Earlier this month we posted about the Russian Elektro-L3 geostationary weather satellite drifting west from 76°E to 14.5°W. It is replacing Elektro-L2 and could bring unencrypted L-band LRIT and HRIT imagery back to Western Europe. Now tec_msat has written in again to let us know that Elektro-L3 has arrived. It is already transmitting X-band RDAS and testing LRIT and HRIT.
tec_msat notes that the satellite was only active on C-band for a couple of days. Then, on October 26, its RDAS, xRIT, and DCP (Data Collection Platform) downlinks all went up. Elektro-L2's DCP transmission at 1697 MHz was switched off at 06:30 UTC, and L3's DCP came up at 07:02 UTC. LRIT data was being received from about 09:42 UTC. GGAK (space weather data) is still being transmitted from Elektro-L2 for now.
This is the first xRIT from 14.5°W in years, so tec_msat warns that transmissions may be sporadic for a while. It's too early to judge signal strength, but it already looks stronger than L3 did at low elevation (under 15 degrees) in its old slot.
If you're in Western Europe, now is a good time to get your dish ready. SatDump is the best software for reception and decoding, and our Discovery Dish with L-band feed and an RTL-SDR Blog V3 is a great starting point for hardware.
Elektro-L3 LRIT Image Received from 14.5°W on October 26
With AI-in-the-loop reverse engineering, things are heating up, and we're starting to see a gold rush of reverse-engineered Wi-Fi radios turning into software-defined radios. Just yesterday, we posted about h0m3us3r's discovery of how a Gemtek W1700K Wi-Fi 7 router could be turned into a 320 Msps SDR. And the week before, we posted about the ESP32-SDR discovery.
Today, a new Wi-Fi dongle-turned-SDR has been discovered, and this time it is probably the most accessible one. Over on X @luigifcruz, author of the popular CyberEther tool, has announced that he has reverse engineered a commodity US$30 USB 3.0 Wi-Fi dongle with the help of GPT-6 Astra, and discovered a RAW I/Q stream which can be exported over USB3.0. This effectively turns the Wi-Fi dongle into a 2.4 GHz / 5 GHz SDR, capable of exporting 40 Msps at 14-bit ADC resolution. Luigi named the new SDR 'BirriaSDR' after the Birria Taco he was eating at a restaurant while using AI to reverse-engineer the WiFi dongle. The open-source repo is available on GitHub.
This is probably the most accessible of the newly discovered Wi-Fi SDRs because it is cheap, mass-produced, readily available, and has useful export bandwidth. The ESP32-SDR suffers from a lack of usable export bandwidth, meaning that getting usable amounts of IQ data onto a PC is impossible without hacking in an FPGA. The Gemtek W1700K Wi-Fi 7 router has an incredible 320Msps IQ bandwidth and an effective export via Ethernet, but it is expensive and not really available for purchase anywhere anymore.
Luigi has added support for the BirriaSDR in his CyberEther software through an input block and sample flowgraph.
It remains to be seen how popular these dongles will become, and if they'll become a new type of RTL-SDR like device. If there is a sudden influx of purchasers, sellers may put the pricing up. We also note that Wi-Fi dongles are limited to the 2.4/5 GHz bands, where there aren't that many interesting signals to play with. However, as Luigi suggests, modifying the dongle to add a front-end mixer is a possibility. The HackRF already uses a 2.4 GHz IF architecture, so a similar type of front end could be used.
Just last week we posted about ESP32-SDR, which is custom firmware for ESP32's indpendently discovered by two experimenters that transforms them into a full software defined radio.
Now, h0m3us3r, one of the discoverers of the ESP32-SDR hack, has discovered a way to turn a Gemtek W1700K Wi-Fi 7 router, which uses a MediaTek MT7996 chip, into a wideband software-defined receiver. Compared to the ESP32's maximum 80 Msps sample rate, this newly discovered Wi-Fi chip captures a massive 320 MSps. And most importantly, unlike the ESP32, the router has a built-in 10 GbE Ethernet SoC, which lets you stream full-bandwidth data out and ingest it on a PC.
As a result, you can capture the entire 2.4 GHz band and a wide portion of the 5 GHz band live and stream the spectrum to a Linux host running a live spectrum and waterfall display.
Other devices that run the MediaTek MT7996 Wi-Fi chip include the Banana Pi BPI-R4, GL.iNet Flint 4, and Gemtek XR1710G, however it is unclear if this firmware will run on those devices.
The entire 2.4 GHz Wi-Fi Spectrum at the max 320 Msps sample rate.
AI Disclaimer: Claude is listed as a contributor to the repo.
Back in 2025, we posted about ESPARGOS, a phased array of many patch antennas, each connected to an ESP32 WiFi microcontroller. ESPARGOS could be used to determine the direction of arrival for WiFi signals and create a live augmented reality heatmap.
Recently, the ESPARGOS team has made an exciting discovery. They found that several ESP32 chips have an undocumented feature that lets the firmware bypass the fixed WiFi and Bluetooth functionality and instead capture raw IQ baseband samples. As a result, several ESP32 models can now be used as an internal SDR covering 2.2–2.7 GHz, plus 4.8–6.0 GHz on the ESP32-C5, with up to 80 MS/s sample rate and roughly 13–54 MHz of analog bandwidth, depending on the chip.
However, for use as a general-purpose PC-connected SDR, the output bandwidth is insufficient, so only snapshots of data can be exported to a PC. This means that the SDR will only work as a spectrum analyzer, and demodulating or decoding continuous radio data is not possible with just an ESP32. The exception is the new ESP32-S31, which can stream continuously at up to 16 MS/s over its Gigabit Ethernet interface, with a SoapySDR driver for GNU Radio and gqrx coming soon. If you want to try it yourself, the ESP-WebSDR page lets you flash the firmware to most ESP32 dev boards directly from your browser and view a live spectrum and waterfall.
Furthermore, ESPARGOS notes that phase-coherent IQ sample capture is now possible with their hardware. This means ESPARGOS is no longer limited to WiFi and Bluetooth signals; it can now perform direction finding on any arbitrary signal in the 2.4 GHz band. The team also says phase-coherent transmissions would be possible, but they aren't implementing them right now because they could be misused.
It also seems that, independently, at least two other projects discovered the same or similar features around the same time, but to solve different problems.
Over on Reddit, user /u/h0m3us3r discovered the same feature and uploaded it to GitHub on Sept 26, and recorded a video showing an ESP32-S3 working as an SDR with an FPGA used as a USB3 front end. Unlike ESPARGOS, h0m3us3r's project streams the raw IQ data to a PC continuously via the FPGA rather than in snapshots, so full demodulation/decoding on PC should be possible. However, the current prototype uses the FPGA to clock the ESP32, which results in poor phase noise. So if the clocking issues can be resolved, an ESP32 combined with an FPGA could make a standard general-purpose SDR, like the RTL-SDR, but with a 2.2–2.8 GHz frequency range and up to 80 MHz of bandwidth.
Another project that seems to be using a somewhat similar finding is C5VRX, which was first uploaded to GitHub on August 13. C5VRX uses an ESP32-C5 as a 5.8 GHz real-time FPV video receiver. Although this project appears to use a different mechanism, the result is similar: it uses an undocumented IQ data stream on the ESP32 to sample FPV signals and demodulate them onboard, outputting analog composite video through a simple resistor DAC. The project is still a work in progress and doesn't yet work reliably at range.
Back in May, we posted about how Russia's Elektro-L3 geostationary weather satellite was expected to move from 76°E to 14.5°W, which would finally bring an unencrypted L-band LRIT/HRIT downlink over Western Europe. Thank you to RTL-SDR reader tec_msat for writing in and letting us know that the move now appears to be underway.
tec_msat writes that Elektro-L3 went quiet around September 10. Updated TLEs on September 13 then showed the satellite drifting west at roughly 1.7 degrees per day. Around September 20, its orbit was circularized, making it drift faster at around 3.1 degrees per day. At its current speed, it should reach 14.5°W around October 12. Based on Elektro-L5's commissioning timeline, test transmissions could begin within days of arrival.
Elektro-L5, launched in February 2026, has now been successfully commissioned at L3's old 76°E slot, which covers Asia, the Middle East, and parts of Russia and Australia. It has been transmitting GGAK, LRIT and HRIT, as well as X-band RDAS. With L5 taking over the eastern slot, L3 will replace the aging Elektro-L2 at 14.5°W. L2 never provided LRIT/HRIT from that position due to power supply issues, although the original Elektro-L1 did when it was stationed there.
Roscosmos noted in August, when announcing L5's commissioning, that L3 may be moved to 14.5°W. However, there has been no official announcement from Roscosmos that the relocation has started, so the drift observations currently come from amateur TLE tracking.
Once commissioned, L3 should once again make geostationary L-band weather imagery at 1691 MHz available to users in the UK, Ireland, Iceland, Portugal, Spain and western France. tec_msat also speculates that the signal may be stronger over Europe than it was from 76°E (potentially due to better elevation angles), making xRIT reception even easier.
If you're in the coverage area, now might be a good time to get your dish, feed and LNA ready. SatDump is the best software tool to use for reception and decode and our Discovery Dish with L-Band feed and RTL-SDR Blog V3 is a great starting point for hardware.
Expected Elektro L3/L4/L5 global coverage from mid-October 2026.
We're happy to announce that the RTL-SDR Blog V4L (Lite) model is now available for purchase in our store! Our initial production batches are small, so we will have limited stock at first, and the first batches will be available for shipment only from our warehouse in China. But we expect to ramp up production and get stock on Amazon over the next 2-3 months.
Currently, only our blog store (via the red add to cart button), official eBay listing (note that this is an affiliate link that helps us claim back some eBay fees: as an eBay Partner, we may be compensated if you make a purchase), and Aliexpress listing sell this product. Amazon will be stocked in about 2-3 months.
The RTL-SDR Blog V4L (Lite)
As you may already know, the Blog V4 line of products was recently made end-of-life due to the exhaustion of the stockpile of Rafael R828D tuner chips that the V4 models require. The R828D chip has not been in production for many years, but we were able to access a large stockpile of the chip via our contract manufacturer relatively cheaply, which made the Blog V4 models cost-viable. We predicted that the V4 models would be in production until the end of 2026, as we expected to be able to purchase a few more R828D chips from third-party stockpiles at slightly higher prices. But it turns out that the last few chips available in those third-party stockpiles were all counterfeits (they had put legitimate chips in the first 100 spaces in the reel, then for the rest they had lasered the R828D logo on a totally different chip with the same package size and expected us not to notice!).
We have recently secured a confirmed good stockpile of Rafael R828S chips via our contract manufacturer, which allows us to produce the new Blog V4L (Lite) design. Compared to the R828D, the R828S is a variant with one fewer RF input. This means that instead of a triplexed filtered input, we can only do a diplexed filtered input. Hence the 'lite' designator, as the design is identical to the original V4 models, except for the triplexed input filtering feature. This lack of filtering comes with a minor upside: improved sensitivity due to less filtering losses on the front end.
MDS Measurement Comparisons
Of course, the downside is that the front end is not as well filtered against strong signals, so the two-tone test produces identical results to the V3 model.
Two-Tone Test Results
The V4L still maintains the same built-in HF upconverter architecture of the V4 models and, like the V4, has the improved PCB layout, 1PPM TCXO, 4.5V Bias Tee, bias tee LED, improved power supply, and more.
Another upside is that the R828S chip is cheaper, and so we can sell the Blog V4L at a slightly lower price!
We note that, like the V4 models, the V4L is also a limited edition product. The V4L also relies on a large stockpile of a chip that is no longer in production. We expect the V4L chip stockpile to last about one year. Beyond that, we have a solid idea for V5 model design that is still in the early stages of development, but please don't expect any further news on that until 2027.
As the R828S chip has not been used in an RTL-SDR model before, the official Osmocom drivers do not yet support it. We have submitted a patch request through their channels, but have not heard back yet. - Update: Osmocom has updated their repo and added V4L support.
For now, V4L users can use our rtlsdrblog/rtl-sdr-blog driver fork available on GitHub, with Windows DLL Releases. ExtIO users can access a compatible Windows ExtIO here. We have submitted patches for the Android RTL-TCP app as well. More information about driver compatibility can be found in the V4L user's guide.
This is an unofficial port of librtlsdr, created using USBDriverKit instead of libusb, which is not available on iOS. This now allows RTL-SDRs to run directly on iPad iOS devices via USB without any jailbreak requirements. Previously, RTL-SDRs were unable to run on iOS devices directly. The only way around this was to run an RTL-SDR remotely and connect to it over a network via rtl_tcp.
The one caveat at this stage is that this currently only supports iPads with an M-Series SoC. At this time, only iPads use M-series chips, whereas iPhones currently use A-series chips. It also appears that the Blog V4 is not yet compatible with this driver due to the required EEPROM strings not being read by the drivers yet.
In the video embedded below Arved shows an RTL-SDR running on his M1 iPad, and demonstrates CoronaSDR, welle.io, SatDump and rtl_tcp running.
RTL-SDR Running Directly on iPad via USB — Demo with CoronaSDR, welle.io, SatDump & rtl_tcp (no JB)
Arved has also released a video (embedded below), demonstrating SatDump connecting to an RTL-SDR and receiving a signal from a Meteor M2 LRPT weather satellite. He first records the IQ data with SatDump, then uses SatDump to decode the recorded data into an image.
Meteor-M2 4 LRPT Reception on iPad with RTL-SDR via USB — SatDump Demo
The team behind the wildly popular Flipper Zero product has just announced their development plans for a Flipper One device. If you were unaware, Flipper Zero is an extremely popular wireless hacking/research tool based on a STM32 microcontroller and TI CC1101 sub-ghz transceiver. While not an SDR, the CC1101 hardware radio chip is very capable at demodulating/transmitting many sub-GHZ OOK/ASK/FSK/GFSK/MSK protocols, and for capture/replay attacks. Flipper Zero also implements 125 kHz RFID, Bluetooth LE, 13.56 MHz NFC, Infrared RX/TX capabilities, and general GPIO/UART/SPI/I2C interfaces. Flipper Zero has been so popular that it has been seen in more mainstream media such as on Linus Tech Tips.
While Flipper Zero was extremely popular, the team outright makes clear that Flipper One is not a successor to Flipper Zero. Instead, it is a completely new project. Flipper One will be a full RK3576 ARM-based Linux computer (with computing power similar to a Raspberry Pi 5), with a Raspberry Pi RP2350 Microcontroller co-processor and PCIe M.2 expansion modules to add capabilities such as an SDR, a 5G modem, an SSD, or anything else. It will also include GPIO expansion modules, be a full Ethernet/WiFi multi-tool with MediaTek MT7921AUN, have a satellite NTN (non-terrestrial network) cellular modem, and, of course, come with a built-in NPU AI accelerator capable of supporting offline LLMs. On the more conventional side, they also plan to make Flipper One capable of running a full Linux desktop and serving as a portable TV media box.
Currently, they are in early development, still working through architectural and hardware choices, and developing software. The announcement post was created to announce that they will design and build Flipper One openly in public, and are actively seeking public support via their Flipper One development portal.
They note that building in public will be required to support their lofty ambitions to bring in full mainline Linux kernel support to the RK3576 ARM processor, push vendors to open up existing closed-source code and ditch binary blobs, build an unconventional CPU + Microcontroller co-processor architecture, build Flipper OS, a Debian layer with resettable user profiles, and design a Linux UI framework for small screens.
The closest competing existing devices appear to be the ClockworkPI uConsole and Vivid Unit, as well as the various Cyberdeck-type products.
The Flipper OneAn example of how a SDR module might be attached to Flipper One
