Hacking the GSM codecs to pass FSK data through
an experiment by sv3ora
experiment has been completed by me on 12 November 2019. I did this
experiment without any searching on the web or any know-how of the
networks. It was all try and see...
For my CB2 micro,
I wanted to investigate the possibility of making a modem that would
make possible for two such micros to communicate through the users
mobile phones. In the beginning I thought this would be straight
forward. However after forums discussions I realized that the GSM
codecs use aggressive schemes, optimized only for human voice, which
would make baseband FSK audio data impossible to pass through.
To test this in practice, I setup a PC with MixW and set it for
packet radio. MixW modem, allows the standard rates and mark/space
frequencies, but it also allows defining custom rates and mark/space
frequencies. So I could play around with these settings and connect the
audio from the hands-free jack of a smartphone to the PC. The other
party is a landline for the time being, testing initially if any tones
will be heard or not.
I believe that if it works for me, will work on every country, since I
guess the cellphone networks are compatible. (eg. if I visit another
country roaming works).
Initial questions for Bell 202 (1200 baud half duplex) are:
Can you pass a single continuous tone of 1200Hz through GSM?
Can you pass a single continuous tone of 2200Hz through GSM?
Can you pass alternatively switched 1200/2200 tones in low speed through GSM?
Can you switch these tones more frequently and how much more?
I am not limited to Bell 202, but let's start from somewhere.
I did an initial test. I connected a smart phone from it's hands free
port to the PC mic and phones. Then I called the smart phone from a
land line at home.
It could not even send 110 baud through. It started sending them ok but
after 1-3 seconds they were suppressed. Continuously changing the AF
volume of the sender PC to 0% and then back to a certain percentage,
tricked the codec somehow to restart the ceased transmission tones.
Sending just low rate pulses of a single tone (like morse code) passed ok.
But not FSK at 110, 300 or 1200baud, they all seemed to have this
problem I mentioned, after a few seconds the FSK audio ceased by the
Also when sending the above pulses and tried at the same time to
send FSK, again everything was ceased at the channel
and nothing heard at the other end, even if my sound card was output
I have also tried SSTV and the result was that audio was ceased after a while, but after more time, compared to the FSK case.
Now, I did not know if the previous test failure was due to the mobile phone codecs or the
landline phone codecs. So this time I tried it with just two mobile phones. I
connected a smart phone from it's hands free
port to the PC mic and phones. Then I called another mobile phone
placed at my ear to see if I could hear the tones. I tested the above
scenarios and the results were the same.
I had to do something to trick the GSM codecs to "think" that ordinary
voice is present on the channel and not FSK data, which would be
compressed. Finally I managed to do it by passing on the channel, along
with the FSK data tones, DTMF tones! In fact only one continuous DTMF
tone is needed along with the FSK data, which makes the generator
hardware pretty easy, just two oscillators! This tricks the GSM codecs
to think that voice or just DTMF tones are passing through, whereas FSK
tones are passed too. In other words FSK data is not compressed any
I have tested it with the DTMF number 2, but there are other more
suitable tones which are more far apart to the 1200Hz/2200Hz of the
FSK, so that filtering can become easier later on. To test this
yourself, I have created a zip file which
contains two audio wav recordings. One of them is random FSK data at
1200 baud following the Bell202 tones protocol. The other is a single
continuous DTMF tone, the number 2. Set up your audio player so it can
open multiple instances and play these files at the same time, at about
the same audio volume. If you do not have an audio jack connection from
your phone to the PC, you could try acoustically coupling the phone to
the PC, although I have not tested this. If you can hear the FSK data
uninterrupted on the other phone, then it works for you. Note that I
have deliberately introduced a few short pauses in the original FSK
audio data, as an indication of which part is played, without looking
at the screen.
This experiment, proves that 1200 baud FSK data can be transferred
through the mobile phone network, provided that the GSM codecs are
manipulated accordingly so that they do not compress the FSK tones.
Although I have not yet tried to retrieve and decode the FSK data
stream, the audio of the received stream sounds like the original.
Back to main