November 4, 2026

RS41 and M20 Android Decoder: A Standalone Radiosonde Decoder Android App for RTL-SDR

Back in June 2025, we posted about a radiosonde decoder and tracker program for Windows written by Mario Ančić (9A4AM). Mario has now written in again to share a new radiosonde decoder for Android, which works with an RTL-SDR dongle connected via a USB OTG adapter. As far as Mario is aware, it is the first standalone Android app dedicated to radiosonde decoding, as other solutions only offer it as an add-on within a larger SDR program.

The app decodes the common RS1729 radiosonde protocol and supports Vaisala RS41 and Meteomodem M20 sondes, with the type detected automatically, so you only need to enter the frequency and start decoding. As it is designed for radiosonde hunters, it skips PTU (pressure, temperature and humidity) data and focuses on position, altitude, speed, climb rate and heading. A 'Geo App' button passes the sonde's coordinates to your map app as a marker.

The decoder runs via the 'SDR driver' app by Signalware and was tested with our RTL-SDR Blog V3 and V4. The code is open source under the GPL-3.0 licence and available on GitHub, with the APK in the Releases section. Since the app runs as a background service, Android's battery optimization settings may need adjusting for it.

AI Disclaimer: The project README notes that parts of the code were written with the help of an AI assistant and reviewed by the author.

Vote

November 4, 2026

Backtrail Pro: An Open-Source App for Discontinued goTenna Mesh Radios and Meshtastic

Thank you to Patrick Gartner for writing in and sharing Backtrail Pro, a new iOS and Android app that brings discontinued goTenna Mesh radios back into use and also supports Meshtastic. The goTenna Mesh is a pocket-sized 1 W radio for the 902 - 928 MHz ISM band that pairs with a phone over Bluetooth for mesh texting without cell service.

The company behind goTenna Mesh has since shifted focus to military and public safety customers with its goTenna Pro line. In 2024, the security researchers who disclosed a series of goTenna vulnerabilities noted that goTenna discontinued support for the goTenna v1 and Mesh and exited the civilian market, around the same time CISA published its advisories on the Pro line. The consumer app has since disappeared, and goTenna was acquired by defense autonomy company Forterra in October 2025, leaving many owners with working radios and no app. With no vendor support, it's also unlikely that the Mesh's disclosed vulnerabilities, such as spoofed message injection with an SDR, will ever be patched.

Backtrail Pro talks to the goTenna Mesh through an independent implementation of its Bluetooth protocol, building on earlier community reverse engineering work. It supports group and direct messages, delivery receipts, location sharing, and optional AES-256 encryption. For Meshtastic radios, it lists every node heard and can change basic radio settings. The goTenna Mesh uses FSK rather than LoRa, so the two radio types can't talk to each other directly. However, with one of each connected to the phone, an optional relay can re-send group messages between the goTenna group and the Meshtastic mesh. The app costs US$0.99 on the Google Play Store and Apple App Store with no account or servers, and the code is open-source under GPL-3.0 and available on GitHub.

Backtrail Pro App for GoTenna Mesh Radios

AI Disclaimer: The Backtrail commit on GitHub lists Claude as a co-author.

Vote

November 4, 2026

Frugal Radio: Testing the Discovery Dish on Inmarsat AERO with JAERO and InmarScope

Over on YouTube, Rob from the 'Frugal Radio' channel has uploaded part one of a review of our Discovery Dish, which we sent over for testing. Rob used the Inmarsat L-band feed with an RTL-SDR Blog V4, SDR++ and JAERO to receive AERO signals from the 98W satellite, which sits at about 27 degrees elevation from Rob's location in central Alberta.

Rob notes that the 10500 bps channels, which carry most aviation traffic and are usually the hardest to decode, held a steady Eb/No (a signal-to-noise measure for digital signals) of 14-16 over several days of testing. For comparison, Rob's previous best of 10 came from a grid dish designed for 1.7 GHz GOES reception, while our RTL-SDR Blog L-band patch antenna peaked at 8. Rob also shows the dish assembly, which took about 30 minutes.

Later in the video, Rob briefly tries out InmarScope, the multichannel Inmarsat decoder from Sarah Rose that we posted about previously. It decoded every 600, 1200 and 10500 bps AERO channel at once and automatically followed a voice call when one was assigned. Part two will cover maritime EGC, GOES reception, or more InmarScope, depending on viewer feedback.

Discovery Dish Review Pt 1 : High Gain Inmarsat AERO reception with SDR++, JAERO & Inmarscope

Watch this video on YouTube

Vote

November 3, 2026

Router CSI Toolkit: Capturing 80 MHz Wi-Fi Channel State Information from a GL-MT6000 Router

Thank you to Wu Jun (aka jjjwu on GitHub) for writing in and sharing a guide to capturing Wi-Fi channel state information (CSI) from a GL.iNet GL-MT6000 router, along with the 'Router CSI Toolkit' scripts that go with it. CSI is the per-subcarrier amplitude and phase data that a Wi-Fi receiver measures to equalize the channel. Because it changes as people move through a room, it is often used for experimental Wi-Fi sensing.

The router is based on the MediaTek MT7986 chipset and runs OpenWrt with an existing mt76 driver CSI patch from the ossiemarks OpenWrt fork. A small daemon on the router streams 80 MHz, 256-subcarrier CSI from the 5 GHz radio over UDP to a host PC. There, Python scripts check the capture quality and produce amplitude heatmaps and a simple motion metric. A 10-minute test run produced 57,293 per-chain records at about 95.5 records/s.

While this project doesn't use an SDR, it may interest readers who followed BirriaSDR and Mtk79ICAP, which also patch the mt76 driver to turn MT7921 Wi-Fi dongles into SDRs. The scripts are MIT-licensed and available on GitHub, and the 10-minute dataset is on Zenodo under CC BY 4.0.

The GL-MT6000 (MT7986) Router used in these experiments

Vote

November 3, 2026

dec406: Decoding Second-Generation COSPAS-SARSAT 406 MHz Distress Beacons with an RTL-SDR

Thank you to Fabrice Morel (F4MLV) for writing in and sharing his project 'dec406', an open-source Linux decoder for COSPAS-SARSAT 406 MHz distress beacons. These are the EPIRBs carried on ships, ELTs on aircraft, and personal locator beacons (PLBs) carried by hikers. When activated, they transmit a digital message with a unique ID and often a GPS position, which satellites relay to rescue coordination centers.

What makes dec406 interesting is that it decodes the newer second-generation beacons. Unlike the narrowband first-generation signal, these use a ~50 kHz wide DSSS/OQPSK spread-spectrum signal that must be despread and BCH error-corrected before it can be read. Fabrice tested it with an RTL-SDR, and Bernard (F6BVP) at the F4KLO La Villette radio telescope used an Airspy on the MEOSAR satellite downlink near 1544 MHz, decoding system and calibration beacons in the USA, Cyprus, Brazil and Togo.

Fabrice has published real IQ recordings, and running 'make demo-real-sgb' downloads one and checks the decode. The live scanner supports RTL-SDR, Airspy, PlutoSDR, and HackRF, and the code is MIT licensed. More details are in the F4KLO field report. As Fabrice notes, never radiate test transmissions on 406 MHz. Fabrice has also sent us a PDF article of his results, which you can download here.

A Wide SGB Burst Near 406.05 MHz Received with an RTL-SDR in SDRangel (Top), dec406 Decoding a French Second-Generation System Beacon in Self-Test Mode (Bottom)

AI Disclaimer: While Fabrice does not mention it, the dec406 README and .gitignore reference a "Claude assistant memory" CLAUDE.md file, which suggests that Claude was used to help develop the software.

Vote

November 2, 2026

NightDX: Automated Overnight Shortwave DX Listening with an Airspy HF+

Thank you to Marco Zennaro for writing in and sharing NightDX, a free terminal app for macOS, Windows and Linux that lets an Airspy HF+ do your overnight shortwave listening for you. The menu interface is deliberately styled like early-90s DOS software.

NightDX pulls the EiBi, AOKI and HFCC broadcast schedules, plus live solar flux and Kp from NOAA. A propagation model then predicts what should reach your location and calibrates itself against what your own radio hears. The HF+ sweeps all the bands in about 10 seconds to see which carriers are really there, and overnight NightDX records the best stations, putting ones you've never logged first.

Optional AI features can then label each recording as speech, music, or noise using an AudioSet classifier, and transcribe and translate it with OpenAI's Whisper, which helps when writing reception reports. In the morning, a browser report shows the recordings with audio players, one-click reception reports drafted in Gmail, and a QSL card log.

We note that NightDX doesn't claim to identify stations. It shows schedule names as candidates and flags recordings where the evidence doesn't fit, such as the wrong language or a signal far too strong for the predicted path. Only the Airspy HF+ (Discovery or Dual Port) is supported for now, so there is no RTL-SDR support. Marco notes that other SDRs such as the Perseus and Elad are being looked into. The code is open-source under the MIT license and available on GitHub.

AI Disclaimer: Marco notes that NightDX was built with the help of Claude.

Vote

November 2, 2026

SweepSA: A Fast Swept Spectrum Analyzer for Pluto-Style AD936x SDRs and the HackRF

Thank you to zxkmm, one of the maintainers of PortaPack Mayhem, for writing in and sharing their new program 'SweepSA', a swept spectrum analyzer for Pluto-style AD936x SDRs such as the AntSDR E310 and LibreSDR. It also supports the HackRF One and HackRF Pro, and is designed to feel more like a bench instrument than an SDR receiver app.

One of SweepSA's core features is speed. It uses the AD936x's little-used 'fastlock' feature, which stores synthesizer profiles that can be recalled almost instantly with a full LO retune. The hop, capture, FFT, and detection all run on the board's ARM CPU, so only the reduced spectrum is sent to the PC, which avoids the slow USB or network round trip on every hop. zxkmm reports sweeps of about 10 - 60 ms over a few hundred MHz, and 500 - 800 ms over the full 70 MHz to 6 GHz range. That's similar to a HackRF One, but with each segment a gapless 40 - 56 MHz wide.

Other features include four traces, eight markers, a waterfall, zero span, and CSV/PNG export. Levels are shown in dBFS with an 'UNCAL' badge until an amplitude correction file is loaded. SweepSA is free for Windows, Linux, and macOS (arm64), with downloads available on GitHub. We note that it is currently closed source, but zxkmm plans to publish the source code later.

sweepsa demo

Watch this video on YouTube

Vote

October 29, 2026

SPECTER: Leaking Data from Air-Gapped Computers by Toggling USB Power States

This October, researchers Hyeongjun Choi, Ji Hyuk Jung and Ji Won Yoon from Korea University and 78ResearchLab in Seoul have published a paper describing "SPECTER", a covert channel that leaks data from air-gapped computers by repeatedly switching the power state of attached USB devices. This first requires installing malware with root or administrator privileges, which then controls power via the operating system's suspend or disable/enable controls. No modification to the peripheral's hardware or firmware is needed.

Three receiving methods were demonstrated, with one being RF based. The first method uses a phone plugged into the port, which then simply logs its charging state as on/off binary data. The second method uses a connected mouse, webcam or USB hub whose status LEDs can be watched by a person or camera. The final method uses a HackRF One with a near-field loop probe to pick up the switching emissions at around 5 MHz. Data rates are only 0.2 to 1 bit per second, so the channel is only useful for short secrets like passwords or keys.

We note that so far, the RF method was only tested with the probe touching the USB cable. This project is similar to USBee, which we posted about in 2016, where an unmodified USB device was also turned into a transmitter via malware. The difference is that USBee requires a data transfer USB device like a thumb drive to be connected, whereas SPECTER can use any connected USB device, even those that are charge-only.

SPECTER RF Receiver Setup with a HackRF One and Loop Probe

Vote