KhanfarRX: Mayhem External App for the PortaPack H4M with Band Plan Tuning, Band Lock, EIBI “On Air Now” and FT8 Geo Map

Thank you to M Khanfar for writing in and sharing his new app for the HackRF PortaPack H4M, KhanfarRX. The program aims to make listening to HF on the PortaPack a much better experience. Khanfar writes:

KhanfarRX: Never get lost in the HF bands! A free external app for the HackRF PortaPack H4M (Mayhem firmware).

In this video I show KhanfarRX, an app that makes HF listening on the PortaPack H4M much easier.

It has an easy band plan, a band lock that keeps you inside the band you choose, and a live EIBI browser that shows which shortwave stations are on the air right now.

WHAT KHANFARRX GIVES YOU

  • Easy band plan: HAM HF/VHF, broadcast, airband and marine bands in one clean menu
  • Stay in the band: tuning wraps around inside the band edges, so you can't drift out. One tap on DisableHF returns to free tuning
  • EIBI "On Air Now": see which shortwave stations are broadcasting at this moment and tune in with one touch
  • Correct mode automatically: AM/LSB/USB for HF, NFM for marine, AM for airband, WFM for FM broadcast
  • Full receiver: live waterfall, RSSI, recorder, gain and squelch, like the stock Mayhem Audio app

Not mentioned in Khanfar's notes is that KhanfarRX also comes with an FT8 Geo map. This plots every received FT8 message on a map displayed by the PortaPack's screen.

PortaPack H4M · Mayhem External KhanfarRX App

 

Tweet
Share
Reddit
Vote
Email

Turning a Smartphone’s Speaker Amplifier into a Silent Intentional VHF Morse Transmitter

Thank you to Efe Işık (TA1EEI) for writing in and sharing with us his open-source project showing how to turn a modern Android smartphone’s internal Class-D speaker amplifier into a silent, intentional VHF Morse transmitter. Efe writes:

By pushing inaudible 21 kHz full-amplitude PCM audio via Android's AudioTrack, the amplifier's PWM switching circuit radiates near-field RF harmonics into the 144 MHz (VHF) band. The signal is strong enough to be received in AM mode on common SDRs and BK4819-based handheld transceivers (such as the Quansheng UV-K5) simply by placing the antenna near the speaker grill.

Everything is open-source, requires zero Android permissions, and includes instructions on receiver setup and frequency alignment.

With the software running on the Android device, simply use an SDR or handheld radio to look for the signal in the 144 - 146 MHz region. Increasing the volume can help increase transmission power.

This reminds us of the TrojPix project, a more sophisticated method that uses a program on a PC to imperceptibly modulate pixels on a screen, effectively turning video cable/screen EMI into an air-gapped data transfer path.

Tweet
Share
Reddit
Vote
Email

Elektro-L3 Now Drifting West to 14.5°W: L-Band xRIT Could Return to Western Europe in October

Back in May, we posted about how Russia's Elektro-L3 geostationary weather satellite was expected to move from 76°E to 14.5°W, which would finally bring an unencrypted L-band LRIT/HRIT downlink over Western Europe. Thank you to RTL-SDR reader tec_msat for writing in and letting us know that the move now appears to be underway.

tec_msat writes that Elektro-L3 went quiet around September 10. Updated TLEs on September 13 then showed the satellite drifting west at roughly 1.7 degrees per day. Around September 20, its orbit was circularized, making it drift faster at around 3.1 degrees per day. At its current speed, it should reach 14.5°W around October 12. Based on Elektro-L5's commissioning timeline, test transmissions could begin within days of arrival.

Elektro-L5, launched in February 2026, has now been successfully commissioned at L3's old 76°E slot, which covers Asia, the Middle East, and parts of Russia and Australia. It has been transmitting GGAK, LRIT and HRIT, as well as X-band RDAS. With L5 taking over the eastern slot, L3 will replace the aging Elektro-L2 at 14.5°W. L2 never provided LRIT/HRIT from that position due to power supply issues, although the original Elektro-L1 did when it was stationed there.

Roscosmos noted in August, when announcing L5's commissioning, that L3 may be moved to 14.5°W. However, there has been no official announcement from Roscosmos that the relocation has started, so the drift observations currently come from amateur TLE tracking.

Once commissioned, L3 should once again make geostationary L-band weather imagery at 1691 MHz available to users in the UK, Ireland, Iceland, Portugal, Spain and western France. tec_msat also speculates that the signal may be stronger over Europe than it was from 76°E (potentially due to better elevation angles), making xRIT reception even easier.

If you're in the coverage area, now might be a good time to get your dish, feed and LNA ready. SatDump is the best software tool to use for reception and decode and our Discovery Dish with L-Band feed and RTL-SDR Blog V3 is a great starting point for hardware.

Expected Elektro L3/L4/L5 global coverage from mid-October 2026.
Expected Elektro L3/L4/L5 global coverage from mid-October 2026.
Tweet
Share
Reddit
Vote
Email

Demod Analyzer: Analyze Digital Modulation (BPSK, QPSK, 16-QAM) in IQ Files

Thank you to Attila Zsellér, who has submitted his latest Python program called "Demod Analyzer". This program is designed for analyzing BPSK/QPSK/QAM16 signals in recorded IQ samples. Atilla writes:

I'm developing OpenStint, an SDR-based lap timing solution for rc racing and motorsport, which [RTL-SDR.COM] presented during the summer. Active transponders emit short bursts of data containing a unique id. By the time of reception, it's often full of various impairments. People are sometimes sending me IQ recordings for debugging purposes, and I was in need of a tool that can do a basic initial analysis on them, just to see if there is a chance of decoding anything.

It's a set of tools, doing a typical RX chain, with instant visual feedback:

  1. Segment the bursts of transmissions based on RSSI
  2. Apply phase/frequency offset (with an "auto" button that just works)
  3. Optional upsample + (matched) filtering
  4. Symbol synchronization
  5. Optional blind-EQ

It supports BPSK/QPSK/QAM-16. By the end of the process, you see the demodulated bits and MER & EVM figures.

There are sample recordings of actual transponders in the repository. It's Python, and the CI builds a Windows-variant. Images are in the github repository.

Demod Analyzer Screenshot
Demod Analyzer Screenshot

AI Disclaimer: The submitted notes that this program was created via vibe coding.

Tweet
Share
Reddit
Vote
Email

Marine VHF Scanner: A General Purpose Narrowband Receiver and Scanner for the RTL-SDR

Thank you to Wolfgang (OE1MWW) for writing in and sharing with us his software called "Marine VHF Scanner". Although its title suggests it's a Marine band scanner, Wolfgang notes that he has since evolved it into a general-purpose narrowband scanning tool. Wolfgang writes:

Marine VHF Scanner began as a purpose-built receiver for VHF marine channels using an RTL-SDR USB receiver.

It has evolved into a general-purpose narrowband receiver and scanner. User-editable channel databases support marine, airband (AM), 2 m and 70 cm amateur radio (FM), and other AM/FM services within the RTL-SDR tuning range of approximately 24 MHz to 1.7 GHz.

Recent additions include manual and unattended frequency-range sweeps (Section 4.7) and two configurable keyboard hotkeys (Section 4.8) for quickly saving interesting frequencies.

A note on its development
Although the project consists of around 4,000 lines of Python code, I did not write those lines myself. The code was generated - completely - by Claude.ai under my supervision. I developed it iteratively by specifying features, requesting changes, and reporting operational logic errors (views, handling etc.) until reaching Version 6.6.17.

Unique features

  • Pre-recording and recording to WAV files (where permitted by local laws!)
  • Frequency-range scan in Discovery Mode, registering and storing where signals have been heard
  • Frequency-range scan with automatic stop on detected signals - Continue button to go to the next signal.
  • Dual-channel monitoring (helpful for duplex split-frequency stations)
  • Remembers recent settings, the last-used database, and window position
  • Priority Channel button (the same frequency must be twice in the database, once marked PriCh)
  • Database editor for the CSV frequency database
  • JSON settings editor for viewing and editing configuration files

The ZIP package includes English and German manuals and additional documentation.

Download: http://oe1mww.work/marine_vhf_scanner.v6.6.17.zip

The program is supplied as a compiled Windows executable (.exe), together with configuration files (.json), example frequency databases (.csv), recent rtlsdr.dll files, and detailed documentation in the ZIP package.

No Python installation is required. Download, unzip – read the manuals – start it!

To protect your ears, Mute is enabled at startup. Set the volume low and click Unmute before listening.

The Python source code is available on request

Marine VHF Scanner: A general purpose narrowband VHF scanner
Marine VHF Scanner: A general purpose narrowband VHF scanner

AI Disclaimer: This program was generated entirely by Claude.

Tweet
Share
Reddit
Vote
Email

LakeShark: P25 Phase 1, FM, POCSAG, ADS-B and Sub-GHz with an RTL-SDR on the LilyGO T-Display P4 (ESP32-P4)

Thank you to Samuel Reynolds (aka SAMS0N1TE on GitHub), for writing in and sharing with us his project called 'LakeShark'. LakeShark is firmware for the LilyGO T-Display P4 (an ESP32-P4-based microcontroller with a 4.1 Inch touchscreen, detachable keyboard, GPS, and nine-axis motion sensor), which allows a USB-connected RTL-SDR Blog V3 or V4 to be used for P25 Phase 1 trunking, FM, POCSAG, ADS-B, and sub-GHz capture. Samuel writes:

LakeShark supports P25 Phase I conventional and trunked voice, analog FM, POCSAG pager decoding and 1090 MHz ADS-B, with a spectrum display and waterfall for tuning around.

There are a few other things that might interest your readers:

  • Passive sub-GHz pulse recording with export to Flipper .sub files, so captures can be transferred to a Flipper and opened in its Sub-GHz app.'
  • Offline maps showing aircraft and MeshCore nodes, plus GPS track recording with GPX export.
  • Mixed P25/FM scan lists and a field journal for saving notes with radio readings, position and sensor data.
  • MeshCore messaging and LoRa experiments using the onboard SX1262. The optional MIX-RF keyboard adds CC1101, nRF24 and NFC tools.

The T-Display-P4 touchscreen works on its own, but you can also use the keyboard or connect a Flipper Zero over Bluetooth. LakeShark also supports a headless ESP32-P4 Nano receiver controlled from the Flipper. That lets you keep the radio and antenna in a bag while tuning from the Flipper.

Version 2.2.0 is available now. Experimental work includes manually tuned P25 Phase II decoding, HackRF support and GPS-based scan filtering. Those have separate limitations documented in the wiki. Next steps include live-RF validation, Phase II automatic call following and further work on portable power and everyday usability.

There’s also an experimental CELL WATCH app for surveying cellular-band activity and comparing it against a saved baseline. It’s meant for spotting changes worth investigating, rather than identifying a cell site as malicious or claiming to detect an IMSI catcher.

LakeShark builds on xtrsdr, OP25 and other open-source projects. ADS-B Scope also provided a reference for part of the aircraft position decoding. Full credits are in the README.

Showcase, photos and overview:
https://terminalbay.com/?m=lakeshark-showcase

Source and credits:
https://github.com/SAMS0N1TE/LakeShark

Version 2.2.0 downloads:
https://github.com/SAMS0N1TE/LakeShark/releases/tag/v2.2.0

Flipper companion app:
https://github.com/SAMS0N1TE/LakeShark-Flipper

Wiki and guides:
https://terminalbay.com/?m=wiki

LakeShark is part of a growing repertoire of ESP32-P4 microcontroller RTL-SDR applications. Just last week we posted about OrcSDR, a standalone RTL-SDR application built around the M5Stack Tab5. Back in May, we also posted about a portable open-source 1090 MHz ADS-B firmware for the LILYGO T-Display-P4.

Previously, RTL-SDR applications have only run on full general-purpose CPUs running an OS like Windows/Linux/MacOS/Android. But the ESP32-P4 has shown that commodity microcontrollers are now powerful enough to run an RTL-SDR too, via custom bare-metal drivers and software.

LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).
LakeShark running on A LilyGO T-Display-P4 next to a HackRF (left) and a Flipper Zero (right).
LarkShark Screens
LarkShark Screens
Tweet
Share
Reddit
Vote
Email

Automating Indoor RF Heatmapping with a PlutoSDR, Raspberry Pi 5 and LiDAR SLAM

Researchers at Tokyo City University in Japan recently showed in an academic paper how indoor mapping via LiDAR SLAM (simultaneous localization and mapping) and SDR can be combined to generate accurate indoor RF heatmaps. Mapping WiFi reception in indoor spaces can be challenging because accurate indoor localization is often lacking (GPS doesn't work), so it is usually done through manual measurements.

In this system, the researchers used a Raspberry Pi with a LiDAR sensor and Google Cartographer SLAM running on a connected PC to automatically locate and map out the indoor space. At the same time, a PlutoSDR measures the WiFi SNR. The result is a relative SNR WiFi heatmap.

They then derive a 3D model from the collected LiDAR SLAM data and put it into an RF ray-tracing simulation. Finally, they compared their real-world results with the ray-tracing simulation and found the results matched.

Combining LiDAR SLAM + WiFi SNR Measurements for Indoor Signal Strength Mapping
Combining LiDAR SLAM + WiFi SNR Measurements for Indoor Signal Strength Mapping
Tweet
Share
Reddit
Vote
Email

InjectEave: Eavesdropping on Headphones by Injecting a Carrier and Listening to the Modulated Retransmission

Researchers from the Hong Kong University of Science and Technology (Guangzhou) and the Hong Kong Polytechnic University recently published a paper titled "Injected and Leaked: Actively Inducing Side-Channel Leakage Using Electromagnetic Injection and Hardware Nonlinearity".

The paper describes how an attacker can use a directional antenna to transmit a carrier signal toward an electronic device, where nonlinearities in its components modulate the signal, which connected cables then re-radiate as unintentional antennas. The attacker can then receive the modulated carrier at the same frequency as it is transmitted and demodulate the modulated sidebands.

The Injecteave Process
The Injecteave Process

In their experiments, they used a USRP B210 software-defined radio to transmit the CW injection signal at anywhere from 0 to 8 MHz (the exact frequency for a device is not specified in the paper for ethical considerations), and a spectrum analyzer to receive the injection-induced EM leakage. The spectrum analyzer demodulates the received mixed signal, then routes the baseband to a PC for further processing. They show how various wired and wireless headphones exhibited injection-induced leakage via the amplifier, and how landline desk phones, smart fans, and lamps were also susceptible.

They also show a real-world application where they eavesdropped on audio from headphones and desk phones through walls in a hotel, meeting room, and office.

Update: Thanks to a commenter for pointing out the InjectEave demo page at https://injecteave.github.io.

InjectEave: Real World Examples
InjectEave: Real World Examples
Tweet
Share
Reddit
Vote
Email