|Emission mode||FSK, 200 bd, 1000 Hz, ACF=288|
|Known counterpart stations|
F06a is a variant of the Russian intelligence broadcast system F06. While it mostly uses the same modem protocol, the encoded payload is completely different - it sends an ASCII text file. However, no plaintext has been encountered, only 5-digit and -letter groups. This variant is rare and has only been heard in unscheduled transmissions.
Instead of the normal encoding for 5-figure groups, the payload of F06a message blocks is raw binary. The recomposed message payload contains the binary contents of a file, preceded by a 20-byte binary metadata header and followed by some padding.
|File size||File name||CRC||File contents||End of file||Padding|
|Hexadecimal||00000621||00 00 30 30 32 32 35 33 2e 54 4c 47||c2452b33||31 31 31 30 30 20 31 30 30 39 37 20 33 36 39 38 37... 33 32 31 37 39||00||99 99 99 99 99 99 99 99 99 99|
|Decode||1569||002253.TLG||11100 10097 36987... 32179|
|32-bit byte count of file contents||12-byte ASCII string, 8.3 short file name padded on the left with NUL characters||32-bit CRC of file contents||Variable-length, raw binary file contents||0x00-byte marker||Variable number of 0x99 padding bytes|
In practice, the first 10 bits of the file size field are always 0000000000, whereas 5-figure group messages always use 0001101111, which allows to detect and identify this payload type. The CRC algorithm seems to be the bitwise NOT of the standard CRC-32.
Although this payload structure seems able to carry any kind of file, in reports so far all files transmitted contained 8-bit ASCII text with 5-figure/letter group encrypted contents like in typical Russian intelligence cryptograms. For example:
11100 10097 36987 15002 02533 89993 42710 53704 65567 33602 63598 18747 25742 68953 11062 01317 23342 73178 75721 54292 96655 82229 34867 26791 79634 82642 80040 45836 28941 40511 30651 28182 01869 84855 19571 52020 33582 87572 61625 43224 87111 07154 40950 55834 74542 [20 lines skipped...] 26225 98404 91176 79583 95169 19865 97310 80099 25382 01179 15578 32179
Like normal F06 messages, they start with a 5-group header. It uses message type 11100, possibly because the transmissions are unscheduled. 5-figure group messages don't include a serial number, group count postamble. The messages appear to be always one group shorter than the group count in the header.
The layout of the text is always the same. Groups are separated by single space characters. The 5-group header is on its own on the first line, and followed by an empty line before the body of the message, formatted with 10 groups on each line. The line breaks used have mostly been CRLF. The file ends with no end-of-line character at the end of the last line.
File names follow the 8.3 format. Names longer than eight characters are truncated down to the first six, with the rest replaced with ~1; this is how the Windows operating systems represent long file names to old MS-DOS programs.
File names of 5-digit group messages follow a 6-digit structure exhibiting the serial number and group count of the message inside, and use the TLG type extension, which could stand for telegram.
|Serial number||Group count||File type extension,
File names of 5-letter group messages begin with the link ID and a hyphen, and use the TXT file extension. However, it is always truncated, so all of its elements are unknown.
|Link ID||Truncated portion||File type extension,