Category: hardware

the creeper bot

a video review of a DIY remote controled car using an arduino.

more info here


openwrt router as wireless client bridge – procedure
1. flash the router with openwrt firmware (kamikaze version in my case)
2. config the hardware to connect to an existing router as a wireless client bridge
3. connect the wired hardware to the client bridge

information links:
to flash the openwrt

to config the router as wireless client bridge

as a test run i’m currently watching “assassin’s” through the network (1.4GB avi DVDRiP 480p over a G wireless
network). streaming is fine. Going to test a matroska later on.

matroska update: the streaming of a 720p mkv is a bit more slugish, but still watchable as far as i see. some speed
testing are needed i guess.


0) install a telnet and a tftp client (pacman -S tftp-hpa and pacman -S inetutils)

i) download openwrt image (*.bin)

ii) power down the router

iii) conect a linux PC to a LAN port of router

iv) set your ip to

ifconfig eth0:1 netmask

v) order your tftp client to begin pushing the firmware to the router (once every second for 60 seconds). issue the following commands:

rexmt 1
timeout 60
Packet tracing on.
tftp> put openwrt-xxx-x.x-xxx.bin

vi) power up the router. if all goes well the router will start the boot and will open to receive the new firmware.
vii) wait a few minutes. the router will reboot once the flashing is complete.
viii) reset ETH0 to “regular” mode

ifconfig eth0:1 down

ix) telnet to router and set root password

#passwd (then type new root pass)

x) if you wish you may ssh the router at this point

<pre>ssh -l root

or you may go to the webgui to finish the configuration (point browser to


for extra info check:

I was installing a package from aur today (with yaourt), when i ran out of space in my /tmp partition. the computer is a 901 eee-pc runnig arch linux. the /tmp partition as only 60MB in size so its prone to kind of situation i guess. what it happened was that i ran out of space while building the package.

to solve the problem decided to manually build the package. the solution was to copy the entire yaourt tmp dir (/tmp/yaourt***something) to my home dir and continue the process from there with the command:

$makepkg PKGBUILD

this step will build a compressed package *.pkg.tar.xz.

to install simply did (as root):

#pacman -U package_name.pkg.tar.xz

more info on pkgbuild here

aqui fica uma ferramenta bastante util para quem quer seguir os desenvolvimentos do openmoko: o openmoko world agregator (trata-se de um pipe da yahoo)

“O “cano” agrega as fontes, busca pela palavra openmoko tanto no título como no corpo, filtra os repetidos pelo título, ordena pela data de publicação, e publica.”

creditos para o vasco névoa pelo trabalho.

Categorias do Technorati ,

Samsung d600 and Linux

Este post servirá para juntar informação sobre este telemovel da samsung e a sua integração com linux. infelizmente a samsung ignora completamente este SO pelo que a ajuda só poderá vir da comunidade (rant, rant, rant)…

post 1:

A beautiful friendship? Linux and Samsung SGH-D600

Alex Günsche · May 30, 2006

This article is from the website of the discontinued ServerSite project. As it is often found via search engines and it is much linked across the web, I decided to post it here again.

And now for something completely different: I managed to synchronize my Samsung SGH-D600 mobile phone with my Linux machine. I know there are many people who also want that, and I still haven’t found any useful resources on other websites. So I’m trying to outline here how to get the SGH-D600 to talk to Linux.

A brief history of my efforts: First, I tried to “detect” and mount the Phone’s internal memory. Samsung delivers a software package in order to do so, but that cr*p only runs on Windows. It doesn’t behave like a usual USB device; although it was detected as such by my system. So I tried to run Samsungs “PC Studio” with wine. I spent some hours until I gave up, totally upset and angry.

So I decided to spend some more money and get a microSD card, in order to have an additional reason to hate Samsung and their “What-is-that-Linux-you’re-talking-about”-attitude. It was detected directly as I put it into my SGH-D600, and the phone suggested to format it, which I allowed to happen. After that, I set the data transfer type to “Mass storage” (Settings -> Phone settings -> USB settings). Then I plugged it into my PC, and the phone said “USB now in use.” (It did that before, too; so I still wasn’t expecting too much.)

But then, I got the following (slightly adapted to fit layout):

# tail -n 20 /var/log/messages
usb 3-2: new full speed USB device using ohci_hcd and address 3
usb 3-2: configuration #3 chosen from 1 choice
scsi0 : SCSI emulation for USB Mass Storage devices
usb-storage: device found at 3
usb-storage: waiting for device to settle before scanning
Vendor: Model: Rev:
Type: Direct-Access ANSI SCSI revision: 00
SCSI device sda: 1983495 512-byte hdwr sectors (1016 MB)
sda: Write Protect is off
sda: Mode Sense: 00 6a 00 00
sda: assuming drive cache: write through
SCSI device sda: 1983495 512-byte hdwr sectors (1016 MB)
sda: Write Protect is off
sda: Mode Sense: 00 6a 00 00
sda: assuming drive cache: write through
sda: sda1
sd 0:0:0:0: Attached scsi removable disk sda
sd 0:0:0:0: Attached scsi generic sg0 type 0
usb-storage: device scan complete
scsi.agent[11755]: disk at /devices/pci0000:00/0000:00:03.1/usb3/3-2/3-2:3.0/host0/target0:0:0/0:0:0:0

So the card actually was detected, whereas before my machine was barely able to detect some sort of storage device.
First, I tried to mount /dev/sda1, but all I got was some subdirectories with names consisting of but weird characters. So I unmounted it and mounted /dev/sda, and – behold! – I got a list of folders like “Images”, “Video”, “Music” etc.

Now I had to test if it would accept me changing the contents: I put one of my favourite albums into the “Music” folder and unmounted. Unmounting took very long, so I think the actual writing was performed there. Then I started the mp3 player integrated with the SGH-D600, and I got my favourite sound coming out of my cell phone. :-D

I hope this encourages Linux users with the Samsung SGH-D600 to give it a try, too. What you need, are a few things: (1) a microSD (a.k.aTransflash) Card, (2) the (afaik always included) USB cable, and (3) a Linux kernel with support for plenty of USB and SCSI stuff. Especially important is the ohci support and “Probe all LUNs”, but they should be active on recent distros anyway. (Note: the device can also appear as /dev/sdb or somoething different. Check your /dev directory and /var/log/messages.)

Try out and have fun.


A pretty good tutorial for begginers (


What is voltage?

So what is voltage anyhow? Well, its a pretty abstract term but a lot of people like to use the term “potential energy” which is that thing you heard about in high school physics and then forgot immediately.

Some people like to draw an analogy to water to describe voltage. A water pump is like a voltage supply (also known as a battery).
The pump pushes water through a hydraulic system, and the voltage supply pushes electrons through an electronic system.
The higher the rated pressure of the pump, the more ‘work’ the water can do.
Likewise, the higher the voltage the more ‘work’ (Watts) the electrons can do.

Voltage is used to provide power (via a battery or wall plug) and its also used as a way of transmitting data. For example, music is recorded from a microphone as an analog voltage signal, if that voltage waveform is applied to a speaker the voltage performs the work of making air move and produces sound.
Voltage is also used to in digital circuits to talk back and forth in binary, usually 5V or 3.3V is a “1” and 0V is a “0”, by alternating the 1’s and 0’s millions of times a second, data can be moved around rather quickly.


Not just an 80’s hair metal band! Voltage comes in two flavors (yum): Alternating Current (AC) and Direct Current (DC). Here is a quick tour of the differences.

Direct current voltage is what comes out of batteries. The battery is at 9V, and it pretty much keeps that voltage constant, until it dies. The chemical reactions inside the battery creates DC voltage.
Electronic circuits really like DC voltage.

Alternating current voltage is what comes out of the wall. The generator at the US power plant creates a voltage that oscillates, going from -60V to 0 to +60V to 0 again, 60 times a second. At the European power plant its -120V to +120V at 50 times a second.
AC voltage is great for power plants because its easy to transform AC voltages (using a transformer) up to 50KV for long distance travel and then down to 240V or 120V to safely power your home. Those big honking grey things that you see next to buildings that hum are the huge transformers.
Motors (like your washing machine and refrigerator compressor pump) like running off of AC voltage.

You can turn AC voltage into DC voltage very easily by using a very small transformer to bring the 120V down to a reasonable level like say 16VAC and rectifier. This is basically what’s inside a wall wart plug or your laptop power supply.
Its much harder to turn DC into AC, you will need an inverter which are more expensive than transformers/rectifiers.

Batteries only supply DC voltage and wall plugs only supply AC voltage. However, it is totally possible to have both AC and DC voltage at a certain point:
If an AC voltage is oscillating between -60V and +60V it has 120V AC and 0V DC because the average voltage of -60V and +60V is 0V.
If an AC voltage is oscilating between 0V and 120V then it has 120V AC and 60V DC because the average voltage of 0V and 120V is 60V.

In the above oscilloscope image, the dashed horizontal line in the center is ground (0V) and each dashed division is 5V. The scope is displaying a signal that has both AC and DC components. There is an alternating voltage (a square wave) that is about 4V high at about 100Hz and a DC (mean average) voltage that is around 7V. Use the dashed divisions to verify for yourself that this is so.

What is voltage testing good for?

Voltage testing is very common, you’ll use it a lot

  • Test if your power supply is working, are you getting 5V out of that 7805 regulator?
  • Verify that your circuit is getting enough power: when all of the blinky lights are on, is the power supply drooping too low?
  • Verify signals to and from chips to make sure they are what you expect once the circuit is up and running
  • Testing batteries, solar cells, wall plugs, and power outlets (carefully!)
  • With a current sense resistor you can perform current testing on a project without possibly damaging your meter.


You can only test voltage when the ciruit is powered If there is no voltage coming in (power supply) then there will be no voltage in the circuit to test! It must be plugged in (even if it doesn’t seem to be working)

Voltage is always measured between two points There is no way to measure voltage with only one probe, it is like trying to check continuity with only one probe. You must have two probes in the circuit. If you are told to test at a point or read the voltage at this or that location what it really means is that you should put the negative (reference, ground, black) probe at ground (which you must determine by a schematic or somewhere else in the instructions) and the positive (red) probe at the point you would like to measure.

If you’re getting odd readings, use a reference voltage (even a 9V battery is a reasonable one) to check your voltage readings. Old meter batteries and wonky meters are the bane of your existence but they will eventually strike! Good places to take reference voltages are regulated wall plugs such as those for cell phones. Two meters might also be good 🙂

Voltage is directional If you measure a battery with the red/positive probe on the black/negative contact and the black probe on the positive contact you will read a negative voltage. If you are reading a negative voltage in your ciruit and you’re nearly positive (ha!) that this cannot be, then make sure you are putting the black probe on the reference voltage (usually ground)

DC voltage and AC voltage are very different Make sure you are testing the right kind of voltage. This may require pressing a mode button or changing the dial.

Unless otherwise indicated, assume DC voltages

Get into the right mode

There are often two seperate modes for AC and DC voltage. Both will have a V but one will have two lines, one dashed and one solid (DC) and one with have a wave next to it (AC).

This meter has the double line for DC voltage, and 5 ranges, from 200mV to 600V. The lightning bolt symbol is a gentle reminder that this voltage is extremely dangerous.

There is also the V-wave symbol for AC, and two ranges since most AC voltages that are measured are power voltages and are pretty big. (For small AC waveforms, a scope is best since you will be able to see the waveform itself)

This autoranging meter makes it pretty clear which mode you want to be in

This ranged meter has 5 ranges, the top range is 750 VAC or 1000 VDC, to switch between DC and AC you need to press the DC/AC button on the upper right.

When the probes are not connected to anything, they should display 0V. They might flicker a bit if they pick up ambient voltage (your home is a big radiator of 60Hz voltage which can couple into your meter probes).

Example 1: Testing batteries

Testing batteries is a super useful skill and is one of the best ways to practice with your multimeter

The first battery we’ll test is a new 1.5V alkaline. This one is a AAA but a AA, C or D cell will be the same voltage. Set the range to 2V DC .

We read 1.588V, which you may think is a mistake, after all its a 1.5V battery so shouldn’t it be 1.5V? Not quite, the 1.5V written on the side is just a nominal voltage, or the “average” you may expect from the battery.In reality, an alkaline battery starts out higher, and then slowly drifts down to 1.3V and then finally to 1.0V and even lower. Check out this graph from Duracell’s page about alkaline battery voltage

Using this graph you can easy tell how fresh your battery is and how long you can expect it to last.

Next, we measure a 9V alkaline battery. If we still have the range set to 2VDC we will get a mysterious “1. ” display, indicating is it over-range.

Fix the range so that it’s 20V, and try again.

For this new battery we get 9.6V. Remember that battery voltage is nominal, which means that the “9V” is just the average voltage of the battery. In reality, it starts out as high as 9.5V and then drops down to 9 and then slowly drifts to 7V. You can check out the discharge curve in the Duracell 9V datasheet

If we want to check a rechargeable AA battery, and it’s set to a 20VDC range, we will read 1.3V, which is about what a fully charged NiMH battery will measure.

If we fix the range so it’s 2VDC, we can get an extra digit of precision. This meter probably isnt more than 0.5% accurate so the precision may not mean much.

Finally, I test a lithium 3V coin cell, its at 2.7V which means it’s getting near the end of it’s life.

Example 2: Testing wall wart (adapter) plugs

Testing wall adapters is also very handy, especially when you build your own circuits.

The first kind we will test is a transformer-based adapter.





This photo has notes. Move your mouse over the photo to see them.

<a href=””><img src=”../../images/metertutorial/wartdetail.jpg” width=286 height=340></a> Note that the label says Transformer, its also blocky and heavy which indicates a transformer as well. It requires 120VAC input, US power only. The nominal output is 9VDC at 300mA. The polarity symbol shows that the middle is positive, the outside is negative, thus we place the ground (black) probe on the outside and the positive (red) probe on the inside.

Yow! 14V? That’s not anything like the 9V on the package, is this a broken wall wart? Turns out, its totally normal. Transformer-based wall adaptors are (almost always) unregulated, which means that the output is not guaranteed to be a particular value, only that it will be at least what is printed on the box. For example, with this adapter it means that when drawing 300mA, the voltage is guaranteed to be higher than 9V.

Since the output is unregulated, the voltage supplied will droop as more current is pulled from it, which means that open-circuit (connected to nothing) the measured output can be as high as 14V. Glitchbuster has a long page that describes this.

Next, lets check out a Switch-mode adapter

Notice that it’s not square, its much thinner and although you cant feel it, its quite light for its size: There is no big honking transformer inside!





This photo has notes. Move your mouse over the photo to see them.

<a href=””><img src=”../../images/metertutorial/smpsdetail.jpg” width=190 height=257></a>

Note that it says Switching (not Transformer) on the label, and you can input US or European power. Like the transformer adapter, it is center-positive polarity.


Switch-mode wall adapters are regulated which means that the output doesn’t droop from open-circuit to full load. Its not an ultra-high quality supply, the voltage is 12.2V which is less than 5% error. Still, its much better than the transformer’s 50% error!

Lastly, we’ll test a 9VAC adaptor, which outputs AC voltage instead of DC. Basically this means that there’s still a transformer inside, but no rectifier. This is also an unregulated supply

Note that is is similar to the transformer-based DC supply we checked out first





This photo has notes. Move your mouse over the photo to see them.

<a href=””><img src=”../../images/metertutorial/9vactransdetail.jpg” width=304 height=363></a>

Note again that the label says transformer. It requires 120VAC input, US power only. The nominal output is 9VAC at 300mA. The output is indicated twice, once at the top “AC/AC” and then again in the output designator “9V AC”
There is no polarity because AC adaptors are not polarized: AC power oscillates between positive and negative voltages.

We test the output, but get 0V! That’s when we remember that the multimeter has to be in AC voltage mode.

Switching over to AC, we get a good reading, 10.5VAC. This is an unregulated supply so again we are going to get a voltage higher than 9V.


Example 3: Testing Wall output

This is the ‘easiest’ test, just shove the two probes into a wall socket. If you’re clumsy and think you’ll somehow electrocute yourself, don’t do this. Many people freak out about this test, but ironically it’s what the multimeter was designed to do.

About 120V, as expected

Bonus Example: Testing a circuit with AC and DC

If you’re trying to measure something that is just DC or just AC its very easy, just get into the right mode and measure away! The hardest thing to do is measure a circuit with both AC and DC voltages.

For example, here is a few attempts to measure the VCO output of a x0xb0x as seen in the oscilloscope output shown here (its the same one from above

The DC portion is the easy part to measure, most multimeters just average out the input measurement

We read 6.75V DC, which is about right.

However, when trying to measure AC, this multimeter gives us a seemingly random number. (Maybe the DC voltage * 2 ?)

The Extech meter reads 1.65V

The Wavetek does the same

The lesson? You can’t depend on your multimeter to measure AC voltages when there is a DC component!

 ==Phrack Inc.==

               Volume 0x0b, Issue 0x3c, Phile #0x0d of 0x10

|=-----------------=[ Low Cost and Portable GPS Jammer ]=----------------=|
|=---------------=[ anonymous < ]=---------------=|

--[ Contents

  1 - Project Overview

  2 - Why?

  3 - Technical Description
    3.1 - Phase Locked Loop
    3.2 - Noise Generator
    3.3 - RF Amplifiers
    3.4 - Voltage Regulation
    3.5 - Antenna

  4 - Construction Notes
    4.1 - Component Purchasing
    4.2 - Layout

  5 - Operation

  6 - References

  Appendix A: Links to Datasheets

  Appendix B: Schematic Diagram - (uuencoded)

--[ 1 - Project Overview

  A low cost device to temporarily disable the reception of the civilian
course acquisition (C/A) code used for the standard positioning service
(SPS)[1] on the Global Positioning System (GPS/NAVSTAR) L1 frequency of
1575.42 MHz.

  This is accomplished by transmitting a narrowband Gaussian noise signal,
with a deviation of +/- 1.023 MHz, on the L1 GPS frequency itself.  This
technique is a little more complicated than a simple continuous wave (CW)
jammer, but tends to be more effective (i.e. harder to filter) against
spread spectrum based radio receivers.

  This device will have no effect on the precise positioning service (PPS)
which is transmitted on the GPS L2 frequency of 1227.6 MHz and little
effect on the P-code which is also carried on the L1 frequency.  There may
be a problem if your particular GPS receiver needs to acquire the P(Y)-code
through the C/A-code before proper operation.

  This device will also not work against the new upcoming GPS L5 frequency
of 1176.45 MHz or the Russian GLONASS or European Galileo systems.  It can
be adapted to jam the new civilian C/A-code signal which is going to also
be transmitted on the GPS L2 frequency.

  That said, it will work against the majority of consumer/OEM GPS
receivers, provided they are not setup in any advanced anti-jam

---[ 2 - Why?

  The onslaught of cheap GPS based navigation (or hidden tracking devices)
over the past few years has made it necessary for the typical citizen to
take up the fine art of electronic warfare.

  Several companies[2] now sell "hidden" GPS based tracking devices which
mount inside or underneath your vehicle.  Some transmit the coordinates,
via cellular phone, of your vehicle's present and/or past locations for
weeks at a time without battery changes or court orders!

  Vehicle rental companies have been known to use GPS tracking devices to
verify you don't speed or abuse their rental vehicles.  The unsuspecting
renter is often faced with these hidden abuse "fees" after returning the
rental vehicle.

  Law enforcement agencies are dumb enough to keep track of house arrest
prisoners with simple GPS based tracking bracelets[3].  Some even use GPS
for automatic vehicle location (AVL) on their squad cars to allow the
dispatchers to send in the closest unit to a particular call or to know an
officer's location in case of an emergency situation where they can't use
their radio.

  Cellular phone companies, trucking companies, private investigators,
toll-roads, aircraft, those "protect your child" systems and many more
services are all fully involved with the use of GPS based tracking.  The
problem is, do you really want everyone to know where you are?

---[ 3 - Technical Description

  This will be a brief description of each of the major sections which
compromise the entire jammer device.  Refer to the included schematic
diagram (Appendix B) as you read along.  You should also refer to the
component's datasheets for even more detailed information.

---[ 3.1 - Phase Locked Loop

  The jammer's main oscillator components consist of a Motorola MC145151
phase-locked loop (PLL) frequency synthesizer chip, a Micronetics M3500-
1324S voltage controlled oscillator (VCO) module and a Fijitsu MB506 divide
-by-256 prescaler chip.

  The VCO feeds a portion of its radio frequency (RF) output signal into
the prescaler chip, where it is divided by 256.  A 1575 MHz signal would be
turned into a 6.15234375 MHz signal.  This is then fed into one side of the
PLL chip.

  The other side of the PLL is fed with a reference frequency which is
derived from a 10 MHz quartz crystal.  This crystal reference frequency is
divided down 512 times by the PLL to reach 19531.25 Hz.  The 6.15234375
MHz prescaler output frequency is also further divided down 315 times by
the PLL chip for a final frequency of 19531.25 Hz.  This will be the new
PLL internal reference frequency.  That big bad 1575 MHz microwave signal
now looks like a simple audio frequency to the PLL chip and the supporting

  The PLL chip internally compares the phase of the 19531.25 Hz VCO side
signal to the phase of the 19531.25 Hz crystal side signal.  The PLL chip
outputs high or low voltage pulses depending on whether the crystal signal
is leading or lagging in phase with the VCO signal.  These pulses are then
filtered and dampened into a pure DC control signal via a simple passive
loop filter.  This cleaned up signal is then connected to the VCO's voltage
tune control input.

  When everything is working properly, the VCO's output frequency is locked
to whatever frequency you programmed into the PLL chip, 1575 MHz in this
case.  It will stay on that frequency even through dramatic temperature
changes, a problem that a non-PLL VCO would have.  If the PLL is not
working properly, the red "PLL Unlock" LED will be lit.

  Due to a quirk with using low cost, easy to obtain components, you'll
need to tweak two loading capacitors on the reference crystal.  This is
unusual, but necessary to move the signal from the default 1575 MHz to
the more appropriate 1575.42 MHz (+/- a few hundred Hertz).  This is a very
important and delicate procedure, and you'll need a frequency counter to
accomplish it.

---[ 3.2 - Noise Generator

  The actual noise generator of the jammer is very simple.  A 6.8 Volt
Zener diode is first biased, buffered and amplified by a single 2N3904
transistor.  This single Zener diode is capable of generating broadband
noise signals from audio frequencies up to over 100 MHz.  We then filter
this noise signal down to something more practical and something which the
VCO module can actually respond too.  This is done via the LM386 audio
amplifier chip.  The LM386 both amplifies and low pass filters the final
noise signal.  The final LM386 output signal will have enough overhead if
you need to adapt it for a wideband noise jammer.

  This low frequency noise signal is fed, via a 100 Ohm potentiometer, to
a simple resistor/capacitor network where it's mixed with the VCO voltage
tune control signal (described above).  The single 1N4148 diode is to
prevent any negative voltage pulses from reaching the VCO.

  This mixing results in a new "noisy" voltage tune control signal feeding
the VCO.  The resulting RF signal looks like random noise dancing around
the center 1575.42 MHz RF carrier.  You'll need to set the deviation of
this noise to approximately +/- 1.023 MHz from the 1575.42 MHz RF carrier.
Access to a spectrum analyzer is required to do this properly, or you can
use an oscilloscope and the included test point voltages to get an
approximate setup.

---[ 3.3 - RF Amplifiers

  The VCO's +7 dBm (5 milliwatts) RF output is first slightly attenuated
(4 dB) and tapped for the MB506 prescaler input.  It then passes through to
the RF amplifier stages and band pass filter.

  The first RF amplifier is a Sirenza Microdevices SGA-6289.  It provides
about 13 dB of gain to overcome the losses from the resistive attenuation
pad.  It also shows a good 50 Ohm termination for the VCO RF output and
even helps to drive the final RF amplifier.

  The GPS band pass filter is a 2-pole Toko 4DFA-1575B-12 ceramic
dielectric filter from Digi-Key[4], part number TKS2609CT-ND.  This part is
optional, but helps clean up the RF spectrum before further amplification.
The filter's insertion loss is around 2 dB.

  The final RF amplifier is a WJ Communications AH102.  It provides another
13 dB of gain, with a higher P1dB compression point of around +27 dBm (500
mW).  The AH102 draws the most current of any part, and is not really
necessary if you're aiming for a low range, low current, battery operated

---[ 3.4 - Voltage Regulation

  Voltage input regulation and filtering is done using standard voltage
regulator ICs.  A LM2940CT-12 12 Volt, 1 Amp low dropout voltage regulator
is used to regulate the main 12 Volt power line.  Standard 78xx series
regulators are used from there on to provide both the 9 and 5 Volt lines.
A simple diode/fuse polarity protection scheme is also provided on the
battery input.  The use of an automatic reset fuse is highly recommended.

  You can power the jammer off a common 12 Volt rechargeable battery.
The 12 Volt, 4.5 Amp-hour, lead-acid battery from Radio Shack[5], part
number 23-289, is a good choice.  Old car batteries, strings of 6 Volt
lantern batteries or even solar panels will also work.  Current draw for
the completed jammer will be around 300 milliamps.

---[ 3.5 - Antenna

  A radiating antenna is not shown in the schematic diagram and one will
need to be purchased or constructed for proper operation.  There are
numerous commercial GPS receiving antennas which will work fine for this
low power transmitting application.  Some of the best pre-made or easily
assembled microwave antennas can be purchased directly from Ramsey

  The Ramsey DA25 broadband discone antenna is recommended for omni-
directional (transmit in a circle) radiating applications.  The LPY2 log
periodic Yagi antenna can be used for directional (transmit in a straight
line) radiating applications.  Using a directional antenna will give you a
slight increase in overall transmitted RF power, which increases the
jammer's range, and can also be used to shield your own GPS receiver from
being jammed (i.e. point it at the enemy).

  Dielectric GPS patch antenna elements may also be purchased from Digi-
Key.  Toko DAK series elements, Digi-Key part number TK5150-ND, are perfect
for surface mounting directly to the circuit board.  They will require a
plastic radome to slightly lower their resonant frequency.  The small
antenna element size is also perfect for hidden or portable operations.

---[ 4 - Construction Notes

  Unfortunately, proper jammer construction will require fairly advanced
engineering skills.  Prior knowledge of high frequency microwave circuits
and printed circuit board (PCB) design is required.  A good start for the
beginner is by reading the "UHF/Microwave Handbook" and "The ARRL Handbook"
both published by the Amateur Radio Relay League (ARRL)[7].  Access to
fundamental RF test equipment (oscilloscope, frequency counter, spectrum
analyzer, loads, attenuators, etc.) is also required.

---[ 4.1 - Component Purchasing

  The main VCO module and RF amplifiers can be purchased from Richardson
Electronics[8].  Part number M3500C-1324S for the VCO module and part
numbers SGA-6289 and AH102 for the RF amplifiers.  Equivalent VCO and RF
amplifiers can be purchased from companies such as Mini-Circuits[9] or
Synergy Microwave[10].  Slight component changes may be required if using
alternate components to take into account different operating voltages and
input/output RF power requirements.  The PLL loop filter may also need
tweaking if you use a different VCO module.

  The MC145151 PLL synthesizer chip can be purchased from Digi-Key.  There
are several pin packages available (leaded or surface mount), choose the
one suitable for your application.  The small 28-SOIC surface mount package
is part number MC145151DW2-ND.  You may also be able to salvage MC145151
chips from older CB radios or older C-band satellite receivers (the kind
that where tuned via DIP switches).

  Digi-Key also handles an equivalent prescaler IC, the NEC UPG1507GV, part
number UPB1507GV-ND.  This is an exact replacement for the Fijitsu MB506,
but the main drawback to the UPG1507GV is that it is in a 8-SSOP package
(i.e. very small) and is fairly difficult to work with using standard
soldering tools.

  The 10 MHz crystal is also available from Digi-Key, part number
300-6121-1-ND.  Other miscellaneous components may also be purchased from
Digi-Key (capacitors, resistors, voltage regulators, inductors,
diodes, transistors, LM386, project box, RF connectors, etc.) as their
prices are the most competitive and their service is outstanding.

---[ 4.2 - Layout

  No PCB pattern is available, you'll have to layout the project by hand
using felt-tip markers, drafting tape, dry-etch or iron-on transfers.  You
should make your own PCB pattern to fit your application specifically.

  The PCB layout isn't that difficult or challenging, but will require
prior experience and patience.  Using all surface mount components and good
board layout practices will reduce the jammer's physical size and cost

  The use of high frequency, double sided copper clad laminate is essential
for properly working microwave circuits.  GIL Technologies[11] GML1000
(2-side, 1 oz., 0.030") is a good choice but standard FR-4 laminate will
work in a pinch.  You can purchase 6" x 6" FR-4 (2-side, 1 oz., 0.030")
laminate from Digi-Key, part number PC45-S-ND.

  A 50 Ohm micro stripline on 0.030" GML1000 PCB laminate will be about 70
mils (1.8 mm) wide and on FR-4 it will be about 55 mils (1.5 mm) wide.  Be
sure to keep any micro stripline carrying RF signals short, straight and
perpendicular to any DC bias line or any other micro stripline it has to

  The 2 mm wide line in the dry-etch transfer package from Radio Shack,
part number 276-1490, will work O.K. on both materials for creating
homebrew micro striplines which are close enough to 50 Ohms.

  The two RF amplifiers, band pass filter, VCO and prescaler PCB patterns
will all require numerous ground vias connecting the top and bottom ground
planes.  These help prevent ground loops and instability (oscillations)
from disrupting proper circuit operation.  In the case of the AH102, they
even provide some heat sinking to allow cooler operation of the final RF

  Any resistors, capacitors or inductors used in the RF sections should be
in a 0603, 0805 or 1206 size surface mount package.  Leaded components will
not work at this high of a frequency.  Be sure your choice of surface mount
inductors can handle the current when used as part of the DC bias on the
RF amplifiers.  The ferrite bead shown in the schematic can be any salvaged
ferrite bead.  The inductor assortment package at Radio Shack, part number
273-1601 should have a couple of them in it.

--[ 5 - Operation

  Once the jammer is operational, you can practice testing it by monitoring
the signal on a common consumer GPS receiver or high quality communications
receiver.  A GPS receiver close to the jammer will not be able to acquire
C/A-code lock and any operating GPS in the jammer's radiation pattern will
lose C/A-code lock.  Higher quality GPS receivers tend to be less
susceptible to low power jamming, so you'll need to be in the antenna's
near-field radiation pattern (i.e. close) for it to work.

  Any obstructions near the jammer's own antenna (trees, houses, hills,
walls, etc.) will decrease the jamming range.  The best placement is where
the jammer's antenna is line-of-sight to the antenna of the GPS receiver
you're trying to jam.  Real world results will vary drastically, but you
should be able to obtain a jam radius of a few hundred feet even in heavily
obstructed areas with the higher power (AH102) option and a simple antenna.

  You can even practice counter-jamming methods to protect yourself against
hostile or accidental GPS jamming.  Try to shield your GPS receiver from
the interference source by placing your body, trees, hills, rocks or other
obstructions in-between your position and the interference.  More advanced
methods involve using directional or steerable phased-array antennas on
your GPS receiver (pointed skyward) to nullify any ground based

--[ 6 - References

[1] Standard Positioning Service (SPS) Signal Specification

[2] GPS-Web

    Travel Eyes 2

[3] VeriTrack


    Pro Tech Monitoring

[4] Digi-Key

[5] Radio Shack

[6] Ramsey Electronics

[7] Amateur Radio Relay League

[8] Richardson Electronics

[9] Mini-Circuits

[10] Synergy Microwave

[11] GIL Technologies

[12] Xcircuit

--[ Appendix A: Links to Datasheets

Alternate component manufactures may be substituted in most cases.

* Fairchild Semiconductor 2N3904 NPN Transistor

* Micronetics M3500-1324S VCO

* Motorola MC145151 PLL Frequency Synthesizer

* National LM2940-12 Voltage Regulator

* National LM386 Audio Amplifier

* National LM78L05 Voltage Regulator

* NEC UPB1506/07GV Prescaler

* Sirenza Microdevices SGA-6289 RF Amplifier

* STMicroelectronics 78M09 Voltage Regulator

* Toko DAK1575MS50T Dielectric Antenna

* Toko 4DFA-1575B-12 Dielectric Band Pass Filter

* WJ Communications AH102 RF Amplifier

--[ Appendix B: Schematic Diagram - (uuencoded)

  Below is the schematic diagram ( in an uuencoded gzipped
PostScript file.  This is the native Xcircuit[12] format and is used for
ease of viewing, printing and modification.

<++> ./

begin 644

<--> ./

|=[ EOF ]=---------------------------------------------------------------=|