Muxwright: A Multi-Standard Radio and TV Test Transmitter for the PlutoSDR

Thank you to Peter Holzhauser for writing in and sharing Muxwright, a multi-standard radio and TV test transmitter for the ADALM-Pluto (PlutoSDR). Peter has in the past submitted his ESPSoup, and Etherbulb projects. Muxwright is intended for home lab testing only, with the Pluto connected to the receiver under test via cable and attenuator or inside a shielded box, as radiating broadcast standards over the air requires a frequency assignment.

Muxwright can generate FM stereo with RDS/RBDS, DAB+, DVB-T, DVB-T2, DVB-C, DVB-S/S2, ATSC 1.0, ISDB-T, DTMB and analog PAL/NTSC TV, plus DVB-S2 DATV for QO-100 and other amateur bands (which of course requires an amateur radio license). The digital TV modulators run directly on the Pluto and everything is controlled from a browser dashboard. The Pluto's RX input can also be used as a monitoring receiver for expected vs. actual test reports.

The software runs on Windows 10/11 via WSL2 and is currently at Beta 0.4. The README notes that it has only been verified on the original Pluto Rev. B, and that DVB-T2, ATSC, ISDB-T and DTMB are still untested with real TV sets. The code is MIT licensed (with the FM/RDS module under GPL-3.0) and available on GitHub, however, the Windows installer is only available by request via email from the website.

Muxwright Transmitting DVB-T with a PlutoSDR
Muxwright Transmitting DVB-T with a PlutoSDR

AI Disclaimer: The project's GitHub commit history lists Claude as a co-author.

D325f-SDR: Turning the Cellular Modem in an Old LG Phone into an SDR

Thank you to Logan Zarov for writing in and sharing D325f-SDR, a project that turns the cellular modem in an old LG D325 (L70 Dual) Android phone into a software-defined radio. This is another in a series of wireless devices being reverse-engineered into SDRs with the help of AI. Recently we've seen the ESP-SDR, W1700K-SDR, BirrariaSDR, and LR2021 LoRa-SDR projects. From now on, we're calling these newly discovered SDRs "Sleeper SDRs": commodity RF devices with hidden SDR capabilities that have been discovered and tapped.

To activate D325f-SDR mode, the phone needs to be rooted and running LineageOS 14.1 with TWRP and a custom kernel. A small patch is then applied to the Hexagon firmware on the phone's Qualcomm MSM8610 modem, which enables the ability to stream raw 8-bit IQ samples at 7.68 MS/s (about 5 MHz of bandwidth) into a shared memory buffer that the custom kernel sets up. An Android app based on Dennis Mantz's RF Analyzer then shows the spectrum and waterfall and demodulates AM, FM, SSB, and CW on the phone itself.

Tuning works by hooking into the modem's stock PLL calculation. Logan has confirmed PLL lock from 1.7 to 2.17 GHz and has received an 1875 MHz cellular base station downlink directly. To get below 800 MHz, the app uses an interesting trick. It keys the phone's own Bluetooth transmitter to produce a carrier in the 2.4 GHz ISM band, and uses that carrier as a mixer. In this mode, Logan has received FM broadcast stations, an analog TV carrier at 551.25 MHz, and shortwave AM stations between 8 and 15 MHz, including speech at 14.970 MHz.

For the hardware modification, the B8 and B1 RF bypass wires are brought out to the phone's 3.5 mm headphone jack, and an antenna plugs in through a homemade SMA-to-3.5 mm adapter.

Logan is upfront about the limitations. So far it has only been built and tested on one phone, and calibrated sensitivity figures haven't been published yet. The modem-side buffer is only about 8 ms long, so a busy CPU can stop the stream. The Bluetooth carrier coupling technique also hasn't been characterized. We also note that the phone actively transmits a Bluetooth carrier in the below-800 MHz mode, which probably violates the Bluetooth module's certification and could make this mode legally grey.

The code is open source under the GPL-3.0-or-later license and available on GitHub. Logan has also written up a detailed explanation of how it works, with IQ analysis, and shared raw IQ recordings. 

D325f-SDR Running on an LG D325 with SMA Antenna Adapter
D325f-SDR Running on an LG D325 with SMA Antenna Adapter

AI Disclaimer: The project's credits note that AI tools assisted with code development and documentation.

Elektro-L3 Arrives at 14.5°W and Begins Testing L-Band LRIT and HRIT

Earlier this month we posted about the Russian Elektro-L3 geostationary weather satellite drifting west from 76°E to 14.5°W. It is replacing Elektro-L2 and could bring unencrypted L-band LRIT and HRIT imagery back to Western Europe. Now tec_msat has written in again to let us know that Elektro-L3 has arrived. It is already transmitting X-band RDAS and testing LRIT and HRIT.

tec_msat notes that the satellite was only active on C-band for a couple of days. Then, on October 26, its RDAS, xRIT, and DCP (Data Collection Platform) downlinks all went up. Elektro-L2's DCP transmission at 1697 MHz was switched off at 06:30 UTC, and L3's DCP came up at 07:02 UTC. LRIT data was being received from about 09:42 UTC. GGAK (space weather data) is still being transmitted from Elektro-L2 for now.

This is the first xRIT from 14.5°W in years, so tec_msat warns that transmissions may be sporadic for a while. It's too early to judge signal strength, but it already looks stronger than L3 did at low elevation (under 15 degrees) in its old slot.

If you're in Western Europe, now is a good time to get your dish ready. SatDump is the best software for reception and decoding, and our Discovery Dish with L-band feed and an RTL-SDR Blog V3 is a great starting point for hardware.

Elektro-L3 LRIT Image Received from 14.5°W on October 26
Elektro-L3 LRIT Image Received from 14.5°W on October 26

rxx_lora: A Lightweight rtl_fm-Style LoRa Receiver for RTL-SDR and SDRplay, No GNU Radio Required

Thank you to Przemysław Wcisło (SO5DZ) for writing and sharing rxx_lora, a command-line LoRa receiver for RTL-SDR and SDRplay RSP devices. Przemysław notes that it was designed in the spirit of rtl_fm, so there are no GNU Radio flowgraphs to build or maintain. Instead, it is a single small C binary (rtl_lora or rsp_lora, plus file_lora for saved I/Q captures). Decoded packets are printed as JSONL to stdout, so you can pipe them into other programs.

Przemysław writes:

  • It's fast. The entire receive chain (detection, sync, demodulation, FEC) runs from dozens to hundreds times real-time, depending on the PHY parameters and hardware, of course.

  • It's sensitive. I've benchmarked the binary end-to-end over AWGN, and it comes within ~1-2 dB of ideal theoretical LoRa performance. It can easily demodulate Meshtastic's MediumFast preset at -14 dB SNR. I can also vouch for this based on real-world observations. Valid decodes regularly pop up at -12 to -14 dB. I even saw a frame at -17 dB SNR, although it had a bad CRC :)

  • It's stable. It's never crashed on me, apart from when I accidentally wiggled the dongle out of the USB port ;) It should also be stable from a software quality perspective. I've put together an extensive suite of quality gates and tests, including noise tests, tests against previously recorded over-the-air captures... This should make it quite unlikely that an upcoming change will accidentally introduce a major regression.

  • It doesn't require much: librtlsdr, FFTW, a C compiler, and make. Most who have dabbled with RTL-SDRs probably won't need to install a single package on top of what they already have. Python and a few libraries are used for the tests and extra tools, but they're not required for normal operation.

The receiver implements the standard LoRa PHY, so it can be used for Meshtastic, LoRaWAN, MeshCore, APRS-over-LoRa and other LoRa signals. An included Python script also decrypts Meshtastic packets with the default or configured channel keys and prints them in a readable form.

The demodulation core is derived from the gr-lora and gr-lora_sdr GNU Radio projects. The code is open source under GPLv3 and available on GitHub. It runs on Linux, and the README says macOS "probably" works too. The SDRplay version also requires the SDRplay API. For Meshtastic reception, it covers similar ground to the GNU Radio-based Meshtastic_SDR project, which we previously posted about, but with a much smaller footprint.

rxx_lora Decoding Meshtastic Packets with an RTL-SDR
rxx_lora Decoding Meshtastic Packets with an RTL-SDR

AI Disclaimer: Przemysław notes that the sensitivity improvements came from "patient and deliberate use of strong AI tools", and the README states that the project made heavy use of AI for both coding and theoretical exploration.

DAB SDR GUI: An Open-Source DAB+ Receiver for the RTL-SDR and SDRplay

Thank you to Tomas Krajco for writing in and sharing DAB SDR GUI, a Windows program for listening to DAB+ digital radio with an RTL-SDR or SDRplay RSP. DAB+ is the digital broadcast radio standard used in much of Europe and Australia, and is transmitted in VHF Band III (174 - 240 MHz).

The program scans Band III and saves the stations it finds, then plays the selected station while showing its logo, ensemble name, and song text. It also has a 10-band equalizer with presets and a spectrum analyzer with RTA bar, FFT curve and LED bar display modes. Note that the analyzer shows the decoded audio rather than the RF spectrum, so this is a program for listening rather than signal analysis.

Decoding is handled by Tomas' own plain C DAB/DAB+ library called dab-lib, and both the library and the GUI are open source under the GPLv2 license. The latest Windows installer is v0.1.5, and older Android (RTL-SDR) and Linux AppImage (SDRplay)
builds are also available on the SourceForge files page.

DAB SDR GUI Playing a DAB+ Station
DAB SDR GUI Playing a DAB+ Station

AI Disclaimer: Recent commits to the dab-lib GitHub repo, including the port of the GUI to WinUI 3, list GitHub Copilot as a co-author.

DecSAT: A DVB-S/S2/S2X Satellite Receiver with Blind Scanning for the HackRF One

Thank you to RTL-SDR.COM reader Vitor for writing in and sharing DecSAT, an open-source Rust program by CasualArclamp that turns a HackRF One into a DVB-S/S2/S2X satellite receiver. It's laid out like SDR++, with a large waterfall and VFOs that you drop onto carriers, each running its own decoder.

DecSAT decodes DVB-S2 and S2X carriers, including ACM, and outputs MPEG-TS to VLC or its built-in TV player, and IP data to PCAP files for Wireshark. A blind 'Identify' mode works out an unknown carrier's symbol rate and modulation, and a 'Survey' tool acts like a blind scan, identifying and decoding every carrier in the span. It also supports various SCPC modem, voice, radar, and satellite beacon formats.

Portable Windows binaries are available on the original repo's releases page, and Vitor notes that he has created a fork that adds a Visual Studio 2022 build.

Update: Vitor notes that his fork as added several new features, including analogue modes such as WFM with RDS, analogue TV (PAL/NTSC) and integration to CrazyCat's streamreader.dll allowing use of compatible satellite tuners (mostly made by TBS) to setup the LNB (polarity, band and power), launch DiSEqC commands and blindscan and stream the actual TS back to DecSAT. He notes that these updates should eventually work their way back into the upstream code.

DecSAT Identifying Carriers in a Synthetic 8 MS/s Test Scene
DecSAT Identifying Carriers in a Synthetic 8 MS/s Test Scene

AI Disclaimer: Claude is listed as a contributor to the DecSAT repo.

Testing Hubble Network’s Bluetooth-to-Satellite Link from Budapest

Thank you to Zoltán Dóczi for writing in and sharing his blog post about trying out Hubble Network’s direct-to-satellite Bluetooth service. Hubble is a growing LEO satellite constellation service (currently about seven satellites are up, with a planned 60) that claims that off-the-shelf BLE chips can send small telemetry packets straight to its satellites without any extra hardware. To test this, Zoltán ran Hubble’s Zephyr-based satellite sample on a +20 dBm Silicon Labs EFR32MG24 board with a PCB antenna, and later added an ESP32-C6. The devices were powered by an 18650 cell and left on a flat roof in Budapest from August until late September.

Locally, the transmitter was clearly working. He picked up bursts every 10 seconds near 2.482 GHz with a Signal Hound BB60C, a HackRF One running an Android RF analyzer app, and his ESP32-based ESPARGOS receiver array. The signal turns out to be narrowband and frequency hopping across 19 channels at the top of the 2.4 GHz band, rather than standard BLE advertising.

Unfortunately, over about eight weeks, the Hubble dashboard recorded zero satellite packets. The cause appears to be that Hubble’s satellite service currently only covers the USA, which was not clear in the onboarding documentation at the time. Satellite access also requires a paid “Live” organization, not the free Sandbox account he used. SatNOGS observations of HUBBLE-6 telemetry on 401.1 MHz confirmed that the satellites themselves were healthy. While this was a negative result so far, mostly due to his EU location, Zoltán's post is a useful write-up for anyone thinking of experimenting with the service. He notes that his next step is to try decoding the uplink frames locally with a PlutoSDR.

Hubble Network outdoor test with EFR32xG24 transmitter and HackRF for test reception (Left), Measured spectrum with Signal Hound BB60C (right)
Hubble Network outdoor test with EFR32xG24 transmitter and HackRF for test reception (Left), Measured spectrum with Signal Hound BB60C (right)

Mobile-Whip: A Compact Battery Powered Mini-Whip Style Active HF Antenna for Handhelds and SDRs

Thank you to RTL-SDR.COM reader Ernie (NH7L), who wrote in and wanted to share news about the “Mobile-Whip” antenna, an open-source active receive antenna from GitHub user skuep.

The design is based on the well-known PA0RDT Mini-Whip, but it is built for portable use. It runs from a single 18650 lithium cell with an onboard USB charger, or from 5V USB, the 4.5V bias tee on the RTL-SDR Blog V4, or a standard 12-15V Mini-Whip bias tee. It uses an ultra-low input capacitance LTC6268 op-amp instead of a JFET, draws about 20 mA, and is only 200 mm long. That makes it small enough to mount directly on a handheld like an HF-modded UV-K5, a portable receiver, or a dongle SDR. It is designed for 100 kHz to 30 MHz, but the author says it also works reasonably well on FM and 2m.

The project is a first-revision preview with some known issues. A revision B with better VHF/UHF performance is reportedly in the works. There is no reverse-TX protection yet, so pressing PTT with it attached could destroy it. The KiCad files, simulations and JLCPCB-ready assembly files are on GitHub under the CERN-OHL-P-2.0 license. Assembled boards work out to roughly €25 each.

In two YouTube videos from a Polish ham, the Mobile-Whip is compared against a 27 MHz telescopic whip on several receivers, including the Radtel RT-950 Pro, UV-K5, ATS Mini, and Malahit DSP2. The tiny PCB antenna generally comes out ahead. On the RT-950 it even receives Polish Radio on 225 kHz longwave, which the telescopic whip could not. He does note that its high gain can overload receivers with poor front-end filtering.

The "Mobile-Whip" a PA0RDT Mini-Whip inspired portable antenna for HF
The "Mobile-Whip" a PA0RDT Mini-Whip inspired portable antenna for HF