RunboData UHF transmitter

From Randomdata wiki
Revision as of 20:04, 4 June 2013 by Ardillo (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search



Started: April 3 2013
Goal: To use the UHF transmitter on the Runbo-X5 Android phone as a SDR
Who: Ardillo
Active task: Getting root rights on device


The Runbo X5 Android smartphone is a normal Android 4.0 phone with some strange features. The most important for users is that it is an IP-67 graded device which means it can be submersed in water and you can drive over it. It also has a built-in laser and Walkie Talkie. Wait.. a what? A Walkie Talkie, it works on the UHF band between 400-470 MHz. After reading this feature I was curious about the possibility's. Maybe we can use this to hack some KlikAanKlikUit systems or build a SDR-system with it. The Runbo has WiFi, Bluetooth and some other standard things as well.


I followed this guide for unrooting the device. For rooting the device I first had to get adb working. Luckily nowadays Android gives you an ADT bundle for Linux. After unzipping the adb package is at the extract location in map Android/sdk/platform-tools. For listing all devices connected you have to execute command:

 ./adb devices </blockquote>

But instead of listing the devices I saw question marks. After so somehow the device wasn't recognized. I made an file /etc/udev/rules.d/50-android.rules en put the information below in it. I found the Vendor ID after running 'dmesg'.

SUBSYSTEM=="usb", ATTRS{idVendor}=="0bb4", MODE="0666", GROUP="plugdev" 

After that the device was recognized as 'Runbo' with the './adb devices' command.

RDA1846 chip

The Runbo has an RDA1846 radio chip for the walkie talkie function. Last weekend I got a mail from 'Q' - division... yes really.
He gave me some datasheets belonging to the specific radiochip (look below for the links).
After some communication he gave me the tip that the RDA1846's digital interface only allow settings not data. So SDR maybe technical impossible.
In the datasheets is some information about the receive/transmit characteristics. The hardware should be capable receiving and transmitting in three regions, 134-174 MHz; 200-260 MHz; 400-520 MHz. But the software only allows the last one. This could be some point of investigation :)

Android app

For controlling the radio, the Runbo comes with an Android app called 'intercom' this app can be used for transmitting and receiving voice signals over the radiochip.
With the help of 'Q' I saw the source code of the app which seems only a wrapper for the JNI library's. As of the increasing popularity of the Runbo smartphone more people are interested in the use of the radiochip. So I found these two sites:

Especially the first (french) one is interesting, which confirms the idea of a wrapper function of the classes found.





Backup Program