Dual-rate FSK transmission at 250 and 500 bps (for binary FSK, bps and baud coincide) with a mark/space shift of 1000 Hz, as shown in Figure 1. The data section and the trailing portion, presumably sync since it carries no information, are modulated at 500 bps, while the first portion, consisting of a repeated "01" sequence, is modulated at 250 bps. The recording was kindly sent me by my friend Cryptomaster.
 |
Figure 1: Spectrograms of the dual-rate FSK transmission with a 1000 Hz mark/space shift. Top: full capture. Middle: item showing the keying-rate lines at 249.76 Hz and 499.88 Hz, corresponding to the 250 bps preamble and the 500 bps data and tail segments. Bottom: keying-rate measurement (Br = 249.94 bps) on the preamble segment. |
The bitmaps in Figure 2 confirm both the keying rates and the function of each segment. In particular, the data segment, shown in the center of the figure, exhibits a periodicity of 64 ms, which at 500 bps corresponds to a period of 32 bits. The same bitmap shows that this periodicity is produced by a constant bit position, visible as a solid column of identical bits.
 |
| Figure 2: Bitmaps of the 3 segments. Top: "01" preamble at 250 bps. Middle: data section at 500 bps, showing a 64 ms (32-bit) periodicity. Bottom: trailing section at 500 bps. |
The bitstream obtained by demodulating the 2 500 bps segments is shown in Figure 3 and matches what was already observed in the bitmaps of Figure 2. Both the bit shift (i.e., "where does the frame start?") and the polarity ambiguity must be taken into account, since the bitstream was obtained with the generic FSK demodulator of SA (Signals Analyzer).
 |
| Figure 3: Demodulated 500 bps bitstream displayed with a 32-bit period. Top: data segment. Bottom: trailing segment, showing a fixed pattern repeating all 32 bits. Bit shift and polarity are arbitrary. |
Once the polarity is inverted and the bits are shifted accordingly, the data section reveals a phasing bit, i.e., a bit with a fixed value at a fixed position in all frame, which appears here as the last column of 0s (Figure 4).
 |
| Figure 4: Data section of the demodulated 500 bps bitstream after polarity inversion and bit shifting, displayed with a 32-bit period. The phasing bit appears as the last column of 0s. |
A akin signal with different parameters was previously reported [1], featuring a 500 Hz shift and a 24-bit period; its bitstream is shown in Figure 5 for ease of comparison. The relation between the FSK parameters of the signal observed in August 2022 and those of the signal analyzed in this post is noteworthy: 150/300 bps with a 500 Hz shift versus 250/500 bps with a 1000 Hz shift, respectively. The keying rates scale by a origin of 5/3, while the shift doubles.
 |
| Figure 5: Demodulated bitstream of the akin signal observed in August 2022 [1], displayed with a 24-bit period. |
Once again, the question arises of whether differential decoding should be applied. Since the information then lies in the transitions between consecutive bits alternatively than in absolute mark/space values, differential decoding removes the polarity ambiguity, and it could uncover a hidden structure if the transmitter uses differential (NRZI-like) encoding. It does not solve the bit shift, though.
As shown in Figure 6, a parity test over the full 32-bit frame of the differentially decoded bitstream of Figure 4 returns 100% success for even parity at a single start-bit offset, the 1 aligned with the phasing bit column. This is not an independent confirmation: XORing all the differential bits of a frame leaves only the XOR of the 2 bits at the frame boundary, which lie in the same column. If that column is constant, as the phasing bit is, the parity is necessarily even. The 2 readings are so equivalent: a natural bitstream with a constant bit position, or differentially encoded frames carrying an even parity bit (31 data bits plus 1 parity bit). Both produce the same natural bitstream, so the data alone cannot separate between them.
As shown in Figure 6, a parity test over the full 32-bit frame of the differentially decoded bitstream of Figure 4 returns 100% success for even parity at a single start-bit offset, the 1 aligned with the phasing bit column. This is not an independent confirmation: XORing all the differential bits of a frame leaves only the XOR of the 2 bits at the frame boundary, which lie in the same column. If that column is constant, as the phasing bit is, the parity is necessarily even. The 2 readings are so equivalent: a natural bitstream with a constant bit position, or differentially encoded frames carrying an even parity bit (31 data bits plus 1 parity bit). Both produce the same natural bitstream, so the data alone cannot separate between them.
 |
| Figure 6: Parity test on the differentially decoded bitstream of Figure 4, computed over the full 32-bit frame. Left: decoded bitstream, 1 frame per row. Right: parity success rate versus start-bit offset, peaking at 100% for even parity at a single offset. |
The 2022 signal [1] was located in the Kaliningrad Oblast by TDOA. It shares with the signal analyzed here a constant last bit (0) in all frame and, after differential decoding, a parity test returning 100% for even parity; moreover, the FSK parameters of the 2 signals are related (keying rates scaling by a origin of 5/3, shift doubling). These similarities propose a Russian origin for this signal as well, although this remains a hypothesis.
Unlike the 2022 signal [1], in which an H(24,16) code was found, a rank test over the 32-bit frames of Figure 4 shows no parity relation another than the constant bit, so no specified structure is evident in this capture. The number of captured frames is not adequate to test longer or interleaved codeword structures, and so to formulate more consistent hypotheses on the coding.
Unlike the 2022 signal [1], in which an H(24,16) code was found, a rank test over the 32-bit frames of Figure 4 shows no parity relation another than the constant bit, so no specified structure is evident in this capture. The number of captured frames is not adequate to test longer or interleaved codeword structures, and so to formulate more consistent hypotheses on the coding.
Downloads
Signal recording: https://disk.yandex.com/d/jK3Yu1PdPEF94Q
References
[1] https://i56578-swl.blogspot.com/2022/08/unid-150-300bd500-fsk.html
