Category: RTL-SDR

Telive osmo-tetra-sq5bpf: An Experimental TETRA Decoder that Enables Voice Decryption (If You Have the Key)

Thank you to Jacek / SQ5BPF for letting us know that he's recently released a modified version of the Telive TETRA decoder for Linux. The modification allows the user to listen to TEAx-encrypted voice signals if they have the decryption key. Typically, if a TETRA signal is encrypted, there is no way to listen to it, unless you have obtained the decryption key from the network operator, or extracted it from TETRA keyloader hardware.

But because the TEA1 encryption was broken due to a backdoor being discovered in 2023, he has also added support for using the 32-bit short key directly, which can be automatically recovered from TETRA traffic using his other software called teatime. TEA1 encryption is being phased out, but many deployments still use it.

The software is designed for advanced users to compile and run, so very little documentation is provided. However, there is a blog post here that explains the overall steps. Some additional information can be found on SQ5BPF's RadioReference post here.

TETRA Decoding (with telive on Linux)
TETRA Decoding (with telive on Linux)

Web-Spectrum: Web-Based Spectrum Analyzer and GPS Signal Analyzer with RTL-SDR Support

Over on GitHub we've recently seen a new open source program release called "web-spectrum". Web-spectrum is a multi-purpose browser-based tool. One interesting feature is that it allows you to view the GNSS spectrum (via a connected RTL-SDR or SDRplay with an appropriate antenna), decode it to a position, and also analyze the signal for jamming. It uses gnss-sdr or Gypsum as the backend GNSS processing tool.

The tool can also be used as a real-time spectrum analyzer, and for this, it supports RTL-SDR and SDRplay as well as the tinySDR Ultra spectrum analyzer.

Finally, in addition to GPS decoding, it also supports ADS-B and ISM band decoding.

Web-Spectrum: A Browser based tool for spectrum analyzer, GNSS analysis, and ADS-B and ISM band decoding.

Tech Minds: Testing Out A New Signals Intelligence Tool Called Intercept

Over on the Tech Minds YouTube channel, Matt has uploaded a video where he tests out 'Intercept', a new tool for RF signals intelligence with RTL-SDRs and other wireless devices. It is open source with code available on GitHub and can be installed on Linux and OSX devices.

Intercept is a tool that combines multiple external decoder tools into one easy-to-access web interface. It is capable of the following:

  • Pager Decoding - POCSAG/FLEX via rtl_fm + multimon-ng
  • 433MHz Sensors - Weather stations, TPMS, IoT devices via rtl_433
  • Aircraft Tracking - ADS-B via dump1090 with real-time map and radar
  • Listening Post - Frequency scanner with audio monitoring
  • Satellite Tracking - Pass prediction using TLE data
  • WiFi Scanning - Monitor mode reconnaissance via aircrack-ng
  • Bluetooth Scanning - Device discovery and tracker detection

We note that features like WiFi and Bluetooth scanning will require a separate WiFi and Bluetooth adapter to be connected. In terms of supported SDR hardware, Intercept supports RTL-SDRs, as well as any SDR supported by SoapySDR.

In the video Matt shows how to install Intercept, and shows it decoding data from the various supported signal types.

Intercept Radio Signals For Intelligence Gathering With An RTL SDR

Guglielmo FM and DAB Receiver Software Updated to Version 0.7

Thank you to Marco for letting us know that his Guglielmo software has recently been updated to Version 0.7.

Guglielmo is an FM and DAB receiver for Linux, Windows and MacOS. It supports all major SDRs, including RTL-SDR, Airspy, SDRplay, HackRF, and LimeSDR. It is designed to be easy to use for media users rather than hobbyist technical users.

Version 0.7 adds the following features:

  • Raspberry PI appimage
  • UI improvements
  • Basic skins support
  • Logo handling

The new Raspberry Pi appimage, and binaries for other platforms can be found on the GitHub Releases page. Just expand the "assets" tab.

Guglielmo: Screenshot of the DAB Interface

Mykola: A New Fast Multichannel Scanner Application for RTL-SDR, Airspy and HackRF

A new multichannel SDR scanner application called 'Mykola' has recently been released by a Ukrainian programmer with the same name as the application. A scanner application allows users to scan a much wider bandwidth than the SDR's instantaneous bandwidth, while automatically searching for active signals.

Mykola advertises extreme scanning speed abilities, adaptive noise floor, and simultaneous demodulation of 3 channels (20 in the paid pro version). It currently supports RTL-SDR, Airspy R2, and HackRF SDR devices. Some of the other features include automatic normalization of the noise floor, audio panning, and support for Windows and macOS.

The application is free, but a pro version will be available in the future, which enables additional features such as stored channel scanning, recording, voice activation, CTCSS/DCS decoder, SDR migration, channel editor, and a base channel set. The pro version is not yet available, and pricing has not been announced. 

Features of the Mykola Scanning Software
Features of the Mykola Scanning Software
Mykola Scanner Interface
Mykola Scanner Interface

SDRSharp Frequency Manager Python Application

Thank you to Argilli Marco (IU4HMY) for writing in and sharing with us his Python application called "SDR# Frequency Manager 1.0.1" for managing frequency lists in SDR#. SDR# is a popular free SDR program commonly used with RTL-SDR and Airspy dongles. Argilli writes:

SDR# Frequency Manager is a Python application designed to simplify the management and editing of frequency lists used by SDR#. The software allows you to open, edit, and save SDR# XML frequency files in a clear and structured interface.

The application is free but closed source and available on his website.

SDR# Frequency Manager Python Application

The Thought Emporium Explores IMSI Cell Phone Tracking and Other Advanced Cell Phone Attacks with Software Defined Radios

Over on YouTube, The Thought Emporium channel has uploaded a video outlining how mobile phones constantly leak unique IMSI identifiers over the air, making passive location tracking much easier than most people expect. While LTE and 5G improve security, older 2G and 3G protocols still expose permanent subscriber IDs that can be collected and linked to movement over time.

The video highlights how accessible this surveillance is. A cheap RTL-SDR USB dongle, basic antenna, and free software pre-installed on DragonOS are enough to passively collect IMSI numbers from nearby phones running on 3G. Once you know a person's unique IMSI number, you can easily track their movements if you have cheap radios monitoring the areas they frequent.

They also show how it's possible to use a more advanced TX-capable SDR like a USRP B210 to create a Stingray device, which is a fake cell-tower base station that you can force nearby cell phones to connect to. Once connected to the Stingray, all communications from your phone can be tapped. Finally, they discuss SS7 attacks, which, while difficult and/or expensive to gain access to the SS7 walled garden, can allow malicious actors to easily reroute security-related messages, such as 2-factor authentication.

The video finishes with potential defenses, including turning phones off when needed, forcing more secure LTE/5G-only connections, and using tools that detect fake cell towers. Privacy-focused mobile services that rotate identifiers are also discussed.

Recreating ICE Spy Tech Was WAY Too Easy

 

Building a P25 Police Scanner with an RTL-SDR Blog V3 and ZimaBoard 2

Over on YouTube, creator "MostlyBuilds" builds a networked digital police scanner using an RTL-SDR Blog V3 dongle and a compact x86 single-board computer called the ZimaBoard 2. The system receives over-the-air police radio signals, decodes digital P25 voice traffic, and turns it into an audio stream that can be listened to from any device on the home network, such as a phone, tablet, or computer.

The video walks through the hardware setup, ZimaBoard 2 features, and software configuration using ZimaOS and Docker. The open-source OP25 decoder handles the digital radio decoding, while containerized services stream the audio using Icecast and MediaMTX. MostlyBuilds also explains how to find local police frequencies, avoid encrypted channels, and verify signals using a handheld radio.

To make the stream more usable, a custom Python script inserts silence during gaps in transmissions, creating a continuous audio feed. Finally, MostlyBuilds ends the video by showing a small ESP32-based client prototype that plays the stream through a speaker, plus a breakdown of the full audio pipeline.

DIY Digital Police Scanner With ZimaBoard 2