基于GnuRadio与Hack RF One的蓝牙信号解码问题求助

Hey there! Let's work through the issues you're facing with your Bluetooth signal decoding project. It sounds like you've got the basics in place (Hack RF capture + GNU Radio demod) but are hitting snags with getting clean frame views and reliable decoding after clock recovery. Here’s how to troubleshoot step by step:

1. Start with Clock Recovery Module Tuning #

Bluetooth uses GFSK modulation, and the clock recovery block (usually Clock Recovery MM in GNU Radio) is make-or-break here. If your signal looks messy post-recovery, double-check these settings:

• Omega: This should equal the number of samples per Bluetooth symbol. For classic Bluetooth (1Mbps symbol rate), if your Hack RF is sampling at 4MHz, set Omega to 4.0. If you’re using 8MHz sampling, use 8.0—always match your sample rate to the symbol rate’s integer multiple.
• Gain & Mu: Default values (0.01 for Gain, 0.5 for Mu) might be too aggressive for noisy signals. Try lowering Gain to 0.001 first to prevent clock oscillation, then tweak Mu if the timing is slightly off.

2. Validate Demodulation Before Clock Recovery #

Don’t jump straight to clock recovery—first confirm your GFSK demodulation is outputting a clean signal:

• Add a QT GUI Constellation Sink right after your GFSK Demod block. You should see two tight, distinct clusters (since GFSK is binary). If the clusters are blurry or overlapping, your RF front-end is the problem:
  • Adjust Hack RF gains: Avoid maxing out RF gain (it causes signal saturation). Start with RF gain = 25dB, IF gain = 5dB, BB gain = 20dB, then tweak incrementally.
  • Fix frequency alignment: Bluetooth uses 1MHz-spaced channels in the 2.4GHz ISM band. Use a Frequency Xlating FIR Filter to fine-tune for any frequency offset (you can estimate this with a QT GUI Frequency Sink first).

3. Ditch Manual Frame Hunting—Use Automatic Sync #

Searching binary files for Bluetooth frames manually is error-prone and inefficient. GNU Radio has built-in tools to handle frame sync automatically:

• Add a Correlate Access Code - Tag block to your flowgraph. For classic Bluetooth broadcast channels, use the access code 0x8E89BED6; for BLE, use the broadcast preamble 0xAA followed by the appropriate access code.
• This block will tag the start of valid Bluetooth frames. You can visualize these tags with a QT GUI Time Sink (enable tag display) or save tagged data to a file with File Sink—this gives you a clear, reliable view of where valid packets start.

4. Ensure Sample Rate & Decimation Are Correct #

Your sample rate must be an integer multiple of the Bluetooth symbol rate (1Mbps for classic/BLE 1Mbps, 2Mbps for BLE 2Mbps). Non-integer multiples make clock recovery unstable, leading to jittery, unreadable signals. If you’re using a higher sample rate (like 20MHz), use a Decimator block to bring it down to a clean multiple (e.g., 4MHz for 1Mbps symbols).

5. Test with a Known Signal Source #

If you’re still stuck, test with a predictable Bluetooth signal (like your phone’s Bluetooth broadcast or a dedicated beacon). Compare your GNU Radio output to a known good capture (use Wireshark with a regular Bluetooth adapter to grab the same packets). This will help you pinpoint whether the issue is in RF capture, demodulation, or clock recovery.

Hope these steps help you get that clean Bluetooth signal view and start decoding packets reliably!

内容的提问来源于stack exchange，提问作者Vick_59