearly like a rectangle, then you're most likely looking at an OFDM multicarrier system. If it's really wide, but not very powerful and typically has slight periodic sidelobes, that'd be typical for a direct-sequence spread-spectrum system. If it looks like a set of sub-100% duty cycle tones, it might be FSK. You'll need to play with the parameters of your spectrum display quite a bit to see that!

Then, you'd look at the signal autocorrelation statistics to figure out symbol rate.

Also, you'd often manually try very hard to correct any frequency offset. There's algorithms to do that, but they are not the same for all modulations. A FLL might be reasonably generic, but it's rather sensitive to noise and hard to parameterize optimally.

Armed with that, you can have an attempt at things like trying to come with an eye diagram for I and Q; that can give you an idea of the number of discrete points in constellation space that you'll see. Another good option is to attempt a reasonable guess of symbol timing, based on the maxima of the signal shape in the eye diagram and generate a scatter plot showing the complex values at that point in a complex plane – a constellation plot! Ideally, you could already see the constellation in that, but in reality, noise and frequency error as well as remaining timing error will typically smear and distort that.

However, you can often infer a lot from that:

• All points on a circle: PSK or FSK
  • With that, you can apply clever higher-order statistics to get a very good frequency estimate. Correct that frequency, and analyze furhter
• Points with wildly varying amplitude, but not mostly on one or two lines: QAM
  • Due to the multiple unknowns, this is very hard to recover other than trying. Try 16QAM, 64QAM; anything higher than that would be very hard to deal with later on.
• Points straddling the 0+0j point, mostly looking like a cloud with a Gaussian intensity: sorry, you didn't quite manually synchronize enough. Try again!

Start with short segments of signal; you'll not have succeeded at completely removing frequency error at this point, so everything will at least slightly rotate.

There's a very rich amount of knowledge on automated signal classification, mostly dating back to the cold war era. As you can imagine, it's not the easiest to access literature; there's plenty of companies that offer products and services related to classifying modulations; it's a nontrivial business.

One attempt at a half-automated classifier is SbMüller's gr-inspector, a GNU Radio module using a lot of cool algorithms to take reasonable stabs at estimatimating the modulations and exact positions of transmitters. As you can imagine, it has to focus on a few very specific types of modulation. It does a very good job at estimating OFDM parameters, though!

---

So, assume you now know that e.g. this is an OFDM system with 128 carriers, 1/8 symbol length cyclic prefix, Schmidl&Cox synchronization symbols and QPSK on each carrier, and you're able to correctly synchronize to that and receive the symbols.

Great! Now you've got symbols. That means that for any serious system you still have to figure out

• Mapping of symbols to code bits
• Scrambling/Whitening/Interleaving
• channel coding (very often: outer and inner coding)
• frame data structure and
• potentially cryptography.

So, that's really far from an easy task!

However, many very cheap remote controllers for toys simply do idiotically simple and inefficient things like OOK, no interleaving, no whitening, a repetition code, and constant frame structure, meaning that pushing the same thing always results in the same transmission.

Not only are the parameters that realistically guessable, but you could just as well deal with this by not decoding anything but simply linking your RF signal observation directly to the action that caused it via cross-correlation with reference signals.

Have fun!