Decrypt P25 Radio

Posted on  by  admin
Decrypt P25 Radio Rating: 6,5/10 6359 reviews

The APCO P25 Decoder is an XRS Plug-in which, upon installation, can be selected from the receiver's Demodulators top bar menu, as simply another alternative demodulator. The APCO P25 Decoder then appears fully integrated within the receiver front panel. The research is part of the OP25 project, which uses GNUradio to implement a P25 stack using software defined radio. With this solution in. Also mentioned is that the encryption units use the IF circuit (presume 10.7MHz) - the fact that there was a product manufactured a few years ago (AOR?) that used 10.7 output to reproduce the P25 audio on a analog radio, there was a post here describing how it could be used on a normal discriminator circuit with good results - Is it really necessary to use 10.7 on P25 radio systems?

  1. Decrypt P25 Radio Systems
  2. Encrypted Radios For Sale

Overview

Digital Speech Decoder is an open source software package that decodes severaldigital speech formats. It uses the mbelib library (a separate open source package)to synthesize the decoded digital speech. It does not allow decoding of encryptedcommunications. It can save the compressed digital audio bits to 'mbe' data files(.imb and .amb extensions) and play back those saved files. It's discussed in this forum.

The latest version (1.6) supports the following formats and modulation types:

  • P25 Phase 1
  • ProVoice EDACS Digital voice
  • X2-TDMA - Motorola public safety TDMA system with P25 style signaling (mostly based on DMR)
  • DMR/MOTOTRBO - Digital Mobile Radio standard
  • NXDN - 9600 baud (12.5 kHz) NEXEDGE and 4800 baud (6.25 kHz) NEXEDGE/IDAS
  • D-STAR - The Github version of dsd/mbelib can parse and play back D-STAR traffic.
  • C4FM modulation
  • GFSK modulation (including GMSK and other filtered 2/4 level FSK)
  • QPSK modulation (sometimes marketed as 'LSM')

The following formats are currently under investigation or development:

  • P25 Phase 2 - standard not finalized yet, vocoder is supported by mbelib
  • OpenSky - four slot format vocoder may be supported by mbelib. Will not be supportable if it is determined that voice encryption is standard
  • Other formats will only be considered if high quality samples of the signals are made available for download by the developers. Samples must be from a discriminator tap, .wav format, 48000Hz, 16 bits per sample, mono.

DSD and mbelib should compile on Linux and *BSD operating systems. Any linuxdistribution should work as long as it has support for your audio devices.DSD version 1.3 and later requires mbelib 1.2 or later.

The forum for discussion of this package can be found here.

Copyright License

DSD and mbelib are both released under a BSD style copyright license. This means that as far as copyrights are concerned it can be freely copied and used, including for commercial products as long as the original copyright notice is included. (However, see important patent issues section below.)

Patent Issues with mbelib

While DSD was intended to be patent-free, mbelib describes functions thatmay be covered by one or more U.S. patents owned by DVSI Inc. The source code itself shouldnot be infringing as it merely describes possible methods of implementation.Compiling or using mbelib may infringe on patents rights and/or require licensing.It is unknown if DVSI will sell licenses for software that uses mbelib. If you donot have a license and are in a jurisdiction protected by the DVSI patents you shouldnot compile or use this source code.

Decrypt P25 Radio Systems

Help Page for Windows

GitHub Wiki

Downloads

dsd-1.6.0 source download in zip format

mbelib-1.2.5 source download in zip format

Windows executables and support files, zipped


  • Note: You'll need cygwin1.dll for all but DSD+. Go to cygwin.com and install it.
  • Note: Cygwin 1.7.26 is broken (/dev/dsp audio device doesn't work)
  • DSD on Github Currently 1.7 version

Known Working Hardware Setups

If this list gets large enough I will move it to its own page so as not to detract from the overview of DSD.

Discriminator SourceInputInput Sound DeviceOutput Sound DeviceOperating System/Linux DistroComputer SpecsAudio Successfully Decoded
GRE PSR-500 Direct TapiMic mic portiMicOnboard audioUbuntu 10.04Dell Mini 1012 netbook N450(1.66GHz)ProVoice
TV28T DVB-T (R820T)/SDR# *VB-AudioSoundblaster Audigy (PCI)Onboard AudioWindows XP ProIntel DG41TY w/ Intel Core2 Quad CPU Q9400 (2.66GHz)P25 Phase 1, MotoTRBO
TV28T DVB-T (R820T2)/SDR# *VB-AudioNvidia HD AudioNvidia HD AudioWindows 7Intel DG41TY w/ Intel Core2 Quad CPU Q9400 (2.66GHz)P25 Phase 1, MotoTRBO
RadioShack Pro-97 Direct TapLine InRealtek HD AudioRealtek HD AudioUbuntu 10.04Acer Aspire One Netbook D150 (1.7 GHz)P25 Phase I
RadioShack Pro-95 Direct Tap w/10k ResistorLine IniMic & Realtek HD AudioiMic & Realtek HD AudioUbuntu 10.04Custom Built/ Gigabyte MotherboardP25 Phase I, Provoice
RadioShack Pro-95 Disc TapLine inG110 KeyboardG110 KeyboardWindows 7EVGA x58/i7 920Provoice
RadioShack Pro-94 Direct TapLine InRealtek HD AudioRealtek HD AudioUbuntu 10.04Custom Built/ Gigabyte MotherboardP25 Phase I
RadioShack Pro-90 Disc TapLine InAC97AC97Ubuntu 10.43 GHz 1.5MBP25 Phase I
RadioShack Pro-79 Direct TapLine InAnalog Devices ADI 198x Integrated Audio/SoundBlaster Live!32Analog Devices ADI 198x Integrated Audio/SoundBlaster Live!32Xubuntu 9.10/Ubuntu 10.04Dell GX270 (P4 2.6 GHz)/Lenovo Thinkpad X61 (Core 2 Duo)/Dell Precision 300 (P4 3.2 GHz)P25 Phase I, ProVoice, MotoTRBO
RadioShack Pro-2067 Direct TapLine InAnalog Devices ADI 198x Integrated AudioAnalog Devices ADI 198x Integrated AudioUbuntu 10.04Dell GX520 (2.8 GHz - 3.4 GHz)MotoTRBO, ProVoice
RadioShack Pro-433 Disc TapLine inIntel HD AudioIntel HD AudioUbuntu 11.04Dell Inspiron 1525 Core 2 DuoMotoTRBO
Icom IC-PCR1000 Packet out w/100k ohm resistor and 10uf capacitor built into cableLine InAC97Diamond XS71Ubuntu 10.04Amd Athlon 64 (1.8 GHz - 2.4 GHz)P25 Phase I, MotoTRBO
Icom IC-PCR1000 Packet outputLine InAC97Sound Blaster X-FiDebian LennyAthlon 64 3000+ (2.0 GHz)Provoice, MotoTRBO, P25 Phase I
Uniden BCT15XLine InAC97Sound Blaster X-Fi Debian LennyAthlon 64 3000+ (2.0 GHz)Provoice, MotoTRBO, P25 Phase I
Uniden BCT-15X Disc TapMic In (DC Bias removed)C-Media CM108 ($1.87 on eBay)C-Media CM108 ($1.87 on eBay)Windows 7 ProIBM x336 dual Xeon 3.0GHzProVoice, DMR, P25 Phase I
Uniden BCT-15 Disc TapMic inATISound MaxUbuntu 10.42.4 GHz Core 2 Duo 4.0MBP25 Phase I
Uniden BCT-8 Disc TapLine InRealtek HD AudioSound Blaster X-FiWindows 7i7-3960X 3.30GHzMotoTRBO
Uniden BC796D Disc TapLine inSound Blaster X-FiSound Blaster X-FiWindows 7HP Pavillion Elite, Intel i7 quad coreP25 Phase 1, ProVoice, MotoTRBO
Uniden BC350A Direct TapLine InRealTek HD AudioRealTek HD AudioUbuntu 10.04 32-bitAMD Turion 64 X2 (2.0 GHz)MotoTRBO, NXDN 4800
Uniden BC246T Disc Tap w/100k ohm resistor and 10uf capacitor built into cableLine InAC97AC97Ubuntu 10.04 on flash driveDell Dimension 2400 (2.4 GHz - 2.8 GHz)P25 Phase I
Uniden BC245xlt Direct TapiMic mic portiMicOnboard audioUbuntu 10.04Dell Mini 1012 netbook N450(1.66GHz)ProVoice
Uniden BC235xlt Direct TapiMic mic portiMicOnboard audioUbuntu 10.04Dell Mini 1012 netbook N450(1.66GHz)ProVoice
Yaesu ft857 packet socketLine Insnd_hda_intelsnd_usb_audioUbuntu 9.1 32bitAMD Athlon 64x2 8400+ (2.1 GHz)MotoTRBO
Yaesu FT8800 Disc TapLine InAC97AC97Debian (no GUI)1.7 GHz AthlonMotoTRBO, P25 Phase I
AOR AR-2515 Disc TapLine InAC97AC97Ubuntu 10.43 GHz 1.5MBP25 Phase I
Kenwood TH-F6A 9600 baud out w/100k ohm resistor and 10uf capacitor built into cableMic inAC97AC97Ubuntu 10.04Acer Aspire OneP25 Phase I, MotoTRBO
Uniden BCT15X Disc Tap 10k ohm resistor and 10uf capacitorLine InSoundMAX Integrated Digital HD AudioSoundMAX Integrated Digital HD AudioWindows 8 ProAthlon 64 6400+ (3.1 GHz)P25 Phase I NXDN 9600
Uniden BC346XT Disc Tap 10k ohm resistorLine InRealtek HD AudioRealtek HD AudioWindows 7 64Intel i5-2500 (3.3 GHz)Provoice, P25 Phase I, DMR
ICOM IC-7100 USB Sound output USB USB Audio Codec Realtek HD AudioWindows 7 32Intel P9700 (2.8 GHz) P25 Phase I, DMR
DVT-SDR with , Unitrunker 1.0.27.19,or SDR#USBVB Audio Virtual CableOnboard AudioWindows 8.1 ProMicrosoft Surface Pro (first gen). Intel i5.MotoTRBO, P25


  • also tested using the DSD+ plugin from Vasili Beliakov's SDR# plugin collection

Frequently Asked Questions

Q: Do I need a radio with discriminator tap?

A: Yes, if you want to listen live or save mbe data files, and are using a scanner for input. No radio or discriminator tap is required to play saved mbe data files.

Q: Where can I get information on the discriminator tap for my radio?

A: Wiki information is available here for the Discriminator_output.

Q: Will this work on Windows?

A: As of December 7, 2011 binaries for Windows have been added.

Q: Will this work on a Mac?

A: No, because OS X does not use the traditional Unix-like /dev/audio interface. It shouldbe easy for someone familiar with Mac audio programming to port it to the Mac.

Q: Will you support decryption if I lawfully posess the encryption keys?

A: From the Readme file:

Q: Who are the author(s)?'

A: The author(s) are anonymous but PGP keys are provided inside the packagesso future releases/communications can be verified.

Retrieved from 'http://wiki.radioreference.com/index.php/Digital_Speech_Decoder_(software_package)'

P25 digital decode threshold adjustments allow user to control of how digital system are decoded inside the scanner. The P25 Threshold is a kind of 'digital squelch setting'. There's three variants in the Menu to help for the 'novice', the 'intermediate,' 'advanced' users, at least try to enable a 'bit' better decoding than standard Auto settings. In some scanner models it is System/Site specific, in other models it is a hidden feature. It is likely 'the most important thing,' besides good reception, of how well, the digital system, will be decoded. There are the additional caveats explained further in this article.

The adjustment(s) mentioned below must be done while you have good reception. The other side of that coin is, that the maunal adjustment(s) do absolutely nothing to fix reception issues. If you have bad receive, you'll have bad decode, regardless. You can easily double-check the Control & Voice Channels by tuning into them as conventional frequencies and opening squelch, and then listening to them to hear if you are getting dropouts or audible interference. Only after fixing any reception issues (changing antennas (less is more w/ digital), location, etc) should you try to optimize the P25 decode setting.

Once optimized for a System, the threshold settings shouldn't be changed in the x96T or x36HP series, regardless of future interference or signal conditions, unless you have confirmation that the system engineers have actually made changes to the system itself (which is highly unlikely).

Lets start at just viewing the screen, then onto defining and adjusting, and lastly additional digital decode refinements

  • 1P25 system decode and voice

Viewing the P25 Threshold levels on the Display

Let's first make sure we have the P25 Level set option is set to Auto. While you viewing the typical scanner system talkgroup on an active digital channel on a receivable System display:

  • Press HOLD/RESUME
  • HOLD appears on the display.
    • 396T, 396XT, 325P2, and 436 press Func then Vol knob (on T hold Func)

Or

  • 996T, 996XT, 996P2, 536 press the Scroll wheel the control then Vol knob

The P25 Threshold levels appear as the bottom 2-lines of the display.

The next to last line on the display, should now show the 'current threshold level' (0-20 (model dependent)), with 'AUTO' on the right, and in between (with an active voice transmission,) the digital bit error rate. The last line on the display shows the 3 millivolt values in a 3-digit representation 1.xx 'Threshold Levels'.

Allow the scanner to monitor channel activity for several minutes on a single specific System/Site (without additional Systems monitored at all). The error rate should begin drop for each transmission and the threshold levels should have adjusted to its best setting. Then, once it's seem to have stabilize or with LSM P25 Phase I and II at least, where you can see and hear the best decode values, write down the values from the screen. This is that System's 'optimum decode threshold'.

To exit, viewing the screen, press FUNC/Scroll - VOL.

Defining of P25 Threshold Auto, Default, Manual

Setting Low Mid High
0 1.54 1.60 1.66
1 1.52 1.60 1.68
2 1.50 1.60 1.70
3 1.48 1.60 1.72
4 1.46 1.60 1.74
5 1.44 1.60 1.76
6 1.42 1.60 1.78
7 1.40 1.60 1.80
8 1.38 1.60 1.82
9 1.36 1.60 1.84
10 1.34 1.60 1.86
11 1.32 1.60 1.88
12 1.30 1.60 1.90
13 1.28 1.60 1.92
14 1.26 1.60 1.94
15 1.24 1.60 1.96
16 1.22 1.60 1.98
17 1.20 1.60 2.00
18 1.18 1.60 2.02
19 1.16 1.60 2.04
20 1.14 1.60 2.06

AUTO - Means the radio attempts to fine tune the P25 audio transmissionthresholds during receive. You can generally see it doing this. In AUTO mode by you attempt to interject by using the FUNC or SCROLL while viewing the decode screen. Whatever you set at this point will be remembered FORTHIS SYSTEM as the starting point for the auto-tuning function forsubsequent transmission ON THAT SYSTEM,some models it will be universal for all Systems.
DEFAULT - Means a Level (Index) setting of 8. Thresholds don't change.Most likely you can do better!!!The newer BCDx36HP Series models have shown that Default is basically the same as Auto.
MANUAL - Means you control it all - Hold Func and press the scroll knob twice to get the screen. Adjust the setting with until you get the best result forany given SYSTEM. The radio will remember this setting for that System and use itevery time it has to decode digital audio.
Higher numbers are more permissive (the thresholds for decoding are wider) while smaller numbers tighten the threshold ranges. The optimum range depends on how the engineers/technicians have set up the system you are trying to receive, albeit Phase I and Phase system can often be modulated in phase shift keying instead of FM, which cause the P25 threshold to swing wildly from 5-13.

The threshold levels are in an index table for easy viewing.

Manually Adjusting P25 Decode Thresholds

Adjusting the P25 Decode Level for the BCDx96T/XT, P2 and BCDx36HP in an effort to make voice tuning easier for all user. Go into the Menu and set the P25 Threshold to Manual, then change the number that most closely matches the System's 'optimum decode threshold' that you wrote down, moments ago. Whatever you set at this point, will be remembered FOR THIS SYSTEM, this will be the setting for all subsequent transmission on that System/Site.

Available on BCD396T, BCD396XT, BCD996T, BCD996XT, BCD325P2, BCD996P2 BCD436HP and BCD536HP
  • BCD396T, BCD396XT, BCD996T, BCD996XT, BCD325P2, BCD996P2 require a special key press at power up, and return to Auto once power cycled:
  1. Hold the HOLD key while powering up the scanner. The screen will flash all of the colors (325P2's led just blinks) twice
  2. Press Menu go to
  3. Press Settings go to P25

Or

  • BCD436HP and BCD536 are under 'Edit Site', not available on Database based Scanning
  1. Press Menu go to
  2. Press Manage Favorites' go to
  3. Select Favorites 'xxxxx'
  4. Select Review/Edit System
  5. Select System 'xxxxx'
  6. Select Edit Site
  7. Select Site 'xxxxx'

Scroll to 'Digital Threshold Mode'

To exit Menu after adjustment hit L/O or Avoid to quickly to return to scanning

Now I can offer a slight refinement: If you're having trouble with a P16 (Moto type 2) system decoding digital P25 audio, slightly offtune the automatic setting. Frequently the radio will auto tune to a setting that is halfway between the values that you can set manually. For example, it might finally settle to a low threshold of 1.41, but you can't set the starting point to that, you can only make it 1.40 or 1.42.Well, the trick that helps stop the motorboating is to pick the looser threshold side. In the example, instead of picking 1.40, pick 1.42 (that's a looser threshold). (Think of it as similar to setting the squelch looser for a conventional channel.) Even if it typically tunes to an even value, like 1.42, pick the next looser value (1.44) to start.

Works for a lot of people. Cuts out 80% of the motorboating that occurred prior to and/or after a transmission. YMMV. You guys having trouble with motorboating on the Moto Type II System's should definitely try this.

Decrypt P25 Radio


Additional P25 adjustable features

  • P25 Waiting Time - (In the Conventional systems and Motorola System/Site menus) On channels that contain a mix of analog and digital voice (i.e., where the Audio Mode is set to All), it is possible to have false decode problems caused by digital noise at the beginning of transmissions. To prevent this, a user-configurable P25 wait time (default 400ms; 0 to 1000 ms) was been added. During the 'Wait Time', the scanner evaluates the received signal; if it detects P25 data, the scanner opens the transmission immediately. If no P25 data is detected, the scanner opens squelch after the 'Wait Time' has expireds.
    • Note: Any analog voice transmissions on this channel will lose the first part of the transmission, up to the wait time you set here. Select the number of milliseconds (after the start of a transmission) the scanner should wait while checking for P25 data. Choose a number from 0 through 1000ms in 100ms increments. The scanner only applies the wait time setting to Conventional or Motorola Systems, and only when the channel's Audio Mode setting is All.
Available only in BCD396T, BCD396XT, BCD996T, BCD996XT

Require a special key press at power-up, and return to Auto once power cycled:

  1. Hold the HOLD key while powering up the scanner. The screen will flash: 396t, 996t and leds just blinks or 396XT, 996XT, and will flash all of their colors twice
  2. Press Menu go to:
  3. Press'Settings go to:

2 Added Settings will appear:

  • P25 Adjust Mode - This mode sets the algorithm speed for P25 decode in the DSP.
    • If your firmware version is lower than 1.10.00 (T& XT), leave this setting at 3. Anything higher than 3 will just act like 3. Anything lower will have the reduced performance of previous firmware versions on the 396T. Instructions for older firmwares on BCD396XT Firmware Webpage which suggest using the mode 11 (though some systems are reported to decode better at a setting of 8).
  • P25 Adjust Level - sets the RSSI value below which the scanner will not attempt to make P25 fine tune adjustments. If the signal is too low, RX reliability is not high enough to make P25 adjustments correctly. 50 is the default setting (1-200). People have had better decoding with this value turned up. Note that for BCDx96t and BCDx96XT firmware version 3.01.00 and 1.10.00 respectively, Uniden specifically instructs users to reset this value back to 50 if it had been changed in the past.
Only Available: BCD396XT, BCD996T, BCD996XT, BCD325P2, BCD996P2
  • P25 LP Filter - lets you set the scanner to apply a software filter that removes the 4kHz tone you can hear on some P25 systems. Note that turning on this setting increases the CPU load and could slightly degrade P25 decode performance on some systems and battery life for handhelds. The option is On or Off.


Displayed P25 & LNK explained

If the P25 audio is choppy, or switches between LNK and P25 very quickly, you could try to set the P25 threshold to DEFAULT (in non-BCx36HP models) with allows for much slower response adjustments. This can also happen if you are in the fringes of the coverage of a P25 system, and the Control & Voice Channels are not being received and decoded cleanly, except on a Moto Type II, Phase I and II, LNK should show up at end of tranmission - when a signal is being transmitted after the voiced audio with data or shortly after 'End Code' is detected (before a user set 'Delay' has expired), and/or shortly afterward LNK shows when the scanner returns to the same channel that the user Delay just expired on, but is still receiving End Code/Delay info from the System (which may have it's own delay by the System Admin).

History of P25 Threshold BETA TESTING & NOTES

During the beta test, we convinced Uniden to implement a slight change to the'Auto' functionality. Specifically, we noticed that it was startingover at the default setting and then trying to correct it again at everytransmission; sometimes this meant it took a long time to settle in.We went thru a couple of iterations, requiring at first - Set thethreshold with MANUAL and then AUTO would use that as a starting point.This was cumbersome, the final product is what you see now.

Incidentally, we did suggest the ultimate -- for the radio toautomatically remember this on its own, continually refining it andpicking a better starting point if it could. But the engineers thoughtit would results in too many writes to the EEPROM, which has a generouscapability for making changes to the programming, but the limit would bereached if every P25 audio transmission resulted in a write.

Encrypted Radios For Sale


  1. With a Great Big Special Thanks to: Paul Opitz, Uniden product manager (UPMan), posted the threshold value table for the BCD396T and L. W. 'Dan' Danz (Danny6569) (WA5SKM) of Fountain Hills AZ in the BCD396T Yahoo group for this insightful descriptions


Note: while the 'how to' details differ, this can also be done with GRE/RS/Whistler scanners for an improvement in 'signals received' for a given area (county, city, etc). See here for more info

Motorola


Return to the Uniden DMA FAQ

Retrieved from 'http://wiki.radioreference.com/index.php/P25_audio_decode_level_adjustment'
Coments are closed
Scroll to top