Category: Digital Signals

Live TEA1 Decryption Support Added to an osmo-tetra Fork

Over on GitHub, su4am has published a fork of the well-known osmo-tetra-sq5bpf TETRA decoder that integrates TEA1 cipher support based on CVE-2022-24402. Back in 2023, we first posted about the TETRA TEA1 vulnerability discovery. Midnight Blue, a security research team, discovered this vulnerability as part of their TETRA:BURST research. The discovery found that a key-scheduling flaw reduces the effective keyspace from an impossible-to-brute-force 2^80 down to 2^32, which is small enough to brute force in a few minutes on a commodity GPU. This fork combines the osmo-tetra-sq5bpf TETRA decoder with Midnight Blue’s TETRA_crypto library so that recovered 32-bit keys are applied on the fly to encrypted voice bursts directly inside the decoder.

Importantly, we note that the fork does not crack keys by itself. The tetra-rx decoder outputs “key recovery candidate” tuples from the air, which you then feed into a separate GPU tool (SQ5BPF’s teatime) to actually brute force the reduced keyspace. Recovered keys are added to a keyfile and loaded live, so decryption begins on the next burst without restarting the pipeline. The fork also adds a dual-socket TRA output, letting you monitor decrypted and unencrypted traffic simultaneously with two telive-2 instances. 

We want to warn that intercepting or decrypting communications you are not authorized to receive is illegal in most countries.

TETRA Decoding (with telive on Linux)
TETRA Decoding (with telive on Linux)

Advanced FT8/FT4 DX Decoder: A Native FT8/FT4 Decoder Plugin for SDR++Brown on macOS

Thank you to ReLLL for writing in and sharing news about the release of his "Advanced FT8/FT4 DX Decoder", a free and open-source plugin for SDR++Brown running on Apple Silicon Macs. SDR++Brown is a popular unofficial fork of SDR++ that already includes some built-in FT8 decoding capabilities. This plugin builds on that and adds a full DX monitoring workspace directly inside the SDR software, so there is no need to pipe audio out to WSJT-X just to see who you’re hearing.

The plugin decodes FT8 and FT4 and plots received stations on a DX map. It also displays tables of unique stations, all decoded messages and countries heard, along with receiver SNR and approximate distances calculated from grid locators. Other features include table filtering and sorting, persistent CSV reception logging, optional waterfall notifications, and a WSJT-X format UDP output that can feed GridTracker directly. Decoding also continues in the background even when the plugin window is closed.

We note that the latest release also adds decoding for WSPR, FST4, FST4W and Q65. Note that the plugin is not intended for use with standard SDR++, or on Windows or Linux. Installation instructions are on the GitHub page, and a user guide is also available.

Advanced FT8/FT4 DX Decoder plugin for SDR++Brown
Advanced FT8/FT4 DX Decoder plugin for SDR++Brown

LakeShark Update: Using an LR2021 LoRa Chip as an SDR for Portable P25, POCSAG and FM Reception on the ESP32-P4

Back in September, we posted about LakeShark, Samuel Reynolds’ (aka SAMS0N1TE) T-Display P4 ESP32-P4 firmware that turns a USB-connected RTL-SDR into a handheld P25 Phase 1, POCSAG, and FM receiver.

Samuel has now written in to share news that with the T-Display P4 variant containing a Semtech LR2021 LoRa chip, LakeShark no longer needs an RTL-SDR at all. Instead, it can pull raw I/Q samples directly out of the built-in LR2021 LoRa transceiver chip and demodulate them on the ESP32-P4. Back in May, we posted Zoltán Papp and team's discovery that showed how an LR2021 could receive ADS-B. But this relied on the chip’s built-in OOK mode.

With raw I/Q available, the chip’s built-in modes no longer limit what it can receive. Both of the LR2021’s RF paths work, providing continuous coverage from 100 MHz to 2.74 GHz, and no upconverters, external tuners, or extra front-end hardware are used. The sample rate is relatively low at 250 Ksps max, meaning only a narrow bandwidth slice is available, but this is more than large enough for narrowband channels like P25. Samuel notes that it’s pretty unreal being able to listen to his local analog NFM fire department channels from such a low-power chip.

Smanuel notes that the LR2021 is still pretty new, and few products use them. However, it is possible to DIY a receiver for about $28 with Waveshare’s Core2021 LR2021 modules and their ESP32-P4-WIFI6 board. Samuel also has an experimental transmit path working, which has sent custom waveforms, temperature packets and P25 test-tone bursts. In one test, an independent receiver decoded 72 P25 voice frames from a single transmission and recovered the expected tone.

The radio access layer has been released as a separate project called LR2021-SDR. It includes a portable C library, capture firmware, waveform tools and measurements, along with graphs from a real received P25 call and a recording of the recovered transmit tone. The updated handheld firmware is available on the LakeShark GitHub.

LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).
LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).

OnAir Adds Decoder Support for Almost Every Signal

Just last week we posted about OnAir, a new open-source program that started out as an easy-to-use digital and analog TV decoder for software-defined radios. It also had support for a few digital modes like ADS-B, GNSS and DMR.

In the last week, with the obvious help of Claude AI, OnAir has added experimental support for almost every single analog and digital signal and application out there. Support ranges from digital voice modes like P25 and NXDN, to HF digital modes like HFDL, to aircraft signals like ACARS and VOR/ILS, to ocean radar, to a radio astronomy integrator, to satellite decoders like Iridium and Inmarsat, to cell tower metadata decoders to Wi-Fi and many many more.

Obviously, with these decoders all being vibecoded so quickly, there is no guarantee yet that they will all work as expected. However, we did give some decoders in the program a test with an RTL-SDR. A DMR control channel was successfully decoded, and it read the calls; ADS-B showed aircraft; LTE PCI values were detected with the LTE decoder; and POCSAG messages came in cleanly.

From our own experience with Claude, Opus 5.5 is very capable of vibe-coding decoders, so there is a high chance that most, if not all, of the decoders implemented in this software will work. 

OnAir Updated to Add Almost Every Decoder Possible
OnAir Updated to Add Almost Every Decoder Possible

AI Disclaimer: This software was coded with Claude AI.

SDR– Updated to V2.2: Many New Decoders, Tools and KrakenSDR Direction Finding and Beamforming Support Added

Last month we posted about the release of SDR-- (SDR minus minus), an open-source app that lets you visually wire together a receiver on a canvas. Since that time, Julian, the developer of SDR--, has been busy adding support for many decoders, various tools, and improving performance. Julian has also added KrakenSDR support, with radio direction-finding and beamforming blocks. Julian shares the following update for SDR-- V2.20:

New Decoders

  • Aviation and satellite: VDL2, HFDL, Inmarsat Aero and STD-C, Iridium, Drone Remote ID, 406 MHz beacons
  • Voice: TETRA, Tetrapol, GSM downlink, DECT, D-STAR, FreeDV, NXDN, dPMR
  • Data: LoRa (LoRaWAN, Meshtastic, MeshCore), ISM sensors, End-of-Train, DSC, BLE, Wi-Fi survey
  • Weather: NOAA APT, Meteor LRPT, WEFAX, radiosondes with landing forecast
  • Broadcast: DVB-T/T2, DVB-S2X, DAB packet mode, DRM with xHE-AAC

Coherent and mobile

  • Direction finding, beamforming and passive radar on the KrakenSDR
  • An iOS app with CarPlay for DF while driving is in TestFlight. Android is coming soon.

Hardware

  • Native Support: KrakenSDR, RTL-SDR Blog V4 Lite, AntSDR, PlutoSDR, SDRplay, Airspy, bladeRF and ESP-SDR
  • NanoVNA and antenna rotators
  • rtl_tcp and ADS-B Beast output for other apps

Tools

  • A satellite node with Doppler correction, plus a map with footprints and tracks
  • A spectrum monitor that classifies signals automatically, and a scanner with priorities and lockouts
  • Antenna calculator, noise figure, PER tester, SID monitor
  • Audio denoise, call recording, and a decoder log grouped by station
  • Event outputs: CSV, desktop notifications, PostgreSQL, InfluxDB

App

  • A redesigned UI with a unified look for every node
  • Multi-user editing, remote access from a browser, built-in HTTPS
  • An MCP server, so an AI assistant can build and tune a canvas

Performance

All measured on an M4 Max, full results at https://sdrmm.com/benchmarks:

  • DSP against GNU Radio:
  • FIR is 3.5x faster
  • NCO is 3x faster
  • FM demod is 4x faster
  • DDC is 1.6x faster
  • A 4096-point FFT is 1.6x faster than FFTW
  • Decoding rate in noise (48 trials per decoder across an SNR range):
  • ADS-B: 68%, against 56% for readsb and 50% for dump1090-fa
  • POCSAG: 73%, against 50% for multimon-ng
  • DMR: 81%, against 60% for dsd-fme
  • NXDN: 67%, against 23% for dsd-fme

(feel free to verify yourself with cargo xtask compare dsp)

The speed comes from hand-written SIMD kernels (NEON, AVX2, AVX-512), one shared downconversion for all channels on a radio, and a DSP path that never locks or allocates. The noise gains come from decoding IQ directly with
coherent receivers and soft decisions.

SDR-- Screenshot
SDR-- Screenshot

AI Disclaimer: This software is likely to be AI-assisted or vibe-coded.

ESPsoup: Turn an ESP32-C5 into a 2.4 & 5 GHz Pocket Scanner with a Connected Phone or PC

Thank you to Peter Holzhauser for writing in and sharing with us his latest open-source project, 'ESPsoup'. Peter has written in previously to share his Android app, V2X2MAP, which detects and plots vehicle V2X (car-to-car) communications used by some modern cars. His new project, ESPsoup, combines an ESP32-C5 and a connected PC or phone into a fully featured scanner for the 2.4 GHz and 5 GHz bands.

ESPsoup has various features including a live spectrum view up to 80 MHz wide, a sweep mode to monitor larger bandwidths, a GPS-enabled heatmapping tool, Bluetooth analysis tools, an AirTag detector, WiFI analysis tools, a car-to-car V2X monitor, a smart home sensor reader, a drone remote ID detector, a microwave oven detector, and an analog FPV video demodulator and display.

The website notes that if you want to monitor multiple FPV drone video channels, up to eight ESP32-C5s have been tested to work together on a single USB hub connected to a PC.

Peter notes that he is planning to add RTL-SDR support to ESPsoup in approximately two weeks, so keep an eye out on their website for updates.

ESPsoup screenshots from a mobile device.
ESPsoup screenshots from a mobile device.

HamRadioWeb FT8 WSJTx JTDX Remote Control Android App

Thank you to Patricio (LU5AKF) for sharing with us the release of HamRadioWeb.com's new FT8 WSJTx JTDX remote control Android app. Previously, we posted about HamRadioWeb's browser-based remote FT8 and FT4 receiver, and this Android app seems like a natural continuation of their software.

Patricio writes:

The app allows amateur radio operators to remotely control their JTDX or WSJT-X station from any Android phone or PC — no VPN, no port forwarding required.

What operators can do with it:

  • Monitor real-time FT8/FT4 decodes and band activity, just like sitting in front of JTDX or WSJT-X
  • Respond to CQ calls and transmit CQ remotely
  • Check where your signal is being heard via PSKReporter
  • Explore a worldwide activity map and a public DX spot page
  • Keep a contact log — auto-detected or manually added/imported
  • Follow community rankings and chat with other operators

The station connection is handled by a free Windows companion app (HamRadioWeb Companion) that links JTDX or WSJT-X to the user's account.

No radio at hand? The app opens in demo mode with simulated data so anyone can explore before creating an account.

Screenshots from the HamRadioWeb.com FT8 Remote Control App.
Screenshots from the HamRadioWeb.com FT8 Remote Control App.

Demod Analyzer: Analyze Digital Modulation (BPSK, QPSK, 16-QAM) in IQ Files

Thank you to Attila Zsellér, who has submitted his latest Python program called "Demod Analyzer". This program is designed for analyzing BPSK/QPSK/QAM16 signals in recorded IQ samples. Atilla writes:

I'm developing OpenStint, an SDR-based lap timing solution for rc racing and motorsport, which [RTL-SDR.COM] presented during the summer. Active transponders emit short bursts of data containing a unique id. By the time of reception, it's often full of various impairments. People are sometimes sending me IQ recordings for debugging purposes, and I was in need of a tool that can do a basic initial analysis on them, just to see if there is a chance of decoding anything.

It's a set of tools, doing a typical RX chain, with instant visual feedback:

  1. Segment the bursts of transmissions based on RSSI
  2. Apply phase/frequency offset (with an "auto" button that just works)
  3. Optional upsample + (matched) filtering
  4. Symbol synchronization
  5. Optional blind-EQ

It supports BPSK/QPSK/QAM-16. By the end of the process, you see the demodulated bits and MER & EVM figures.

There are sample recordings of actual transponders in the repository. It's Python, and the CI builds a Windows-variant. Images are in the github repository.

Demod Analyzer Screenshot
Demod Analyzer Screenshot

AI Disclaimer: The submitted notes that this program was created via vibe coding.