Voice Inversion Radio Scrambler Testing
Inverted audio is interesting to me, it has the correct timing of regular speech, it is just unintellagable, similar to listening to another language. I want to learn more about Voice Inversion. First task, test some radios.
Baofeng BF-888S
Reading some reviews of the Baofeng BF-888S, some versions of the radios have a Voice Inversion scrambler that they call 'Beat Shift'. According to the review on
www.miklor.com, getting a BF-888S with Beat Shift is 'luck of the draw'. I bought a pair of BF-888S, and although in CHIRP I saw the option for Beat Shift, it didn't work.
Raddioddity R2
The second radio I tried was a Raddioddity R2, it is even advertised prominently as having a Scrambler Function:
Using the CHIRP Software, it was easy to turn on the voice inversion, and it worked fine. The inversion is set only with software, you can't turn it off/on from the radio. The Radios are UHF only, and support FM and Narrow FM. I used the Baofeng cord to program the R2.
Ramsey SS-70A Speech Descrambler
Used a Ramsey SS-70A speech descrambler connected to a scanner to verify the audio from the R2 descrambled ok.
*Diagram from the Ramsey Manual
The Ramsey has a bypass switch so you can toggle between inverted speech and regular. There is a RadioReference.com thread Scanners that p/up Voice Inversion (Encryption) that mentions "This unit has the serious flaw of not being able to be tuned to the correct inversion frequency of the Kenwood radios. Ramsey uses a fixed crystal to set the 3300 cps for the pilot carrier. Most of the single inversion radios marketed today can be programmed between 3000-4000 cps, so your decoded audio is still very Donald Duck sounding or will not clarify."
Leixen VV-898S
The third radio I tested was a Leixen VV-898S. In CHIRP there are several options for Audio Processing including Scrambler, TX Scrambler, and RX Scrambler:
Using CHIRP with the VV-898S takes a little more effort to get it to work (Factory reset the radio, manually program 2 frequencies, turn on CHIRP developer featrues, import a module). Since I only have one Leixen VV-898S, I thought I would try Raddioditty R2 and Leixen VV-898S interoperability. Both radios set to the same frequency, same mode (Narrow FM), and both set to scramble... doesn't work. I can record both radios individually in Gqrx, decode the audio with the same perl script below. But when they try to comunicate directly, it still sounds scrambled. Maybe the inversion frequency is off just enough that the radios can't understand each other, but the script overcomes it somehow? I wish I could find specs on what each company was doing for their version of scrambling.
Scripts
Recorded some audio transmitted from a Raddioditty R2 radio set to scramble, received with the Gqrx software using a RTL-SDR dongle on a Mac. Took the .wav file to a CentOS Linux machine, installed sox. Then used one of Oona Räisänen's Perl scripts to decode the .wav:
my $bandwidth = 4300;
my $fc = $bandwidth * 2;
# Using SoX for resampling and decoding/encoding WAV headers
open my $inf, '-|', 'sox scrambled.wav -r '.$fc.' -c 1 -t .s16 -';
open my $outf, '|-', 'sox -r '.$fc.' -c 1 -t .s16 - descrambled.wav';
my $sign = 1;
while (read $inf, my $sample, 2) {
# Simply multiply every other sample by -1
print $outf pack "s", (unpack "s", $sample) * $sign;
$sign *= -1;
}
The output is a file called descrambled.wav. The speech was recognizable, but sounded a little off.
Future:
I would like to test a Motorola RMM2050 MURS radio. Since it is on the MURS band and FCC approved, it is one of the only radios that can legally do voice inversion for the general public in the US. The manual says "the Scramble feature must be programmed to either SB1 or SB2". Guessing that means Side Button 1 or 2 should be programmed to toggle voice inversion on and off. I see mentioned on one site that there are 3 scrambler codes... would like to test this and see how the codes change the inversion.
There are several VHF Marine radios such as the ICOM M85 that have Voice Inversion. The M85 has 32 codes, would like to test that out. The Standard Horizon HX890 (NB and BK) have two scramber systems. The 4 code CVS2500A and a 32 code FVP-42 scrambler system. Would like to play around with those. The VHF Marine radios is another set of radios that can legally be used for Voice Inversion by the general public in the US (well on a boat).
The TCA 152A is a functional replica of a Harris Falcon III AN/PRC-152. There is a CT mode (CrypTo Mode I assume) that apparently does Voice Inversion. Interested in actually testing that.
Would also like to play around with a RACAL MA4204 or MA-4014B to see how Time-division voice scrambling works. They pop up on ebay from time to time.
Notes and Links on Voice Inversion
Work by Oona Räisänen:
Descrambling the voice inversion scrambler
Interesting post, includes some perl scripts to descramble inverted audio.
Descrambling split-band voice inversion with deinvert
Follow up post, talks about split band inversion with a program to descrable it.
Descrambling split-band inversion real-time (RasPi1, deinvert)
Trivial Voice "Scramblers" and How To Defeat Them Interesting article on building circuits to defeat Voice Inversion and some good ASCI art.
The Speech Inverter (1928) Article from 1928.
Voice Privacy Equipment For Law Enforcement Communication Systems (1973)
FCC Applies Novel Rule Interpretation, Levies Fine talks about the fine against Midland for selling voice inversion radios
CMX264 - Frequency Domain Split-band Scrambler IC
Specs of a Chip used in cosumer products to do split-band voice scrambling.
Radio Intercept: CML CMX264 Frequency Domain Split-Band Speech Inversion
Back to Main Menu