RTL-SDR Running Directly on iPad without Jailbreak TestFlight Invitation

Back in June, we posted about work from Arved (DK5AV/M0KDS) that enabled RTL-SDR to run directly on iPad devices without requiring a jailbreak. Previously, RTL-SDRs couldn't run directly on any iOS device. The only workaround was to run an RTL-SDR remotely and connect to it over a network via rtl_tcp.

Arved recently received distribution entitlement from Apple, which now opens the door to submitting to the Apple App Store. However, Arved notes that he would like feedback from Beta testers before that happens, so he has shared a TestFlight link at https://testflight.apple.com/join/jUDtSBmb. 

We note that this currently will only work on iPad devices with a modern M-series chip. iPhones are not compatible because they use the A-series.

Arved also writes:

The host app also contains a few more features compared to last time. It has a diagnostics view to see if the driver talks to the SDR correctly. It also contains a built-in FM receiver (including stereo and RDS) for broadcast FM stations. But finally the most important feature on the iPad is probably the built in rtl_tcp Server which runs directly on the iPad itself. That way users can use any compatible rtl_tcp client already available on iOS with this driver. Examples would be CoronaSDR, VibeSDR etc.

In the driver I also added support for the V4 dongle (which didn’t work last time). Unfortunately I had to drop the FCxxxx tuners for now due to issues with the AppStore and its GPL license issues. The whole driver is now based on the open source GNURadio driver instead of librtlsdr due to licensing issues with the GPL. Maybe I can find a way to add the other tuners back at some point. The driver for the iPad is open source (same repo as last time). The API for this driver is also available as header so that other apps in the future can directly talk to this driver.

RTL-SDR Running Directly on iPad via USB — Demo with CoronaSDR, welle.io, SatDump & rtl_tcp (no JB)

SDR++ and SDR# Plugins For: FT8 / FT4 / WSPR / FST4 / FST4W / JS8 / Q65 / CW / RTTY / JS8 / Olivia / PSK31 and PSK63

Thank you to ReLLL for writing in with an update on his decoder plugins, which we previously posted about as the “Advanced FT8/FT4 DX Decoder” just yesterday. 

Kondor Weak Signal Modes Decoder is the renamed and expanded version of the original plugin. It now decodes WSPR, FST4, FST4W, JS8, and Q65 in addition to FT8 and FT4. Its features include: A day/night DX map with SNR colors, station and country statistics, a DX activity bearing display, searchable tables, SQLite and CSV logging and optional forwarding to GridTracker.

ReLLL also added a new plugin called Maverick Text Modes Decoder (formerly CW Notebook) which decodes CW, RTTY, JS8, Olivia, PSK31 and PSK63. It provides a CW transcript with Markdown logs, simultaneous frequency tabs, spectrum discovery, pinned priority signals, and RX SNR readouts.

Both plugins now support standard SDR++ 1.2.0 and SDR++Brown 1.2.1 on Apple Silicon Macs running macOS 15 or later. There is also now a downloadable Windows preview for SDR#.

ReLLL welcomes reception reports, bug reports and UI ideas via GitHub Issues or X @FoxOnTheRunTr.

Kondor Weak Signal Modes Decoder
Kondor Weak Signal Modes Decoder

BrowSDR Update: Multi-SDR Support, LimeSDR, and Decoders for ADS-B, AIS, ACARS, RS41, rtl_433, BLE and DMR

Back in April, we posted about BrowSDR, an open-source browser-based SDR receiver by Joel (jLynx) that talks directly to SDR hardware via WebUSB, with no software install required. Joel has written in to let us know it has received many updates since then. The biggest is support for multiple SDRs at once, each with its own receiver tab, tuning, waterfall, and VFOs, and a single WebRTC sharing link that gives remote listeners access to all of them. LimeSDR-USB is now supported at up to 61.44 MSPS, and Airspy R2 support has been fixed.

Many new in-browser decoders have also been added, including ADS-B and AIS tracking with live maps, VHF ACARS with readable message explanations, RS41 weather balloon tracking, and rtl_433 for weather sensors, TPMS, and other ISM devices. There is also passive Bluetooth Low Energy scanning for receivers covering 2.4 GHz, and DMR voice decoding, with P25, NXDN, and D-STAR still experimental. Reception improvements include stereo FM with RDS, automatic squelch, upconverter offsets, automatic gain for HackRF and LimeSDR, a Signal Discovery panel, and a reworked POCSAG decoder.

Joel notes that all new features have been tested on real hardware, including our RTL-SDR Blog V4, the LimeSDR, and the HackRF Pro. The open-source code is available on it's Github repo.

BrowSDR Interface with POCSAG Decoding
BrowSDR Interface with POCSAG Decoding

Live TEA1 Decryption Support Added to an osmo-tetra Fork

Over on GitHub, su4am has published a fork of the well-known osmo-tetra-sq5bpf TETRA decoder that integrates TEA1 cipher support based on CVE-2022-24402. Back in 2023, we first posted about the TETRA TEA1 vulnerability discovery. Midnight Blue, a security research team, discovered this vulnerability as part of their TETRA:BURST research. The discovery found that a key-scheduling flaw reduces the effective keyspace from an impossible-to-brute-force 2^80 down to 2^32, which is small enough to brute force in a few minutes on a commodity GPU. This fork combines the osmo-tetra-sq5bpf TETRA decoder with Midnight Blue’s TETRA_crypto library so that recovered 32-bit keys are applied on the fly to encrypted voice bursts directly inside the decoder.

Importantly, we note that the fork does not crack keys by itself. The tetra-rx decoder outputs “key recovery candidate” tuples from the air, which you then feed into a separate GPU tool (SQ5BPF’s teatime) to actually brute force the reduced keyspace. Recovered keys are added to a keyfile and loaded live, so decryption begins on the next burst without restarting the pipeline. The fork also adds a dual-socket TRA output, letting you monitor decrypted and unencrypted traffic simultaneously with two telive-2 instances. 

We want to warn that intercepting or decrypting communications you are not authorized to receive is illegal in most countries.

TETRA Decoding (with telive on Linux)
TETRA Decoding (with telive on Linux)

Etherbulb: An ESP32-C3 Smart Bulb That Changes Color Based on Nearby RF Signals

Thank you to Peter Holzhauser for writing in and sharing his latest open-source project, "Etherbulb," a technical-art project that builds on his ESPSoup project that we previously posted.

Etherbulb turns an ESP32-C3-based smart bulb into an ambient RF spectrum monitor.  Etherbulb uses the ESP-SDR discovery to capture IQ data at 80 MSps 25 times per second, then runs an FFT on the chip, covering 2.13 to 2.73 GHz. This range includes Wi-Fi, Bluetooth, Zigbee/Thread, analog FPV video, and LTE/5G Bands 1, 7, and 38. The signals are then mapped to visible colors, such as blue for Bluetooth and green for Wi-Fi, with brightness scaling with signal strength.

The bulb serves its own web dashboard with a live waterfall, spectrum and signal log, and it stays on your Wi-Fi network while listening. You can assign colors, brightness, and sensitivity per signal type, or drag a range on the waterfall to create custom rules. It includes 26 presets, from ExpressLRS to microwave ovens, plus 412 mobile network bands for 39 European countries. Supported hardware includes a 12W RGBCW E27 bulb, flashable over Wi-Fi, and the BTF SP530E LED strip controller, which needs a first UART flash and can drive five strips at once, one per signal type.

Etherbulb: Turning a ESP32 WiFi Bulb Into an ambient RF spectrum display
Etherbulb: Turning an ESP32 WiFi Bulb Into an ambient RF spectrum display

AI Disclaimer: This code lists Claude as a contributor.

Advanced FT8/FT4 DX Decoder: A Native FT8/FT4 Decoder Plugin for SDR++Brown on macOS

Thank you to ReLLL for writing in and sharing news about the release of his "Advanced FT8/FT4 DX Decoder", a free and open-source plugin for SDR++Brown running on Apple Silicon Macs. SDR++Brown is a popular unofficial fork of SDR++ that already includes some built-in FT8 decoding capabilities. This plugin builds on that and adds a full DX monitoring workspace directly inside the SDR software, so there is no need to pipe audio out to WSJT-X just to see who you’re hearing.

The plugin decodes FT8 and FT4 and plots received stations on a DX map. It also displays tables of unique stations, all decoded messages and countries heard, along with receiver SNR and approximate distances calculated from grid locators. Other features include table filtering and sorting, persistent CSV reception logging, optional waterfall notifications, and a WSJT-X format UDP output that can feed GridTracker directly. Decoding also continues in the background even when the plugin window is closed.

We note that the latest release also adds decoding for WSPR, FST4, FST4W and Q65. Note that the plugin is not intended for use with standard SDR++, or on Windows or Linux. Installation instructions are on the GitHub page, and a user guide is also available.

Advanced FT8/FT4 DX Decoder plugin for SDR++Brown
Advanced FT8/FT4 DX Decoder plugin for SDR++Brown

LakeShark Update: Using an LR2021 LoRa Chip as an SDR for Portable P25, POCSAG and FM Reception on the ESP32-P4

Back in September, we posted about LakeShark, Samuel Reynolds’ (aka SAMS0N1TE) T-Display P4 ESP32-P4 firmware that turns a USB-connected RTL-SDR into a handheld P25 Phase 1, POCSAG, and FM receiver.

Samuel has now written in to share news that with the T-Display P4 variant containing a Semtech LR2021 LoRa chip, LakeShark no longer needs an RTL-SDR at all. Instead, it can pull raw I/Q samples directly out of the built-in LR2021 LoRa transceiver chip and demodulate them on the ESP32-P4. Back in May, we posted Zoltán Papp and team's discovery that showed how an LR2021 could receive ADS-B. But this relied on the chip’s built-in OOK mode.

With raw I/Q available, the chip’s built-in modes no longer limit what it can receive. Both of the LR2021’s RF paths work, providing continuous coverage from 100 MHz to 2.74 GHz, and no upconverters, external tuners, or extra front-end hardware are used. The sample rate is relatively low at 250 Ksps max, meaning only a narrow bandwidth slice is available, but this is more than large enough for narrowband channels like P25. Samuel notes that it’s pretty unreal being able to listen to his local analog NFM fire department channels from such a low-power chip.

Smanuel notes that the LR2021 is still pretty new, and few products use them. However, it is possible to DIY a receiver for about $28 with Waveshare’s Core2021 LR2021 modules and their ESP32-P4-WIFI6 board. Samuel also has an experimental transmit path working, which has sent custom waveforms, temperature packets and P25 test-tone bursts. In one test, an independent receiver decoded 72 P25 voice frames from a single transmission and recovered the expected tone.

The radio access layer has been released as a separate project called LR2021-SDR. It includes a portable C library, capture firmware, waveform tools and measurements, along with graphs from a real received P25 call and a recording of the recovered transmit tone. The updated handheld firmware is available on the LakeShark GitHub.

LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).
LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).

Demod Updates: Adds Support for OpenWebRX, FT8 Decoding, CarPlay and an Android Version

Back in July, we posted about Demod, an iOS and iPadOS SDR receiver app that works as a client for rtl_tcp, SpyServer, and KiwiSDR. The developer, Alphonse, recently wrote in again to share updates. Alphonse writes:

Since the launch, Demod has added:

  • OpenWebRX support on top of KiwiSDR, SpyServer and rtl_tcp. Public receivers are browsable on a built-in map, so it can be tried without any hardware.
  • FT8, CW and RTTY decoding on the phone.
  • Identify. Tap an unknown signal and it measures it, checks the shortwave broadcast schedules against the receiver's location and the time, and names the likely station and how far away it is.
  • Live on-device transcription and translation of what you're listening to.
  • CarPlay, and a "car radio" Seek that jumps to the next real signal for the current mode and stops there (the next AM station, SSB voice or CW signal). It also works from headphones and the steering wheel. 
  • A band scanner, recording and 15-second rewind of live radio, and Siri ("Tune Demod", "Ask Demod what this signal is").
  • A three-pane iPad layout, a mains-hum filter, an auto-contrast waterfall and squelch that works on every source.

Android: Demod is now on Google Play, with the same receiver support and decoders. Android Auto support coming soon.

Alphonse has also decided to share with the community 15 free codes for each platform that let you download the app for free. These codes are first come, first served, so if a code no longer works, it will have already been claimed.

iOS (iPhone/iPad) — redeem in the App Store app: tap your profile photo → Redeem Gift Card or Code. Or tap the link directly: https://apps.apple.com/redeem?ctx=offercodes&id=6782193839&code=CODE1
KTKAWEXFT36F,
LWPN4RNLTFMK, HMJKF39KLPN9, FM7JEHP7H7XA, 3F9PALW93KYM, MJ7TH3E9E3W9 ,P7P3NJR66XKT, K7WKYKNNRPMY, 94WLYNRLKNFR, 4XE7WAYHX4PN, 3KLPHAE9TTHX, MY64T9JWW3HA ,TXWWHNPMNYAX, LPJALTHR966K, EMRLANKKF7L6

Android — redeem in the Play Store app: profile icon → Payments & subscriptions → Redeem code. Or tap the link: https://play.google.com/redeem?code=CODE1
3SD4H680XKNUGNP9V6SXT8U,
68XKMWQEGUXLW2T6W41XEUR, 2N8E2KY22V9L49D92NQ86DX, VHG4UJPUJ6DGRVZGYGA331Z, 3N48JPPJ8F5RUA9S2E55C2N, 7N4BMSA3X1J893QQGC9H6ZM, VVQBLBGFBJED9GU7Y3UZQZK, NTC82UE8KT1RMSFF9GW1LVA, LBLKS33KUG3PQML1KYVK2P2, 9THCT76YXV61HAFK9ZY22J7, CMF62T6LA46V6PVCUZ4BYZG, S895G4U1E5FZ3QZA255FPU1, QQR944S4BUCA1XKCEBAJPPU, PDYWFXGWUJBV9C9UACTJ065, EXZRMG3RB3XJUEB42Z6KTZH

Demod iOS and Android Client for WebSDRs
Demod iOS and Android Client for WebSDRs