Re: [Discuss-gnuradio] XM on GR

[Andy Walls]

>         The audio codec is proprietary and not documented anywhere AFAIK so
>         even if you demod the bitstream, you won't be able to do much with it.

> Thank you all for the conversation, it is pretty interesting.  That makes 
> sense 
> that they have a proprietary protocol, it's a shame though.  Is the text that 
> comes through encoded in a proprietary way?
> 
> Does anyone know what the frequency of channel 1 is on (I'd like to see if I 
> can even see the signal popping up above the noise)?
> 
> ~Jason

The XM center freqs are shown here:

https://www.rohde-schwarz.com/us/technologies/satellite-broadcast/xm-satellite/xm-satellite-technology/xm-satellite-technology_55613.html

The Sats are QPSK, the terrestrial is COFDM.

That page also states the audio codec for voice programming is AMBE, and
AAC+ for all other programming.


The XM radio patents give you a lot of clues:
https://www.google.com/search?tbo=p&tbm=pts&hl=en&q=inassignee:%22Xm+Satellite+Radio+Inc.%22

Images 4 and 6 of this one:
https://www.google.com/patents/US7020217?dq=inassignee:%22Xm+Satellite+Radio+Inc.%22&hl=en&sa=X&ved=0ahUKEwj5ycbeoP_LAhXEXh4KHWSdDeA4HhDoAQgwMAM
Image 4 of this one:
https://www.google.com/patents/US6510317?dq=inassignee:%22Xm+Satellite+Radio+Inc.%22&hl=en&sa=X&ved=0ahUKEwikn4Ogof_LAhVIJx4KHYaYCt44KBDoAQhTMAg

And maybe the most useful I've skimmed:
https://www.google.com/patents/US7123875?dq=inassignee:%22Xm+Satellite+Radio+Inc.%22+MCM&hl=en&sa=X&ved=0ahUKEwidqpT1of_LAhUFXh4KHXqIDuEQ6AEIKjAC
Images 1, 5, and 6.

This particular patent also indicates that after the demod, RS decoder,
viterbi decoder, and deinterleaver, that an MPEG TS *might* be the
transport multiplex.

The images show that the decryption happens after all the FEC and
deinterleaving is handled and also after SL (service layer) decoding.
The I2C connected external NVRAM is likely where the program decryption
key is stored (inside of a tamper boundary), according to other internet
pages from 7 years ago.

So I'm guessing you have to totally demodulate and decode one of the SAT
or terrestrial channels, and then dig around in a (hopefully MPEG)
transport stream to find your unencrypted "Channel 1"

Regards,
Andy