SPECTRAL-GSM: A Web-Based GSM Interception Platform Built on OsmocomBB

OsmocomBB is an open-source project that replaces the stock baseband firmware on old Motorola phones (C118, C139, etc.) that use the Texas Instruments Calypso chipset. By flashing custom "layer23" firmware over serial, these cheap legacy handsets become capable of accessing raw GSM radio data at the baseband level, enabling cell scanning, burst capture, and passive subscriber identity harvesting.

SPECTRAL-GSM builds on this by wrapping OsmocomBB into a full GSM intelligence suite controlled from a single browser tab. The system supports up to five phones simultaneously and provides a structured pipeline: scan local GSM cells, capture raw bursts on a target channel, crack the A5/1 encryption using rainbow tables on a 2 TB SSD, and then use the recovered session key for real-time voice and SMS decryption. Additional modules handle passive IMSI catching, targeted single-IMSI surveillance, silent SMS location probing via a USB modem, and OpenCellID cell tower mapping.

The developer notes that the platform is intended for authorized research, law enforcement, and educational use. At the moment, Mini0com has not provided a link or website to the software, only providing a PDF file, and video demonstrations of the system on their YouTube channel. Contact details for Mini0com can be found in the description on the YouTube videos below.

Spectral-GSM OsmocomBB

OTP Capture Demonstration Using Spectral-GSM OsmocomBB



 
 
Tweet
Share
Reddit
Vote
Email

Echo: KiwiSDR, OpenWebRX, WebSDR and FM-DX iOS Browser App now Officially Released

Back in February, we posted about the beta release of Echo, an iOS app designed for browsing global web-based KiwiSDR, OpenWebRX, WebSDR, and FM-DX software-defined radios. Mark, the developer of Echo, has now officially released the app on the Apple App Store for free.

Echo turns your iPhone and iPad into a global radio receiver. Browse 2,000+ KiwiSDR, OpenWebRX, WebSDR, and FM-DX servers to hear shortwave, aviation, numbers stations, and distant FM in real time.

More information can also be found on the new echosdr.com website.

Echo iOS KiwiSDR, OpenWebRX, WebSDR and FM-DX Browser App
Echo iOS KiwiSDR, OpenWebRX, WebSDR and FM-DX Browser App
Tweet
Share
Reddit
Vote
Email

TRNXSDR-Carrier: A Modular Baseboard for SDR Modules

Over on GitHub, user acruxcz has released the TRNXSDR-carrier, an open hardware baseboard platform designed to host and interconnect multiple SDR modules. The board is built around a Xilinx XC7Z015 FPGA with 1 GB of DDR3 RAM at 1066 MHz, and features four SMA RF connectors, Gigabit Ethernet, an SFP optical port (with GTX support planned for up to 5 Gbit throughput), and USB-C with Power Delivery. It is not a standalone SDR, instead it acts as a central hub that requires external SDR modules connected via its expansion slots.

The slot system is a defining feature. The baseboard provides two high-speed primary slots (one with JESD204B support via GTX), two lower-speed primary slots, and room for an expansion board adding a further six slots and ten module positions in total. Planned RF modules include Lime Microsystems LMS6002D and LMS7002M chips, as well as Analog Devices AD9361/AD9363/AD9364 transceivers. A custom GNU Radio OOT source block is already functional, and initial RX testing at 433 MHz shows a clean signal with minimal noise floor. SoapySDR driver support, which would bring compatibility with SDR++, SDRangel, and other tools, is planned.

The hardware design is at Rev 1.0 with a Rev 2.0 in progress to address known bugs. The project is actively under development. It is not yet known if the developers plan to sell hardware, or leave it as open-source plans. 

The TRNXSDR-Carrier Board
The TRNXSDR-Carrier Board
Tweet
Share
Reddit
Vote
Email

Adding ACARS Decoding to an ADS-B Flight Tracker

Over on his blog, cynicalGSD has written a detailed post about how he extended his home ADS-B flight tracking setup to also decode ACARS. His existing system runs an RTL-SDR dongle on a Raspberry Pi feeding a database and Flask web app. Adding ACARS required a second RTL-SDR and a separate VHF dipole antenna tuned for 129–131 MHz.

ACARS (Aircraft Communications Addressing and Reporting System) is a text-based datalink that has been in use since 1978, carrying short messages between aircraft and ground stations. It includes messages such as OOOI events (Out of gate, Off ground, On ground, Into gate), pilot weather reports, maintenance fault codes, and gate and fuel data. The key feature of their implementation is cross-referencing ACARS messages with existing ADS-B records via aircraft registration and ICAO hex address, enriching flight records with precise departure and arrival timestamps from the airline's own reporting system.

The full write-up covers the database schema, Python integration using acarsdec, gain tuning tips, and the Flask web interface. cynicalGSD mentions that the code is available for anyone interested, but we didn't see a link, so please comment on his post if you are interested.

Technical Summary of cynicalGSD's ACARS + ADS-B implementation.
Technical Summary of cynicalGSD's ACARS + ADS-B implementation.
Tweet
Share
Reddit
Vote
Email

Using the NISAR Satellite as an Illuminator for Passive Radar

Over on GitHub, Jean-Michel Friedt has uploaded new code, results, and findings from one of his latest experiments with passive radar. A simple passive radar system uses two coherent receive channels and two antennas. One antenna receives a clean reference signal from an illuminator of opportunity, such as an FM or TV transmitter, while the other surveillance antenna receives echoes from the area containing targets. By correlating the surveillance signal with the reference signal over different delays and Doppler shifts, the system produces a range-Doppler map showing potential targets.

The novel thing about Friedt's recent work is that the illuminator is a moving L/S-Band satellite in space. The illuminator used is the polar-orbiting NISAR, a NASA-ISRO satellite designed for synthetic aperture radar (SAR). SAR satellites create detailed images of Earth by sending radar pulses to the ground and combining the returning echoes collected as the satellite moves, effectively simulating a much larger antenna.

Part of the trouble with using NISAR as an illuminator is predicting when it will be illuminating your current location. Friedt's GitHub readme explains how the software does illumination prediction.

NISAR emits chirp signals at 20 MHz bandwidth in the L and S-band, so a wideband SDR is required to get the full resolution. In his setup, Friedt used an Ettus B210 or Enjoy Digital M2SDR SDR, with two active GNSS antennas. 

The results show that he was able to successfully receive reflections of the satellite signal from the ground, transform the range-doppler data into map coordinates, and overlay them on a map.

[Also seen on Hackaday]

Passive Radar via the NISAR Satellite
Passive Radar via the NISAR Satellite

 

Tweet
Share
Reddit
Vote
Email

PhaseLatch: Using a 1970’s Microprocessor Chip with a Modern 20 MSPS ADC

Back in September 2025 we posted about Anders Nielsen's PhaseLoom, an SDR based on the MOS Technology 6502 chip - the chip behind the early age of home computing, powering iconic systems like the Apple I & II, Commodore 64, Atari, and Nintendo Entertainment System.

Anders has now moved on and created PhaseLatch, which combines the 6502 with a modern ADC that can be memory-mapped directly onto the 6502's data bus. Although achieving the theoretical max ADC bandwidth of 20 MSPS is not possible with the underpowered 6502, Ander's notes that when combined with some external RAM he was still able to perform some DSP on the 6502 such as tone detection.

The entire project is open source on GitHub, and Anders sells pre-made boards for experimentation.

6502 SDR with 20MHz ADC!

Tweet
Share
Reddit
Vote
Email

DeDECTive: A DECT 6.0 Cordless Phone Scanner and Voice Decoder for the HackRF

Over on GitHub and YouTube, we've seen the release of Sarah Rose's new program called DeDECTive, a DECT 6.0 scanner and voice decoder for the HackRF running on Linux systems. DECT (Digital Enhanced Cordless Telecommunications) is a digital wireless protocol typically used by modern cordless phones.

Back in 2019, Sarah (previously known as Corrosive) demonstrated how to use gr-dect2 to decode DECT in a previous video. In her latest work, she's ported gr-dect2 to C++ and written a nice GUI for the decoder. This makes running and setting up the decoder a significantly better experience. The GUI has a wideband scanner and the ability to tune for a single DECT channel for full voice decoding. There is also a CLI version that will automatically tune to the first active voice channel.

We note that many DECT cordless phones use encryption, so this software may not work with those devices. In any case, please be aware that intercepting phone calls may be illegal in many jurisdictions.

DeDECTive: The DECT Toolkit

Tweet
Share
Reddit
Vote
Email

Saveitforparts: Testing a Prototype Discovery Drive Az/El Antenna Rotator

Over on YouTube, Gabe from the saveitforparts channel has uploaded a new video testing a prototype of our upcoming Discovery Drive Az/El antenna rotator, which is now live for crowdfunding on Crowd Supply.

In the video, Gabe unboxes the Discovery Drive and sets it up with a Discovery Dish. He then tests it on various weather satellites, including Meteor M2-4, Meteor M2-3, DMSP, Metop-B, and Metop-C.  Later in the video, Gabe shows that you can also attach an Arrow Yagi antenna to the mount and notes that in a future video, he hopes to test CubeSat and Amateur radio satellite reception with the Yagi.

Testing Prototype Discovery Drive Satellite Tracker

Tweet
Share
Reddit
Vote
Email