Tim Allen

Hardware & Software Reverse Engineer — embedded systems, firmware extraction, FPGA, bare metal

RTL SDR

These were originally marketed as DTV-T (Analogue TV) receivers. They use direct-conversion (not to be confused with direct sampling—which uses very high speed ADCs) so no IF, they convert all the way down to base band (0-IF).

Board Top

This ia a zero‑IF (direct‑conversion) tuner, so it hands the RTL2832U complex baseband as two differential pairs — I+/I− and Q+/Q− — which land on the RTL2832U's two ADC inputs. Riding alongside them are the I²C control bus (the RTL configures the tuner through its built‑in I²C repeater).

The digital I/Q samples only exist after the ADCs, inside the RTL, and leave over USB. I've left the (I±/Q±/SDA/SCL) vague as some run as inner-layer/under-chip routing.

Block Diagram

Inside the E4000 you have the full zero-IF quadrature path: LNA → a split into the I and Q mixers, both driven by the on‑chip PLL/VCO synth through a 0°/90° splitter → LPF + PGA on each branch → differential analog I/Q out.
Inside the RTL2832U: two 8‑bit ADCs (I and Q) → DDC/DSP (NCO · LP filter · ↓N decimate) → USB 2.0 FIFO/SIE → host. The green/amber lines back to the tuner are the reference clock and I²C control.

GNUradio

I threw this tegether using GNUradio, it's just a narrowFM receiver tuned to a frequency in the 70cm HAM band.

HT

A couple of basic HTs (walkie-talkie).