pwn 0.5.627 → 0.5.628

data/lib/pwn/sdr/decoder/gsm.rb

@@ -3,65 +3,176 @@
 module PWN
   module SDR
     module Decoder
-      # GSM (2G) true-air BCCH/CCCH activity decoder.
+      # GSM (2G) true-air FCCH/SCH decoder.
+      #
+      # 270.833 kbit/s GMSK. FCCH burst = 148 all-zero bits → a pure
+      # +67.708 kHz tone for ~547 μs. Detect via variance-dip on the FM
+      # discriminator (PWN::FFI::Liquid.freq_demod), estimate carrier
+      # offset from mean deviation, then correlate the SCH 64-bit extended
+      # training sequence 8 timeslots later and recover the 6-bit BSIC
+      # (NCC/BCC) + 19-bit reduced frame number (T1/T2/T3'). Emits
+      # {event:'fcch'|'sch', freq_offset_hz:, bsic:, ncc:, bcc:, rfn:}.
       module GSM
-        # Streaming I/Q energy/burst demod for Base.run_iq.
+        SYMBOL_RATE = 270_833.0
+        FCCH_TONE   = SYMBOL_RATE / 4.0 # 67.708 kHz above carrier
+        FCCH_BITS   = 148
+        # SCH extended training sequence (64 bits, TS 45.002 Table 5.2.5)
+        SCH_ETSC = [
+          1, 0, 1, 1, 1, 0, 0, 1, 0, 1, 1, 0, 0, 0, 1, 0,
+          0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 1, 1, 1, 1,
+          0, 0, 1, 0, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0, 1,
+          0, 1, 1, 1, 0, 1, 1, 0, 0, 0, 0, 1, 1, 0, 1, 1
+        ].freeze
+
+        # Streaming GMSK demod for Base.run_iq — I/Q → FCCH lock + SCH BSIC.
         class DemodIQ
-          def initialize(rate:, protocol:, modulation:, extra: {})
-            @rate = rate.to_f
-            @protocol = protocol
-            @modulation = modulation
-            @extra = extra
-            @floor = nil
-            @in_burst = false
-            @burst_t0 = nil
-            @peak = -200.0
-            @burst_n = 0
-            @threshold = (extra[:threshold] || 8.0).to_f
-            @carry = []
+          def initialize(rate:)
+            @rate  = rate.to_f
+            @spb   = @rate / SYMBOL_RATE
+            @audio = []
+            @fcch_n = 0
+            @sch_n  = 0
           end
 
           def feed_iq(samples, rate: nil, &)
             @rate = rate.to_f if rate
-            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: samples)
-            # process in ~1 ms hops
-            hop = [(@rate / 1000.0).round, 1].max
+            @spb  = @rate / SYMBOL_RATE
+            fm = PWN::SDR::Decoder::DSP.fm_demod_iq(iq: samples)
+            @audio.concat(fm)
+            scan(&) if block_given?
+            max = (@rate * 0.25).to_i
+            @audio.shift(@audio.length - max) if @audio.length > max
+          end
+
+          private
+
+          def scan
+            win = (FCCH_BITS * @spb).round
+            return if @audio.length < win * 4
+
+            # slide half-burst hop, look for min-variance window (pure tone)
+            hop  = win / 4
+            best = nil
             i = 0
-            while i < m2.length
-              win = m2[i, hop]
-              break if win.nil? || win.empty?
-
-              ms = win.sum / win.length
-              lvl = ms.positive? ? (10.0 * Math.log10(ms)) : -120.0
-              @floor = @floor.nil? ? lvl : ((@floor * 0.98) + (lvl * 0.02))
-              delta = lvl - @floor
-              if delta >= @threshold
-                unless @in_burst
-                  @in_burst = true
-                  @burst_t0 = Time.now
-                  @peak = lvl
+            while i < @audio.length - win
+              seg  = @audio[i, win]
+              mean = seg.sum / seg.length
+              var  = seg.sum { |v| (v - mean)**2 } / seg.length
+              best = { i: i, mean: mean, var: var } if best.nil? || var < best[:var]
+              i += hop
+            end
+            return unless best
+
+            # FCCH criterion: variance ≪ overall variance AND mean > 0.
+            g_mean = @audio.sum / @audio.length
+            g_var  = @audio.sum { |v| (v - g_mean)**2 } / @audio.length
+            return unless g_var.positive? && (best[:var] / g_var) < 0.15 && best[:mean].positive?
+
+            @fcch_n += 1
+            # discriminator output ≈ 2π·Δf/fs → Δf = mean · fs / (2π)
+            f_est = best[:mean] * @rate / (2 * Math::PI)
+            f_off = (f_est - FCCH_TONE).round
+            yield(
+              protocol: 'GSM', event: 'fcch', modulation: 'GMSK',
+              symbol_rate: SYMBOL_RATE.to_i, fcch_no: @fcch_n,
+              tone_hz: f_est.round, freq_offset_hz: f_off,
+              variance_ratio: (best[:var] / g_var).round(4),
+              summary: "GSM FCCH lock ##{@fcch_n} tone=#{f_est.round}Hz Δf=#{f_off}Hz"
+            )
+
+            # SCH lives 8 timeslots after FCCH: 8 × 156.25 = 1250 symbols.
+            sch_off = best[:i] + (1250 * @spb).round
+            return unless sch_off + (148 * @spb).round < @audio.length
+
+            seg  = @audio[sch_off, (156 * @spb).round]
+            bits = PWN::SDR::Decoder::DSP.nrz_slice(
+              samples: seg, rate: @rate, baud: SYMBOL_RATE
+            )
+            # GMSK data are differentially encoded (1 = no phase change).
+            db = PWN::SDR::Decoder::DSP.diff_decode(bits: bits).map { |b| b ^ 1 }
+            idx = PWN::SDR::Decoder::DSP.find_sync(
+              bits: db, pattern: SCH_ETSC, max_err: 8
+            )
+            return unless idx && idx >= 42 && idx + 64 + 39 <= db.length
+
+            # SCH burst: 3 tail + 39 enc + 64 TS + 39 enc + 3 tail + 8.25 guard
+            enc1 = db[idx - 39, 39]
+            enc2 = db[idx + 64, 39]
+            enc  = enc1 + enc2 # 78 coded bits (rate-1/2 conv, K=5)
+            info = GSM.viterbi_decode(bits: enc, k: 5, g0: 0o23, g1: 0o33)
+            # 25 info bits + 10 parity + 4 tail = 39 → we get first 39.
+            bsic = PWN::SDR::Decoder::DSP.bits_to_int(bits: info[0, 6])
+            t1   = PWN::SDR::Decoder::DSP.bits_to_int(bits: info[6, 11])
+            t2   = PWN::SDR::Decoder::DSP.bits_to_int(bits: info[17, 5])
+            t3p  = PWN::SDR::Decoder::DSP.bits_to_int(bits: info[22, 3])
+            @sch_n += 1
+            yield(
+              protocol: 'GSM', event: 'sch', modulation: 'GMSK',
+              bsic: bsic, ncc: (bsic >> 3) & 7, bcc: bsic & 7,
+              t1: t1, t2: t2, t3p: t3p, sch_no: @sch_n,
+              raw_info_hex: info[0, 25].each_slice(4).map { |n| PWN::SDR::Decoder::DSP.bits_to_int(bits: n).to_s(16) }.join,
+              summary: "GSM SCH BSIC=#{bsic} (NCC=#{(bsic >> 3) & 7} BCC=#{bsic & 7}) T1=#{t1} T2=#{t2} T3'=#{t3p}"
+            )
+            # consume up to & incl. SCH so we don't re-emit on next feed
+            @audio.shift(sch_off + (156 * @spb).round)
+          end
+        end
+
+        # Supported Method Parameters::
+        # bits = PWN::SDR::Decoder::GSM.viterbi_decode(
+        #   bits: 'required - Array<0|1> soft/hard coded bits (rate-1/2)',
+        #   k: 5, g0: 0o23, g1: 0o33
+        # )
+        # Minimal hard-decision K=5 rate-½ Viterbi (GSM 05.03 CC(2,1,5)).
+
+        public_class_method def self.viterbi_decode(opts = {})
+          bits = opts[:bits]
+          k    = (opts[:k] || 5).to_i
+          g0   = (opts[:g0] || 0o23).to_i
+          g1   = (opts[:g1] || 0o33).to_i
+          nstates = 1 << (k - 1)
+          npairs  = bits.length / 2
+          pm = Array.new(nstates, 1 << 30)
+          pm[0] = 0
+          bp = Array.new(npairs) { Array.new(nstates, 0) }
+          npairs.times do |t|
+            r0 = bits[t * 2]
+            r1 = bits[(t * 2) + 1]
+            npm = Array.new(nstates, 1 << 30)
+            nstates.times do |s|
+              [0, 1].each do |u|
+                reg = (u << (k - 1)) | s
+                o0 = parity(reg & g0)
+                o1 = parity(reg & g1)
+                m  = pm[s] + (o0 == r0 ? 0 : 1) + (o1 == r1 ? 0 : 1)
+                ns = reg >> 1
+                if m < npm[ns]
+                  npm[ns] = m
+                  bp[t][ns] = (s << 1) | u
                 end
-                @peak = lvl if lvl > @peak
-              elsif @in_burst
-                @in_burst = false
-                @burst_n += 1
-                dur_ms = ((Time.now - @burst_t0) * 1000).round
-                msg = {
-                  protocol: @protocol, event: 'burst', source: 'iq',
-                  burst_no: @burst_n, peak_dbfs: @peak.round(1),
-                  floor_dbfs: @floor.round(1), delta_db: (@peak - @floor).round(1),
-                  duration_ms: dur_ms, modulation: @modulation,
-                  sample_rate: @rate.to_i
-                }.merge(@extra)
-                msg[:summary] = format(
-                  '%<p>s IQ-burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms',
-                  p: @protocol, n: @burst_n, pk: @peak, d: @peak - @floor, ms: dur_ms
-                )
-                yield msg if block_given?
               end
-              i += hop
             end
+            pm = npm
           end
+          # traceback from best final state
+          s = pm.each_with_index.min_by(&:first).last
+          out = Array.new(npairs)
+          (npairs - 1).downto(0) do |t|
+            v = bp[t][s]
+            out[t] = v & 1
+            s = v >> 1
+          end
+          out
+        end
+
+        public_class_method def self.parity(opts = {})
+          parity = opts[:parity].to_i
+          p = 0
+          while parity.positive?
+            p ^= 1
+            parity &= parity - 1
+          end
+          p
         end
 
         # Supported Method Parameters::
@@ -71,24 +182,16 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          rate = (opts[:sample_rate] || freq_obj[:iq_rate] || 1_000_000).to_i
-          proto = 'GSM'
-          extra = {}
-          describe = proc { |b| { modulation: 'GMSK', symbol_rate: 270_833, tdma_frames: (b[:duration_ms] / 4.615).round, classification: (b[:duration_ms] / 4.615) > 10 ? 'BCCH/CCCH-continuous' : 'RACH/paging-burst' } }
-          demod = DemodIQ.new(
-            rate: rate, protocol: proto, modulation: 'GMSK',
-            extra: { threshold: 5.0 }.merge(extra)
-          )
+          rate = (opts[:sample_rate] || freq_obj[:iq_rate] || 1_083_333).to_i
           PWN::SDR::Decoder::Base.run_iq(
             freq_obj: freq_obj,
-            protocol: proto,
+            protocol: 'GSM',
             sample_rate: rate,
             source: opts[:source],
             file: opts[:file],
-            demod: demod,
-            threshold: 5.0,
-            note: '270.833 kbit/s GMSK — true-air path streams I/Q from RTL-SDR/Pluto and characterises TDMA burst duty; full Viterbi/BCCH SI decode is layered on Liquid when available.',
-            describe: describe
+            demod: DemodIQ.new(rate: rate),
+            note: '270.833 kbit/s GMSK — I/Q→freqdem→FCCH tone lock→SCH TS correlate→Viterbi→BSIC/RFN.',
+            describe: proc { |b| { modulation: 'GMSK', tdma_frames: (b[:duration_ms] / 4.615).round } }
           )
         end
 
@@ -115,7 +218,6 @@ module PWN
           bits << "MCC/MNC=#{out[:mcc]}/#{out[:mnc]}" if out[:mcc]
           bits << "LAC=#{out[:lac]} CI=#{out[:cell_id]}" if out[:lac]
           bits << "IMSI=#{out[:imsi]}" if out[:imsi]
-          bits << "TMSI=#{out[:tmsi]}" if out[:tmsi]
           out[:summary] = "GSM #{bits.join(' ')}".strip
           out
         end
@@ -131,9 +233,11 @@ module PWN
             #{self}.decode(
               freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq',
               source:   'optional - :auto|:rtlsdr|:adalm_pluto|:file',
-              file:     'optional - .cu8/.cs16 capture'
+              file:     'optional - .cu8/.cs16 capture (≥1.0833 Msps)'
             )
 
+            #{self}.viterbi_decode(bits:, k: 5, g0: 0o23, g1: 0o33)
+
             #{self}.authors
           "
         end

data/lib/pwn/sdr/decoder/lora.rb

@@ -5,66 +5,125 @@ require 'json'
 module PWN
   module SDR
     module Decoder
-      # True-air + detector-fallback decoder for LoRa.
-      # Prefers PWN::FFI I/Q (RTL-SDR / ADALM-Pluto / HackRF / capture file)
-      # via Base.run_iq; degrades to Base.run_detector with no hardware.
+      # LoRa (Semtech CSS) true-air preamble/sync-word decoder.
+      #
+      # I/Q resampled so fs = BW (default 125 kHz), one complex sample per
+      # chirp step. For each SF ∈ 7..12: dechirp with a reference
+      # down-chirp (DSP.cmul + PWN::FFI::FFTW.cfft), find ≥6 consecutive
+      # symbols whose FFT-argmax bin is identical (preamble), then read
+      # the two sync-word symbols and two SFD down-chirps. Emits
+      # {sf:, bw_hz:, sync_word:, preamble_len:, cfo_bins:} — the same
+      # metadata gr-lora / rtl-lora surface, no external binary.
       module LoRa
-        # Streaming I/Q energy/burst demod for Base.run_iq.
+        DEFAULT_BW = 125_000
+        SF_RANGE   = (7..12)
+        # Public LoRaWAN sync = 0x34; private/Meshtastic default = 0x12.
+        KNOWN_SYNC = { 0x34 => 'LoRaWAN', 0x12 => 'private/RadioLib' }.freeze
+
+        # Streaming CSS dechirp demod for Base.run_iq.
         class DemodIQ
-          def initialize(rate:, protocol:, modulation:, extra: {})
+          def initialize(rate:, bw: DEFAULT_BW)
             @rate = rate.to_f
-            @protocol = protocol
-            @modulation = modulation
-            @extra = extra
-            @floor = nil
-            @in_burst = false
-            @burst_t0 = nil
-            @peak = -200.0
-            @burst_n = 0
-            @threshold = (extra[:threshold] || 8.0).to_f
+            @bw   = bw.to_i
+            @buf  = []
+            @dchirp = {}
+            @seen = {}
           end
 
           def feed_iq(samples, rate: nil, &)
             @rate = rate.to_f if rate
-            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: samples)
-            hop = [(@rate / 1000.0).round, 1].max
-            i = 0
-            while i < m2.length
-              win = m2[i, hop]
-              break if win.nil? || win.empty?
-
-              ms = win.sum / win.length
-              lvl = ms.positive? ? (10.0 * Math.log10(ms)) : -120.0
-              @floor = @floor.nil? ? lvl : ((@floor * 0.98) + (lvl * 0.02))
-              delta = lvl - @floor
-              if delta >= @threshold
-                unless @in_burst
-                  @in_burst = true
-                  @burst_t0 = Time.now
-                  @peak = lvl
+            r = PWN::SDR::Decoder::DSP.resample_iq(
+              iq: samples, src_rate: @rate, dst_rate: @bw
+            )
+            @buf.concat(r)
+            SF_RANGE.each { |sf| try_sf(sf, &) if block_given? }
+            max = ((1 << 12) * 20) * 2
+            @buf.shift(@buf.length - max) if @buf.length > max
+          end
+
+          private
+
+          def down_chirp(sf)
+            @dchirp[sf] ||= begin
+              n = 1 << sf
+              iq = Array.new(n * 2)
+              n.times do |k|
+                # base up-chirp φ(k) = π·k·(k/N − 1); down-chirp = conj.
+                ph = Math::PI * k * ((k.to_f / n) - 1.0)
+                iq[k * 2]       = Math.cos(ph)
+                iq[(k * 2) + 1] = -Math.sin(ph)
+              end
+              iq
+            end
+          end
+
+          def demod_symbol(iq, sf)
+            n  = 1 << sf
+            dc = down_chirp(sf)
+            de = PWN::SDR::Decoder::DSP.cmul(a: iq, b: dc)
+            mag = PWN::SDR::Decoder::DSP.cfft_mag(iq: de, n: n, shift: false)
+            pk_i = mag.each_with_index.max_by(&:first).last
+            [pk_i, mag[pk_i], mag.sum / mag.length]
+          end
+
+          def try_sf(sf)
+            n = 1 << sf
+            need = n * 12 * 2 # ≥ 8 preamble + 2 sync + 2.25 SFD
+            return if @buf.length < need
+
+            # coarse alignment: try 8 phase offsets across first symbol
+            best_off = 0
+            best_run = 0
+            best_bin = nil
+            (0...n).step([n / 8, 1].max) do |off|
+              bins = []
+              10.times do |s|
+                seg = @buf[(off + (s * n)) * 2, n * 2]
+                break if seg.nil? || seg.length < n * 2
+
+                bins << demod_symbol(seg, sf).first
+              end
+              # longest run of equal bins
+              run = 1
+              cur = 1
+              (1...bins.length).each do |i|
+                if ((bins[i] - bins[i - 1]) % n).zero?
+                  cur += 1
+                  run = cur if cur > run
+                else
+                  cur = 1
                 end
-                @peak = lvl if lvl > @peak
-              elsif @in_burst
-                @in_burst = false
-                @burst_n += 1
-                dur_ms = ((Time.now - @burst_t0) * 1000).round
-                msg = {
-                  protocol: @protocol, event: 'burst', source: 'iq',
-                  burst_no: @burst_n, peak_dbfs: @peak.round(1),
-                  floor_dbfs: @floor.round(1), delta_db: (@peak - @floor).round(1),
-                  duration_ms: dur_ms, modulation: @modulation,
-                  sample_rate: @rate.to_i
-                }.merge(@extra.except(:threshold))
-                # protocol-specific enrichment
-                msg.merge!(self.class.enrich(msg)) if self.class.respond_to?(:enrich)
-                msg[:summary] = format(
-                  '%<p>s IQ-burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms',
-                  p: @protocol, n: @burst_n, pk: @peak, d: @peak - @floor, ms: dur_ms
-                )
-                yield msg if block_given?
               end
-              i += hop
+              if run > best_run
+                best_run = run
+                best_off = off
+                best_bin = bins.group_by { |x| x }.max_by { |_, v| v.length }&.first
+              end
             end
+            return unless best_run >= 6 && best_bin
+
+            # sync symbols follow preamble; walk forward until bin changes
+            i = best_off
+            i += n while ((demod_symbol(@buf[i * 2, n * 2], sf).first - best_bin) % n).zero? && i < (@buf.length / 2) - (4 * n)
+            s1 = demod_symbol(@buf[i * 2, n * 2], sf).first
+            s2 = demod_symbol(@buf[(i + n) * 2, n * 2], sf).first
+            # sync word nibble encoding (× 2^(SF-4)); recover both nibbles.
+            div = 1 << (sf - 4)
+            n1 = (((s1 - best_bin) % n) / div) & 0xF
+            n2 = (((s2 - best_bin) % n) / div) & 0xF
+            sync = (n1 << 4) | n2
+            key = "SF#{sf}:#{format('%02X', sync)}"
+            unless @seen[key]
+              @seen[key] = true
+              yield(
+                protocol: 'LoRa', event: 'preamble', modulation: 'CSS',
+                sf: sf, bw_hz: @bw, preamble_len: best_run,
+                cfo_bins: best_bin, sync_word: format('0x%02X', sync),
+                sync_name: KNOWN_SYNC[sync],
+                summary: "LoRa SF#{sf}/BW#{@bw / 1000}k sync=0x#{format('%02X', sync)}#{" (#{KNOWN_SYNC[sync]})" if KNOWN_SYNC[sync]} preamble=#{best_run}"
+              )
+            end
+            @buf.shift((i + (2 * n)) * 2)
           end
         end
 
@@ -75,23 +134,17 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-
-          rate  = (opts[:sample_rate] || freq_obj[:iq_rate] || 1_000_000).to_i
-          proto = 'LoRa'
-          demod = DemodIQ.new(
-            rate: rate, protocol: proto, modulation: 'CSS',
-            extra: { threshold: 8.0 }
-          )
+          bw   = (opts[:bw] || freq_obj[:lora_bw] || DEFAULT_BW).to_i
+          rate = (opts[:sample_rate] || freq_obj[:iq_rate] || (bw * 4)).to_i
           PWN::SDR::Decoder::Base.run_iq(
             freq_obj: freq_obj,
-            protocol: proto,
+            protocol: 'LoRa',
             sample_rate: rate,
             source: opts[:source],
             file: opts[:file],
-            demod: demod,
-            threshold: 8.0,
-            note: 'CSS over 125–500 kHz — true-air I/Q path estimates SF from chirp duration; full dechirp via FFTW is layered when available.',
-            describe: proc { |b| { modulation: 'CSS', bw_khz_assumed: 125, sf_estimate: (begin; t = b[:duration_ms] / 20.0; t.positive? ? Math.log2(t * 125).round.clamp(6, 12) : nil; end) }.compact }
+            demod: DemodIQ.new(rate: rate, bw: bw),
+            note: 'CSS 125–500 kHz — I/Q→resample_iq(fs=BW)→dechirp+FFTW per SF→preamble/sync-word.',
+            describe: proc { |b| { modulation: 'CSS', bw_khz_assumed: bw / 1000, sf_estimate: b[:sf] } }
           )
         end
 
@@ -106,8 +159,7 @@ module PWN
           bits = []
           bits << "SF#{out[:sf]}" if out[:sf]
           bits << "BW#{out[:bw]}" if out[:bw]
-          bits << "CR#{out[:cr]}" if out[:cr]
-          bits << "RSSI=#{out[:rssi]}" if out[:rssi]
+          bits << "sync=#{out[:sync_word]}" if out[:sync_word]
           bits << out[:payload].to_s[0, 40] if out[:payload]
           out[:summary] = bits.empty? ? line[0, 120] : bits.join(' ')
           out
@@ -124,7 +176,8 @@ module PWN
             #{self}.decode(
               freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq',
               source:   'optional - :auto|:rtlsdr|:adalm_pluto|:file',
-              file:     'optional - .cu8/.cs16 capture'
+              file:     'optional - .cu8/.cs16 capture',
+              bw:       'optional - LoRa BW Hz (default 125000)'
             )
 
             #{self}.authors