Tagged: hackrf

VMA Radio Lab: DecSAT Extended into a Multi-SDR Receiver with DVB-T/T2, DAB+ and Analog PAL TV

Last week we posted about DecSAT, an open-source program by CasualArclamp that turns a HackRF One into a DVB-S/S2/S2X satellite receiver and analyzer. Now Vitor Martins Augusto has written to share his fork, 'VMA Radio Lab' (initially called DecSAT-VMA), which extends DecSAT into a general-purpose broadcast receiver and measurement tool.

The biggest difference between DecSAT and VMA Radio Lab is multi-SDR operation. VMA Radio Lab can run several SDRs at once, each with its own VFOs, including the HackRF, PlutoSDR, USRP B210, RTL-SDR, SDRplay RSP1 and Airspy. One SDR can be dedicated to a sweeping wideband overview, such as the full 950 - 2150 MHz satellite IF. It also pulls in DVB-T/T2, DAB/DAB+ and TETRA decoding from CasualArclamp's sibling projects DecDVB-T, DecDAB and DecLAB, and adds analog radio, PAL color TV with teletext, measurement tools such as a vectorscope and transport stream analyzer, and control of CrazyScan-compatible TBS tuner cards for LNB power and hardware DVB reception.

Meanwhile, the original DecSAT remains satellite-focused. Since our last post it has added support for Fobos SDR, Airspy and network IQ input (including rtl_tcp), and has merged some of VMA's early RTL-SDR, PlutoSDR, B210 and analog TV code.

VMA Radio Lab is GPLv3 and available as a Windows 64-bit build and source zip on the website. We note that TETRA audio needs a separate ACELP codec DLL that isn't included for legal licensing reasons, and the bundled development notes describe several of the newer decoders, such as AIS and ACARS, as experimental. 

Decscat-VMA Screenshot
Decscat-VMA Screenshot

AI Disclaimer: The original DecSAT lists Claude as a contributor. While VMA does not disclose it, the development notes included with the VMA Radio Lab source suggest that its extensions were also written with the help of AI.

SweepSA: A Fast Swept Spectrum Analyzer for Pluto-Style AD936x SDRs and the HackRF

Thank you to zxkmm, one of the maintainers of PortaPack Mayhem, for writing in and sharing their new program 'SweepSA', a swept spectrum analyzer for Pluto-style AD936x SDRs such as the AntSDR E310 and LibreSDR. It also supports the HackRF One and HackRF Pro, and is designed to feel more like a bench instrument than an SDR receiver app.

One of SweepSA's core features is speed. It uses the AD936x's little-used 'fastlock' feature, which stores synthesizer profiles that can be recalled almost instantly with a full LO retune. The hop, capture, FFT, and detection all run on the board's ARM CPU, so only the reduced spectrum is sent to the PC, which avoids the slow USB or network round trip on every hop. zxkmm reports sweeps of about 10 - 60 ms over a few hundred MHz, and 500 - 800 ms over the full 70 MHz to 6 GHz range. That's similar to a HackRF One, but with each segment a gapless 40 - 56 MHz wide.

Other features include four traces, eight markers, a waterfall, zero span, and CSV/PNG export. Levels are shown in dBFS with an 'UNCAL' badge until an amplitude correction file is loaded. SweepSA is free for Windows, Linux, and macOS (arm64), with downloads available on GitHub. We note that it is currently closed source, but zxkmm plans to publish the source code later.

SPECTER: Leaking Data from Air-Gapped Computers by Toggling USB Power States

This October, researchers Hyeongjun Choi, Ji Hyuk Jung and Ji Won Yoon from Korea University and 78ResearchLab in Seoul have published a paper describing "SPECTER", a covert channel that leaks data from air-gapped computers by repeatedly switching the power state of attached USB devices. This first requires installing malware with root or administrator privileges, which then controls power via the operating system's suspend or disable/enable controls. No modification to the peripheral's hardware or firmware is needed.

Three receiving methods were demonstrated, with one being RF based. The first method uses a phone plugged into the port, which then simply logs its charging state as on/off binary data. The second method uses a connected mouse, webcam or USB hub whose status LEDs can be watched by a person or camera. The final method uses a HackRF One with a near-field loop probe to pick up the switching emissions at around 5 MHz. Data rates are only 0.2 to 1 bit per second, so the channel is only useful for short secrets like passwords or keys.

We note that so far, the RF method was only tested with the probe touching the USB cable. This project is similar to USBee, which we posted about in 2016, where an unmodified USB device was also turned into a transmitter via malware. The difference is that USBee requires a data transfer USB device like a thumb drive to be connected, whereas SPECTER can use any connected USB device, even those that are charge-only.

SPECTER RF Receiver Setup with a HackRF One and Loop Probe
SPECTER RF Receiver Setup with a HackRF One and Loop Probe

sdrtop Update: Wi-Fi Airtime Tools, POCSAG Pager Decoder and Native Airspy R2 Support

Earlier this month we posted about sdrtop, a Rust-based SDR bench instrument that runs in a terminal and is aimed at measurement rather than listening. Viktor László (MusiThang on GitHub) has now written in again to share several updates. Viktor notes that the goal is still to "make radio signals and the measurements behind them inspectable, rather than hiding everything behind a decoded result."

The biggest additions are new Wi-Fi tools. sdrtop can now survey 2.4 GHz channels 1 to 13 and name the least busy one, inspect a single channel frame by frame at three time scales, and show a channel's airtime use second by second. These tools need 20 Msps, so you need an SDR like the HackRF. There is also a new POCSAG pager decoder written from the ITU standard without external libraries. Viktor tested it over the air by transmitting with a HackRF and PortaPack Mayhem and receiving with an Airspy R2.

The Airspy R2 is now natively supported too. Its gain staging follows the R2's Linearity and Sensitivity gain curves, and sdrtop warns you before the tuner clips. RTL-SDRs are still fully supported, and native support for the SDRplay RSP1B and Airspy HF+ Discovery is in progress. The code is open source under the GPLv3 and available on GitHub.

Some screens from sdrtop
Some screens from sdrtop

AI Disclaimer: The project's CREDITS.md file notes that Claude Code was used for implementation, architecture discussion and problem-solving.

DecSAT: A DVB-S/S2/S2X Satellite Receiver with Blind Scanning for the HackRF One

Thank you to RTL-SDR.COM reader Vitor for writing in and sharing DecSAT, an open-source Rust program by CasualArclamp that turns a HackRF One into a DVB-S/S2/S2X satellite receiver. It's laid out like SDR++, with a large waterfall and VFOs that you drop onto carriers, each running its own decoder.

DecSAT decodes DVB-S2 and S2X carriers, including ACM, and outputs MPEG-TS to VLC or its built-in TV player, and IP data to PCAP files for Wireshark. A blind 'Identify' mode works out an unknown carrier's symbol rate and modulation, and a 'Survey' tool acts like a blind scan, identifying and decoding every carrier in the span. It also supports various SCPC modem, voice, radar, and satellite beacon formats.

Portable Windows binaries are available on the original repo's releases page, and Vitor notes that he has created a fork that adds a Visual Studio 2022 build.

Update: Vitor notes that his fork as added several new features, including analogue modes such as WFM with RDS, analogue TV (PAL/NTSC) and integration to CrazyCat's streamreader.dll allowing use of compatible satellite tuners (mostly made by TBS) to setup the LNB (polarity, band and power), launch DiSEqC commands and blindscan and stream the actual TS back to DecSAT. He notes that these updates should eventually work their way back into the upstream code.

DecSAT Identifying Carriers in a Synthetic 8 MS/s Test Scene
DecSAT Identifying Carriers in a Synthetic 8 MS/s Test Scene

AI Disclaimer: Claude is listed as a contributor to the DecSAT repo.

Mayhem Mobile: Run PortaPack Mayhem Apps on a Browser or Android with an RTL-SDR or HackRF

Thank you to RocketGod, one of the developers of the Mayhem firmware for the HackRF PortaPack, for writing in and sharing the news that he has released Mayhem Mobile. It lets you plug an RTL-SDR (including the RTL-SDR Blog V4), a HackRF, or a PortaPack in HackRF mode directly into an Android phone or tablet, with no PC, Zadig, or driver installation needed. It comes as a native Android APK (direct APK download) or as a WebUSB web app that also works plug-and-play on a desktop.

Along with ports of the Mayhem receiver apps, it adds a ham radio mode with SSB, CW, AM and FM, live FT8, PSK31, RTTY and CW decoding with auto mode detection, an ADIF logbook, and DMR and P25 decoding. It also includes a full rtl_433 port with over 370 protocols, plus ADS-B, AIS, APRS, pager, ACARS, BLE, RDS and satellite decoders, a wideband sweep waterfall and raw IQ capture.

With a HackRF, it can also transmit FM voice through the phone’s microphone with CTCSS and repeater offsets, as well as RTTY, Morse, APRS, POCSAG, OOK and Flipper .sub replay, all behind a safety prompt. As always, make sure you’re licensed before transmitting.

Mayhem Mobile Screenshot
Mayhem Mobile Screenshot

BrowSDR Update: Multi-SDR Support, LimeSDR, and Decoders for ADS-B, AIS, ACARS, RS41, rtl_433, BLE and DMR

Back in April, we posted about BrowSDR, an open-source browser-based SDR receiver by Joel (jLynx) that talks directly to SDR hardware via WebUSB, with no software install required. Joel has written in to let us know it has received many updates since then. The biggest is support for multiple SDRs at once, each with its own receiver tab, tuning, waterfall, and VFOs, and a single WebRTC sharing link that gives remote listeners access to all of them. LimeSDR-USB is now supported at up to 61.44 MSPS, and Airspy R2 support has been fixed.

Many new in-browser decoders have also been added, including ADS-B and AIS tracking with live maps, VHF ACARS with readable message explanations, RS41 weather balloon tracking, and rtl_433 for weather sensors, TPMS, and other ISM devices. There is also passive Bluetooth Low Energy scanning for receivers covering 2.4 GHz, and DMR voice decoding, with P25, NXDN, and D-STAR still experimental. Reception improvements include stereo FM with RDS, automatic squelch, upconverter offsets, automatic gain for HackRF and LimeSDR, a Signal Discovery panel, and a reworked POCSAG decoder.

Joel notes that all new features have been tested on real hardware, including our RTL-SDR Blog V4, the LimeSDR, and the HackRF Pro. The open-source code is available on it's Github repo.

BrowSDR Interface with POCSAG Decoding
BrowSDR Interface with POCSAG Decoding

OnAir Adds Decoder Support for Almost Every Signal

Just last week we posted about OnAir, a new open-source program that started out as an easy-to-use digital and analog TV decoder for software-defined radios. It also had support for a few digital modes like ADS-B, GNSS and DMR.

In the last week, with the obvious help of Claude AI, OnAir has added experimental support for almost every single analog and digital signal and application out there. Support ranges from digital voice modes like P25 and NXDN, to HF digital modes like HFDL, to aircraft signals like ACARS and VOR/ILS, to ocean radar, to a radio astronomy integrator, to satellite decoders like Iridium and Inmarsat, to cell tower metadata decoders to Wi-Fi and many many more.

Obviously, with these decoders all being vibecoded so quickly, there is no guarantee yet that they will all work as expected. However, we did give some decoders in the program a test with an RTL-SDR. A DMR control channel was successfully decoded, and it read the calls; ADS-B showed aircraft; LTE PCI values were detected with the LTE decoder; and POCSAG messages came in cleanly.

From our own experience with Claude, Opus 5.5 is very capable of vibe-coding decoders, so there is a high chance that most, if not all, of the decoders implemented in this software will work. 

OnAir Updated to Add Almost Every Decoder Possible
OnAir Updated to Add Almost Every Decoder Possible

AI Disclaimer: This software was coded with Claude AI.