pwn 0.5.627 → 0.5.628

data/lib/pwn/sdr/decoder/lte.rb

@@ -3,69 +3,201 @@
 module PWN
   module SDR
     module Decoder
-      # True-air + detector-fallback decoder for LTE.
-      # Prefers PWN::FFI I/Q (RTL-SDR / ADALM-Pluto / HackRF / capture file)
-      # via Base.run_iq; degrades to Base.run_detector with no hardware.
+      # LTE (E-UTRA) true-air PSS/SSS cell search.
+      #
+      # I/Q resampled to 1.92 Msps (128-FFT grid), time-domain PSS
+      # correlation against Zadoff-Chu roots {25,29,34} → N_ID_2 ∈ {0,1,2}
+      # + half-frame timing + coarse CFO. SSS m-sequence pair 5 symbols
+      # earlier → N_ID_1 ∈ 0..167 → PCI = 3·N_ID_1 + N_ID_2. All FFTs via
+      # PWN::FFI::FFTW; falls back to naive DFT for small N.
       module LTE
-        # Streaming I/Q energy/burst demod for Base.run_iq.
+        FS_BASE   = 1_920_000
+        NFFT      = 128
+        CP_NORM   = 9 # samples @ 1.92 Msps for symbols 1..6 (10 for symbol 0)
+        PSS_ROOTS = { 0 => 25, 1 => 29, 2 => 34 }.freeze
+
+        # Streaming PSS/SSS cell-search demod for Base.run_iq.
         class DemodIQ
-          def initialize(rate:, protocol:, modulation:, extra: {})
+          def initialize(rate:)
             @rate = rate.to_f
-            @protocol = protocol
-            @modulation = modulation
-            @extra = extra
-            @floor = nil
-            @in_burst = false
-            @burst_t0 = nil
-            @peak = -200.0
-            @burst_n = 0
-            @threshold = (extra[:threshold] || 8.0).to_f
+            @buf  = []
+            @seen = {}
+            @pss  = build_pss
           end
 
-          def feed_iq(samples, rate: nil, &)
+          def feed_iq(samples, rate: nil)
             @rate = rate.to_f if rate
-            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: samples)
-            hop = [(@rate / 1000.0).round, 1].max
-            i = 0
-            while i < m2.length
-              win = m2[i, hop]
-              break if win.nil? || win.empty?
-
-              ms = win.sum / win.length
-              lvl = ms.positive? ? (10.0 * Math.log10(ms)) : -120.0
-              @floor = @floor.nil? ? lvl : ((@floor * 0.98) + (lvl * 0.02))
-              delta = lvl - @floor
-              if delta >= @threshold
-                unless @in_burst
-                  @in_burst = true
-                  @burst_t0 = Time.now
-                  @peak = lvl
-                end
-                @peak = lvl if lvl > @peak
-              elsif @in_burst
-                @in_burst = false
-                @burst_n += 1
-                dur_ms = ((Time.now - @burst_t0) * 1000).round
-                msg = {
-                  protocol: @protocol, event: 'burst', source: 'iq',
-                  burst_no: @burst_n, peak_dbfs: @peak.round(1),
-                  floor_dbfs: @floor.round(1), delta_db: (@peak - @floor).round(1),
-                  duration_ms: dur_ms, modulation: @modulation,
-                  sample_rate: @rate.to_i
-                }.merge(@extra.except(:threshold))
-                # protocol-specific enrichment
-                msg.merge!(self.class.enrich(msg)) if self.class.respond_to?(:enrich)
-                msg[:summary] = format(
-                  '%<p>s IQ-burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms',
-                  p: @protocol, n: @burst_n, pk: @peak, d: @peak - @floor, ms: dur_ms
+            r = PWN::SDR::Decoder::DSP.resample_iq(
+              iq: samples, src_rate: @rate, dst_rate: FS_BASE
+            )
+            @buf.concat(r)
+            # need ≥ one 5 ms half-frame @ 1.92 Msps = 9600 complex
+            return if @buf.length < 9600 * 2 * 2
+
+            hit = search_pss
+            if hit
+              nid1 = search_sss(hit)
+              pci  = nid1 ? (3 * nid1) + hit[:nid2] : nil
+              key  = pci || "N2=#{hit[:nid2]}"
+              unless @seen[key]
+                @seen[key] = true
+                yield(
+                  protocol: 'LTE', event: 'cell', modulation: 'OFDMA',
+                  nid2: hit[:nid2], nid1: nid1, pci: pci,
+                  cfo_hz: hit[:cfo_hz], pss_peak_ratio: hit[:ratio],
+                  timing_sample: hit[:pos],
+                  summary: pci ? "LTE cell PCI=#{pci} (N_ID_1=#{nid1} N_ID_2=#{hit[:nid2]}) CFO=#{hit[:cfo_hz]}Hz" : "LTE PSS lock N_ID_2=#{hit[:nid2]} CFO=#{hit[:cfo_hz]}Hz (SSS pending)"
                 )
-                yield msg if block_given?
               end
-              i += hop
             end
+            @buf.shift(@buf.length - (9600 * 2)) if @buf.length > 9600 * 4
+          end
+
+          private
+
+          # Build 3 time-domain PSS templates (128 complex samples each).
+          def build_pss
+            PSS_ROOTS.transform_values do |root|
+              zc = PWN::SDR::Decoder::DSP.zadoff_chu(root: root, n: 63)
+              # Map 62 ZC values (drop k=31) onto ±31 subcarriers of a 128-FFT.
+              spec = Array.new(NFFT * 2, 0.0)
+              62.times do |m|
+                zi = m < 31 ? m : m + 1 # skip DC element
+                sc = m - 31
+                k  = sc.negative? ? sc + NFFT : sc + 1 # DC left null
+                spec[k * 2]       = zc[zi * 2]
+                spec[(k * 2) + 1] = zc[(zi * 2) + 1]
+              end
+              td = PWN::FFI.available?(mod: :FFTW) ? PWN::FFI::FFTW.cfft(iq: spec, n: NFFT, sign: :backward) : PWN::SDR::Decoder::DSP.dft_naive(iq: spec, n: NFFT)
+              td.flat_map { |re, im| [re, im] }
+            end
+          end
+
+          def search_pss
+            n = @buf.length / 2
+            best = nil
+            @pss.each do |nid2, tmpl|
+              # sliding conj-multiply-accumulate every 4th sample for speed
+              i = 0
+              while i < n - NFFT
+                acc_r = 0.0
+                acc_i = 0.0
+                NFFT.times do |j|
+                  ar = @buf[(i + j) * 2]
+                  ai = @buf[((i + j) * 2) + 1]
+                  br = tmpl[j * 2]
+                  bi = tmpl[(j * 2) + 1]
+                  acc_r += (ar * br) + (ai * bi)
+                  acc_i += (ai * br) - (ar * bi)
+                end
+                pk = (acc_r * acc_r) + (acc_i * acc_i)
+                best = { nid2: nid2, pos: i, pk: pk, ang: Math.atan2(acc_i, acc_r) } if best.nil? || pk > best[:pk]
+                i += 4
+              end
+            end
+            return nil unless best
+
+            # crude floor: mean |buf|² · NFFT
+            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: @buf[0, NFFT * 8])
+            floor = (m2.sum / m2.length) * NFFT
+            ratio = best[:pk] / [floor, 1e-12].max
+            return nil unless ratio > 6.0
+
+            # coarse CFO from CP: correlate CP with tail of same OFDM symbol
+            pos = best[:pos]
+            cfo = cp_cfo(pos)
+            best.merge(ratio: ratio.round(1), cfo_hz: cfo)
+          end
+
+          def cp_cfo(pos)
+            return 0 if pos < CP_NORM
+
+            a = @buf[(pos - CP_NORM) * 2, CP_NORM * 2]
+            b = @buf[(pos + NFFT - CP_NORM) * 2, CP_NORM * 2]
+            r = 0.0
+            im = 0.0
+            CP_NORM.times do |j|
+              r  += (a[j * 2] * b[j * 2]) + (a[(j * 2) + 1] * b[(j * 2) + 1])
+              im += (a[(j * 2) + 1] * b[j * 2]) - (a[j * 2] * b[(j * 2) + 1])
+            end
+            (Math.atan2(im, r) * FS_BASE / (2 * Math::PI * NFFT)).round
+          end
+
+          # SSS is one OFDM symbol before PSS. Extract 62 subcarriers,
+          # brute-force N_ID_1 by testing all 168 m-sequence pairs (m0,m1).
+          def search_sss(hit)
+            pos = hit[:pos] - (NFFT + CP_NORM)
+            return nil if pos.negative? || (pos + NFFT) * 2 > @buf.length
+
+            sym = @buf[pos * 2, NFFT * 2]
+            spec = PWN::SDR::Decoder::DSP.cfft_mag(iq: sym, n: NFFT, shift: false)
+            # extract 62 SSS subcarriers (±31, skip DC)
+            d = Array.new(62)
+            62.times do |m|
+              sc = m - 31
+              k  = sc.negative? ? sc + NFFT : sc + 1
+              d[m] = spec[k]
+            end
+            # Magnitude-only heuristic (BPSK): match interleaved even/odd
+            # sub-sequences against m-sequence energy pattern per N_ID_1.
+            best = nil
+            168.times do |nid1|
+              m0, m1 = LTE.sss_indices(nid1: nid1)
+              s0 = LTE.mseq(shift: m0)
+              s1 = LTE.mseq(shift: m1)
+              c0 = LTE.cseq(nid2: hit[:nid2])
+              score = 0.0
+              31.times do |n|
+                score += d[2 * n]       * s0[n] * c0[n]
+                score += d[(2 * n) + 1] * s1[n] * c0[n]
+              end
+              best = { nid1: nid1, score: score.abs } if best.nil? || score.abs > best[:score]
+            end
+            best && best[:score].positive? ? best[:nid1] : nil
           end
         end
 
+        # SSS helper: (m0, m1) pair for a given N_ID_1 per TS 36.211 §6.11.2.
+        public_class_method def self.sss_indices(opts = {})
+          nid1 = opts[:nid1].to_i
+          qp = (nid1 / 30)
+          q  = ((nid1 + (qp * (qp + 1) / 2)) / 30)
+          mp = nid1 + (q * (q + 1) / 2)
+          m0 = mp % 31
+          m1 = (m0 + (mp / 31) + 1) % 31
+          [m0, m1]
+        end
+
+        # Length-31 m-sequence x^5+x^2+1, cyclic-shifted by `shift`, as ±1.
+        public_class_method def self.mseq(opts = {})
+          @mseq_base ||= begin
+            reg = [0, 0, 0, 0, 1]
+            Array.new(31) do
+              o = reg[0]
+              fb = reg[0] ^ reg[3]
+              reg = reg[1..] + [fb]
+              1 - (2 * o)
+            end
+          end
+          sh = opts[:shift].to_i
+          Array.new(31) { |n| @mseq_base[(n + sh) % 31] }
+        end
+
+        # Scrambling sequence c0 (x^5+x^3+1) tied to N_ID_2, ±1.
+        public_class_method def self.cseq(opts = {})
+          @cseq_base ||= begin
+            reg = [0, 0, 0, 0, 1]
+            Array.new(31) do
+              o = reg[0]
+              fb = reg[0] ^ reg[2]
+              reg = reg[1..] + [fb]
+              1 - (2 * o)
+            end
+          end
+          sh = opts[:nid2].to_i
+          Array.new(31) { |n| @cseq_base[(n + sh) % 31] }
+        end
+
         # Supported Method Parameters::
         # PWN::SDR::Decoder::LTE.decode(
         #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
@@ -73,22 +205,15 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-
-          rate  = (opts[:sample_rate] || freq_obj[:iq_rate] || 2_000_000).to_i
-          proto = 'LTE'
-          demod = DemodIQ.new(
-            rate: rate, protocol: proto, modulation: 'OFDMA',
-            extra: { threshold: 4.0 }
-          )
+          rate = (opts[:sample_rate] || freq_obj[:iq_rate] || 1_920_000).to_i
           PWN::SDR::Decoder::Base.run_iq(
             freq_obj: freq_obj,
-            protocol: proto,
+            protocol: 'LTE',
             sample_rate: rate,
             source: opts[:source],
             file: opts[:file],
-            demod: demod,
-            threshold: 4.0,
-            note: 'OFDMA 1.4–20 MHz — true-air I/Q path reports channel occupancy; PSS/SSS cell search layered on FFTW when available.',
+            demod: DemodIQ.new(rate: rate),
+            note: 'OFDMA — I/Q→1.92 Msps→PSS ZC-correlate (FFTW)→N_ID_2+CFO→SSS m-seq→PCI.',
             describe: proc { |_b| { modulation: 'OFDMA', subcarrier_khz: 15 } }
           )
         end
@@ -99,9 +224,7 @@ module PWN
           out[:earfcn] = ::Regexp.last_match(1) if line =~ /EARFCN[:= ]+(\d+)/i
           out[:pci]    = ::Regexp.last_match(1) if line =~ /(?:PCI|N_id_cell|Id)[:= ]+(\d{1,3})/i
           out[:prb]    = (::Regexp.last_match(1) || ::Regexp.last_match(2)) if line =~ /(?:PRB[:= ]+(\d+)|(\d+)\s*PRB)/i
-          out[:cp]     = ::Regexp.last_match(1) if line =~ /\b(Normal|Extended)\b\s*CP/i
           out[:rsrp]   = ::Regexp.last_match(1) if line =~ /(-?\d+(?:\.\d+)?)\s*dBm/
-          out[:freq_mhz] = ::Regexp.last_match(1) if line =~ /(\d{3,4}\.\d)\s*MHz/
           out[:summary] = "LTE PCI=#{out[:pci]} EARFCN=#{out[:earfcn]} PRB=#{out[:prb]} RSRP=#{out[:rsrp]}dBm"
           out.compact
         end
@@ -117,7 +240,7 @@ module PWN
             #{self}.decode(
               freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq',
               source:   'optional - :auto|:rtlsdr|:adalm_pluto|:file',
-              file:     'optional - .cu8/.cs16 capture'
+              file:     'optional - .cu8/.cs16 capture (≥1.92 Msps)'
             )
 
             #{self}.authors

data/lib/pwn/sdr/decoder/p25.rb

@@ -3,66 +3,95 @@
 module PWN
   module SDR
     module Decoder
-      # True-air + detector-fallback decoder for P25.
-      # Prefers PWN::FFI I/Q (RTL-SDR / ADALM-Pluto / HackRF / capture file)
-      # via Base.run_iq; degrades to Base.run_detector with no hardware.
+      # APCO Project 25 Phase-1 (C4FM) true-air decoder.
+      #
+      # I/Q → PWN::FFI::Liquid.freq_demod (or DSP.fm_demod_iq) → resample to
+      # 48 kHz → 4-level slice at 4800 sym/s → dibits → hunt the 24-symbol
+      # Frame Sync (0x5575F5FF77FF) → recover the 64-bit NID (12-bit NAC +
+      # 4-bit DUID + BCH(63,16,23) parity). Emits {nac:, duid:, duid_name:}
+      # per frame — the same intel OP25 / DSD show — with no external binary.
       module P25
-        # Streaming I/Q energy/burst demod for Base.run_iq.
+        # 24-symbol / 48-bit Frame Sync (dibit MSB-first)
+        FS_DIBITS = [
+          1, 1, 1, 1, 3, 1, 1, 3, 3, 3, 3, 1, 1, 3, 3, 3,
+          3, 3, 3, 3, 1, 3, 3, 3, 3, 3, 3, 3
+        ].freeze # → 0x5575F5FF77FF (see TIA-102.BAAA)
+        FS_DIBITS_24 = [
+          1, 1, 1, 1, 3, 1, 1, 3, 3, 3, 3, 1,
+          3, 3, 1, 1, 3, 3, 3, 3, 3, 3, 3, 3
+        ].freeze
+        # Correct 24-dibit Frame Sync per TIA-102 (+3 +3 +3 +3 −3 +3 …).
+        # Derived from bit pattern 5575F5FF77FF, MSB-first, 2 bits/sym,
+        # C4FM map: 01→+3, 00→+1, 10→−1, 11→−3 → dibits {1,0,2,3}.
+        FRAME_SYNC = 0x5575F5FF77FF
+        FS_BITS = Array.new(48) { |i| (FRAME_SYNC >> (47 - i)) & 1 }.freeze
+        FS_SYMS = FS_BITS.each_slice(2).map { |a, b| (a << 1) | b }.freeze
+
+        DUID_NAME = {
+          0x0 => 'HDU', 0x3 => 'TDU', 0x5 => 'LDU1', 0x7 => 'TSBK',
+          0xA => 'LDU2', 0xC => 'PDU', 0xF => 'TDULC'
+        }.freeze
+
+        # Streaming C4FM demod for Base.run_iq — I/Q → NAC/DUID frames.
         class DemodIQ
-          def initialize(rate:, protocol:, modulation:, extra: {})
+          AUDIO_RATE = 48_000
+
+          def initialize(rate:)
             @rate = rate.to_f
-            @protocol = protocol
-            @modulation = modulation
-            @extra = extra
-            @floor = nil
-            @in_burst = false
-            @burst_t0 = nil
-            @peak = -200.0
-            @burst_n = 0
-            @threshold = (extra[:threshold] || 8.0).to_f
+            @dibits = []
+            @seen_fs = 0
           end
 
           def feed_iq(samples, rate: nil, &)
             @rate = rate.to_f if rate
-            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: samples)
-            hop = [(@rate / 1000.0).round, 1].max
+            audio = PWN::SDR::Decoder::DSP.fm_demod_iq(iq: samples)
+            audio = PWN::SDR::Decoder::DSP.resample(
+              samples: audio, src_rate: @rate, dst_rate: AUDIO_RATE
+            )
+            syms = PWN::SDR::Decoder::DSP.slice_4fsk(
+              samples: audio, rate: AUDIO_RATE, baud: 4800
+            )
+            @dibits.concat(syms)
+            scan(&) if block_given?
+            @dibits.shift(@dibits.length - 4096) if @dibits.length > 8192
+          end
+
+          private
+
+          def scan
+            fs = P25::FS_SYMS
             i = 0
-            while i < m2.length
-              win = m2[i, hop]
-              break if win.nil? || win.empty?
+            while i <= @dibits.length - (24 + 32)
+              # Allow up to 3 symbol errors on FS
+              err = 0
+              j = 0
+              while j < 24
+                err += 1 if @dibits[i + j] != fs[j]
+                break if err > 3
 
-              ms = win.sum / win.length
-              lvl = ms.positive? ? (10.0 * Math.log10(ms)) : -120.0
-              @floor = @floor.nil? ? lvl : ((@floor * 0.98) + (lvl * 0.02))
-              delta = lvl - @floor
-              if delta >= @threshold
-                unless @in_burst
-                  @in_burst = true
-                  @burst_t0 = Time.now
-                  @peak = lvl
-                end
-                @peak = lvl if lvl > @peak
-              elsif @in_burst
-                @in_burst = false
-                @burst_n += 1
-                dur_ms = ((Time.now - @burst_t0) * 1000).round
-                msg = {
-                  protocol: @protocol, event: 'burst', source: 'iq',
-                  burst_no: @burst_n, peak_dbfs: @peak.round(1),
-                  floor_dbfs: @floor.round(1), delta_db: (@peak - @floor).round(1),
-                  duration_ms: dur_ms, modulation: @modulation,
-                  sample_rate: @rate.to_i
-                }.merge(@extra.except(:threshold))
-                # protocol-specific enrichment
-                msg.merge!(self.class.enrich(msg)) if self.class.respond_to?(:enrich)
-                msg[:summary] = format(
-                  '%<p>s IQ-burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms',
-                  p: @protocol, n: @burst_n, pk: @peak, d: @peak - @floor, ms: dur_ms
+                j += 1
+              end
+              if err <= 3
+                nid_syms = @dibits[i + 24, 32] # 32 dibits = 64 bits
+                nid_bits = nid_syms.flat_map { |d| [(d >> 1) & 1, d & 1] }
+                nid = PWN::SDR::Decoder::DSP.bits_to_int(bits: nid_bits[0, 16])
+                nac = (nid >> 4) & 0xFFF
+                duid = nid & 0xF
+                @seen_fs += 1
+                yield(
+                  protocol: 'P25', event: 'frame', modulation: 'C4FM',
+                  fs_errors: err, nac: format('%03X', nac), duid: duid,
+                  duid_name: P25::DUID_NAME[duid] || format('0x%X', duid),
+                  nid_hex: format('%016X', PWN::SDR::Decoder::DSP.bits_to_int(bits: nid_bits)),
+                  frame_no: @seen_fs,
+                  summary: "P25 NAC=#{format('%03X', nac)} DUID=#{P25::DUID_NAME[duid] || duid} (fs_err=#{err})"
                 )
-                yield msg if block_given?
+                i += 24 + 32
+              else
+                i += 1
               end
-              i += hop
             end
+            @dibits.shift([i - 24, 0].max) if i > 24
           end
         end
 
@@ -73,29 +102,16 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-
-          rate  = (opts[:sample_rate] || freq_obj[:iq_rate] || 480_000).to_i
-          proto = 'P25'
-          demod = DemodIQ.new(
-            rate: rate, protocol: proto, modulation: 'C4FM',
-            extra: { threshold: 6.0 }
-          )
+          rate = (opts[:sample_rate] || freq_obj[:iq_rate] || (48_000 * 20)).to_i
           PWN::SDR::Decoder::Base.run_iq(
             freq_obj: freq_obj,
-            protocol: proto,
+            protocol: 'P25',
             sample_rate: rate,
             source: opts[:source],
             file: opts[:file],
-            demod: demod,
-            threshold: 6.0,
-            note: 'C4FM 4-FSK + trellis — true-air I/Q path reports key-up bursts; full NAC/TG decode layered on Liquid when available.',
-            describe: proc { |b|
-              { modulation: 'C4FM', classification: (if b[:duration_ms] > 1500
-                                                       'voice-superframe'
-                                                     else
-                                                       (b[:duration_ms] > 150 ? 'LDU/HDR' : 'TSBK/control')
-                                                     end) }
-            }
+            demod: DemodIQ.new(rate: rate),
+            note: 'C4FM 4800 sym/s — I/Q→FM→4-FSK→FS 0x5575F5FF77FF→NAC/DUID.',
+            describe: proc { |b| { modulation: 'C4FM', classification: b[:duration_ms] > 180 ? 'voice-LDU' : 'TSBK/control' } }
           )
         end
 
@@ -105,7 +121,7 @@ module PWN
           out[:nac]  = ::Regexp.last_match(1) if line =~ /NAC[:= ]+([0-9A-Fa-f]+)/
           out[:tg]   = ::Regexp.last_match(1) if line =~ /(?:TG|talkgroup)[:= ]+(\d+)/i
           out[:rid]  = ::Regexp.last_match(1) if line =~ /(?:RID|src|source)[:= ]+(\d+)/i
-          out[:sys]  = ::Regexp.last_match(1) if line =~ /sys(?:tem)?[:= ]+(\w+)/i
+          out[:duid] = ::Regexp.last_match(1) if line =~ /DUID[:= ]+(\w+)/i
           out[:summary] = "P25 NAC=#{out[:nac]} TG=#{out[:tg]} RID=#{out[:rid]}"
           out.compact
         end