Tagged: bluetooth

Testing Hubble Network’s Bluetooth-to-Satellite Link from Budapest

Thank you to Zoltán Dóczi for writing in and sharing his blog post about trying out Hubble Network’s direct-to-satellite Bluetooth service. Hubble is a growing LEO satellite constellation service (currently about seven satellites are up, with a planned 60) that claims that off-the-shelf BLE chips can send small telemetry packets straight to its satellites without any extra hardware. To test this, Zoltán ran Hubble’s Zephyr-based satellite sample on a +20 dBm Silicon Labs EFR32MG24 board with a PCB antenna, and later added an ESP32-C6. The devices were powered by an 18650 cell and left on a flat roof in Budapest from August until late September.

Locally, the transmitter was clearly working. He picked up bursts every 10 seconds near 2.482 GHz with a Signal Hound BB60C, a HackRF One running an Android RF analyzer app, and his ESP32-based ESPARGOS receiver array. The signal turns out to be narrowband and frequency hopping across 19 channels at the top of the 2.4 GHz band, rather than standard BLE advertising.

Unfortunately, over about eight weeks, the Hubble dashboard recorded zero satellite packets. The cause appears to be that Hubble’s satellite service currently only covers the USA, which was not clear in the onboarding documentation at the time. Satellite access also requires a paid “Live” organization, not the free Sandbox account he used. SatNOGS observations of HUBBLE-6 telemetry on 401.1 MHz confirmed that the satellites themselves were healthy. While this was a negative result so far, mostly due to his EU location, Zoltán's post is a useful write-up for anyone thinking of experimenting with the service. He notes that his next step is to try decoding the uplink frames locally with a PlutoSDR.

Hubble Network outdoor test with EFR32xG24 transmitter and HackRF for test reception (Left), Measured spectrum with Signal Hound BB60C (right)
Hubble Network outdoor test with EFR32xG24 transmitter and HackRF for test reception (Left), Measured spectrum with Signal Hound BB60C (right)

FliteGrid: A Crowdsourced Drone Detection Network That Pays Feeders US$50 A Month

Thank you, Chris, for writing in and sharing news about the recent launch of FliteGrid's hex claiming scheme. FlightGrid is a crowdsourced drone-tracking network that will pay feeders in an eligible hex grid $50 a month to run a drone-detection sensor. Chris explains:

The US government is building out Unmanned Traffic Management (UTM), which will be the equivalent of air traffic control for drones. This will make it possible to automate things like shipping, emergency response, infrastructure inspections, and more all over the country. To do that, they'll need awareness of every drone in the sky just like they have for every plane today, and FliteGrid is our solution to providing it.

The devices themselves are custom sensors that receive Remote ID transmissions. That's the standard the FAA created for drones to transmit identifying information, which it now requires all drones in America to broadcast. Serial number, location, altitude, operator location, etc. Remote ID can be broadcast on four different protocols, so we've got four receivers in each piece of hardware; two WiFi and two Bluetooth. That data is then uploaded onto the SkySafe platform, which provides a realtime map of every drone in the sky.

The catch to getting paid is that you need to 1) pay a $100 refundable deposit to receive their hardware, and 2) place and run it in a hex grid that offers to pay. The paying hex grids are mostly around US airports and critical infrastructure right now, so you'd need to live in, or have access to a roof in those areas to host the device. Payment is given in USDC, a stablecoin cryptocurrency pegged to the US dollar.

FliteGrid Hexes: Red - Claimed, Green - Available to claim with $50 p/m payout, Purple - Requested by community, Black - Requestable.
FliteGrid Hexes: Red - Claimed, Green - Available to claim with $50 p/m payout, Purple - Requested by community, Black - Requestable.

FliteGrid/SkySafe is able to pay users because operators of critical infrastructure and large facilities such as airports, universities, energy infrastructure, the US military, DHS, and the DOD will pay for real-time awareness of the airspace above them. SkySafe has been around since 2015, has raised around $50M in funding, and has contracts with many of the previously listed organizations. Chris notes that the service has already been used successfully in operations like busting gangs smuggling drugs into prisons via drones. 

The FliteGrid sensor appears to be a computing device with WiFi and Bluetooth radios repurposed to detect Remote ID, with each radio connected to a higher-gain external antenna. Recently, on the blog, we have seen DIY Remote ID detectors made from ESP32s and other commodity Bluetooth hardware.

Since a 2024 mandate, drones over 249 g in the USA must transmit Remote ID signals for tracking and identification purposes, similar to how ADS-B is used for larger aircraft. For ADS-B, flight aggregation services such as FlightAware/FlightRadar24/ADS-B Exchange etc. already exist, with volunteer feeders setting up stations that can cover up to 400km. However, unlike ADS-B, Remote ID is transmitted with single-digit milliwatts of power, compared to a minimum of 70W for ADS-B, so its reception range is limited, making a dense distributed reception network like SkySafe for Remote ID very important. Individual SkySafe hex grids cover just under 1km of area. 

FliteGrid cannot detect drones that are not transmitting Remote ID, though Chris mentions that government infrastructure and facilities may use normal radar to detect these. A radar detection that does not correlate with a SkySafe detection would confirm that a drone is a potential threat.

The FliteGrid Sensor
The FliteGrid Sensor

ESPsoup: Turn an ESP32-C5 into a 2.4 & 5 GHz Pocket Scanner with a Connected Phone or PC

Thank you to Peter Holzhauser for writing in and sharing with us his latest open-source project, 'ESPsoup'. Peter has written in previously to share his Android app, V2X2MAP, which detects and plots vehicle V2X (car-to-car) communications used by some modern cars. His new project, ESPsoup, combines an ESP32-C5 and a connected PC or phone into a fully featured scanner for the 2.4 GHz and 5 GHz bands.

ESPsoup has various features including a live spectrum view up to 80 MHz wide, a sweep mode to monitor larger bandwidths, a GPS-enabled heatmapping tool, Bluetooth analysis tools, an AirTag detector, WiFI analysis tools, a car-to-car V2X monitor, a smart home sensor reader, a drone remote ID detector, a microwave oven detector, and an analog FPV video demodulator and display.

The website notes that if you want to monitor multiple FPV drone video channels, up to eight ESP32-C5s have been tested to work together on a single USB hub connected to a PC.

Peter notes that he is planning to add RTL-SDR support to ESPsoup in approximately two weeks, so keep an eye out on their website for updates.

ESPsoup screenshots from a mobile device.
ESPsoup screenshots from a mobile device.

Bluewatch: Detecting new Bluetooth Devices in your Neighbourhood via a Raspberry Pi

Thank you to p0larpatch for writing in and sharing with us his project called "Bluewatch," which uses a Raspberry Pi to detect when new Bluetooth devices appear in your neighborhood. While Bluewatch doesn't use an SDR and only uses a standalone Raspberry Pi, it may still interest our readers. p0larpatch explains the project below:

Get alerts when new Bluetooth devices appear in your local neighbourhood.

The real strength shows up once you actually start using it: categorize the devices you already know, your own phones, your TV, the smart plugs, the neighbour's robot lawnmower, whatever's expected around you, and BlueWatch filters all of that familiar traffic out of the way.

What's left standing out is the interesting part: the moment an unrecognized device enters the radio range of whatever's running BlueWatch, it surfaces immediately instead of being buried under dozens of devices you've already triaged.

The dashboard stops being a wall of MAC addresses and turns into an actual presence radar for your surroundings. You notice the one device that doesn't belong, not the fifty that do.

Bluewatch Screenshot: Detecting Bluetooth Devices
Bluewatch Screenshot: Detecting Bluetooth Devices

ESP32 Bit Pirate Updates: New LoRa and Meshtastic Analysis Features

Back in September 2025, we posted about the "ESP32 Bus Pirate" firmware, which transforms an ESP32-S3 into a multi-protocol debugging and hacking tool. We later covered an update in March 2026 that added waterfall displays, cellular modem support, and an external radio expander.

Although the ESP32 does not have true SDR capabilities, it can leverage its numerous built-in radio hardware components to achieve a range of interesting SDR-like features. Recently, "Geo," the creator of the ESP32 Bus Pirate, wrote in to share some recent firmware updates with us.

Geo notes that the project is now called "ESP32 Bit Pirate" and now includes LoRa/SX1262 support and Meshtastic analysis features.

ESP32 Bit Pirate can now transmit and receive LoRa packets, monitor RSSI, scan frequency activity, display a simple waterfall view and perform Channel Activity Detection. Radio parameters including frequency, bandwidth, spreading factor, coding rate, transmit power, preamble and sync word can be configured directly from the interface.

Packets can also be recorded to the ESP32 filesystem and replayed later together with their original radio configuration.

A dedicated Meshtastic analysis shell has also been added, allowing users to send, receive and inspect Meshtastic packets. The goal is not to replace a Meshtastic node, but to provide a debugging and experimentation interface for understanding and interacting with LoRa/Meshtastic traffic.

The latest update has also added new LoRa hardware support for the Heltec Vision Master T190 and Heltec WiFi LoRa 32 V4, a browser-based debugging ecosystem, a Python scripting lab, and a BPIO2 USB adapter mode.

The project is entirely open source, and the code can be found on their GitHub page.

ESP32 Bit Pirate LoRa Support Added
ESP32 Bit Pirate LoRa Support Added

ESP32 Bus Pirate: Update Brings Waterfall Displays, Cellular Modem Support and External Radio Expander

Back in September 2025, we posted about the "ESP32 Bus Pirate" firmware, which transforms an ESP32-S3 into a multi-protocol debugging and hacking tool. Although the ESP32 does not have true SDR capabilities, it can leverage its numerous built-in radio hardware components to achieve a range of interesting feats. Recently, "Geo," the creator of the ESP32 Bus Pirate, wrote in to share some recent firmware updates with us. He writes:

The ESP32-Bus-Pirate project is an open-source firmware that transforms inexpensive ESP32-S3 boards into versatile hardware hacking and debugging tools. Inspired by tools like the Bus Pirate and Flipper Zero, the firmware allows a single ESP32 device to interact with a wide range of digital buses, radios, and hardware interfaces.

Because ESP32 boards include integrated WiFi and Bluetooth radios and can interface with many external modules, the firmware makes it possible to experiment with both hardware protocols and RF systems using very low-cost hardware.

The firmware currently supports a wide range of protocols and devices including:

I²C, SPI, UART, CAN, 1-Wire, infrared, smartcards, Sub-GHz radios, RF24 modules, WiFi, Bluetooth and cellular modems.

Major New Features in v1.5

The latest release adds several major capabilities useful for hardware analysis and RF experimentation.

Waterfall Spectrum Displays

Multiple RF modules can now display real-time waterfall visualizations, showing signal peaks and activity across frequencies. This is available for:

• Sub-GHz radios
• RF24 modules
• FM radio modules
• WiFi channel activity

This makes it easier to visually monitor RF environments directly from the device.

Sub-GHz Improvements

The Sub-GHz subsystem has been completely reworked for improved reliability when recording, replaying and receiving RF frames. Raw payload transmission is also supported.

Cellular Modem Support

ESP32-Bus-Pirate can now interact with cellular modem modules, allowing users to inspect modem and network information and perform operations such as:

• Dumping SIM card data
• sending SMS
• dialing calls

External Radio Expander

The firmware now supports an **external UART radio expansion module** called the **ESP32 Bus Expander**, which allows adding additional RF hardware modules to the system, notably for the WiFi 5GHz.

Links

Project:
https://github.com/geo-tp/ESP32-Bus-Pirate

Web Flasher:
https://geo-tp.github.io/ESP32-Bus-Pirate/webflasher/

Documentation:
https://github.com/geo-tp/ESP32-Bus-Pirate/wiki

Scripts collection:
https://github.com/geo-tp/ESP32-Bus-Pirate-Scripts

ESP32 Bus Expander:
https://github.com/geo-tp/ESP32-Bus-Expander

ESP32 Bus Pirate. Left - Running on COTS ESP32-S3 based devices. Right - ESP32 Bus Pirate Interface
ESP32 Bus Pirate. Left - Running on COTS ESP32-S3 based devices. Right - ESP32 Bus Pirate Web Interface

SLZB-Ultima: A Quad-Radio Smart Home Radio Controller Supporting Various Protocols

While not based on SDR technology, we think that some readers may be interested in this product.

We'd like to thank Serhii, who writes on behalf of SMLIGHT in Ukraine. SMLIGHT recently released its "SLZB-Ultima" device, a compact radio platform supporting multiple wireless technologies commonly used in smart homes. 

These technologies include Zigbee, Thread, Wi-Fi, and Bluetooth. The device also optionally supports Z-Wave, LTE, Power-over-Ethernet, UPS backup, infrared control, and USB-over-Ethernet. The cloud-independent software supports WireGuard VPN, Dynamic DNS, Internal Zigbee hub mode, local IF-THEN automations running directly on the device, and one-click OTA updates.

The full press release is available here in this PDF.

The device is priced affordably at only US$40 on Aliexpress.

The SLZB Ultima
The SLZB Ultima

 

ESP32 Bus Pirate: Turn your ESP32 into a Multi-Purpose Hacker Tool

Thank you to "Geo" for writing in and sharing with us his open source project called "ESP32-Bus-Pirate" which he thinks might be of interest to those in the RTL-SDR community. The ESP32 is a popular low-cost microcontroller due to the fact that it has WiFi and Bluetooth capabilities built in. Although the ESP32 does not have true SDR capabilities, it can leverage its numerous built-in hardware radio components to achieve various interesting feats. Geo writes:

This firmware turns an inexpensive ESP32-S3 board into a multi-protocol debugging and hacking tool, inspired by the original Bus Pirate and the Flipper Zero.

It currently supports a wide range of protocols and devices, including I²C, SPI, UART, 1-Wire, CAN, infrared, smartcards, and more. It also communicates with radio protocols as Subghz, RFID, RF24, WiFi, Bluetooth.

Compared to existing solutions, the focus is on:

Accessibility — runs on cheap ESP32-S3 hardware (around $7–$10).

Versatility — one device can probe, sniff, and interact with multiple buses.

Extensibility — open-source and modular, making it easy to add new protocol support.

I believe this could be useful for hardware hackers, security researchers, and hobbyists looking for a low-cost, flexible alternative to commercial tools.

With the firmware installed on a compatible ESP32 device, it is possible to create WiFi, Bluetooth, and RF24 sniffers, scanners, and spoofers, as well as perform general sub-GHz and RFID sniffing, scanning, and replay attacks. It also has a host of non-RF capabilities useful for hacking devices.