Marine VHF Scanner: A General Purpose Narrowband Receiver and Scanner for the RTL-SDR

Thank you to Wolfgang (OE1MWW) for writing in and sharing with us his software called "Marine VHF Scanner". Although its title suggests it's a Marine band scanner, Wolfgang notes that he has since evolved it into a general-purpose narrowband scanning tool. Wolfgang writes:

Marine VHF Scanner began as a purpose-built receiver for VHF marine channels using an RTL-SDR USB receiver.

It has evolved into a general-purpose narrowband receiver and scanner. User-editable channel databases support marine, airband (AM), 2 m and 70 cm amateur radio (FM), and other AM/FM services within the RTL-SDR tuning range of approximately 24 MHz to 1.7 GHz.

Recent additions include manual and unattended frequency-range sweeps (Section 4.7) and two configurable keyboard hotkeys (Section 4.8) for quickly saving interesting frequencies.

A note on its development
Although the project consists of around 4,000 lines of Python code, I did not write those lines myself. The code was generated - completely - by Claude.ai under my supervision. I developed it iteratively by specifying features, requesting changes, and reporting operational logic errors (views, handling etc.) until reaching Version 6.6.17.

Unique features

  • Pre-recording and recording to WAV files (where permitted by local laws!)
  • Frequency-range scan in Discovery Mode, registering and storing where signals have been heard
  • Frequency-range scan with automatic stop on detected signals - Continue button to go to the next signal.
  • Dual-channel monitoring (helpful for duplex split-frequency stations)
  • Remembers recent settings, the last-used database, and window position
  • Priority Channel button (the same frequency must be twice in the database, once marked PriCh)
  • Database editor for the CSV frequency database
  • JSON settings editor for viewing and editing configuration files

The ZIP package includes English and German manuals and additional documentation.

Download: http://oe1mww.work/marine_vhf_scanner.v6.6.17.zip

The program is supplied as a compiled Windows executable (.exe), together with configuration files (.json), example frequency databases (.csv), recent rtlsdr.dll files, and detailed documentation in the ZIP package.

No Python installation is required. Download, unzip – read the manuals – start it!

To protect your ears, Mute is enabled at startup. Set the volume low and click Unmute before listening.

The Python source code is available on request

Marine VHF Scanner: A general purpose narrowband VHF scanner
Marine VHF Scanner: A general purpose narrowband VHF scanner

AI Disclaimer: This program was generated entirely by Claude.

LakeShark: P25 Phase 1, FM, POCSAG, ADS-B and Sub-GHz with an RTL-SDR on the LilyGO T-Display P4 (ESP32-P4)

Thank you to Samuel Reynolds (aka SAMS0N1TE on GitHub), for writing in and sharing with us his project called 'LakeShark'. LakeShark is firmware for the LilyGO T-Display P4 (an ESP32-P4-based microcontroller with a 4.1 Inch touchscreen, detachable keyboard, GPS, and nine-axis motion sensor), which allows a USB-connected RTL-SDR Blog V3 or V4 to be used for P25 Phase 1 trunking, FM, POCSAG, ADS-B, and sub-GHz capture. Samuel writes:

LakeShark supports P25 Phase I conventional and trunked voice, analog FM, POCSAG pager decoding and 1090 MHz ADS-B, with a spectrum display and waterfall for tuning around.

There are a few other things that might interest your readers:

  • Passive sub-GHz pulse recording with export to Flipper .sub files, so captures can be transferred to a Flipper and opened in its Sub-GHz app.'
  • Offline maps showing aircraft and MeshCore nodes, plus GPS track recording with GPX export.
  • Mixed P25/FM scan lists and a field journal for saving notes with radio readings, position and sensor data.
  • MeshCore messaging and LoRa experiments using the onboard SX1262. The optional MIX-RF keyboard adds CC1101, nRF24 and NFC tools.

The T-Display-P4 touchscreen works on its own, but you can also use the keyboard or connect a Flipper Zero over Bluetooth. LakeShark also supports a headless ESP32-P4 Nano receiver controlled from the Flipper. That lets you keep the radio and antenna in a bag while tuning from the Flipper.

Version 2.2.0 is available now. Experimental work includes manually tuned P25 Phase II decoding, HackRF support and GPS-based scan filtering. Those have separate limitations documented in the wiki. Next steps include live-RF validation, Phase II automatic call following and further work on portable power and everyday usability.

There’s also an experimental CELL WATCH app for surveying cellular-band activity and comparing it against a saved baseline. It’s meant for spotting changes worth investigating, rather than identifying a cell site as malicious or claiming to detect an IMSI catcher.

LakeShark builds on xtrsdr, OP25 and other open-source projects. ADS-B Scope also provided a reference for part of the aircraft position decoding. Full credits are in the README.

Showcase, photos and overview:
https://terminalbay.com/?m=lakeshark-showcase

Source and credits:
https://github.com/SAMS0N1TE/LakeShark

Version 2.2.0 downloads:
https://github.com/SAMS0N1TE/LakeShark/releases/tag/v2.2.0

Flipper companion app:
https://github.com/SAMS0N1TE/LakeShark-Flipper

Wiki and guides:
https://terminalbay.com/?m=wiki

LakeShark is part of a growing repertoire of ESP32-P4 microcontroller RTL-SDR applications. Just last week we posted about OrcSDR, a standalone RTL-SDR application built around the M5Stack Tab5. Back in May, we also posted about a portable open-source 1090 MHz ADS-B firmware for the LILYGO T-Display-P4.

Previously, RTL-SDR applications have only run on full general-purpose CPUs running an OS like Windows/Linux/MacOS/Android. But the ESP32-P4 has shown that commodity microcontrollers are now powerful enough to run an RTL-SDR too, via custom bare-metal drivers and software.

LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).
LakeShark running on A LilyGO T-Display-P4 next to a HackRF (left) and a Flipper Zero (right).
LarkShark Screens
LarkShark Screens

Automating Indoor RF Heatmapping with a PlutoSDR, Raspberry Pi 5 and LiDAR SLAM

Researchers at Tokyo City University in Japan recently showed in an academic paper how indoor mapping via LiDAR SLAM (simultaneous localization and mapping) and SDR can be combined to generate accurate indoor RF heatmaps. Mapping WiFi reception in indoor spaces can be challenging because accurate indoor localization is often lacking (GPS doesn't work), so it is usually done through manual measurements.

In this system, the researchers used a Raspberry Pi with a LiDAR sensor and Google Cartographer SLAM running on a connected PC to automatically locate and map out the indoor space. At the same time, a PlutoSDR measures the WiFi SNR. The result is a relative SNR WiFi heatmap.

They then derive a 3D model from the collected LiDAR SLAM data and put it into an RF ray-tracing simulation. Finally, they compared their real-world results with the ray-tracing simulation and found the results matched.

Combining LiDAR SLAM + WiFi SNR Measurements for Indoor Signal Strength Mapping
Combining LiDAR SLAM + WiFi SNR Measurements for Indoor Signal Strength Mapping

InjectEave: Eavesdropping on Headphones by Injecting a Carrier and Listening to the Modulated Retransmission

Researchers from the Hong Kong University of Science and Technology (Guangzhou) and the Hong Kong Polytechnic University recently published a paper titled "Injected and Leaked: Actively Inducing Side-Channel Leakage Using Electromagnetic Injection and Hardware Nonlinearity".

The paper describes how an attacker can use a directional antenna to transmit a carrier signal toward an electronic device, where nonlinearities in its components modulate the signal, which connected cables then re-radiate as unintentional antennas. The attacker can then receive the modulated carrier at the same frequency as it is transmitted and demodulate the modulated sidebands.

The Injecteave Process
The Injecteave Process

In their experiments, they used a USRP B210 software-defined radio to transmit the CW injection signal at anywhere from 0 to 8 MHz (the exact frequency for a device is not specified in the paper for ethical considerations), and a spectrum analyzer to receive the injection-induced EM leakage. The spectrum analyzer demodulates the received mixed signal, then routes the baseband to a PC for further processing. They show how various wired and wireless headphones exhibited injection-induced leakage via the amplifier, and how landline desk phones, smart fans, and lamps were also susceptible.

They also show a real-world application where they eavesdropped on audio from headphones and desk phones through walls in a hotel, meeting room, and office.

Update: Thanks to a commenter for pointing out the InjectEave demo page at https://injecteave.github.io.

InjectEave: Real World Examples
InjectEave: Real World Examples

Bluewatch: Detecting new Bluetooth Devices in your Neighbourhood via a Raspberry Pi

Thank you to p0larpatch for writing in and sharing with us his project called "Bluewatch," which uses a Raspberry Pi to detect when new Bluetooth devices appear in your neighborhood. While Bluewatch doesn't use an SDR and only uses a standalone Raspberry Pi, it may still interest our readers. p0larpatch explains the project below:

Get alerts when new Bluetooth devices appear in your local neighbourhood.

The real strength shows up once you actually start using it: categorize the devices you already know, your own phones, your TV, the smart plugs, the neighbour's robot lawnmower, whatever's expected around you, and BlueWatch filters all of that familiar traffic out of the way.

What's left standing out is the interesting part: the moment an unrecognized device enters the radio range of whatever's running BlueWatch, it surfaces immediately instead of being buried under dozens of devices you've already triaged.

The dashboard stops being a wall of MAC addresses and turns into an actual presence radar for your surroundings. You notice the one device that doesn't belong, not the fifty that do.

Bluewatch Screenshot: Detecting Bluetooth Devices
Bluewatch Screenshot: Detecting Bluetooth Devices

Frugal Radio: A Six SDR Setup with KrakenSDR and SDRplay for ADSB, ACARS, VDL2, P25

Over on YouTube, Rob from the 'Frugal Radio' channel has uploaded a video showing his multi-SDR monitoring setup that consists of a KrakenSDR, SDRplay RSP1A, and a cheap 12-year-old computer. The KrakenSDR is a 5-channel coherent SDR based on RTL-SDRs, and when connected to a computer, it appears as five independent RTL-SDRs that you can use for any purpose.

Rob currently uses three out of the five channels on the KrakenSDR to monitor three aviation digital signals: ADS-B, ACARS, and VDL2. The SDRplay is used on the same PC to monitor a 700 MHz P25 digital voice system. Rob uses the ADSB.im Docker image, which lets users feed multiple flight aggregation services, such as ADSBExchange, FlightRadar24, FlightAware, etc., all on one device. 

In the future, Rob hopes to add Inmarsat L-band reception with the spare channels on the KrakenSDR, which will be received by a Discovery Dish.

6 x SDR, 4 x monitor PC decoding ADSB, ACARS, VDL2, P25

SDR–: A Software-Defined Radio Application with Visual Signal Path

Thank you to Julian for writing in and sharing with us his interesting project called SDR-- (SDR minus minus). SDR-- is an open-source app that lets you wire devices, decoders, and displays together on a desktop window or browser-based canvas. It is described as "a software-defined radio application with a visual signal path. Connect devices, decoders, displays, and recorders on a canvas, then pin the controls you use to a rack."

A separate Rust server, which can sit on the same PC or a remote computer (like a Raspberry Pi), handles the DSP. Julian notes that SDR-- has native RTL-SDR support, and decoders for ADS-B, AIS, POCSAG, FT8, SSTV, and RDS are already implemented, with more in progress. The app also has a built-in signal generator and a repository of IQ recordings that can be used for experimentation and testing the various decoders.

The project releases are available on GitHub releases, and they cover Windows, Linux, and MacOS. 

SDR-- Screenshot
SDR-- Screenshot

AVARE ADS-B Receiver for Android Updated

All the way back in 2014, we posted about Avare ADS-B Receiver, which back then was a simple RTL-SDR ADS-B receiver and map for Android devices. The author of this app, TFL, recently wrote in and shared that the app is now a modern, fully featured ADS-B app, having added many new features such as UAT decoding with aviation weather products and NEXRAD weather radar/lightning strikes shown on the map, aircraft pictures, better SDR support, traffic filters, and audio alerts.

ADSB Receiver lets you collect live air traffic data directly on your Android device using any RTL-SDR (RTL2832U) dongle and an OTG cable. No cloud. No fees. Just raw RF decoded in real time.

  • Dual-band reception — 1090 MHz Extended Squitter (ES) for worldwide traffic, and 978 MHz UAT for US general aviation traffic plus integrated weather products (METAR, TAF, PIREP, SIGMET, AIRMET, WINDS, NOTAM)
  • Live aircraft details — tap any target on the map to pull a live photo alongside aircraft type and registered operator
  • NEXRAD weather imagery — receive official NEXRAD radar images over UAT 978 MHz
  • Network send/receive
    • Forward all received data to any GDL90-capable EFB app (AvareX, ForeFlight, iFlyGPS, DroidEFB, and others)
    • Stream dump1090/dump978 frames to any SDR tool on your network, or ingest from an external source
  • Bias Tee and Gain support — power an external LNA or active antenna, adjust Gain as needed
  • Proximity alerts — configurable range-based traffic warnings with optional callsign filtering; useful for drone pilots monitoring airspace
  • Data logging — save all received data
  • Metric support — instead of imperial values

Webpage: https://hiz.ch/index.php/adsb-receiver-avare-adsb

Play Store Links:

https://play.google.com/store/apps/details?id=bs.Avare.ADSB
https://play.google.com/store/apps/details?id=bs.Avare.ADSB.Pro

AVARE ADS-B Receiver Android App
AVARE ADS-B Receiver Android App