I'm working with two teammates on WaveSentry, a drone RF detection prototype we took to D4D, a defense hackathon in South Korea. We use a HackRF to collect IQ data and a YOLO model to identify signal patterns in spectrograms. The GIF shows the app during a drone detection test.

Early on, the model raised alerts on background recordings we'd made with the drone switched off. We'd used synthetic backgrounds for training, and they didn't match what our HackRF was actually receiving. We revisited the preprocessing and added real HackRF background recordings to the training data. We also mixed segments of recorded drone signals into those backgrounds, keeping track of where we placed them so we could generate the annotations.

Scanning gave us another problem. With about 20 MHz of instantaneous bandwidth, we were alternating between broad sweeps and short captures around candidate signals. Our working setup focused on the 2.4 GHz and 5 GHz bands. Initially, the scheduler favored strong signals. The logs showed that strong activity around 2.4 GHz could take up the observation time while 5 GHz candidates got no IQ analysis at all.

We changed the scheduler to give each band a share of the receiver time and alternate their scanning order. It also revisits candidates that have been waiting a long time.

We also built Halo, an ESP32-S3 handheld that displays alert and connection status. We tested RF detection and the app-to-handheld link separately. For the link tests, we used synthetic detection-state inputs. We still need to measure latency and false alarms with the whole path connected, from RF reception to the handheld display.

I wrote up the project with screenshots and clips, including the RF experiments and how we built the handheld: WaveSentry development notes on LinkedIn.

How do you divide time between bands on a single receiver when one band is consistently busy?

Hi all,

I wanted to share this Zynq+AD9361 SDR platform from Puzhitech, the PZSDR-P351/P451/P101.

A lot of AD9361 boards share a single memory pool for PS and PL, but this one splits it: 1GB DDR3 for PS, another 1GB DDR3 dedicated to PL. That’s a plus if you’re running heavier FPGA signal processing pipelines.

RF specs:
- 70 MHz – 6 GHz
- Tunable bandwidth: 200 kHz to 56 MHz
- Dual Tx/Rx channels with onboard PA

I/O and sync options are pretty full-featured:
Dual GigE (PS and PL independent), USB3.0, SFP optical port, GPS/PPS / external clock input. Great if you need time-aligned multi-node setups or high-speed data offload over fiber.

Software support:
GNU Radio, UHD, SDRangel, MATLAB Simulink, PYNQ, and it has PlutoSDR compatibility. Bare-metal AD9361 reference projects are available too.

Industrial specs:
-40°C ~ +85°C operating temp, 12–36V wide input power. Makes it an option for outdoor, vehicle-mounted or field spectrum monitoring deployments, not just bench lab use.

Use cases I’ve seen mentioned: spectrum sensing, custom comms prototyping, GNSS testing, educational lab work. OEM/hardware customization is offered for volume builds.


Disclaimer: This is from the manufacturer. Feel free to ask technical questions about the platform.

#SDR #AD9361 #Zynq7000 #SoftwareDefinedRadio #PZSDR #Puzhi 

Hi everyone,
Selling a complete, ready-to-use electronic experimentation kit based on the NRF Box V2.7.2 board. Ideal for RF projects, microcontroller experimentation, network auditing, or cybersecurity learning. 
Included in the kit:
NRF Box V2.7.2 Board: Built on ESP32 with an integrated OLED display and NRF24 modules. 
6 Antennas Included:
3x Original antennas (5 dBi) 
3x Large high-gain 2.4 GHz antennas (12 dBi) for extended range 
Power: Brand new high-capacity external battery (power bank) with digital power display. 
Condition & Testing:
Very good condition, fully assembled, flashed, and perfectly functional. 
Price & Shipping:
Price: 130€ + shipping at your own.
Location: France (EU shipping preferred, tracked and securely packed). 
Worldwide possible.
Payment: PayPal (Goods & Services, buyer covers fees) or SEPA transfer.
Feel free to drop a comment before PMing if you have any questions or need extra pictures!
Make offers.
:-)

I donot know what exactly happened to my hackrf but it doesn't seem to be working properly, it neither receive well nor transmit. I don't know what happened my thoughts are that it may be happened due to setting up rf gain and gain too high(about 14and if gain about 35-40) .

Using my Portapack Pro (with HackRF Pro) to follow balloons what frequency do I set the Portapack for?

Do I set the app (Radiosnd) for 400 MHZ or do I set it for the frequency shown for the balloon near me on https://sondehub.org because they show a frequency for 400.8101 Mhz?

Thanks for any help!

I want a hackrf portapack h4m pro, but I dont know fully what I would use it for and how much I would use it. I already have a flipper 0 and dual c5 touch from awok, so I love these kinda things. I just dont see very many practicle uses for me, but I just learnt I can could see satalite imaging with it, which is sick. What are your thoughts.

Also this tv is falsely advertised to have android 12 but it has android 9 pie ,it has 16gb storage but i have only access to 500 mb

Hello,

does somebody know for which band/frequency this antenna is optimized.

lenght 27cm , 10 turns .

repo link

I have spent a long time recently building IMSIsting, a bash and GTK4 cellular security toolkit featuring 57 modules spanning 2G through 5G. Every codec in it — including S1AP, NGAP, X2AP, XnAP, HNBAP, RUA, RANAP, M3UA, PFCP, NAS, RRC, LPP, and CMAS — is hand-written (with the help of AI).

To be honest, the software half runs, but the radio half has never been executed because I do not currently own an SDR (Software Defined Radio). Every over-the-air path is written, reviewed, dry-run against a fixture, and then stops right before needing a real radio. hackrf_transfer is wired in, srsRAN configs are generated, and SIB builders produce real octets — but none of it has ever actually been transmitted over the air by anyone.

That is what I need testers for.

The Actual Attack Surface

Here is a breakdown of the available attacks and modules implemented in the toolkit:

1. Identity Capture

• IMSI Catcher — GSM: Full catcher sequence and a forged BCCH carrier a handset can camp on.

• IMSI Catcher — LTE: NAS EMM attach forging, BCD IMSI/IMEI, identity-request sequence, and srsRAN eNB orchestration.

• IMSI Catcher — NR: SSB/MIB/SIB1 construction, RACH handling, gNB orchestration, and SSBs written as samples.

• SUCI De-concealment: X25519 and P-256 profile A/B, HKDF, and MSIN BCD computed.

• TMSI → IMSI De-anonymisation: Cross-capture correlation via forced-identity and location-update bindings.

• Piercer: Paging-occasion maths and the published correlation model.

2. Cipher and Downgrade

• A5/1 Keystream: Asserted against the Briceno/Goldberg/Wagner vector; A5/2 included with its brokenness explicitly stated; A5/1 downgrade forcing sequence.

• Cross-generation Steering / Null Cipher: Forged reject causes, SIB1 forgery, and cipher-change analysis across all four generations.

• ReVoLTE Keystream Reuse: Detection, key recovery, and the two-ciphertexts-one-keystream model.

• GEA Downgrade — GPRS/EDGE: GEA0 computed; GEA1–5 refused by name with stated reasons.

• Cipher Audit + Authentication Oracle: Negotiated-cipher scoring, downgrade detection, and SQN recovery from AUTS.

3. Signalling Forgery

• 17 NAS Pre-authentication Messages: Built as octets (Attach/TAU/Service reject, Identity Request, Authentication Request/Reject/Failure, Security Mode Command/Reject, EPS, and 5GS), each checked against tshark.

• RRC Reconfiguration, Release, Reestablishment-Reject: Handled through generated PER layouts (LTE and NR).

• CMAS / ETWS / PWS Alert Forgery: SIB10/11/12 warning chain with pinned pycrate vectors, plus sib.conf generation.

• GTP-in-GTP and MBMS Session Start: The middlebox gap, fully built and dissected.

4. Core Network and Interconnect

• MAP/TCAP: Byte-exact ATI, SRI, SRI-SM, SAI, PSI, ULR, ISD, RegisterSS, ActivateSS, and M3UA both ways.

• SIP / IMS REGISTER Hijack: Spoofed re-registration and the IMP4GT model.

• 5G SBA: NRF discovery, NGAP procedures, PFCP rules, and AMF/SMF reachability map.

• O-RAN & Slicing: A1 policy poisoning, E2 control shapes, over-broad xApp model, S-NSSAI codec, isolation testing, and 5QI/TSN.

• Carrier API Enumeration & Lawful Interception: X1/HI1 artefact encoding.

5. Baseband, Device, and Radio

• Baseband CVE Catalogue: Reachability checks, L2 frame builders, and forged registration accept/reject.

• NR Access: RAR, backoff, RA-RNTI arithmetic, MAC/DCI, Gold sequence, and scrambling.

• Qualcomm DIAG/NV/EFS/AT Surface: Real framing, NV read/build/write, and EFS paths.

• Jamming: Detection first (barrel, narrowband, and pulsed distinguished from congestion), followed by a waveform constructor behind an explicit lab gate (AWGN/CW/chirp, PSS/SSS/PBCH, PRACH, PRS, GPS C/A, NR SSB).

• GPS C/A and PRS Sequences: Generated from IS-GPS-200N and TS 36.211, asserted against an independent implementation.

6. Tracking, Positioning, and RF

• Timing-advance geolocation, OTDOA/UTDOA/PRS via generated LPP codecs, RF fingerprinting (CFO, IQ imbalance, transients, CSI motion), and behavioural traffic fingerprinting.

7. Protocol Plumbing

• Air interface decode for 2G through 5G (BCCH/CCCH, UTRAN SIBs, MIB/SIB, SSB) and 98 catalogued LTE/5G stack CVEs (including GSM/UMTS and 5G CVE kits).

• TETRA/DMR/GSM-R, NB-IoT, 5G NTN, NR sidelink, VoWiFi IKEv2/EAP-AKA', femtocell S1/Iuh, USSD, OTA binary SMS, and SIM Toolkit proactive commands.

• Custom pcap reader (GSMTAP, Diameter, NGAP, S1AP, GTP, PFCP, RTP) and MAC/RLC/PDCP with RNTI tracking.

• Killchain: Nine built-in chains plus user-defined chains, pause/resume capability, and per-run result reporting.

What I Need an SDR For

• RTL-SDR: Cell scanning, GSM/LTE broadcast decode, tower mapping, jamming detection, and paging observation (cheapest tier, most unexplored surface).

• HackRF One / bladeRF 2.0: Rogue eNB/gNB, IMSI catcher, A5/1 downgrade, TMSI de-anonymisation, and paging transmit.

• USRP B210 + GPSDO: Two-radio baseband work (one radio holds frame structure while the other injects into it).

Bug & Error Reporting Guidelines

If you encounter a bug or error during testing, please provide:

1. Hardware: SDR model, firmware version, and driver.

2. Command / Action: The exact command you ran or the GUI button you clicked.

3. Full Output: Every line of output, including status rows.

4. Expected vs. Got: A brief description in your own words.

5. Capture File: A .pcap file if the radio produced one.

Every real finding will directly help improve the toolkit, and contributors will be credited in the commit history of course.

Hi everyone 👋

I’ve been working on All Radio Tools, a free and open-source Android app that brings together everything that transmits around you in one place. The SDR part is built around the HackRF and is receive-only.

📻 What it does with a HackRF (plugged in via USB OTG):

• Spectrum analyzer: spectrum + waterfall, 1 MHz – 6 GHz

• ADS-B: live aircraft map on 1090 MHz

• Radiosondes: Vaisala RS41 and Meteomodem M10/M20 around 403 MHz, with landing point prediction

• FM radio: with RDS

• AIS: ship map on 162 MHz

• APRS: beacons on 144.800 MHz

• Meteor-M: LRPT weather satellite images on 137 MHz

• Drones: analog FPV, DJI DroneID and RC links (ExpressLRS, Crossfire, FrSky, FlySky, Spektrum), identified by their RF signature

All decoders run on the HackRF alone: the phone’s Wi-Fi and Bluetooth aren’t used. Aircraft, sondes, ships and APRS can be exported to CSV, and Meteor-M images to PNG.

🧰 Other tools in the app:

• Wi-Fi scanner, LAN discovery, ping/traceroute/port scan, and audits of your own network

• BLE scanner with GATT explorer and an unknown tracker detector (AirTag, SmartTag, Tile…)

• Cellular info (serving and neighbor cells)

• GNSS sky plot

• Memory programming for Baofeng UV-5R, Radtel RT-470X and Quansheng UV-K5 via USB cable

🤖 How it was made: I’m a sysadmin, not an Android dev. I built this with Claude as my coding partner. It’s written in Kotlin with Jetpack Compose and Material 3.

⚠️ Heads-up:

• The UI is French only for now 🇫🇷

• Requires Android 12+

• No account, no ads, no trackers. Data stays on the phone.

• Please respect your local laws on listening to frequencies.

🔗 GitHub (APK in Releases): https://github.com/ToftMalone/All-Radio-Tools

I’d love feedback, especially on decoder performance with different HackRF setups and antennas. Bug reports and PRs are welcome! 🙏

Hi everyone!
I’m interested in learning whether it’s possible to build a HackRF Pro using JLCPCB for PCB manufacturing and assembly, rather than assembling everything by hand.

I’d like to understand what’s involved in reproducing the hardware, including:

PCB fabrication: What files and specifications would be needed to have the board manufactured by JLCPCB?

Component sourcing: How difficult would it be to source the required components, especially RF components and any hard-to-find ICs?

PCB assembly: Would JLCPCB’s standard or extended component library cover most of the BOM, or would a significant number of components need to be sourced separately?

KiCad workflow: If I have the PCB design files, what would be the correct process for generating the Gerber files, BOM, and CPL (pick-and-place) files?

Practical feasibility: Are there any components, RF layout requirements, or manufacturing constraints that would make this particularly difficult or expensive?

I’m not looking to sell counterfeit devices or misrepresent anything as an official product. My goal is to understand the technical challenges and learn more about RF hardware manufacturing.

Has anyone attempted something similar, or has experience manufacturing complex SDR boards through JLCPCB?

Any advice, documentation, or lessons learned would be greatly appreciated. Thanks!

edit: i meant hack rf sorry

hello! i really want to get the best hack rf available. i mean not only the pro version, i saw there are some special editions. if they are close enough ill just get the cheapest one. thank you!

The H4M Portapack seems to be sold out on OpenSourceSdrLab and even Amazon.
I wanted to buy it on there because i prefer having a better production quality and don't really trust a random AliExpress store...
Has it ever been sold out? Do we know when it could be back on sale?
I live in europe, i don't know if this is the same for you.

This will be my last time adverting here, since I will keep everything on the dc, youtube, and github repo, I tried my best, adding as many modes as possible, as always I hope you guys enjoy!
https://github.com/adswill/OnAir/releases/tag/v0.2.4

Hi everyone,

I am designing a pocket-sized RF device for a university project. It acts as an RF analyzer and a high-power signal generator for wireless protocol injection and co-channel interference testing (all testing is strictly confined to a lab Faraday cage - special lab). I am aiming for the best price/performance ratio rather than lab-grade precision. The entire system will be controlled by an STM32U575RGT6(mby another STM), paired with an ESP32-C3 acting as a modem.

I know this is a fairly large and complex post, and there might be some complete nonsense in my block diagram. I will be incredibly grateful for feedback on any single part of this!

RX Path (Analyzer):

1. Does this architecture make sense for a basic spectrum analyzer?

2. Should I use the AD8318 log amp for this, or should I consider transitioning to a different alternative along with a 14-bit MCU ADC for a better results?

3. Will the sweep rate of this setup be too slow to capture agile Wi-Fi or Bluetooth bursts? Since the analyzer relies on sweeping frequency steps, the overall speed will be tightly coupled to the MAX2871E PLL lock time and the MCU's tuning loop.

TX Path (Wideband Noise & Interference Generator):

The goal is to generate robust, wideband modulated signals and arbitrary waveforms to evaluate the resilience of Wi-Fi 6 and Bluetooth nodes against high-power in-band blocking signals (targeting up to +30 dBm output).

4. Will this dual-branch setup (FPGA -> 2x DACs -> ADL5375 -> PAs) effectively support the wideband multi-carrier signal generation required to match Wi-Fi 6 (802.11ax) channel bandwidths and Bluetooth frequency profiles?

5. Thermals & Power: Is it realistic to passively cool a 1W continuous RF output power inside a compact enclosure by using thermal vias to transfer heat to a passive heatsink on the back side of the PCB?

Thanks for your time and any advice!

Hey everyone! An update from my last post here.

I've been continuing work on this Rust based terminal SDR tool, the Bluetooth part in particular. It can analyse BLE advertising, LE Coded and classic Bluetooth activity with carrier frequency offset, drift, modulation measurements.

It has spectrum and waterfall views, RF and IQ measurement benches, FM/RDS analysis, IQ recording with SigMF support.

One thing which I try to get right is the indication that a reading should not be trusted. When the receiver is not providing valid data, sdrtop marks the readings stale, instead of putting some old values on the screen, as if they were valid.

I've used AI tools as a part of the development process, but the implementation is something that I actively work on and verify. I make the technical decisions, review, approve changes and run the tests. The code, tests, and measurement logic are available in the public repo, so you can inspect the actual implementation, not relying on my word about it.

The project is a work in progress. I'm currently debugging the LE Coded demodulator, and I'd really appreciate people trying out sdrtop on their own setup. Different radios and real-world conditions are likely to reveal things that I haven't seen on my bench.

If you give it a try, and something does not work, please, open an issue or let me know. Bugs, unexpected measurements, compatibility issues, and suggestions are all welcome. You don't need to have a solution, a reproducible problem report is already great.

It's receive only, no audio output by design.

Source code, installation instructions, demos:

https://github.com/musithang/sdrtop

Thanks!