ENIGMA 2000 Newsletter - Issue 23

July 2004
Articles, newsreports and Items of interest :enigma2000-owner@yahoogroups.com

ENIGMA 2000 article - XPA, previously UNID Polytone

This time we bring you analysis of XPA as promised last time:

XPA, previously UNID Polytone

On Wednesday 3^rd December, 2003 RNGB noticed a strong carrier on 6913kHz. Having waited there he was rewarded with a polytone like signal at 1750z, the sending lasted for two to three minutes.

A similar finding was made by RN GB on 8192kHz at 1710z on Friday 5^th December, 2003 at 1710z and again at 1750z on 6913kHz. RN reported that the transmissions were ‘of the same structure but were not the same.’

RN GB again heard the transmission weakly on Monday 8^th December, 2003 at 1710z on 8192kHz and again on 6193kHz at 1750z. That sending was much stronger and a recording of it was sent to ENIGMA 2000 for further analysis.

RN GB noted that the messages came in blocks of 64.

RN GB also carried out some analysis of the tones used and formed the basis for an exact measurement and analysis of this unknown.

Tones:

The following tones were noticed during frequency analysis using ‘Cool Edit’. [Errors expected].
471, 515, 520, 592, 654, 672, 708, 711, 755, 796, 839, 881, 922, 960, 988, 1000, 1010, 1015, 1020, 1045, 1060, 1086, 1110, 1145Hz.

Following RN GB’s example numerical/functional values were applied to the audio frequencies seen:

471	515	520	592	633	654	672	708	711	755	796	839	881	922	963	988	1000	1010	1020	1045	1060	1086	1110	1126	1145	Hz.
St L			sp	EndL		0		1	2	3	4	5	6	7		8			9			Rpt	EndL	St H

Structure of message submitted:

The transmission commenced with two tones toggling for 59s. The low tone was 471Hz and had a duration of 0.0482s whilst the high tone 1145Hz, each lasting 1.615s. The signal commenced with the high tone.

At the end of the slow tones a pulse train of 16 high and 16 low tones were sent alternately for 1.597s, the high 1015Hz tone leading in, followed by a 515Hz tone. Each tone was 0.054 long.

That led into a seven character pulse sequence starting on the high tone, finishing on the low:

Start of XPA

		h	l	h	l	h	l	h
frequency:	922	755	922	755	922	755	922
duration:	0.258	0.99	0.102	0.054	0.054	0.054	0.054
		6	2	6	2	6	2	6

The sending lasted 0.654s

A complicated tone structure followed; a series of synchronised two high and two low tones were sent for 2.097s. The high tones are designated h1 and h0, the lows, l1 and 10. This sending lasted 2.097s.

The sending commenced with h0/l1 and ended with h1/l0.

h1 1020, h0 988, l1 708, l0 590Hz.

Then an eighteen tone sequence followed starting on the low tone of 515 and toggling to 1015Hz, the repeat command for this series, ran for 1.631s in total.

That led directly to the same seven tone sequence outlined above via a 922Hz tone:

h	l	h	l	h	l	h
frequency:	922	755	922	755	922	755	922
duration:	0.258	0.99	0.102	0.054	0.054	0.054	0.054

Again for 0.654s.

On completion of the seven tone sequence another pulse train started on the high tone of 1110 and toggled ten times to 1086Hz, dropping at the last low tone after 1.000s.

For 0.500s a 592Hz tone led into the message proper:

In the message each pulse was measured as lasting just 0.046s.

The first ten groups of five characters plus the space tone read:

01]	672	796	755	672	1044	592
	0	3	2	0	9	Space	[Possibly decode key]

02]	671	1110	754	967	1049	592
	0	0	2	7	9	Space	[Possibly group count; see later]
03]	796	754	881	964	1042	592
	3	2	5	7	9	Space

04]	962	838	923	673	1000	592
	7	4	6	0	8	Space

05]	881	1114	796	712	839	592
	5	5	3	1	4	Space

06]	959	839	753	882	753	592
	7	4	2	5	2	Space

07]	1000	755	1110	1003	921	592
	8	2	2	8	6	Space

08]	714	922	796	753	960	592
	1	6	3	2	7	Space

09]	839	1110	1042	963	1043	592
	4	4	9	7	9	Space

10]	1002	961	753	1112	796	592
	8	7	2	8	3	Space

The accurately measured time to send these ten message groups was 3.003s; therefore a mean time to send one group is 300.3ms. [Measurement made by Cool Edit].

03209 00279 32579 74608 55314 74252 82286 16327 44979 87283

RNGB discovered that the message blocks consisted of 64 groups, within the entire message sending he also saw that four block of 64 plus 25 separate five character groups had been sent.

In other polytone systems the first two groups are the decode key [dk] and the group count [gc].

This was not missed by RN GB; 64 x4 + 25 = 281 – 2 [the dk/gc grps] = 279.

That is the actual number of groups sent [and certainly as expected by other polytone ‘rules’].

Rest of groups for two messages follow. An audit on the ‘space’ tone, 592Hz confirmed that for each group to be sent, 5+1 took just 0.3seconds. From Group 11:

30549 80119 22813 61903 49837 22723 22075 86352 35851 52863
93692 65534 55137 49033 45541 56729 38339 32264 19174 90948
43392 84899 51713 42676 71481 52830 06156 47454 20349 55234
61440 13338 42545 89839 03223 80933 98955 63255 44423 25741
26588 07759 13196 27830 62349 33139 76358 99550 38018 24557
53891 46293 08218

[Seven tone group nnn in Hz, x.xxxs in seconds]:

923	0.240s	754	0.099s	921	0.096s	754	0.053s	921	0.044s	754	0.053s	921	0.044s,
6		2		6		2		6		2		6

[from grp 65]:

32663 42097 21616 51747 72201 61989 07136 00039 02609 85942
58233 54193 44377 97273 76201 05110 83434 30582 31569 55293
35393 30188 34655 06025 75562 30715 30550 40685 97175 43488
33117 93431 37926 41667 70295 04745 90426 92151 73367 12974
55441 37123 50468 06547 08118 81469 51598 51320 71597 05868
87038 36367 65331 64435 85913 69551 55139 43712 29986 72514
50280 56842 35998

6 2 6 2 6 2 6

64191 55635 70366 16879 12992 88439 36797 93211 37526 07168

This sequence of seven tones then 64 grps continues twice more for a total of 256 groups, followed by the identical seven tones then 25 grps.

On the 24^th group 55003 the space tone, 592Hz had a duration of 100ms instead of the usual 50ms. The last group is 71566. The last figure is a repeat of the preceding 922Hz tone and in this case must be the repeat tone 1112Hz. This runs nicely into the 10 low and 10 high tones that close the message transmission.

Lasting 1.011s the tones toggle between 631 and 1126Hz.

Whilst the message body has been reasonably understood and numerical values or function applied to the tones the other tonal functions are unknown.

The initial sequence was compared with another sample received from JoA, on his sample the long/short 1145/471Hz tones ran for 1minute, but the ‘construction’ of the message appeared the same as that supplied by RN GB. The purpose of this signal is fairly obvious and wakes the receiving apparatus readying it for the automatic reception of its signal.

Then the signal changes to a 16h/16l tones, 1015/515Hz. There then follows seven alternate pulses, 922/755Hz with variation on length. This type of signal is seen at the end of the intro [maybe ‘administration’] sequence before the message proper starts. It also appears after each 64^th group although the times are different, it still makes 6 2 6 2 6 2 6. Perhaps this triggers a part of the receiving/recording/synchronisation apparatus?

After the seven tones a 838Hz tone is sent for 1s this the followed by the same seven tone sequence, obviously switching something, then follows a complicated 4 tone sequence as h1 1020, h0 988, l1 708, l0 590Hz.

The top lines h1/h0 are and sent in three groups of three hl/h0.

The bottom lines L1/L0 are sent in 3L1 then two L0/L1 the res varying in length – apparently. Those must perform a special task, perhaps the recognition of a signal or the type of decode method used or perhaps authentication. Either way it is a complicated pulse train.

Then an eighteen tone sequence followed starting on the low tone of 515 and toggling to 1110Hz, the repeat command for this series, ran for 1.631s in total as mentioned at the beginning. These lead into another seven tones 6262626 separated by a long 840Hz tone of 1.023s duration, then the same seven tone 6262626 sequence which leads on to a high tone toggle sequence.

The tones are 1110 and 1080Hz, each of 0.050s duration. Ten of each tones are sent over a period of 1s.

Immediately the tones are complete a space tone, 592Hz, is sent for 500ms. After that the messages proper are sent. Each block of 64 groups separated by the seven tone 6262626 sequence.

XPA 64grp separator

At the end of the message 10 low and 10 high tones close the message transmission.

Lasting 1.011s the tones toggle between 631 and 1126Hz.

The carrier then drops.

XPA End of message
XPA EOM

Based on ‘n’ events in one second, then the Baud rate for the message section appears to be 20Bd [Definition taken from Macmillan Reference Books, Dictionary of Information Technology 2^nd ed. Page31 and, Newnes Data Communications Pocket Book Page 141]. However there is variation within the message structure.

20Bd.
20 bd

Further interceptions were made of this signal by JoA and PLondon as well as RN GB.

However, the original intercepted signal was in AM, the later ones were only audible with USB selected.

With this change of mode an offset of frequency was noticed on the tones. Nonetheless using the ‘space’ tone [592Hz] as the basis the offset was easily calculated by simple subtraction and appeared to be a constant across the message to which it was applied.

With PLondon and RN GB intercepting the signals they independently ‘decoded’ the tones and agreed on the dk/gc for at least two sendings:

8192kHz	1710z	18/12/03	[01889/00303]
6912kHz	1750z	18/12/03	[01889/00303]

The probability of these signals being involved with automated collection at the receiving end prompts us to make the designation XPA

~~Sample spectrograms of XPA can be seen in Group files in support of this analysis.~~

Already included in the present document.

E2k thanks RNGB, JoA, PLondon, AnonUK and those who assisted with the derivation of this analysis.