Category: HackRF

Tech Minds: Testing out Discovery Dish for Inmarsat and Hydrogen Line Radio Astronomy

Over on YouTube Matt from the Tech Minds YouTube channel has recently uploaded a new video where he tests out our Discovery Dish antenna. Discovery Dish is designed to be a low-cost, portable solution for receiving L-band and S-band weather satellites, Inmarsat satellites, conducting amateur hydrogen line radio astronomy, and more.

In the video, Matt unboxes the Discovery Dish and provides an overview of the build process before demonstrating its use in decoding AERO and STD-C messages on Inmarsat. He then shows the dish and Inmarsat feed being used to receive Iridium satellites, and how they can be decoded using iridium-extractor with a HackRF or Airspy R2.

Finally, Matt swaps out the Inmarsat feed for the Hydrogen Line feed. Using SDR#, the IF AVG plugin, and Stellarium, he was able to obtain a clear hydrogen line peak.

This Discovery Dish Is The ONLY Satellite Dish You Will Need!

TEMPEST-LoRa: Emitting LoRa Packets from VGA or HDMI Cables

University researchers from China have recently shown in a research paper that it is possible to maliciously cause a VGA or HDMI cable to emit LoRa compatible packets by simply displaying a full-screen image or video. This has potential security implications as a malicious program could be used to leak sensitive information over the air, completely bypassing any internet or air-gap security systems.

In the past, we have demonstrated that TEMPEST techniques can be used to spy on monitors and security cameras by analyzing the unintentional signals they emit. This research takes the idea a step further by determining what particular images need to be displayed to create a LoRa packet with data. 

In the paper, the researchers mention using either off-the-shelf LoRa devices or low-cost SDRs such as the HackRF to receive the packets. The advantage of the SDR method is that it allows for customization of the frequency and the use of LoRa-like packets, which can achieve even longer ranges and higher data rates. The team show that they were able to achieve a receive range of up to 132 meters and up to 180 kbps of data rate.

TEMPEST-LoRa Test Setup
TEMPEST-LoRa Test Setup
(Demo video) TEMPEST-LoRa: Cross-Technology Covert Communication

Michael Ossmann Gives A First Look at the HackRF Pro in YouTube Video

Recently, Great Scott Gadgets announced the upcoming September release of their HackRF Pro, an upgrade to their popular HackRF software-defined radio. 

On YouTube, Michael Ossmann, the founder of Great Scott Gadgets, has just uploaded a video explaining the improvements that the HackRF Pro will bring. Apart from the change from microUSB to USB-C, Michael demonstrates how the HackRF Pro has achieved improved performance by eliminating the DC spike and reducing the number of strong signal mirror images.

First Look at HackRF Pro

uAVD: Analog Video Decoder Windows Software for SDRs

Thank yoy to Viol Tailer for submitting news about the release of his new software called "uAVD - Analog Video Decoder". uAVD is capable of demodulating the following:

  • AM (broadcast analog television - NTSC, PAL, SECAM)
  • FM (FPV drone video links)
  • RAW (composite output from VHS, camcorders, game consoles)

The software uses the uSDR software as a host, and it passes the IQ passband stream to the uAVD via a uSDR-TCP link. uSDR is a lightweight general purpose multimode software defined radio receiver Windows application that we have posted about on the blog in the past. Currently, it supports RTL-SDR, AirSpy, BladeRF, HackRF, FobosSDR, and LimeSDR devices.

The software supports full color and grayscale modes. With a wideband receiver, it will be possible to receive full-color video. With the reduced bandwidth available with an RTL-SDR, only grayscale will be available.

The code is not open-source, but the software is freely available from SourceForge.

The image below shows it being used to receive video from a camcorder composite video output. A FobosSDR used in direct sampling mode is used to receive the signal.

uAVD Receiving Camcorder Composite Video via the Direct Sampling Input in FobosSDR
uAVD Receiving Camcorder Composite Video via the Direct Sampling Input in FobosSDR

Below is a video from a user of the software demonstrating it in action.

uSDR and uAVD analog video decoder

HackRF Pro Pre-Order: Frequency Range and RF Performance Improvements, USB-C, TCXO Added

The HackRF by Great Scott Gadgets, released in 2014, remains among the most popular software-defined radios (SDRs) on the market due to its open-source nature, affordability, wideband tuning range, wide 20 MHz bandwidth, and transmit capability.

However, over the past 10 years, very little has changed with the HackRF, with most changes only being made out of necessity due to end-of-life components. It has mostly been the open-source community and clone manufacturers innovating on the circuit.

Today, Great Scott Gadgets has finally announced the HackRF Pro.

Key improvements include expanding the lower frequency limit from 1 MHz down to 100 kHz, integrating a TCXO for enhanced frequency stability, upgrading the microUSB port to USB-C, and improving RF performance with additional shielding, a flatter frequency response, and the elimination of the DC spike. They have also added more RAM and flash memory, and added a 16-bit output mode for low sample rates.

The product is available from their usual distributors (listed on the release page) and costs US$400. Note that the HackRF Pro is currently in pre-order, with production slated to begin in July 2025 and shipping in September 2025. 

The full release article from Great Scott Gadgets reads:

HackRF Pro from Great Scott Gadgets is a Software Defined Radio peripheral capable of transmission or reception of radio signals from 100 kHz to 6 GHz. Designed to enable test and development of modern and next generation radio technologies, HackRF Pro is an open source hardware platform that can be used as a USB peripheral or programmed for stand-alone operation.

  • 100 kHz to 6 GHz operating frequency
  • Tunable from 0 Hz to 7.1 GHz
  • Half-duplex transceiver
  • Up to 20 million samples per second
  • 8-bit quadrature samples (8-bit I and 8-bit Q)
  • Compatible with GNU Radio, SDR#, and more
  • Software-configurable RX and TX gain and baseband filter
  • Software-controlled RF port power (50 mA at 3.3 V)
  • SMA RF connector
  • SMA clock input and output for synchronization and triggering
  • Convenient buttons for programming
  • Internal pin headers for expansion
  • High-Speed USB 2.0 with Type-C connector
  • USB-powered
  • Open source hardware

Compared to HackRF One, HackRF Pro introduces a host of new and updated features, including:

  • Wider operating frequency range
  • Improved RF performance with flatter frequency response
  • Modern USB Type-C connector
  • Built-in TCXO crystal oscillator for superior timing stability
  • Logic upgrade from a CPLD to a power-efficient FPGA
  • Elimination of the DC spike
  • Extended precision mode with 16-bit samples for low sample rates (typical ENOB: 9-11)
  • More RAM and flash memory for custom firmware
  • Installed shielding around the radio section
  • Trigger input and output accessible through clock connectors
  • Cutout in the PCB provides space for future add-ons
  • Improved power management

Software that works with HackRF One is already compatible with HackRF Pro. We designed HackRF Pro for backward compatibility, following the same basic architecture of HackRF One but with many small enhancements. Prior to shipping HackRF Pro, we will publish a migration guide that will show software developers how to take advantage of certain new capabilities of HackRF Pro, but out-of-the-box HackRF Pro will behave like HackRF One with superior performance. In addition to host software compatibility, our migration guide will address firmware, allowing developers to port custom firmware to the new platform and take advantage of its unique capabilities

The HackRF Pro
The HackRF Pro

TechMinds: Testing out the SDRBerry Software on a Pi 4 with Touchscreen

Over on the TechMinds YouTube channel, Matt has posted a video demonstrating the SDRBerry software, which can be used with many SDR devices, including the RTL-SDR, on a Raspberry Pi with a touchscreen.

The SDRberry software is designed to be used on a touchscreen. As Matt points out, it has an aesthetically pleasing user interface and is compatible with almost any SDR software via the Soapy interface. Combining an SDR with a Pi 4 touchscreen and SDRberry results in an excellent hand-held SDR system.

In the video, Matt demonstrates the features of SDRberry, showing its RX features as well as some of its TX features, such as speech transmission and FT8, via a built-in WSjtx tab. He then shows the optional web interface, which is still in the early stages of development. Finally, he shows how to install the software and dependencies onto a fresh Raspbian image. 

SDRBERRY - This User Interface Is Just GORGEOUS! AND IT USES SOAPY TOO!

Saveitforparts: Snooping on the SatGus Selfie Satellite

SatGus is a recently launched cubesat owned by CrunchLabs/Mark Rober, an extremely popular science and engineering YouTuber. The satellite is designed to take selfies of CrunchLabs customers' own photos in space, using a screen and a selfie camera mounted on the satellite. It then broadcasts the selfie image back down to a CrunchLabs ground station, where it is eventually emailed to the customer. Customers then claim that they've had their selfie taken in space.

Over on the saveitforparts YouTube channel, Gabe has been attempting to listen in on the SatGus downlink using a HackRF and a motorized satellite dish setup. SatGus transmits telemetry at 400.2 MHz and the payload dump at 2,262.5 MHz. While he is able to receive the signal, Gabe notes that it is encrypted, so not much can be done with it.

Snooping On SatGus Again

Saveitforparts: Receiving Military DMSP Satellite Data with a Hacked TV Dish

Over on the saveitforparts YouTube channel, Gabe has uploaded a video showing how he uses a hacked TV satellite dish to receive satellite weather data from Defense Meteoroloogical Satellite Program (DMSP) satellites.

These satellites were initially developed during the Cold War and featured an encrypted downlink of meteorological data. However, recently, the DMSP downlink has encryption turned off when passing over the northern half of the USA (40°-41° latitude and up to 60° North), allowing hobbyists in some parts of the USA to decode images. 

In his video, Gabe uses a HackRF SDR with an old DirectTV dish with a modified S-band helical feed mounted on a hacked Wineguard motorized platform that was originally intended for automatically pointing TV dishes on RVs. Despite some initial problems with the SatDump software crashing, he is eventually able to receive some nice, clean images.

Interestingly, Gabe also shows what the signal looks like while encrypted and how it transitions to the unencrypted signal after the satellite passes over the threshold. 

We note that it is not documented by the military why encryption is being turned off only over the northern half of the USA. Still, it is speculated that the military doesn't consider images over this part of the USA to be sensitive, and disabling encryption could help save power and help other organizations with scientific research. However, as Gabe mentions in the video, being a Cold War-era satellite, the image quality from DMSP isn't great, and more modern satellites like the NOAA series give much better images over the entire earth unencrypted. 

Grabbing Military Satellite Data With Hacked TV Dish