All kinds of engineering. Creating and solving technical challenges. Electronics, RF, Linux, Embedded. Starlink hacking and fixing.
Space and Astronomy.
Success!
SpaceX Starlink is working in Kyiv, Ukraine!
The Dishy was placed just outside my window, even without adjustments.
Thanks,
@SpaceX
team, for your support :)
cc
@FedorovMykhailo
I connected the Starlink auth chip to my Raspberry Pi. And it's alive! I managed to build the vendor's library and run a few tests.
It's possible to read zones data and other stuff.
(Sorry for the blur)
Starlink Mini official specifications:
WiFi 5 (sorry!) 3 x 3 MU-MIMO.
1 Ethernet port with a rubber plug.
Power input: 12-48 V, up to 60W, Barrel
Jack.
USB-C to Barrel Jack Cable (sells separately).
1.10 kg (2.43 lb) without stand.
The kickstand and pipe adapter are included.
New
@Starlink
terminal is finally revealed! No motors, only simple stand.
No more proprietary usb-c like cables. Now we have a custom waterproof RJ45.
External PSU brick (as it was with rev1-rev2) + Gen3 router. Power consumption: 75 - 100 W
#starlink
#dishy
Starlink Mini teardown and quick overview.
Compactness and integration have their price. Terminal with the lowest repairability rating.
All new Catapult SoC with built-in secure core.
Single chip 8 Gb RAM.
2 digital beamformers.
GNSS receiver with external LNA and patch antenna.
My small home lab is slowly turning into a
#Starlink
repair shop.
I wish to back to my radio and hacking activity soon, but this is what is essential right now.
Welp, this took a lot of time, Patient, and heat. But I finally managed to disassemble the Starlink Dishy completely.
And here is PCB in all its glory.
Year of
@Starlink
in
#Ukraine
. Real stories from the community.
- More than 10000 terminals repaired (all services)
- Many modifications and adaptations have been developed (auto, power, GPS).
- Unique training materials and lectures.
- Unique auxiliary software was created.
My new Starlink REV4 decided to die after 5 minutes of uptime. Short circuit over the 12V bus.
Close inspection revealed a slightly cracked MLCC near one of the voltage regulators. After replacing everything is ok.
I guess this is the world's first repair of the rev4 Starlink.
Inside the new square Starlink terminal. BOM optimization is impressive.
The new digital beamformer ICs are 16 channels now (it was 8). The SoC is the same.
This is what's inside the new
#Starlink
router GEN3.
It's MediaTek again. MT8986 (Filogic 830) WiFi6 SoC.
And yes, I know what STM32 is doing here. But more on that later :)
The
#Starlink
Dishy firmware was successfully dumped and analyzed.
I wrote a small program to extract and decode all the data: bootloaders, calibration, Linux kernels, + initramfs.
The whole Dishy "OS" is in the initramfs image.
Curiously, some system scripts are dated 2014.
There's a bit of confusion regarding the names of
@Starlink
terminal models. SpaceX hasn't described this, so users have come up with their own versioning system, which doesn't match the internal revisions of the hardware.
I drew a diagram describing the existing models.
Engineering under shelling.
I managed to get the SpaceX Ethernet adapter (for square Dishy).
This is a simple device, and I had no choice but to do reverse engineering.
It helps to keep calm.
Status update on Kyiv where I am.
Yes, there are periodic rocket strikes with destruction ☹️
We have a lot of air raid sirens. Typically at 5 a.m. It's exhausting.
Yes, I continue my work and research projects with some caution and limitations.
This helps to stay calm and sane.
It looks like the
#Starlink
user terminal was initially prototyped (and probably still developed and debugged) on
#Xilinx
ZCU102.
This nice little board costs $3,234.00, and you can use it to build your own Starlink modem IP block 😀
I started receiving a lot of complaints. It turns out that field mice love to eat Starlink cables. They constantly have to be repaired and replaced.
So I came out with this solution. 11mm metal sleeve. Flexible and durable. Could also protect against splinters.
More
#Starlink
terminals for recovery! Delivered moments ago, directly from the war zone.
I'm slowly running out of space in my apartment.
It looks like I need to rent some office and open a
@SpaceX
Starlink service center 😀
Verification of the SFP+ DAC cable (it was labeled as "broken").
I found that many people in the industry don't know that the "DAC" cable is just a passive AC-coupled line with four wires and a simple I2C EEPROM for identification.
It is very handy for some non-standard apps :)
My new 1PPS/Square clock distribution amplifier, 1:8
1PPS propagation delay is 4 ns
10 MHz clock propagation delay is 10 ns.
Disbalance - less than 1 ns.
Details:
This world: Starship, reentry, plasma ball, splashdown (sure, it's impressive and amazing).
Also, this world: TU-95 bombers are en route for a 4 a.m. (today) missile strike to finish off our infrastructure.
It's incredible how it's all on the same planet and simultaneously.
Starlink Mini. Running without the built-in router. Direct Ethernet connection via EtherMod.
DC power from lab’s PSU.
I found something interesting, but more investigation is required.
It's unbelievable. So many people commented about the ping delay.
Everyone forgets that this is a Satellite channel with non-optimal conditions.
This is just a backup channel for me—nothing to complain about.
Cheap and fast fiber optics and LTE still work here.
@planet4589
Actually, my Dishy was here for a while. I brought it from the US a few months ago and used it for research and experiments.
Today I had a chance to confirm that the Starlink service is working in UA.
And yes, today we got a bunch of terminals delivered.
It was a coincidence :)
HP
#Starlink
terminal consumes up to 320W.
But how to implement 320W PoE? There are no standards and ready-to-use Ethernet magnetics.
Use capacitors and common-mode chokes!
I reverse-engineered the HP PoE injector and here is a simplified schematic.
An attempt to listen to the new SpaceX direct-to-cell satellite while passing over Kyiv.
T-Mobile frequency 1910 MHz.
Logic dictates that it should be geofenced, but I received this. Not sure what it is. LTE Band 33 is not used in Ukraine.
#Starlink
terminal from the frontline.
Dishy vs. 7.62 mm bullet - 0:1.
6 FEMs are gone, and 4 DBFs lost power due to a short circuit in the PCB. I had to cut damaged sections and remove DBF's VREG.
Now the CPU boots, but the boot process hangs due to problems with RFFE coms.
Here is what's inside the SWARM modem.
I was surprised to see the LORA transceiver. But apparently, they are using it as an FSK modem.
U-blox EVA8M is for GNSS. The application processor is STM32l562.
TX amp is AFT05MS004N (4W!)
Ever wondered what your
#Starlink
debug data mean? My new project is for you.
Space debugger reads JSON debug data and shows all the data in human-readable format, explaining some components and magic numbers.
The project is open and cross-platform:
Starlink Mini works excellently just on the car seat.
It has enough visibility through the panoramic roof and part of the windshield.
Powering directly from the car's 12V socket using a custom cable. No DC-DC converters.
Idle current: 1.9-2A
Active TX current: 2.9-3.1A
I skipped some Starlink firmware updates and found that my dumping method on my special Dishy is no longer working. It was due to some software changes.
A little hardware mod and one resistor after, and I'm dumping the latest-latest firmware. I’ll share if I find something new.
Adding missing Ethernet port to the Gen2
#Starlink
router.
The solution is based on my EtherMod design, but I had to rework it a little to use it in the router.
The link is stable at 1Gbps. No issues.
It was tricky to get this, considering where I am.
But I found a way (legal 🙂) to deliver the
@SwarmInternet
modem to Ukraine.
Let's see what I can do with this kit.
I decided to repack and port
#Starlink
#Dishy
firmware to a different hardware platform.
Development board combined with some secret ingredients from the Dishy PCB.
Sure, there is no modem or DBFs, but it's a convenient way to play with the system, debug binaries, and have fun.
This is how I'm testing my
#Starlink
Dishy here in
#Kyiv
.
The Dishy was disassembled for my research project.
I had to put everything back together, except stand and steering motors.
Now it's just hanging outside my window on an improvised mount. 150-200 Mbps downlink.
Packing Starlink Dishy into automotive case designed by UA Starlink community volunteers.
Weather proof. Four strong magnets to hold on the roof. Slope for water drainage. A compartment for an optional external GPS antenna.
#Starlink
user terminal transmission, single frame.
A clearly visible pilot tone that uses for doppler-shift correction, I guess.
Preamble duration is ~43 us.
I need to comment on this.
🇷🇺 are importing Starlink terminals from 3rd countries with huge overprice (I mean 5k-6k USD per Dishy). They are paying for the service via front persons and EU cards. Nothing special.
Starlink is not working in 🇷🇺, only on 🇺🇦 land (including occupied)
⚡️The 🇺🇦Ukrainian military reports that Starlink has begun to be delivered en masse to the 🇷🇺Russian military through Dubai, the accounts are activated and work in the occupied territories
A while ago, the marking of the Starlink Shiraz DBF chip was changed. They moved to a more ST-ish LM217013.
No, you will not find a datasheet for this amazing chip :)
Tonight's soundtrack in my lab.
Kalibr missiles are incoming. 15 TU bombers are in the air and ready to fire an unknown amount of Kh-type missiles. Earlier today, there were Kinzhal missiles.
Sadly, there is no way to deal with terrorists (sarcasm).
Starlink Dishy firmware 8cd5bb78-2b4d-46d4-95e0-a4cda85b39e0 introduced a new configuration option: dishInhibitGps
This option allows the terminal to skip GPS NMEA messages and use previously resolved coordinates. This is super useful if the GPS signal is unstable or untrustable.
Verification of the SFP+ DAC cable (it was labeled as "broken").
I found that many people in the industry don't know that the "DAC" cable is just a passive AC-coupled line with four wires and a simple I2C EEPROM for identification.
It is very handy for some non-standard apps :)
I just got the Starlink router (just a router, yet).
Very nice device. Really good design and build quality. It feels rock-solid.
Gonna crack this thing open later today. I would like to dig into the system.
Stumbled upon photos of another my old project (left in Crimea).
This is autonomous "cloud" or sky transparency sensor, plus some basic weather sensors. Wonder where it's now...
I loved (and still love) to build scientific or measurement equipment.
Challenging repair of the Round
@Starlink
Dishy.
Water damaged one of the voltage regulators. 12V bus shorted and vaporized IC pins and a top layer of the PCB down to the inner GND layer.
I used Kapton tape and copper foil to recover PCB layers. Works fine.
People keep asking me about my 1PPS/10MHz distribution amplifier. They want to purchase boards or complete hardware.
I have no idea how do this, but should I try to produce more samples of this? Perhaps with a more factory look.
Another overview of the HackRF SuperCluster.
Finally connected to my clock distribution board and GPSDO.
Clocks and sync pulses are verified. Everything is normal. Power is stable.
Now I have to work around the USB bandwidth problem. 😀 Have some ideas...
Today I found that group of quirky PhD students stole three articles from my blog to make simple (and poor) translations and "compile" 2 articles. Those stolen articles were published in a local science magazine as the author's work.
Should I apply to PhD with my blog? 😅
The new Starlink REV4 is finally available in Europe. Selling started in the following countries: Norway, Sweden, Czech Republic, Hungary, Finland, Romania and Denmark.
I decided to remove auth chip from the Starlink router board.
It's a small (2x3 mm) UFDFPN8 package so I decided to build an adapter for this chip. The reset circuit and bypass capacitor are also here.
I hope that chip is still alive 😀. Will try to read some data tomorrow.
One more water-damaged Starlink was repaired. There was a short circuit on the 12V bus and a missing voltage on the PoE DC/DC Vcc.
Interestingly, the only failed components were 4 capacitors and one resistor.
Repairing burned Gen2 Starlink router. It's a varistor and fuse again.
I'm always adding a thermosetting tube around the varistor. This helps to minimize shrapnel and protect surrounding components when the varistor is burned. It always happens with a bad AC generator.
Another quick repair of the Starlink terminal from the frontline.
The ethernet/Power connector was torn off along with PCB traces and ground plane. Plus, the gyroscope chip was lost.
I replaced everything with donor parts, so the Dishy is back in service.
It was Really hard to get. But I think this is the first and only one
#Starlink
kit in
#Ukraine
.
There is no official service yet, so let's do some hacking!
Starlink router Gen2. It was so hard to disassemble. The front glass panel is glued to the case. But I made it.
Let's run a 'clean' OpenWRT on this MediaTek device.
I'm happy to introduce a new version of the Space Debugger - the first and only offline Starlink debug data visualizer.
What's new in the v0.3:
- Add support for the current JSON format
- Display antenna alignment data
- Display Dishy config
- Minor fixes
It's great that more and more people doing Starlink repairs. I'm sharing as much info as possible (what's safe to share). Also, I'm providing some Starlink components for free for those who needs them.
This Starlink power supply goes to the front line to help repair broken router
Closer inspection of the square Starlink Dishy antenna array.
Active elements are inside PCB layers. There are polarizing slits on the top copper layer.
Coupled patches and circular polarizers are on separate films.
Plastic spacers help to create the required antenna bandwidth.
I'm slowly falling into GPS rabbit hole and bought this.
Spirent GSS6100 GPS signal generator. Now I need to do some engineering and write a beautiful software for this thing.
Teardown is later.
Running the Starlink router firmware on a QCA ipq4029 reference board. The original CPU is ipq4018.
I had to build a custom u-boot and kernel.
Firmware is booting from SPI NOR. Some of the data is still missing. I'm working on this.
The root console is without login/password.
Turning Starlink Dishy into a GPS receiver.
Need to send an additional configuration command to get the available satellites constellation.
GNSS chip is the Teseo-III family with a proprietary NMEA extension.
Quick repair of Starlink terminal from a war zone.
Damaged cable was repaired and sealed.
Bad motors were replaced with donor units. It's a typical problem of the terminal. Plastic gears are quickly dying in military use.
Everything was cleaned up, and Dishy is ready for service.