priyom.org

F06a

Enigma ID n/a

Name F06a
Frequencies
Status Active
Voice N/A
Emission mode FSK, 200 bd, 1000 Hz, ACF=288
Location Moscow, Russia
Activity pages

Download audio sample

Known counterpart stations

F06a is a variant of the Russian intelligence broadcast system F06. While it mostly uses the same modem protocol, the encoded payload is completely different - it sends an ASCII text file. However, no plaintext has been encountered, only 5-digit and -letter groups. This variant is rare and has only been heard in unscheduled transmissions.

Payload structure

Instead of the normal encoding for 5-figure groups, the payload of F06a message blocks is raw binary. The recomposed message payload contains the binary contents of a file, preceded by a 20-byte binary metadata header and followed by some padding.

  File size File name CRC File contents End of file Padding
Hexadecimal 00000621 00 00 30 30 32 32 35 33 2e 54 4c 47 c2452b33 31 31 31 30 30 20 31 30 30 39 37 20 33 36 39 38 37... 33 32 31 37 39 00 99 99 99 99 99 99 99 99 99 99
Decode 1569 002253.TLG   11100 10097 36987... 32179    
  32-bit byte count of file contents 12-byte ASCII string, 8.3 short file name padded on the left with NUL characters 32-bit CRC of file contents Variable-length, raw binary file contents 0x00-byte marker Variable number of 0x99 padding bytes

In practice, the first 10 bits of the file size field are always 0000000000, whereas 5-figure group messages always use 0001101111, which allows to detect and identify this payload type. The CRC algorithm seems to be the bitwise NOT of the standard CRC-32.

File contents

Although this payload structure seems able to carry any kind of file, in reports so far all files transmitted contained 8-bit ASCII text with 5-figure/letter group encrypted contents like in typical Russian intelligence cryptograms. For example:

11100 10097 36987 15002 02533

89993 42710 53704 65567 33602 63598 18747 25742 68953 11062
01317 23342 73178 75721 54292 96655 82229 34867 26791 79634
82642 80040 45836 28941 40511 30651 28182 01869 84855 19571
52020 33582 87572 61625 43224 87111 07154 40950 55834 74542
[20 lines skipped...]
26225 98404 91176 79583 95169 19865 97310 80099 25382 01179
15578 32179

Like normal F06 messages, they start with a 5-group header. It uses message type 11100, possibly because the transmissions are unscheduled. 5-figure group messages don't include a serial number, group count postamble. The messages appear to be always one group shorter than the group count in the header.

The layout of the text is always the same. Groups are separated by single space characters. The 5-group header is on its own on the first line, and followed by an empty line before the body of the message, formatted with 10 groups on each line. The line breaks used have mostly been CRLF. The file ends with no end-of-line character at the end of the last line.

File names follow the 8.3 format. Names longer than eight characters are truncated down to the first six, with the rest replaced with ~1; this is how the Windows operating systems represent long file names to old MS-DOS programs. Most file names, with very few exceptions, follow a 6-digit structure exhibiting the serial number and group count of the message inside, and use the TLG type extension, which could stand for telegram.

002253.TLG
002 253 TLG
Serial number Group count File type extension,
always TLG
Your browser is out-of-date!

Update your browser to view this website correctly. Update my browser now

×