GPS Jammer
GPS Jammer
Issues: [ 1 ] [ 2 ] [ 3 ] [ 4 ] [ 5 ] [ 6 ] [ 7 ] [ 8 ] [ 9 ] [ 10 ] [ 11 ] [ 12 ] [ 13 ] [ 14 ] [ 15 ] [ 16 ] [ 17 ] [ 18 ] [ 19 ] [ 20 ] [ 21 ] [ 22 ] [ 23 ]
[ 24 ] [ 25 ] [ 26 ] [ 27 ] [ 28 ] [ 29 ] [ 30 ] [ 31 ] [ 32 ] [ 33 ] [ 34 ] [ 35 ] [ 36 ] [ 37 ] [ 38 ] [ 39 ] [ 40 ] [ 41 ] [ 42 ] [ 43 ] [ 44 ] [ 45 ]
[ 46 ] [ 47 ] [ 48 ] [ 49 ] [ 50 ] [ 51 ] [ 52 ] [ 53 ] [ 54 ] [ 55 ] [ 56 ] [ 57 ] [ 58 ] [ 59 ] [ 60 ] [ 61 ] [ 62 ] [ 63 ] [ 64 ] [ 65 ] [ 66 ] [ 67 ]
[ 68 ] [ 69 ] [ 70 ] [ 71 ]
Current issue : #60 | Release date : 2002-12-28 | Editor : Phrack Staff Get tar.gz
Introduction Phrack Staff
Loopback Phrack Staff
Linenoise Phrack Staff
Toolz Armory Packet Storm
Phrack Prophile on horizon Phrack Staff
Smashing The Kernel Stack For Fun And Profit noir
Burning the bridge: Cisco IOS exploits FX
Static Kernel Patching jbtzhm
Big Loop Integer Protection Oded Horovitz
Basic Integer Overflows blexim
SMB/CIFS By The Root ledin
Firewall Spotting with broken CRC Ed3f
Low Cost and Portable GPS Jammer anonymous author
Traffic Lights plunkett
Phrack World News Phrack Staff
Phrack magazine extraction utility Phrack Staff
==Phrack Inc.==
--[ Contents
1 - Project Overview
2 - Why?
3 - Technical Description
3.1 - Phase Locked Loop
3.2 - Noise Generator
3.3 - RF Amplifiers
3.4 - Voltage Regulation
3.5 - Antenna
4 - Construction Notes
4.1 - Component Purchasing
4.2 - Layout
5 - Operation
6 - References
This device will have no effect on the precise positioning service (PPS)
which is transmitted on the GPS L2 frequency of 1227.6 MHz and little
effect on the P-code which is also carried on the L1 frequency. There may
be a problem if your particular GPS receiver needs to acquire the P(Y)-code
through the C/A-code before proper operation.
This device will also not work against the new upcoming GPS L5 frequency
of 1176.45 MHz or the Russian GLONASS or European Galileo systems. It can
be adapted to jam the new civilian C/A-code signal which is going to also
be transmitted on the GPS L2 frequency.
---[ 2 - Why?
The onslaught of cheap GPS based navigation (or hidden tracking devices)
over the past few years has made it necessary for the typical citizen to
take up the fine art of electronic warfare.
Several companies[2] now sell "hidden" GPS based tracking devices which
mount inside or underneath your vehicle. Some transmit the coordinates,
via cellular phone, of your vehicle's present and/or past locations for
weeks at a time without battery changes or court orders!
Vehicle rental companies have been known to use GPS tracking devices to
verify you don't speed or abuse their rental vehicles. The unsuspecting
renter is often faced with these hidden abuse "fees" after returning the
rental vehicle.
Law enforcement agencies are dumb enough to keep track of house arrest
prisoners with simple GPS based tracking bracelets[3]. Some even use GPS
for automatic vehicle location (AVL) on their squad cars to allow the
dispatchers to send in the closest unit to a particular call or to know an
officer's location in case of an emergency situation where they can't use
their radio.
The VCO feeds a portion of its radio frequency (RF) output signal into
the prescaler chip, where it is divided by 256. A 1575 MHz signal would be
turned into a 6.15234375 MHz signal. This is then fed into one side of the
PLL chip.
The other side of the PLL is fed with a reference frequency which is
derived from a 10 MHz quartz crystal. This crystal reference frequency is
divided down 512 times by the PLL to reach 19531.25 Hz. The 6.15234375
MHz prescaler output frequency is also further divided down 315 times by
the PLL chip for a final frequency of 19531.25 Hz. This will be the new
PLL internal reference frequency. That big bad 1575 MHz microwave signal
now looks like a simple audio frequency to the PLL chip and the supporting
components.
The PLL chip internally compares the phase of the 19531.25 Hz VCO side
signal to the phase of the 19531.25 Hz crystal side signal. The PLL chip
outputs high or low voltage pulses depending on whether the crystal signal
is leading or lagging in phase with the VCO signal. These pulses are then
filtered and dampened into a pure DC control signal via a simple passive
loop filter. This cleaned up signal is then connected to the VCO's voltage
tune control input.
Due to a quirk with using low cost, easy to obtain components, you'll
need to tweak two loading capacitors on the reference crystal. This is
unusual, but necessary to move the signal from the default 1575 MHz to
the more appropriate 1575.42 MHz (+/- a few hundred Hertz). This is a very
important and delicate procedure, and you'll need a frequency counter to
accomplish it.
The actual noise generator of the jammer is very simple. A 6.8 Volt
Zener diode is first biased, buffered and amplified by a single 2N3904
transistor. This single Zener diode is capable of generating broadband
noise signals from audio frequencies up to over 100 MHz. We then filter
this noise signal down to something more practical and something which the
VCO module can actually respond too. This is done via the LM386 audio
amplifier chip. The LM386 both amplifies and low pass filters the final
noise signal. The final LM386 output signal will have enough overhead if
you need to adapt it for a wideband noise jammer.
This low frequency noise signal is fed, via a 100 Ohm potentiometer, to
a simple resistor/capacitor network where it's mixed with the VCO voltage
tune control signal (described above). The single 1N4148 diode is to
prevent any negative voltage pulses from reaching the VCO.
This mixing results in a new "noisy" voltage tune control signal feeding
the VCO. The resulting RF signal looks like random noise dancing around
the center 1575.42 MHz RF carrier. You'll need to set the deviation of
this noise to approximately +/- 1.023 MHz from the 1575.42 MHz RF carrier.
Access to a spectrum analyzer is required to do this properly, or you can
use an oscilloscope and the included test point voltages to get an
approximate setup.
You can power the jammer off a common 12 Volt rechargeable battery.
The 12 Volt, 4.5 Amp-hour, lead-acid battery from Radio Shack[5], part
number 23-289, is a good choice. Old car batteries, strings of 6 Volt
lantern batteries or even solar panels will also work. Current draw for
the completed jammer will be around 300 milliamps.
A radiating antenna is not shown in the schematic diagram and one will
need to be purchased or constructed for proper operation. There are
numerous commercial GPS receiving antennas which will work fine for this
low power transmitting application. Some of the best pre-made or easily
assembled microwave antennas can be purchased directly from Ramsey
Electronics[6].
Dielectric GPS patch antenna elements may also be purchased from Digi-
Key. Toko DAK series elements, Digi-Key part number TK5150-ND, are perfect
for surface mounting directly to the circuit board. They will require a
plastic radome to slightly lower their resonant frequency. The small
antenna element size is also perfect for hidden or portable operations.
The main VCO module and RF amplifiers can be purchased from Richardson
Electronics[8]. Part number M3500C-1324S for the VCO module and part
numbers SGA-6289 and AH102 for the RF amplifiers. Equivalent VCO and RF
amplifiers can be purchased from companies such as Mini-Circuits[9] or
Synergy Microwave[10]. Slight component changes may be required if using
alternate components to take into account different operating voltages and
input/output RF power requirements. The PLL loop filter may also need
tweaking if you use a different VCO module.
The MC145151 PLL synthesizer chip can be purchased from Digi-Key. There
are several pin packages available (leaded or surface mount), choose the
one suitable for your application. The small 28-SOIC surface mount package
is part number MC145151DW2-ND. You may also be able to salvage MC145151
chips from older CB radios or older C-band satellite receivers (the kind
that where tuned via DIP switches).
Digi-Key also handles an equivalent prescaler IC, the NEC UPG1507GV, part
number UPB1507GV-ND. This is an exact replacement for the Fijitsu MB506,
but the main drawback to the UPG1507GV is that it is in a 8-SSOP package
(i.e. very small) and is fairly difficult to work with using standard
soldering tools.
The PCB layout isn't that difficult or challenging, but will require
prior experience and patience. Using all surface mount components and good
board layout practices will reduce the jammer's physical size and cost
tremendously.
The use of high frequency, double sided copper clad laminate is essential
for properly working microwave circuits. GIL Technologies[11] GML1000
(2-side, 1 oz., 0.030") is a good choice but standard FR-4 laminate will
work in a pinch. You can purchase 6" x 6" FR-4 (2-side, 1 oz., 0.030")
laminate from Digi-Key, part number PC45-S-ND.
The two RF amplifiers, band pass filter, VCO and prescaler PCB patterns
will all require numerous ground vias connecting the top and bottom ground
planes. These help prevent ground loops and instability (oscillations)
from disrupting proper circuit operation. In the case of the AH102, they
even provide some heat sinking to allow cooler operation of the final RF
amplifier.
--[ 5 - Operation
Any obstructions near the jammer's own antenna (trees, houses, hills,
walls, etc.) will decrease the jamming range. The best placement is where
the jammer's antenna is line-of-sight to the antenna of the GPS receiver
you're trying to jam. Real world results will vary drastically, but you
should be able to obtain a jam radius of a few hundred feet even in heavily
obstructed areas with the higher power (AH102) option and a simple antenna.
--[ 6 - References
[2] GPS-Web
http://www.gps-web.com
Travel Eyes 2
http://www.spyyard.com/details_traveleyes2.htm
[3] VeriTrack
http://www.veridian.com/offerings/suboffering.asp?offeringID=472
iSECUREtrac
http://www.isecuretrac.com
[4] Digi-Key
http://www.digikey.com
[9] Mini-Circuits
http://www.minicircuits.com
[12] Xcircuit
http://xcircuit.ece.jhu.edu
<++> ./gps_jammer.ps.gz.uue
<--> ./gps_jammer.ps.gz.uue