Back in March, we posted about GridDown, an open-source Android tablet-based situational awareness system designed to operate without an internet connection, which uses sensors such as an RTL-SDR, a SARSAT receiver and an ESP32-S3/SX1262 LoRa radio.
Recently, GridDown developer Cameron wrote in again and shared with us that the LoRa firmware for GridDown has now been released as an open-source project called "GridDown Secure Messenger" (main website).
The project uses a LILYGO T-Deck CYPHER-M8K (an ESP32-S3 with SX1262, 2.8" display, keyboard, and GPS) to implement secure, encrypted off-grid text messaging, and it also doubles as a 900 MHz drone scanner, with the ability to decode drone Remote ID.
Cameron has also provided two YouTube shorts [1] [2], showing the firmware in action.
Example Renders of the GridDown Secure Messenger Running on a LILYGO T-Deck CYPHER-M8K.
AI Disclaimer: The renders appear to have been AI-generated.
Thank you to Cameron from BlackAtlas LLC for submitting their project GridDown, which is an open source Android tablet-based situational awareness system designed to operate without an internet connection. At its core, it appears to be a tablet with custom software, and then you can add sensors such as an RTL-SDR for ADS-B+Remote ID, a SARSAT receiver, and a Meshtastic ESP32-S3+SX1262 device. A demonstration of the UI can be found at https://griddown.blackatlas.tech.
Cameron writes:
[GridDown is] an offline-first situational awareness platform built for emergency preparedness, field response, and tactical operations in infrastructure-degraded environments — designed to work when cell towers are down, internet is unavailable, and operators are fully off-grid.
The platform is a Progressive Web App (~120,000 lines of vanilla JavaScript, no frameworks) that runs on Samsung Galaxy tablets, laptops/PCs, and works completely offline after initial setup. It's built by BlackAtlas LLC and is available for trial at https://griddown.blackatlas.tech.
The system has many facets to it, including:
Encrypted voice and text messaging via an ESP32-S3 with SX1262 LoRa transceiver
Passive RF sensing with the ESP32-S3 and SX1262.
Three passive drone detection methods: WiFi fingerprinting, FAA Remote ID reception, and 900 MHz control/telemetry link detection
Automatic gunshot detection via a ES7210 quad-channel I2S microphone on the ESP32-S3.
Automatic RF jamming detection
SARSAT beacon receiver
SSTV Encode/Decode
Meshtastic integration
APRS via Bluetooth TNC
ADS-B reception
RadioCode gamma spectrometer integration
Offline maps
ADS-B detection is handled by a Raspberry Pi 5 running an RTL-SDR Blog V4 dongle. Cameron writes:
The Pi connects to the tablet's built-in WiFi hotspot (no internet required — the hotspot functions as a local network only), and a Node.js bridge reads aircraft data from readsb and subscribes to the Remote ID receiver's MQTT output, then serves a unified WebSocket and REST API to the tablet. GridDown renders aircraft and drone tracks as heading-rotated silhouette icons on its offline map with altitude labels, age-based alpha fade, and emergency squawk alerting (7500/7600/7700). A 10,000 mAh USB-C PD battery provides approximately 5 hours of field runtime for the Pi.
The full setup script, hub bridge, and hotspot connection scripts ship with the project.
The software is dual-licensed, with it being open source GPL v3 (note that the GitHub link appears to be broken - we have asked for clarification) for non-commercial use, or a commercial licence for hardware bundles and business deployments.
Alternatively, BlackAtlas LLC is selling ready-to-use kits, with the core tablet coming in at $799. Other bundles include the Tablet + SARSAT receiver for $1,299, the Tablet + Meshtastic bundle for $1,299, and the Tablet + ADS-B/Remote ID bundle for $1,999.
Over on YouTube Aaron, creator of DragonOS and the WarDragon kit has uploaded a video showing how he was able to detect drone Remote ID with a Bluetooth dongle and plot it on a TAK map. Remote ID is an RF system regulated in many countries that broadcasts drone information, including GPS position, often over Bluetooth Long Range or Wi-Fi. Note that the Bluetooth dongle is not an SDR, but this story may still be interesting for many readers.
The setup uses Sniffle, which is an open-source Bluetooth sniffer program for TI CC1352/CC26x2 based Bluetooth hardware. Sniffle passes sniffed data packets into SniffleToTak which is open-source software that relays the drone ID packets into a TAK server, which can then be viewed in TAK software like ATAK.
Aaron tests the setup with his DJI drone flying nearby, and shows that the drone is successfully detected and plotted on the TAK map. He also plots the positions of nearby aircraft received via a second ADS-B receiver to show that drones and aircraft can be plotted on the same map.
WarDragon Enhancing Drone Remote ID Real-Time Tracking + ADS-B w/ ATAK (TAR1090, Sniffle) Part 3
Just recently we posted about the release of some firmware for the AntSDR E200 which allows it to decode DJI DroneID. DroneID is a protocol designed to transmit the position of the drone and operator to authorized entities such as law enforcements and operators of critical infrastructure.
In his latest video Matt from the Tech Minds YouTube channel shows this firmware in action. In the video he first shows how to install the firmware, and how to connect to its serial output. He goes on to test it with his DJI Mini 4 Pro and show some live DroneID frames being decoded.
DJI Drone Hacking Using Software Defined Radio ANTSDR E200
DJI is a major manufacturer of consumer drones and their drones implement an RF protocol called DroneID which is designed to transmit the position of the drone and operator to authorized entities such as law enforcements and operators of critical infrastructure.
Recently the AntSDR team have managed to get DJI DroneID decoding working on the AntSDR's onboard ARM processor. The decoding software runs on board the AntSDR E200 and outputs decoded data via the serial or network port. The AntSDR E200 is an SDR that is based on the AD9361 chip and has a 70 MHz to 6 GHz tuning range, 56 MHz of bandwidth and 12-bit ADC. It has 2x2 full duplex TX/RX channels and has an onboard FPGA with ARM CPU core.
The update from AntSDR shows how to install the firmware onto the device and get it up an running. They note that drones that use Occusync 2 or 3 like the Mini2 or Mini3Pro work best, because other models may be encrypted or have a slightly different protocol which doesn't work with these decoders.
Aaron, creator of DragonOS has also uploaded a video showing the decoder in action.
KerberosSDR is our 4-channel phase coherent capable RTL-SDR unit that we previously successfully crowdfunded back in 2018. With a 4-channel phase coherent RTL-SDR interesting applications like radio direction finding, passive radar and beam forming become possible. It can also be used as 4 separate RTL-SDRs for multichannel monitoring. KerberosSDR is currently in stock and available on the Othernet store.
In their experiment they set up both circular and linear antenna arrays for the KerberosSDR, then flew the drone in front of the antenna array while recording the bearings calculated by the KerberosSDR system. The results showed that the KerberosSDR was able to successfully track the drone's bearing with either antenna array, however the linear array produced more accurate results as expected.
We note that a linear array cannot differentiate if an object is in front or behind the array. However, if this knowledge is known it can be used instead of a circular array to get more accurate bearings that are less affected by multipath.
Over on the LimeSDR CrowdSupply blog, Ogün Levent has submitted a short article about his "Dronesense" project. Dronsense is a spectrum-scanning and jamming system based on the LimeSDR. The LimeSDR is a US$299 12-bit TX/RX capable SDR that can tune between 100 kHz – 3.8 GHz, with a maximum bandwidth of up to 61.44 MHz.
Drone defense is a problem that is plaguing airports, cities, sensitive buildings and the military. These days anyone with a low cost off the shelf drone can cause havoc. Solutions so far have included net guns, drone deployed nets, wideband jammers, GPS spoofers, traditional and passive radar systems, visual camera detection, propeller noise detection, microwave lasers and SDR based point and shoot drone jamming guns like the IXI Dronekiller.
Both the expensive made for military IXI Dronekiller SDR gun, and the LimeSDR Dronesense work in a similar way. They begin by initially using their scanning feature to detect and find potential drone signals. If a drone signal is detected, it will emit a jamming signal on that particular frequency, resulting in the drone entering a fail-safe mode and either returning to base or immediately landing. Specifically targeting the drone's frequency should help make the jammers compliant with radio regulations as they won't jam other legitimate users at the same time. We note that this method might not stop drones using custom RF communications, or fully autonomous drones.
Dronesense: Drone Detection and Jammer Mounted on another Drone, running on a LimeSDR.
However, unlike the IXI Dronekiller gun, Dronesense requires no pointing and aiming of a gun like device. Instead it appears to be mounted on another drone, with an omnidirectional jamming antenna. It runs with a GNU Radio based flowgraph which decides if a detected signal is from a drone, and if so activates the jammer. Unfortunately the software and further details don't appear to be available due to non-disclosure agreements.
DroneSense Second Jamming Test (Software Defined Aerial Platform)
Recently Zoltan of rfsparkling.com wrote in to us to show us how he combined efforts with András (programmer of the OpenWebRX software) to create a proof of concept remote spectrum monitoring drone. The drone uses an RTL-SDR connected to a Raspberry Pi, and the Raspberry Pi runs an OpenWebRX server which broadcasts the radio data via 4G mobile internet. The full connection flow chart goes as follows:
[Drone] Antenna –> RTL-SDR –> RPi 2 –> OpenWebRX Server –> 4G mobile net –> … Internet … [Notebook] –> 4G mobile net –> Browser with OpenWebRX client
Zoltan writes that some possible applications include emergency communications, ham radio, 3D spectrum mapping, etc. In the future he also hopes to add TX capabilities, so that the drone can also work a a makeshift transceiver tower. The biggest limitation that Zoltan noted is the flight time of only about 10 minutes. However, a solution he suggests for future experiments is using wire powered drones.
In previous posts we showed Hak5’s remote RTL-SDR ADS-B drone. Their results were not particularly great, however Zoltan and András’ results seem to be much better.
The video below shows an example of Zoltan and András’ drone experiments.
Remote Spectrum Analyzer Drone With OpenWebRX using RTL-SDR and Raspberry Pi
