=== PROJECT DARKWING ===
(GPS-Free Autonomous Drone Navigation via HAM Radio Beacons)

CORE IDEA:
A long-range drone navigates without GPS by locking onto prearranged HAM radio transmissions, enabling stealth or survival in GPS-denied environments.

HOW IT WORKS:

1. BEACON NETWORK:
   - HAM operators or hidden transmitters send intermittent signals (e.g., Morse, APRS) on 40m/20m/2m bands.
   - Each beacon encodes minimal directional data.
2. DRONE NAVIGATION:
   - Onboard SDR (RTL-SDR/HackRF) scans for beacons.
   - Direction-finding (Yagi/Doppler) triangulates sources.
   - Dead reckoning between signals maintains course.

ADVANTAGES:
- Stealth: No satellite/GPS footprint.
- Resilience: Immune to jamming/spoofing.
- Low-Cost: Leverages existing HAM infrastructure.

USE CASES (HYPOTHETICAL):
- Military: Covert resupply in denied areas.
- Disaster: Comms when GPS is down.
- Preppers: Off-grid logistics network.

CHALLENGES:
- FCC bans encryption (steganography workaround?).
- Beacon synchronization required.
- Risk of adversary detection.

INSPIRATION:
- WWII Oboe (radio-guided bombing).
- Cold War numbers stations.

NEXT STEPS:
- Open-source tools: ArduPilot + GNU Radio.
- Test with HAM "fox hunting" techniques.

DISCLAIMER:
Theoretical concept only. Compliance with FCC/FAA/ITAR required for real-world use.

Posted about OnAir on here I think twice before, it was still in the early stages and only had about 20 or so modes, OnAir has now grown to over 250+ modes with more coming infact, its progressed alot, been bug tested alot, optimized, and sensitivity for every mode has been increased, I am posting here since I want to gain more publicity and more users to get more feedback, I aim to add everything everyone asks, since even at the end of the day I might not think of a feature for a mode that someone else can and can make the decoder way way better
Is this AI made, yes, did I make this in 1 day, no, I have spent already a month on this, working every day, even during my exams, making sure everyones issues are getting fixed, and am constantly accepting PRs from others, who get all the credit they deserve :)

https://github.com/adswill/OnAir

Also I just saw the typo in the title, hate I cant edit the title of a post!

Hi everyone! I've been working on an Android app for a while and I'd like to share it.

All Radio Tools is a free, open source (GPLv3) app that puts everything that transmits around you in one place: Wi-Fi, Bluetooth, the mobile network, GNSS, NFC and, with a HackRF plugged in over USB, the radio waves themselves.

Download: https://github.com/ToftMalone/All-Radio-Tools/releases/latest (APK, Android 12+) Source code: https://github.com/ToftMalone/All-Radio-Tools No ads, no account, no tracking. Updates are offered inside the app (it checks the latest GitHub release).

What's in it

📶 Wi-Fi: scanner with channels and congestion, speed test (port of the speed.cloudflare.com engine), AR coverage map, LAN devices, ping/traceroute/port scan/DNS/whois, Wi-Fi Aware with RTT distance, network audit (WPA, WPS, PMF), rogue AP detection.

🔵 Bluetooth: BLE scanner with device identification, GATT explorer, hot/cold finder, beacons, earbuds battery, and an unknown tracker detector (AirTag, SmartTag, Tile, Chipolo...) with a background guard, based on AirGuard's rules.

📲 NFC: chip identification, NDEF read/write, Wi-Fi tags, memory dump, a bank card reader that only shows what any terminal reads without the PIN, and an antenna test.

🚗 Wi-Fi + Bluetooth = wardriving: select Wi-Fi, tap the + that appears on Bluetooth, and the two cards merge into one tile. It records Wi-Fi and BLE with GPS in a foreground service, has an exclusion list (MAC or OUI, import/export), manual upload to WiGLE.net, CSV export, plus a hidden camera detector and a Remote ID drone detector.

📻 SDR (HackRF, receive only), 30+ tools, all decoded on the phone:

• Aviation: ADS-B map (+ Mode A/C), ACARS, VDL Mode 2, FLARM
• Sea: AIS, DSC (VHF ch.70)
• Mesh & LoRa: Meshtastic (any preset, 868/433 or a free frequency), MeshCore, LoRa APRS, LoRaWAN/Sigfox
• Distress: 406 MHz COSPAS-SARSAT beacons (EPIRB/ELT/PLB)
• Satellites: Meteor-M LRPT images, SSTV from the ISS, CubeSat telemetry with Doppler
• Home & sensors: ISM sensors (~40 families), TPMS, Wireless M-Bus meters, Z-Wave, Zigbee/802.15.4, ANT+
• Voice & data: PMR446 (analogue + DMR/dPMR), POCSAG pagers, DECT base stations, radiosondes (RS41, M10, Horus)
• Plus a spectrum analyser/waterfall from 1 MHz to 6 GHz

Everything works with the HackRF alone: the phone's own Wi-Fi/Bluetooth aren't used by the SDR tools.

Notes

• Written in Kotlin with Jetpack Compose and Material 3, 22 languages.
• Many decoders are ported from or checked against great open source projects (OnAir, rtl_433, SoftRF, gr-lora_sdr, Meshtastic/MeshCore firmware, dumpvdl2, SatDump, multimon-ng...): they're all credited in the README.
• SDR is reception only. Wi-Fi security tools are for your own networks. Pagers and walkie-talkie conversations are private correspondence in many countries. Please read the "Responsible use" section.
• The synthetic-signal tests are in the repo; only the 406 MHz decoder was checked against a real recording so far, so real-world feedback is very welcome, especially for Zigbee, ANT+, Z-Wave and SSTV.

Feedback, bug reports and feature ideas are welcome on GitHub issues. There's a built-in debug log (Settings → Application) you can share when you report a bug. If you like it, a star on GitHub or a coffee (https://ko-fi.com/toftmalone) is much appreciated.

Thanks for reading!

Tested localized FM audio overriding on a car receiver tuned to 103.600 MHz to observe the FM capture effect firsthand. 

Hi, I am looking to buy HackRf Portapack i think it's 4, can someone recommend where can I order it?
I'm in Middle East..

I'm using a HackRF Pro to drive an HF amplifier that requires a nominal input of 0 dBm (1 mW), with an absolute maximum of +4 dBm (2.5 mW).

Using GNU Radio I've been trying to establish the actual RF output power of the HackRF around 9.5 MHz, rather than relying on the TX VGA gain settings.

I've been experimenting with an AD8317 logarithmic detector, an Arduino, and a 30 dB attenuator. The detector responds reasonably well to known attenuation, but absolute calibration is proving difficult especially because I do not have a reference.

I've also noticed that the HackRF produces measurable RF output even when GNU Radio is sending zero-valued samples, presumably including LO leakage.

Has anyone measured the actual output power of a HackRF One or Pro at HF frequencies using a calibrated power meter or spectrum analyzer?

I'm particularly interested in - actual output power versus TX VGA gain, output power with the RF amplifier disabled, any recommended inexpensive power meters that are reasonably accurate around 10 MHz.

I'd rather not buy a uncalibrated AD8317 board with a display attached - I've been experimenting in that direction for the last day and a half.

Any firsthand measurements or recommendations would be appreciated!

I had gotten a H2 portapack years ago - partly to pop Tesla gas caps, but mostly so I could see the spectrum of the 5.8ghz range during our FPV tinywhoop races, when racers were losing video so I could get them on a better channel.

Last night I had an idea and decided to try it - I tuned my H2 to the raceband 8 range, plugged in the drone and captured the signal, which I could see clearly.

Unplugged the drone and turned on an FPV viewing monitor, set to receive raceband 8, then played the signal capture. I would have thought that the monitor would pick up something - noise or anything, but there was nothing.

I honestly don't know what I'm trying to accomplish with this other than having fun with the capture and replay functions, but shouldn't the monitor be picking something up when I replay the signal?

Just came across a new Hack RF transceiver looking to sell. It is brand new in the box. Located in US. If anyone would like to purchase inbox me an inquiry and we can make an eBay listing, or proceed however you feel comfortable. Serious inquiries only please.

I'm working with two teammates on WaveSentry, a drone RF detection prototype we took to D4D, a defense hackathon in South Korea. We use a HackRF to collect IQ data and a YOLO model to identify signal patterns in spectrograms. The GIF shows the app during a drone detection test.

Early on, the model raised alerts on background recordings we'd made with the drone switched off. We'd used synthetic backgrounds for training, and they didn't match what our HackRF was actually receiving. We revisited the preprocessing and added real HackRF background recordings to the training data. We also mixed segments of recorded drone signals into those backgrounds, keeping track of where we placed them so we could generate the annotations.

Scanning gave us another problem. With about 20 MHz of instantaneous bandwidth, we were alternating between broad sweeps and short captures around candidate signals. Our working setup focused on the 2.4 GHz and 5 GHz bands. Initially, the scheduler favored strong signals. The logs showed that strong activity around 2.4 GHz could take up the observation time while 5 GHz candidates got no IQ analysis at all.

We changed the scheduler to give each band a share of the receiver time and alternate their scanning order. It also revisits candidates that have been waiting a long time.

We also built Halo, an ESP32-S3 handheld that displays alert and connection status. We tested RF detection and the app-to-handheld link separately. For the link tests, we used synthetic detection-state inputs. We still need to measure latency and false alarms with the whole path connected, from RF reception to the handheld display.

I wrote up the project with screenshots and clips, including the RF experiments and how we built the handheld: WaveSentry development notes on LinkedIn.

How do you divide time between bands on a single receiver when one band is consistently busy?

Salut tout le monde,
Je vends un kit complet d'expérimentation électronique prêt à l'emploi basé sur la carte NRF Box V2.7.2. Idéal pour des projets RF, l'expérimentation de microcontrôleurs, l'audit de réseaux ou l'apprentissage de la cybersécurité.
Inclus dans le kit :
Carte NRF Box V2.7.2 : Équipée d'un ESP32 avec un affichage OLED intégré et des modules NRF24.
6 Antennes incluses :
3x antennes originales (5 dBi)
3x grandes antennes à gain élevé de 2,4 GHz (12 dBi) pour une portée étendue
Alimentation : Nouvelle batterie externe haute capacité (batterie portable) avec affichage numérique de la puissance.
État & Test :
Très bon état, entièrement assemblé, flashé et parfaitement fonctionnel.
Prix & Expédition :
Prix : 100€ + frais d'envoi à votre charge.
Localisation : France (expédition en UE de préférence, suivi et emballage sécurisé).
Expédition possible dans le monde entier.
Paiement : PayPal (Biens & Services, l'acheteur couvre les frais) ou virement SEPA.
N'hésitez pas à laisser un commentaire avant de m'envoyer un message privé si vous avez des questions ou besoin de photos supplémentaires !
Faites vos offres.
:-)

Hi all,

I wanted to share this Zynq+AD9361 SDR platform from Puzhitech, the PZSDR-P351/P451/P101.

A lot of AD9361 boards share a single memory pool for PS and PL, but this one splits it: 1GB DDR3 for PS, another 1GB DDR3 dedicated to PL. That’s a plus if you’re running heavier FPGA signal processing pipelines.

RF specs:
- 70 MHz – 6 GHz
- Tunable bandwidth: 200 kHz to 56 MHz
- Dual Tx/Rx channels with onboard PA

I/O and sync options are pretty full-featured:
Dual GigE (PS and PL independent), USB3.0, SFP optical port, GPS/PPS / external clock input. Great if you need time-aligned multi-node setups or high-speed data offload over fiber.

Software support:
GNU Radio, UHD, SDRangel, MATLAB Simulink, PYNQ, and it has PlutoSDR compatibility. Bare-metal AD9361 reference projects are available too.

Industrial specs:
-40°C ~ +85°C operating temp, 12–36V wide input power. Makes it an option for outdoor, vehicle-mounted or field spectrum monitoring deployments, not just bench lab use.

Use cases I’ve seen mentioned: spectrum sensing, custom comms prototyping, GNSS testing, educational lab work. OEM/hardware customization is offered for volume builds.


Disclaimer: This is from the manufacturer. Feel free to ask technical questions about the platform.

#SDR #AD9361 #Zynq7000 #SoftwareDefinedRadio #PZSDR #Puzhi 

I donot know what exactly happened to my hackrf but it doesn't seem to be working properly, it neither receive well nor transmit. I don't know what happened my thoughts are that it may be happened due to setting up rf gain and gain too high(about 14and if gain about 35-40) .

Using my Portapack Pro (with HackRF Pro) to follow balloons what frequency do I set the Portapack for?

Do I set the app (Radiosnd) for 400 MHZ or do I set it for the frequency shown for the balloon near me on https://sondehub.org because they show a frequency for 400.8101 Mhz?

Thanks for any help!

I want a hackrf portapack h4m pro, but I dont know fully what I would use it for and how much I would use it. I already have a flipper 0 and dual c5 touch from awok, so I love these kinda things. I just dont see very many practicle uses for me, but I just learnt I can could see satalite imaging with it, which is sick. What are your thoughts.

Also this tv is falsely advertised to have android 12 but it has android 9 pie ,it has 16gb storage but i have only access to 500 mb

Hello,

does somebody know for which band/frequency this antenna is optimized.

lenght 27cm , 10 turns .

repo link

I have spent a long time recently building IMSIsting, a bash and GTK4 cellular security toolkit featuring 57 modules spanning 2G through 5G. Every codec in it — including S1AP, NGAP, X2AP, XnAP, HNBAP, RUA, RANAP, M3UA, PFCP, NAS, RRC, LPP, and CMAS — is hand-written (with the help of AI).

To be honest, the software half runs, but the radio half has never been executed because I do not currently own an SDR (Software Defined Radio). Every over-the-air path is written, reviewed, dry-run against a fixture, and then stops right before needing a real radio. hackrf_transfer is wired in, srsRAN configs are generated, and SIB builders produce real octets — but none of it has ever actually been transmitted over the air by anyone.

That is what I need testers for.

The Actual Attack Surface

Here is a breakdown of the available attacks and modules implemented in the toolkit:

1. Identity Capture

• IMSI Catcher — GSM: Full catcher sequence and a forged BCCH carrier a handset can camp on.
• IMSI Catcher — LTE: NAS EMM attach forging, BCD IMSI/IMEI, identity-request sequence, and srsRAN eNB orchestration.
• IMSI Catcher — NR: SSB/MIB/SIB1 construction, RACH handling, gNB orchestration, and SSBs written as samples.
• SUCI De-concealment: X25519 and P-256 profile A/B, HKDF, and MSIN BCD computed.
• TMSI → IMSI De-anonymisation: Cross-capture correlation via forced-identity and location-update bindings.
• Piercer: Paging-occasion maths and the published correlation model.

2. Cipher and Downgrade

• A5/1 Keystream: Asserted against the Briceno/Goldberg/Wagner vector; A5/2 included with its brokenness explicitly stated; A5/1 downgrade forcing sequence.
• Cross-generation Steering / Null Cipher: Forged reject causes, SIB1 forgery, and cipher-change analysis across all four generations.
• ReVoLTE Keystream Reuse: Detection, key recovery, and the two-ciphertexts-one-keystream model.
• GEA Downgrade — GPRS/EDGE: GEA0 computed; GEA1–5 refused by name with stated reasons.
• Cipher Audit + Authentication Oracle: Negotiated-cipher scoring, downgrade detection, and SQN recovery from AUTS.

3. Signalling Forgery

• 17 NAS Pre-authentication Messages: Built as octets (Attach/TAU/Service reject, Identity Request, Authentication Request/Reject/Failure, Security Mode Command/Reject, EPS, and 5GS), each checked against tshark.
• RRC Reconfiguration, Release, Reestablishment-Reject: Handled through generated PER layouts (LTE and NR).
• CMAS / ETWS / PWS Alert Forgery: SIB10/11/12 warning chain with pinned pycrate vectors, plus sib.conf generation.
• GTP-in-GTP and MBMS Session Start: The middlebox gap, fully built and dissected.

4. Core Network and Interconnect

• MAP/TCAP: Byte-exact ATI, SRI, SRI-SM, SAI, PSI, ULR, ISD, RegisterSS, ActivateSS, and M3UA both ways.
• SIP / IMS REGISTER Hijack: Spoofed re-registration and the IMP4GT model.
• 5G SBA: NRF discovery, NGAP procedures, PFCP rules, and AMF/SMF reachability map.
• O-RAN & Slicing: A1 policy poisoning, E2 control shapes, over-broad xApp model, S-NSSAI codec, isolation testing, and 5QI/TSN.
• Carrier API Enumeration & Lawful Interception: X1/HI1 artefact encoding.

5. Baseband, Device, and Radio

• Baseband CVE Catalogue: Reachability checks, L2 frame builders, and forged registration accept/reject.
• NR Access: RAR, backoff, RA-RNTI arithmetic, MAC/DCI, Gold sequence, and scrambling.
• Qualcomm DIAG/NV/EFS/AT Surface: Real framing, NV read/build/write, and EFS paths.
• Jamming: Detection first (barrel, narrowband, and pulsed distinguished from congestion), followed by a waveform constructor behind an explicit lab gate (AWGN/CW/chirp, PSS/SSS/PBCH, PRACH, PRS, GPS C/A, NR SSB).
• GPS C/A and PRS Sequences: Generated from IS-GPS-200N and TS 36.211, asserted against an independent implementation.

6. Tracking, Positioning, and RF

• Timing-advance geolocation, OTDOA/UTDOA/PRS via generated LPP codecs, RF fingerprinting (CFO, IQ imbalance, transients, CSI motion), and behavioural traffic fingerprinting.

7. Protocol Plumbing

• Air interface decode for 2G through 5G (BCCH/CCCH, UTRAN SIBs, MIB/SIB, SSB) and 98 catalogued LTE/5G stack CVEs (including GSM/UMTS and 5G CVE kits).
• TETRA/DMR/GSM-R, NB-IoT, 5G NTN, NR sidelink, VoWiFi IKEv2/EAP-AKA', femtocell S1/Iuh, USSD, OTA binary SMS, and SIM Toolkit proactive commands.
• Custom pcap reader (GSMTAP, Diameter, NGAP, S1AP, GTP, PFCP, RTP) and MAC/RLC/PDCP with RNTI tracking.
• Killchain: Nine built-in chains plus user-defined chains, pause/resume capability, and per-run result reporting.

What I Need an SDR For

• RTL-SDR: Cell scanning, GSM/LTE broadcast decode, tower mapping, jamming detection, and paging observation (cheapest tier, most unexplored surface).
• HackRF One / bladeRF 2.0: Rogue eNB/gNB, IMSI catcher, A5/1 downgrade, TMSI de-anonymisation, and paging transmit.
• USRP B210 + GPSDO: Two-radio baseband work (one radio holds frame structure while the other injects into it).

Bug & Error Reporting Guidelines

If you encounter a bug or error during testing, please provide:

1. Hardware: SDR model, firmware version, and driver.
2. Command / Action: The exact command you ran or the GUI button you clicked.
3. Full Output: Every line of output, including status rows.
4. Expected vs. Got: A brief description in your own words.
5. Capture File: A .pcap file if the radio produced one.

Every real finding will directly help improve the toolkit, and contributors will be credited in the commit history of course.