Category: HackRF

Sn0ren Tests the HackRF Pro Portapack H4M Pro

Over on YouTube, RF enthusiast sn0ren has posted a video reviewing the new 'HackRF Pro Portapack H4M Pro'. The HackRF Pro is the latest official version of the popular HackRF software-defined radio. It started shipping to customers back in January 2026, and it includes improvements such as improved noise figure measurements, a USB-C port, increased frequency limits, a TCXO, and an improved, flatter frequency response.

The Portapack H4M is currently the most recommended portapack product for the HackRF. A Portapack is a separate PCB board that piggybacks on a HackRF board and turns the HackRF into a portable device that can receive and transmit various signals in the field.

In the video, sn0ren starts by showing a performance comparison between the HackRF and HackRF Pro, noting increased signal strength with the HackRF Pro. The Portapack H4M Pro appears to mostly be a change in order to fit the new HackRF Pro PCB layout, but there are some minor improvements that sn0ren finds in the video, such as better buttons, a slightly larger case, a removable battery lid, metal screws, and a lanyard hole. 

The Biggest HackRF Upgrade in Over a Decade

Building a Homemade Weather Radar with a HackRF or PlutoSDR and Salvaged Automatic RV Dish

After nearly being hit by a tornado that NEXRAD didn't see coming, Koakno decided to build his own DIY self-contained mobile weather radar built from a $5 salvaged RV satellite dome, a HackRF or PlutoSDR, and open-source software. 

Koakno notes that NEXRAD (the US weather radar system) data is typically 4-6 minutes old, and from a radar station that is often 100+ miles away, resulting in warnings coming in too late or not being detected at all. Only professional local mobile Doppler radar trucks have the capability of detecting local tornadoes rapidly enough to take action. Koakno set out to recreate this capability on a budget.

His antenna consists of a salvaged Winegard Carryout Anser GM-5000 automatic satellite dome built for RV motor homes. The dish carries an LNB that radiates an 850 MHz signal at 10.4 GHz, which is a perfect wavelength for weather radar. The SDR hardware can either be a HackRF or PlutoSDR. As the HackRF is only half-duplex, it uses pulsed timing, whereas the full-duplex PlutoSDR uses a continuous FMCW chirp. Open-source Python software processes the results, producing a live radar display showing color-scaled reflectivity.

Importantly, Koakno addresses the licensing concerns around this project. He notes there are clauses in the amateur radio FCC legislation that support the use of automatically controlled beacons for the observation of propagation, and experimental activities in the 3cm 10.0 - 10.5 GHz amateur radio band, but he is not an attorney, so this activity may still exist in a grey area.

The screenshot below was generated via the simulation the software provides for testing the UI.

A Demo of the Weather Radar Display
A Demo of the Weather Radar Display

CellScope: LTE Sniffing on Windows

Over on YouTube, Sarah from the SignalsEverywhere YouTube channel has uploaded a new video showing a new open-source program she's developed called CellScope, which is used for LTE sniffing. She notes that CellScope is essentially LTE Sniffer, but ported for Windows. CellScope needs a wideband SDR, and it currently supports LibreSDR B210 Clone, HackRF and the Airspy R2/Mini

LTE (aka 4G) is a modern mobile wireless standard used by cellphones for data. While it is encrypted, there is still some data transmitted in the clear, such as the devices connected to the cell site and how much data they are pulling down, if there is an active call on the cell site, and of course the data activity can be useful to monitor too. 

In the video Sarah shows CellScope in action, demonstrating it detecting a call from her phone and visualizing the data transfer activity from her device when pulling down data.

CellScope is open-source and available on GitHub. If you don't want to compile it yourself, the Windows executable can be purchased from her site for a minimum $0.00 donation.

CellScope: LTE Sniffing on Windows

War Driving for DECT Devices with a HackRF and Android Device

Over on her YouTube channel SignalsEverywhere, Sarah has uploaded an interesting video showing her doing a wardrive for DECT devices, with an Android device connected to a HackRF, running her own Android version of DECT toolkit. In the past, we also covered her DeDECTive software, which is a fully DECT scanner and voice decoder for Linux and the HackRF.

DECT is a digital wireless protocol operating at around 1.9 GHz, which is typically used by modern cordless home phones, baby monitors, headsets, intercoms, and more. If you are unfamiliar with the term wardriving, this is when someone drives around in a vehicle and looks for interesting signals around the area. Wardriving is typically associated with mapping out the local WiFi environment and looking for security flaws, but it can apply to any signal.

During her wardrive, Sarah finds mostly VTech cordless phones, but a few other models like 'Binatone' and 'RTX' pop up, which she suspects are headsets, one possibly from a local McDonald's. She notes that only one active call was found, although the video has voice decoding stripped out for privacy reasons. She also notes that no encryption was found to be enabled on any device, despite DECT supporting it. The Android App also records the GPS position of any found DECT devices on a map.

War Driving for DECT Devices

Exploring the Art and Science of Spectral Painting with SDR

Thank you to Paul Maine, who wrote in and wanted to share some experiments he and Gary Schafer have been doing with spectral painting. Spectral painting is the art of drawing pictures directly on the spectrum waterfall, which a software-defined radio makes visible. Paul has written the post below:

What happens when radio technology meets digital artwork? The result is something fascinating called Spectral Painting—the ability to create images that appear inside the radio frequency spectrum.

Gary Schafer (@signalgalaxiesunlimited) and Paul “The SDR Guy” Maine (@paulmaine6433) have teamed up to explore this unique combination of software-defined radio, signal processing, and creativity. Together, they have created companion videos on Spectral Painting and released them at the same time, each approaching the topic from a different perspective. For the best experience, it is recommended to watch Gary’s video first, followed by Paul’s practical demonstration.

Gary begins the journey by diving into the theory behind Spectral Painting. Using GNU Radio flowgraphs and GNU Octave scripts, he explains how images can be transformed into signals and displayed within the frequency spectrum.

Paul then takes Gary’s GNU Radio flowgraph and GNU Octave scripts from theory into practice. Using multiple SDR platforms, he demonstrates how to transmit spectral images using both the HackRF and TRX-DUO SDRs. He then completes the process by receiving and displaying the images using several different SDR receivers, including the RTL-SDR V3, RTL-SDR V4, and Airspy HF+.

Together, these videos provide a complete journey—from understanding the science behind Spectral Painting to seeing it come alive on real SDR hardware.

Below is an example screen capture of Spectral Painting in action.

Spectral Painting Example
Spectral Painting Example

Start with Gary’s video to learn the concepts and signal processing techniques:

Creating Spectral Paintings using Gnu Radio Companion (and other open source tools)

Then watch Paul’s video to see Spectral Painting transmitted and received using real SDR equipment:

E30 Spectral Painting

NyxScope: A Windows Multi-Protocol SDR Decoder Program with Multiple Digital Native Decoders

WARNING: Multiple people have noted that this program is not working as expected and may be overly buggy.

Recently, we've learned about NyxScope, a multi-protocol SDR receiver program for Windows that comes with multiple native decoders built right into the software. Their own description describes this all-in-one program best:

You get spectrum and waterfall, multiple concurrent VFOs, trunked-radio following, digital voice, aviation and marine tracking, paging, ISM sensors, HD Radio, and transcription, in one binary.

NyxScope includes decoders for P25 Phase 1 and Phase 2 voice, EDACS and NXDN control channels, ADS-B, AIS, ACARS, POCSAG, FLEX, LoRa CSS PHY + LoRaWAN MAC, Morse, RDS, CTCSS/DCS, Iridium decoding (with voice), and also includes a signal classification tool, Bluetooth LE scanner, and Whisper voice-to-text transcriber. It also outsources decoding of other protocols to mature decoding software such as multimon-ng, rtl_433, dsd-neo, nrsc5, direwolf, dumpvdl2, dump978, rs41mod where required, noting that the outsourced decoders are bundled with the software, meaning no extra installation work is required.

The software supports RTL-SDR, HackRF, Airpsy, bladeRF, SDRplay, Fobos and PlutoSDR. It also supports using multiple SDRs used in parallel.

The software does not appear to be open source, but it is provided for free with a limitation of 3 concurrent VFOs and a limitation on recording, transcribing, and pager messages. A perpetual per-machine license for $89.95 can be purchased to lift these restrictions and add access to their FCC frequency lookup database.

AI-Disclaimer: While the developers have not noted any use of AI tools, we suspect that AI was used in the creation of this software.

NyxScope Screenshot Scanning the 800 MHz Band
NyxScope Screenshot Scanning the 800 MHz Band

InmarScope: An Inmarsat AERO and STD-C Decoder with Multichannel Decoding and Automatic Call Following

Over on the SignalsEverywhere YouTube channel, Sarah Rose has released InmarScope, a multichannel L-band Inmarsat decoder that connects directly to an RTL-SDR, Airspy, or HackRF. The software can receive and decode both aeronautical (AERO) and maritime (STC-C / EGC) traffic at the same time. Decoders are dropped directly onto the aligned FFT and waterfall by holding CTRL and left-clicking, and the software lets you stack Aero MSK (600/1200 bps), high-rate OQPSK (10500 bps), AMBE voice (8400 bps), and Inmarsat-C BPSK decoders side by side.

One of the more interesting features is automatic voice-call following. By monitoring the 10500 baud forward-link channels, InmarScope can receive C channel voice assignments and automatically retune the SDR to the assigned frequency, lock the carrier, decode and record the AMBE call, and then hop back to where it was. There is also a two-SDR mode that dedicates a second radio to voice with a live split-view spectrum so one radio stays on the P control channel while the other tunes to voice calls. For assignments that never get broadcast, there is also a Call Hunter feature that uses a squelch threshold to automatically drop the decoder when a call appears. When a call is playing, the built in flight map also decodes the aircraft hex ICAO address and looks it up on airplanes.live, showing the plane's position and route in real time.

Recent updates have added a community-editable band plan, message search and filtering, an IQ recorder that also captures the seconds before you hit record, and a web dashboard for browsing decoded data from a phone.

The software is completely open source on GitHub, and the C++ code can be compiled from source, or a precompiled Windows build is available on sarasforge.dev for $15, with Sarah's Patreon patrons getting it free.

We note that Inmarsat signals such as AERO and STD-C/EGC can be received with our RTL-SDR Blog L-band Patch Antenna, which is available in our store.

Multi-Channel Voice Following Inmarsat Decoder for Windows!

Decoding Inmarsat in 2026

OpenStint: An Open-Source RC Car Lap Timing System Using an RTL-SDR or HackRF

Thank you to Attila for submitting news about OpenStint, an open-source lap timing system for radio-controlled (RC) car racing that uses an RTL-SDR or HackRF One as its receiver. In RC racing, each car carries a small active near-field transponder that transmits a unique identifier on 5 MHz using BPSK modulation. A wire loop embedded in the track acts as the receiving antenna, picking up each transponder's signal only within a short distance, which allows the exact crossing point to be detected. OpenStint digitizes this signal with the SDR and performs the decoding and pass detection entirely in software, with sufficient accuracy for RC racing.

Professional timing systems work on the same principle, but rely on dedicated proprietary hardware and software, with even entry-level systems typically costing thousands of dollars. OpenStint is compatible with the transponders used by the vast majority of RC racing clubs (MyLaps RC3 and RC4), while also supporting its own fully open-source transponder design. A complete decoder can be built from inexpensive off-the-shelf components, typically consisting of an RTL-SDR dongle, a simple loop interface, and a laptop or even a Raspberry Pi 3. The software has also been tested with existing timing software including LapBeeps, RCGTiming, and ZRound.

Besides the decoder itself, the project documents an open-source transponder protocol, includes an ATtiny-based transponder reference implementation, and describes the signal processing used for reliable pass detection. Documentation and source code can be found on the OpenStint website and over on the project's GitHub page, with the open transponder design available here.

Atilla also sells the transponder boards on the OpenStint website's sales page for a reasonable €30/panel + shipping (8 pcs per panel), and notes that larger quantities can easily be manufactured by JLPCB.

AI-Disclaimer: We note that Claude is listed as a contributor to the code.

OpenStint: RC Car Lap Timing with RTL-SDR or HackRF
OpenStint: RC Car Lap Timing with RTL-SDR or HackRF