PSX GPS Interference

[Jamie]

Since PSX v10.186, Hardy has added native GPS spoofing and jamming simulation.

I made a small external add-on that automatically activates these PSX GPS interference scenarios based on the aircraft's geographical position.

Download (.EXE + Python 3.9+ source):
psx_gps_interference.zip



*NEW* GPS Interference Zone Editor:
https://jamiejets.com/psx/gps-interference/



GitHub:
https://github.com/JamieJanssen/psx_gps_interference

---

The program connects to PSX, continuously monitors the aircraft position, checks whether the aircraft is inside one of the configured interference zones, and automatically activates the corresponding GPS jamming and/or spoofing scenario.

It also supports overlapping zones. When multiple zones overlap, the most relevant zone is selected based on:

Active/Intermittent priority
Distance to the zone centre
Database order

Each zone can define:

Spoofing zone centre
Minimum spoofing radius
Randomized radius addition
Jamming reception zone
Spoofed position
Spoofed altitude
GPS time error

The zone definition itself is simply the PSX Qs572 string as described by Hardy:

https://aerowinx.com/board/index.php/topic,7997.0.html

Example:

Code Select Expand

BLACKSEA_01|JAM|Black Sea west GPS jamming|Pt0.754278;0.540471;0;0;150;0.872665;0.698132;80;-60;

Latitude and longitude values are stored in radians, exactly as used by PSX. No conversion is performed by the application.

The zone database is just a plain text file, making it easy to add, modify or share interference areas.

You can monitor all GPS interference effects on the POS REF 3/4 page.

The current database contains 22 predefined GPS interference zones.

Optional transition area

For jamming-only scenarios I added an optional transition area to simulate intermittent GPS reception before entering the fully affected area.

By default this transition area covers the outer 10% of the jamming radius. For example, with a 200 NM jamming area, intermittent reception occurs between 180 and 200 NM from the centre.

A configurable 5-second minimum state time prevents rapid switching when flying close to the boundary.

This behaviour can be adjusted in the .ini file.

I may remove this feature later, as I recently realised that similar behaviour can probably be achieved using PSX's randomized radius addition. I still need to experiment with that.

NOTE:
I am considering randomly failing one or both GPS receivers after passing through a GPS jamming/spoofing area, as this is a fairly common real-world effect on the Boeing 777.

Are there any B747-400 pilots here who can comment on whether the same behaviour exists on the 747?

On the 777, Boeing advises against resetting failed GPS receivers in flight, so one or both receivers may remain unavailable for the remainder of the flight. I'm curious whether the B744 has similar operational guidance.

[Hardy Heinlin]

I am thinking about randomly failing one or both GPS receivers after passing through a GPS jamming/spoofing area ...

PSX will not immediately clear the position errors when the aircraft exits the spoofing zone. The drift distance will decrease to zero at the same rate it increased to the spoofed-to target value. When you are flying in a spoofing zone for 1 hour, the GPS position will drift very far away; when you exit the zone, it will again take 1 hour until the GPS position arrives at the correct position. During this process the status line indicates "Out of zones, but position error is not reset".


|-|ardy

[Mawea]

I am thinking about randomly failing one or both GPS receivers after passing through a GPS jamming/spoofing area, as this is very common on the B777.

Hi Jamie,

that would be good and thank you for your effort! I can confirm that this would be realistic behavior also for the 747. One or both GPS quit, with a time delay and depending on intensity.
A good source is https://gpswise.aero/map for real time jamming and spoofing. The limitation is that it is based on ADS-B data in real time, therefore it might not show RFI areas when no planes are present. Free version lags a day, payed one is real time.

Brgds Jan

[Hardy Heinlin]

When spoofing to a false position, wouldn't it be more realistic to always spoof the time as well? Or can the spoofers separate the time data from the position data?

During jamming, as long as your onboard clocks are running well, you won't notice any time errors in the avionics anyway. But – for systems integration training – you may learn that the time source indication on the POS INIT page in line 5 will change from "(GPS)" to "(MAN)".


|-|ardy

[Mawea]

Exactly! I'd actually go further and say time is always spoofed when position is spoofed, not just optionally. GPS position calculation is fundamentally built on timestamp manipulation, so the two can't really be separated. The time delta might be nanoseconds or it could be minutes or more but it's always there. Some sophisticated spoofers are getting better at minimizing the time offset to make it harder to detect, but they can't eliminate it entirely.

The jamming point is a good distinction though, jamming just blocks the signal, so your onboard clocks keep running fine. Spoofing is different: you're actively feeding the receiver fake signals, which means fake timestamps, which means the clock gets quietly pulled along with the false position.

[Ton van Bochove]

Works perfectly Jamie! On the moment I am outside of Baku and the aircraft is being jammed!

[Jamie]

Hi Jamie,

that would be good and thank you for your effort! I can confirm that this would be realistic behavior also for the 747. One or both GPS quit, with a time delay and depending on intensity.
A good source is https://gpswise.aero/map for real time jamming and spoofing. The limitation is that it is based on ADS-B data in real time, therefore it might not show RFI areas when no planes are present. Free version lags a day, payed one is real time.

Brgds Jan

Sorry for not replying to this! I forgot to enable Alerts :-)

Thanks I'm thinking about implementing this. There are several articles on the net describing what occurs, like the GPS Almanac gets corrupted etc.

Thanks again for confirming!

Edit: I made a website to be able to edit the Zones file that comes with my little tool.

https://jamiejets.com/psx/gps-interference/

[Jamie]

A g,ood source is https://gpswise.aero/map for real time jamming and spoofing.

It is, but here is a big difference between map shifts as we see in the cockpit or flightradar24 data being all over the place. In other words: the 'spoofing' area's defined in/for PSX are not the same as here on this website. Erratic data being sent by the ADSB transponder to FR24, but not per se map shifts in the cockpit.
My experience is in 99% of the cases the GPS cuts-out, no map shift, maybe the clock that shifts a few hours at max. I have seen that only a few times.

So to spoofing you see on a map here is not the same as the spoofing we see in the cockpit and that is what is simulated in PSX. Therefore you see only a few well-known spoofs where (I personally have seen) map shifts or GPWS terrain shifts occur.

Big difference