Category: Applications

Khanfar Software: Analog Radio Hunter

Recently, M. Khanfar released a new free program, "Analog Radio Hunter," described as a "professional RF analysis and monitoring application built around GNU Radio and Fosphor." The software currently supports RTL-SDR, Airspy, and HackRF. Khanfar writes:

Analog Radio Hunter is a professional RF analysis and monitoring application built around GNU Radio and Fosphor.

It is designed to scan large RF spans, quickly lock onto active signals, and monitor analog transmissions with NFM, AM, or WFM audio demodulation.

  • Real-time FFT + waterfall spectrum display
  • Fast scan with dwell, pause-on-squelch, and skip-ignored channels
  • Detection list with hits, timestamps, and smart deactivation
  • Favorites profiles with monitor and favorites-only scan modes
  • Built-in recorder with auto-record and event log
  • Dedicated WFM broadcast receiver with presets
  • Multi-SDR device support (RTL-SDR, Airspy, HackRF) with auto-detect and device switching
  • NFM and AM audio demodulation (in addition to WFM)
  • Peak-follow in span (auto-tune to strongest signal inside the current MS/s window)
  • Frequency list filtering to skip/mute ignored channels
  • Scan and detection profiles (save/load named presets)
  • PPM correction for RTL-SDR calibration
  • Spectrum interaction controls (cursor readout, click-to-tune, wheel step, drag-pan)
  • Recorder options (record when muted, timestamp/frequency in filename, beep on favorite)
  • WFM de-emphasis selection (50/75 µs) and preset management
  • Audio Output menu with refresh (route audio to speakers, VB-Cable, or USB output)
  • Signal Stability Filter with Min Open + Grace timing and per-target routing
  • Histogram IQ Rec with live IQ follow controls and inspectrum integration
  • Auto Squelch Calibrate (noise floor + margin) for faster field setup
  • Smart Deactivate dual-layer logic (time-based + hit-rate busy rule)
  • Favorites cooldown auto-reactivation for busy channels
  • Favorite TX tones (Tone 1-9), edge selection, and tone test buttons
  • Learning Mode hover guidance for faster onboarding
  • Status bar live metrics for Last, Active, Favorite, Peak SNR, and Level
Unique scanning and detection approach: Traditional sweep scanners only see the center frequency they step to. Analog Radio Hunter monitors an entire chunk of spectrum at once and reacts to peaks inside it. That is a major differentiator.
 

High-Impact Capabilities

  • Wide-span reactive scan engine that hunts activity across a full chunk, not one center point at a time.
  • One-click IQ capture and histogram visualization with follow and idle flow controls.
  • Carrier-resilient channel management using Smart Deactivate + favorites cooldown logic.
  • Field-ready setup speed using Auto Cal squelch and persistent live status metrics.
  • Operator-selectable audio routing to speakers, VB-Cable, or USB audio output devices.
  • Operational clarity from GUI color heatmaps, scan debug reasons, and learning-mode tips.

Signal Stability Filter: Logic and Tuning

  • Purpose: reject short squelch flicker and noisy open/close chatter before actions trigger.
  • Min Open (ms): raw squelch must stay open this long before stable-open is accepted.
  • Grace (ms): stable-open is held briefly after raw close to avoid tiny dropouts.
  • Apply targets: Detection, Rec+Alerts, Scan Hold, and optional Audio Out gating.
  • Start values: Min Open 150-250 ms, Grace 40-80 ms, then tune by channel behavior.

Like his other software, which we previously covered, it is free but not open source. Anti-virus programs may flag the software as suspicious due to heuristics. We believe this to be a false positive, but as with all software that isn't open source, we recommend being highly suspicious and only run it in a sandboxed environment like a VM to be sure.

M Khanfar Analog Radio Hunter
M Khanfar Analog Radio Hunter

Iridium-Sniffer: A Standalone Iridium Satellite Burst Detector and Demodulator

Thank you to Aaron, who is most well known for creating the DragonOS distribution, for writing in and sharing with us a new open-source program he's recently released over on GitHub.

The program is called 'Iridium-Sniffer', and it is a standalone Iridium satellite burst detector and demodulator written in C. Typically, gr-iridium has been used for Iridium demodulation in the past, but it can be clunky and slow on lower-power embedded systems like the Raspberry Pi, as it requires the large GNU Radio dependency.

The program is compatible with iridium-toolkit, which performs the actual decoding and analysis of the Iridium packets demodulated by iridium-sniffer.

If you're not familiar with it, Iridium is a large global communications satellite constellation that provides services such as voice, messaging, and data. An antenna like our RTL-SDR Blog Active Patch antenna, combined with an SDR, can be used to receive these signals. Some data on Iridium is encrypted, but there is some unencrypted data that can be decoded when combining tools like iridium-sniffer and iridium-toolkit.

Iridium-sniffer is compatible with the HackRF, BladeRF, USRP (UHD), and SoapySDR (which includes RTL-SDR). Note that higher-bandwidth SDRs can receive much more of the ~30 MHz Iridium band, and therefore decode more data at once.

The Iridium Satellite Constellation
The Iridium Satellite Constellation

Multimon Pager Decoding on Android

Sarah (aka SignalsEverywhere) has recently released another open-source Android app that enables the multi-signal decoder Multimon-ng to be used on Android. Multimon-ng is a commonly used decoding app, that supports various protocols such as POCSAG/FLEX pagers, as well as DTMF, ZVEI, EAS and more.

The app requires the SDR++ Android app to be running in the background with an SDR like an RTL-SDR connected. The role of SDR++ is to receive the signal and send the demodulated audio over a network connection to the Multimon-NG app, which performs the final decoding.

The app APK can be downloaded from Sarah's website via a minimum $0 donation, or alternatively, built and installed from source.

Multimon-ng on Android!

Setting RF Based Atomic Clocks via Computer Speakers

Over on YouTube, Jeff Geerling has uploaded an interesting video showing how RF-based atomic clocks can be set via signals generated from a computer speaker. In the USA, RF-based atomic clocks typically receive their atomic time signal from the WWVB 60 kHz longwave radio station, operated near Fort Collins, Colorado. In other countries, different time signal transmitters operate on different frequencies. However, these time signals cannot be received everywhere due to interference or geographic limitations, making RF atomic clocks useless in these situations. 

As Jeff points out, a Time Station Emulator program can be used to locally emulate the WWVB or other time signals, which, while not providing atomic time accuracy, could still make these clocks useful again.

Most interestingly, the emulator program requires no special RF transmission hardware. Instead, it simply uses your computer speakers to broadcast the time signal.

By carefully crafting a waveform at a specific audio frequency (out of normal human hearing range), the digital-to-analog converter will generate higher frequency RF harmonics, and one harmonic will match the time signal frequency required by the RF-based atomic clock. The wires running to the speakers, and the speakers themselves, will act as antennas, leaking these harmonics into the surrounding environment. This means that cheaper unshielded speakers, such as those found in phones and tablets, tend to work better.  

In the video, Jeff uses a HydraSDR and an upconverter to receive the time signal generated by the speakers. While the time signal cannot be seen on the spectrum itself, in the demodulated audio, you can hear the signal's pulses.

Van Eck Phreaking time to atomic clocks

Pocket 25: An Android P25 Phase 1 Digital Voice Radio Decoder

Thank you to reader "EN53" for submitting news about a newly released open source Android app called Pocket 25. Pocket 25 is an Android-based APCO Project 25 (P25) phase 1 digital voice decoder based on the DSD-Neo decoder engine. It was developed by Sarah Rose (aka SignalsEverywhere), whose other software we have posted about in the past.

APCO P25 phase 1 trunked digital voice systems are commonly used in the United States, Canada, Australia, and other countries by emergency services. As long as the P25 network is unencrypted, it is commonly decoded to audio with an RTL-SDR and decoding software such as DSDPlus or SDRTrunk.

Pocket 25 allows users to now decode P25 signals on portable Android devices. An RTL-SDR can be connected to an Android device via a USB-OTG cable, or a remote networked RTL-SDR can be used via an rtl_tcp connection. The app also supports RadioReference accounts, automatic GPS site hopping, smart filtering, and logging.

In the readme, Sarah also notes that, because Pocket 25 is based on the DSD-Neo engine, it supports additional digital voice protocols, including DMR, NXDN, and others. However, the interface is designed around P25, so non-P25 systems may show incorrect metadata.

The software is open source and code can be found on the GitHub. There is also an active discussion about the app on RadioReference.

Pocket25 | Running DSD-Neo on Android!

Telive osmo-tetra-sq5bpf: An Experimental TETRA Decoder that Enables Voice Decryption (If You Have the Key)

Thank you to Jacek / SQ5BPF for letting us know that he's recently released a modified version of the Telive TETRA decoder for Linux. The modification allows the user to listen to TEAx-encrypted voice signals if they have the decryption key. Typically, if a TETRA signal is encrypted, there is no way to listen to it, unless you have obtained the decryption key from the network operator, or extracted it from TETRA keyloader hardware.

But because the TEA1 encryption was broken due to a backdoor being discovered in 2023, he has also added support for using the 32-bit short key directly, which can be automatically recovered from TETRA traffic using his other software called teatime. TEA1 encryption is being phased out, but many deployments still use it.

The software is designed for advanced users to compile and run, so very little documentation is provided. However, there is a blog post here that explains the overall steps. Some additional information can be found on SQ5BPF's RadioReference post here.

TETRA Decoding (with telive on Linux)
TETRA Decoding (with telive on Linux)

Web-Spectrum: Web-Based Spectrum Analyzer and GPS Signal Analyzer with RTL-SDR Support

Over on GitHub we've recently seen a new open source program release called "web-spectrum". Web-spectrum is a multi-purpose browser-based tool. One interesting feature is that it allows you to view the GNSS spectrum (via a connected RTL-SDR or SDRplay with an appropriate antenna), decode it to a position, and also analyze the signal for jamming. It uses gnss-sdr or Gypsum as the backend GNSS processing tool.

The tool can also be used as a real-time spectrum analyzer, and for this, it supports RTL-SDR and SDRplay as well as the tinySDR Ultra spectrum analyzer.

Finally, in addition to GPS decoding, it also supports ADS-B and ISM band decoding.

Web-Spectrum: A Browser based tool for spectrum analyzer, GNSS analysis, and ADS-B and ISM band decoding.

Open.Space: An Open Source SDR Based Phased Array for Bouncing Signals off the Moon

Open.space is an upcoming open-source project aiming to unlock affordable earth-moon-earth (EME) bounce communications for the amateur radio public. To achieve this, they have designed a software-defined radio-based tiling system that allows people to easily create phased arrays.

EME (Earth–Moon–Earth) bouncing is a part of the amateur radio hobby that typically involves using (~1m - 3m diameter) high-gain dish antennas to transmit a signal toward the Moon, reflect it off the Moon’s surface, and have it received by a distant contact on Earth with similar hardware.

A phased array consists of a grid or lattice of many small antennas working together in sync. By applying tiny delays between elements and combining their signals, the array can make radio waves add up in one chosen direction and cancel in others. This lets software steer the receive/transmit beam electronically (no motors or moving parts), improving sensitivity and reducing interference. Compared to a dish antenna, it can scan and track targets much faster, form multiple beams if needed, and is compact and low-profile without physically turning. A common phased-array antenna many may have used before is a Starlink antenna.

A single open.space tile consists of a 4x4 MIMO SDR and four antennas. The SDR's frequency range covers 4.9 - 6.0 GHz, and it has 40 MHz of bandwidth via an 8-bit ADC. The tiles can be used on their own as a general SDR, for radio direction finding, as an Open-Wi-Fi router, as a 4G/5G basestation, or for drone HD links and robotics communications.

Multiple tiles can also be combined in a lattice shell to form the "Mini" starter phased array, which consists of 18 tiles. With the Mini phased array, you can achieve 60 degrees of beam steering, up to 34 dBi of gain, and 52.6 dBW of EIRP transmit power. The Mini is not large enough for EME, but upgrading to "Moon", which consists of 60 tiles, makes EME possible. "Moon" gets you 60 degrees of beam steering, up to 39.3 dBi gain, and 63.1 dBW transmit power.

This sounds expensive, but each tile is actually slated to cost only US$49-US$99. The Mini is priced at US$899 - US$1499, and the "Moon" at US$2,499 - US$4,999.

The Open.space hardware has not yet been released for sale, but the website indicates March 2026 as the expected shipping date. You can sign up to their email list on their website for updates.

Open Space. Left: EME Concept, Middle: Single Tile, Right: Moon Phased Array consisting of 60 tiles.
Left: EME Concept, Middle: Single Tile, Right: Moon Phased Array consisting of 60 tiles.