Decoding radio telemetry heard on news helicopter video footage with GNU Radio

Twitter user @d0tslash was watching news helicopter footage of the BLM protests on the 28th of May when he heard something that sounded like an RF telemetry feed in the background audio on the helicopter's video feed. Having seen this previous success at decoding similar helicopter telemetry, he contacted his friend proto17 who proceeded to reverse engineer and figure out how to decode the telemetry, in the end discovering that it was providing location data for the helicopter.

Over on GitHub proto17 has documented the complete process that he took in reverse engineering the telemetry . He first explored the audio in Baudline discovering that there was a 1200 Hz wide FSK signal. Next he used GNU Radio to further analyze the signal, discovering it's baud rate, resampling the signal and then using a GFSK block to demodulate the signal into 1's and 0's.

Finally he used some clever terminal tricks and a Python script to discover the bit pattern and convert the bits into ASCII characters which reveals the helicopter coordinates. The coordinates decoded indicate that the helicopter was indeed circling the protest area.

We looked into the news helicopters in use during the protests and found that Denver news stations all share one helicopter with registration N6UX. Plugging that into adsbexchange.com and looking at the helicopter ADS-B history on the 28th gives a good match to proto17's decoded data.