Category: Digital Signals

TunerScope: A Browser App to Help Optimize HDTV Antenna Positioning with an RTL-SDR

Thank you to Luke Berndt for writing in and sharing with us a new RTL-SDR browser-based app he's created called TunerScope. TunerScope is a spectrum analyzer program that focuses on helping users in areas with ATSC digital TV achieve perfect HDTV antenna positioning.

The app runs entirely in a Chrome browser, so you can just connect your RTL-SDR to your device, browse to https://tunerscope.com, and start using the app instantly. 

TunerScope has a few interesting features, including the use of spectrum stitching to visualize the full 6 MHz + wide ATSC signals as the RTL-SDR only provides 2.56 MSPS max, multipath detection via in-channel flatness, a snapshot reference trace to see how well your antenna movements are helping, an SNR reading, location-aware channel labeling and a tower map, and a channel list view.

We note that from what we can gather, this app appears to be designed for the US only and may only support ATSC signals and FCC lookups for the location aware features.

AI-Disclaimer: From a comment on the YouTube video it appears TunerScope was developed with Claude. 

I got better HDTV using an SDR

CellScope: LTE Sniffing on Windows

Over on YouTube, Sarah from the SignalsEverywhere YouTube channel has uploaded a new video showing a new open-source program she's developed called CellScope, which is used for LTE sniffing. She notes that CellScope is essentially LTE Sniffer, but ported for Windows. CellScope needs a wideband SDR, and it currently supports LibreSDR B210 Clone, HackRF and the Airspy R2/Mini

LTE (aka 4G) is a modern mobile wireless standard used by cellphones for data. While it is encrypted, there is still some data transmitted in the clear, such as the devices connected to the cell site and how much data they are pulling down, if there is an active call on the cell site, and of course the data activity can be useful to monitor too. 

In the video Sarah shows CellScope in action, demonstrating it detecting a call from her phone and visualizing the data transfer activity from her device when pulling down data.

CellScope is open-source and available on GitHub. If you don't want to compile it yourself, the Windows executable can be purchased from her site for a minimum $0.00 donation.

CellScope: LTE Sniffing on Windows

isTRAIN: Detecting if a Train is Blocking a Local Crossing By Listening to Railroad Frequencies

Jhestyr takes pride in being punctual, but a local railroad crossing keeps getting in the way. Trains sometimes park across it for hours at a time, and there is no way to know one is sitting there until you have already driven out to it. Every wasted trip to the crossing and back out to an alternative route costs him a significant chunk of time and fuel.

This is why Jhestyr used two RTL-SDR dongles to build isTrain, an open source program that decodes End-of-Train brake pressure and motion telemetry on 457.9375 and 452.9375 MHz, transcribes railroad voice traffic in the 160 to 162 MHz band via Whisper, and fuses both sources into a single live verdict on whether the crossing is blocked.

The program generates a webpage that can be accessed, providing a YES/NO verdict on whether there is a train blocking the crossing. A live public instance of Jhestyr's isTrain webpage is available here https://istrain.jhestyr.net.

AI-Disclaimer: Jhestyr notes that the code was developed with a 60/40 agentic/human split.

The isTrain Web Interface
The isTrain Web Interface

War Driving for DECT Devices with a HackRF and Android Device

Over on her YouTube channel SignalsEverywhere, Sarah has uploaded an interesting video showing her doing a wardrive for DECT devices, with an Android device connected to a HackRF, running her own Android version of DECT toolkit. In the past, we also covered her DeDECTive software, which is a fully DECT scanner and voice decoder for Linux and the HackRF.

DECT is a digital wireless protocol operating at around 1.9 GHz, which is typically used by modern cordless home phones, baby monitors, headsets, intercoms, and more. If you are unfamiliar with the term wardriving, this is when someone drives around in a vehicle and looks for interesting signals around the area. Wardriving is typically associated with mapping out the local WiFi environment and looking for security flaws, but it can apply to any signal.

During her wardrive, Sarah finds mostly VTech cordless phones, but a few other models like 'Binatone' and 'RTX' pop up, which she suspects are headsets, one possibly from a local McDonald's. She notes that only one active call was found, although the video has voice decoding stripped out for privacy reasons. She also notes that no encryption was found to be enabled on any device, despite DECT supporting it. The Android App also records the GPS position of any found DECT devices on a map.

War Driving for DECT Devices

InmarScope: An Inmarsat AERO and STD-C Decoder with Multichannel Decoding and Automatic Call Following

Over on the SignalsEverywhere YouTube channel, Sarah Rose has released InmarScope, a multichannel L-band Inmarsat decoder that connects directly to an RTL-SDR, Airspy, or HackRF. The software can receive and decode both aeronautical (AERO) and maritime (STC-C / EGC) traffic at the same time. Decoders are dropped directly onto the aligned FFT and waterfall by holding CTRL and left-clicking, and the software lets you stack Aero MSK (600/1200 bps), high-rate OQPSK (10500 bps), AMBE voice (8400 bps), and Inmarsat-C BPSK decoders side by side.

One of the more interesting features is automatic voice-call following. By monitoring the 10500 baud forward-link channels, InmarScope can receive C channel voice assignments and automatically retune the SDR to the assigned frequency, lock the carrier, decode and record the AMBE call, and then hop back to where it was. There is also a two-SDR mode that dedicates a second radio to voice with a live split-view spectrum so one radio stays on the P control channel while the other tunes to voice calls. For assignments that never get broadcast, there is also a Call Hunter feature that uses a squelch threshold to automatically drop the decoder when a call appears. When a call is playing, the built in flight map also decodes the aircraft hex ICAO address and looks it up on airplanes.live, showing the plane's position and route in real time.

Recent updates have added a community-editable band plan, message search and filtering, an IQ recorder that also captures the seconds before you hit record, and a web dashboard for browsing decoded data from a phone.

The software is completely open source on GitHub, and the C++ code can be compiled from source, or a precompiled Windows build is available on sarasforge.dev for $15, with Sarah's Patreon patrons getting it free.

We note that Inmarsat signals such as AERO and STD-C/EGC can be received with our RTL-SDR Blog L-band Patch Antenna, which is available in our store.

Multi-Channel Voice Following Inmarsat Decoder for Windows!

Decoding Inmarsat in 2026

GopherTrunk: A New Pure-Go Trunked Radio Scanner Supporting P25, DMR, TETRA, NXDN and More

Thank you to Matt Cheramie, who wrote in to let us know about his new software called GopherTrunk, a new RTL-SDR compatible radio scanner that follows digital trunked-radio voice calls and decodes them into audio. Gopher Trunk runs on a pool of RTL-SDR dongles and ships as a single ~10 MB static binary for Linux, macOS, and Windows. There are no C dependencies, so neither librtlsdr nor libusb are required at build or runtime, which makes deployment on a fresh machine or Raspberry Pi very straightforward.

On the protocol side, GopherTrunk handles control-channel decoding for P25 (Phase 1 and 2), DMR, TETRA, NXDN, Motorola Type II, EDACS, LTR, MPT 1327, dPMR, D-STAR, and YSF. The voice path is written in pure-Go and implements IMBE and AMBE+2 vocoders directly, removing the dependency on external DVSI or mbelib. The interface is terminal-based, but also includes a full browser-based operator console. There is also a configuration importer that parses RadioReference.com PDF exports and CSV bundles straight into the daemon config.

Matt notes that while the engine is running end-to-end, he is looking for SDR enthusiasts to test it against real-air captures to help refine the on-air FEC layers and vocoder audio levels. Prebuilt releases and the quick start guide are available at gophertrunk.org/downloads, and the full source is on GitHub. Feedback and bug reports are very welcome if you give it a try.

Gopher Trunk: A New Digital Trunking Scanner for RTL-SDR written in Pure-Go
GopherTrunk: A New Digital Trunking Scanner for RTL-SDR written in Pure-Go

Student Arrested in Taiwan for using SDR and Handheld Radios to Halt Four High Speed Trains with TETRA Hack

The Taipei Times has reported that a 23-year-old university student in Taiwan has been arrested after using a software-defined radio and hand held radio to hack into Taiwan High Speed Rail Corporation's (THSRC) internal radio communications and halt four trains mid-service.

Chinese-language coverage from UDN and Newtalk fills in some details omitted in the English Taipei Times article. The system the student compromised is TETRA, and at 23:23 on April 5, 2026, the student transmitted a "General Alarm" (GA) signal, the highest-priority TETRA alert, which automatically instructs trains in the area to switch to manual emergency braking. Four trains were stopped for 48 minutes. THSRC's radio system has reportedly been in service for 19 years with seven verification layers, but parameters were apparently never meaningfully rotated over that period.

Police describe the suspect as buying an SDR online, connecting it between an antenna and a laptop, capturing THSRC traffic, and decoding the relevant parameters in software, then programming those parameters into one of his eleven handheld radios. A 21-year-old friend also allegedly supplied some critical THSRC parameters. The actual details of the 'hack' aren't entirely clear from the news articles. We suspect that the THSRC TETRA system is simply unencrypted, and that the student was able to spoof a legitimate signal. It's also possible that the THSRC TETRA system used TEA1 encryption, which is known to be broken. 

Police located the student through a combination of network-side TETRA logs and CCTV. When the THSRC control center called back to verify the alarm, the person on the other end gave contradictory answers and then powered the radio off, prompting THSRC to audit their handheld fleet, confirm every issued radio was accounted for in its storage locker, and report to police that the parameters had been cloned.

Base station logs from the THSRC TETRA infrastructure (which record which sites received the uplink, with multi-site signal strength narrowing the origin) were used to localize the transmission source, and CCTV from around the coverage area was then used to identify the student and trace him to his rental unit. Search warrants on 28 April seized 11 handheld radios, a laptop, and the SDR. 

He is currently out on NT$100,000 (3,200 USD) bail and faces up to ten years under Taiwan's Railway Act and Criminal Code, with an unconvincing "had it in my pocket and accidentally pressed the button" defense.

Stories like this are a reminder that experimenting with operational safety-of-life radio systems carries serious legal consequences. Back in 2016, we covered the case of Dejan Ornig, a Slovenian university student who used an RTL-SDR and the open source Osmocom TETRA decoder to discover that his country's police TETRA terminals were running unauthenticated, despite official documents stating otherwise. After seven years of court hearings, he ended up with a seven-month suspended sentence. More recently, we posted on the End of Train (EoT) vulnerability, where a security researcher demonstrated that an SDR can replicate the unauthenticated braking command on US freight trains.

The Equipment Seized by Police
The Equipment Seized by Police
A Taiwanese High Speed Train (Source: https://en.wikipedia.org/wiki/File:THSR_700T_TR17_20130907.jpg)
A Taiwanese High Speed Train (Source: https://en.wikipedia.org/wiki/File:THSR_700T_TR17_20130907.jpg)
Translated news graphic from https://udn.com/news/story/7315/9475450
Translated news graphic from https://udn.com/news/story/7315/9475450

P25-Survey: A Tool for Scanning and Logging P25 Control Channels with an SDR

Over on GitHub, programmer blantonl has released p25-survey, a Python tool that scans a frequency range with an RTL-SDR, Airspy or HackRF and identifies any P25 control channels present. For each one found, it logs the WACN, System ID, NAC, RFSS ID and Site ID, the full IDEN_UP band plan, neighbor sites with resolved frequencies, and signal quality metrics including RSSI, BER and decode rate.

The tool also has an optional RadioReference cross-reference mode that annotates results with the RR system name and site description, flags frequency offsets versus the database, and generates a Markdown submission report for data not yet in RadioReference. An auto-gain feature sweeps gain values on each confirmed control channel and recommends the optimal setting for your SDR and location based on BER.

P25 Survey Tool
P25 Survey Tool