FSK signals with 24/32-bit frames and a constant last bit: a possible Russian origin

i56578-swl.blogspot.com 3 dni temu

Cryptomaster kindly provided a recording of an FSK signal at 250/500 Bd with a mark/space shift of 1000 Hz. After reading the analysis of that signal published on the blog [1], he sent a second email: he had forgotten to send another recording, made on the same frequency a fewer hours earlier. This besides turns out to be an FSK signal with a shift of 1000 Hz, at 150/300 Bd. Both signals are binary FSK with the same 32-bit frame structure. Moreover, in both signals the first portion, consisting of a repeated "01" sequence, is modulated at half the rate of the data segment.
This second email prompted a search of the blog for those FSK signals characterized by a frame dimension of 24 or 32 bits with the peculiarity of having the last bit at 0 or, equivalently, the last column of the demodulated bitstream with all bits at 0; the intent of this post is to supply an up-to-date overview of these types of signals. The results are reported in Table I (ordered by date) where, for ease of reading, the waveforms encountered are labeled as WFn; the first and the second recording received from Cryptomaster are WF6 and WF5, respectively. In this post the analysis of WF5, not yet published, is reported in full, while that of WF6, already published on the blog, is summarized here for completeness. The results for WF1-WF4, besides published on the blog, are not repeated.

Note: the table does not claim to be exhaustive by any means, since the signals studied are those occasionally encountered or sent by friends and colleagues. No coding has been identified for WF5 and WF6 (empty cells in the Code column; see the Discussion).

Figure 1: Spectrograms of WF5 (top) and WF6 (bottom), recorded on the same frequency and in same date

WF6
The data section and the trailing portion, presumably sync since it carries no information, are modulated at 500 Bd, while the first "01" condition is modulated at 250 Bd. Both the keying rates and the function of each section are confirmed by the demodulated signal. In particular, the data section exhibits a periodicity of 64 ms, which at 500 Bd corresponds to a period of 32 bits. This periodicity is produced by a constant bit position, visible as a solid column of identical bits, while the trailing section shows a fixed pattern repeating all 32 bits. The bitstream of WF6 was obtained with the generic FSK demodulator of SA (Signals Analyzer), so both the bit shift (i.e., "where does the frame start?") and the polarity ambiguity must be taken into account. erstwhile the polarity is inverted and the bits are shifted accordingly, the data section reveals a phasing bit, i.e., a bit with a fixed value at a fixed position in all frame, which appears as the last column of 0s. The bitstream, already published on the blog, is reproduced in Figure 2 for ease of reading.

Figure 2: Demodulated bitstream of WF6 displayed with a 32-bit period, 1 frame per row. The last column has a constant value of 0 (phasing bit).

Since the information lies in the transitions between consecutive bits alternatively than in absolute mark/space values, the question arises of whether differential decoding should be applied. Differential decoding removes the polarity ambiguity, and it could uncover a hidden structure if the transmitter uses differential (NRZI-like) encoding. It does not solve the bit shift, though.
A parity test over the full 32-bit frame of the differentially decoded bitstream of WF6 returns 100% success for even parity at a single start-bit offset, the 1 aligned with the phasing bit column. This is not an independent confirmation: XORing all the differential bits of a frame leaves only the XOR of the 2 bits at the frame boundary, which lie in the same column. If that column is constant, as the phasing bit is, the parity is necessarily even. The 2 readings are so equivalent: a natural bitstream with a constant bit position, or differentially encoded frames carrying an even parity bit (31 data bits plus 1 parity bit). Both produce the same natural bitstream, so the data alone cannot separate between them.
A rank test over the differentially decoded 32-bit frames of WF6 reveals a single parity relation, the even parity over the full frame, and no other, so no further structure is evident in this capture. As discussed above, this relation is equivalent to the constant last bit. The number of captured frames is not adequate to test longer or interleaved codeword structures, and so to formulate more consistent hypotheses on the coding.

WF5
This is besides a dual-rate FSK signal (see Figure 3): the first "01" series is sent at 150 Bd, followed by the payload transmitted at 300 Bd. The shift is constant across WF5 and WF6, namely 1000 Hz.

Figure 3: Spectrograms of the dual-rate FSK transmission WF5, with a 1000 Hz mark/space shift. Top: full capture. Middle: item showing the keying-rate lines at 150.15 Hz and 299.93 Hz, corresponding to the 150 Bd "01" preamble and the 300 Bd payload. Bottom: keying-rate measurement (Br = 150.15 Bd) on the preamble segment, with a measured shift dF = 999.41 Hz.

Once WF5 is demodulated, the frame structure emerges clearly: a 32-bit period characterized by a last bit with a constant value of 0 (Figure 4). This is precisely the same framing as WF6. After differential decoding, the parity test on WF5 besides returns 100% success for even parity at a single start-bit offset, the 1 aligned with the constant last-bit column (Figure 5), as for WF6. A rank test over the differentially decoded frames of WF5 besides reveals a single parity relation, the even parity over the full frame, and no other. The consequence does not change if a constant offset is allowed, as would be produced by 1 or more inverted columns.

Figure 4: Demodulated bitstream of WF5 displayed with a 32-bit period, 1 frame per row. The last column has a constant value of 0 (phasing bit), as in WF6.

Figure 5: Parity test on the differentially decoded bitstream of WF5, computed over the full 32-bit frame. Left: decoded bitstream, 1 frame per row. Right: parity success rate versus start-bit offset, peaking at 100% for even parity at a single offset, the 1 aligned with the constant last-bit column.

Discussion
All six FSK waveforms have a frame dimension of 24 or 32 bits and a constant last bit (0); in all of them a parity relation is found after differential decoding: the parity over the full frame is even. As discussed above for WF6, this relation is equivalent to the constant last bit and is not an independent confirmation of a parity bit. A common coding is established only for the 4 24-bit signals (WF1-WF4), which share the H(24,16) code (1); for the 32-bit signals (WF5 and WF6) only the framing is shared.
The keying rate, the shift and the frame dimension do not appear to be tied to 1 another. The same keying rates (150/300 Bd) happen with different shifts and frame lengths (WF2, WF3, WF5), and the same shift (1000 Hz) occurs with different frame lengths (WF3, WF5).
Moreover, each of the following pairs differs in a single parameter among keying rate, shift and frame length:

- WF2 and WF3: shift only (500 Hz versus 1000 Hz)
- WF3 and WF5: frame dimension only (24 versus 32 bits)
- WF5 and WF6: keying rates only (150/300 Bd versus 250/500 Bd, a origin of 5/3)

The single keying rates reported for WF1 (500 Bd) and WF4 (300 Bd) coincide with the higher rate of WF6 and of WF2, WF3 and WF5, respectively.

The 32-bit frames of WF5 and WF6 are the only ones observed with this length, and these are besides the most fresh signals. It might be tempting to interpret the 32-bit frame as an evolution of the 24-bit one, but this would be premature. WF5 and WF6 were recorded on the same frequency on the same day, so they represent a single reflection alternatively than 2 independent ones. WF4, a 24-bit signal, was recorded only a fewer months earlier, so the 2 frame lengths are not clearly separated in time. Moreover, Table I contains no FSK captures with 24/32-bit frames between WF3 and WF4 (an interval of nearly 4 years), so it is not possible to exclude that 32-bit frames were already in usage during that period. Further captures would be needed to test this possibility.

The 2 frame lengths disagree by precisely 1 byte (24 bits = 3 bytes, 32 bits = 4 bytes). This may simply reflect a byte-oriented framing, but it could besides be related to the coding used, for instance an additional data or check byte. In WF1-WF4 the 24-bit frame carries an H(24,16) code, i.e. 16 information bits and 8 check bits. With the same polynomial, a 32-bit frame would carry 24 data bits, 7 check bits and the constant bit. A syndrome test of WF5 and WF6 on the natural bitstream with the corresponding check matrix, inverting in turn each single column, finds at most 3 frames out of 95 with null syndrome in each signal, as expected for random frames, and no column gives all frames valid. This circumstantial hypothesis is so not supported for either signal, although another structures, specified as scrambling, interleaving or non-linear codes, cannot be excluded.

In the dual-rate signals (WF2, WF3, WF5 and WF6) the ratio between the 2 rates is 2:1 and the "01" preamble is sent at half the payload rate. This is consistent with a synchronization purpose: longer symbols make carrier and bit-clock acquisition easier on a noisy HF channel, and the alternating pattern maximizes transitions for timing recovery. This is an interpretation, not something the data demonstrates.

These observations are consistent with a household of configurations of a single transmission strategy in which keying rate, shift and frame dimension (and, possibly, the code) can be selected independently. They are besides consistent with different systems sharing the same framing convention, and Table I does not let distinguishing between the 2 cases. WF5 and WF6 were recorded on the same frequency and disagree only in keying rate, which is what 1 would anticipate from experimentation, i.e. trials of different configurations of the same system. This remains a hypothesis: 2 recordings cannot regulation out alternatives specified as velocity selection by the operator or adaptation to propagation conditions, which would produce the same observations. The another signals were observed on different frequencies, so the configurations are not tied to a single channel.

As for the origin, 2 of the signals supply direct evidence. WF2 was located in the Kaliningrad Oblast by TDoA. WF4 was preceded by a voice op-chat in Russian, on a different frequency, in which 2 operators agree on the frequency to be utilized for the following FSK message; the message was then received on the agreed frequency (Table I), as a 300 Bd signal with a 500 Hz shift and the 24-bit frame. The language of the operators indicates Russian-speaking users, but by itself it does not find the transmitter. No direct evidence of origin is available for WF1, WF3, WF5 and WF6. For WF1 and WF3, the H(24,16) code shared with WF2 and WF4 makes a Russian origin more plausible. For WF5 and WF6 only the framing and the relationships among the parameters can be invoked, so a Russian origin remains a hypothesis. A naval user cannot be excluded, but no component in the available data supports it.

Conclusion
The six signals of Table I share a 24- or 32-bit frame with a constant last bit and even parity after differential decoding (a consequence of the constant last bit), and the 4 24-bit signals (WF1-WF4) besides share the H(24,16) code. The signals disagree in keying rate, shift and frame length. WF5 and WF6 share frequency, shift and framing, and disagree only in keying rate. The most likely explanation is simply a household of configurations of 1 transmission system, but different systems with a common framing convention cannot be excluded. Direct evidence of a Russian origin is available only for WF2 (TDoA) and WF4 (Russian-language op-chat). Further captures, ideally with direction finding, and a larger number of frames per signal are needed to confirm the hypothesis of a single transmission strategy and to identify the coding of the 32-bit frames.

To be continued...

Notes

1. The check matrix for the H(24,16) code is generated with the polynomial x^7+x^3+x^2+x+1. In WF1-WF4 the check was applied to the natural (not differentially decoded) bitstream, after inverting the polarity of column 9 of the frames (columns numbered from 1, in the same order as the columns of the matrix below). The 8 check bits computed from the 16 information bits coincide with the received ones in all frames.

1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1 0 0 0 0 0 0 0
0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1 0 0 0 0 0 0
0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1 0 0 0 0 0
0 0 0 1 0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1 0 0 0 0
0 0 1 1 1 0 0 1 1 1 0 1 0 1 1 1 0 0 0 0 1 0 0 0
1 0 1 0 1 1 1 0 0 0 0 1 0 0 1 1 0 0 0 0 0 1 0 0
0 1 1 0 0 1 0 1 1 1 1 1 0 0 0 1 0 0 0 0 0 0 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1

The last row has no data bits: the eighth check bit is always 0, which corresponds to the constant last bit of the frames.

Downloads

WF5: https://disk.yandex.com/d/LW96FulvC-3BYQ

References

[1] https://i56578-swl.blogspot.com/2026/11/unid-250-500bd1000-fsk-relative-of-unid.html
[WF1] https://i56578-swl.blogspot.com/2021/12/unid-500bd1000-fsk-arq-network.html
[WF2] https://i56578-swl.blogspot.com/2022/08/unid-150-300bd500-fsk.html
[WF3] https://i56578-swl.blogspot.com/2022/09/unid-150-300bd1000-fsk-150-300bd500.html
[WF4] https://i56578-swl.blogspot.com/2026/07/voice-coordination-fsk-300bd500.html
[WF6] https://i56578-swl.blogspot.com/2026/11/unid-250-500bd1000-fsk-relative-of-unid.html

Idź do oryginalnego materiału