Tagged: LilyGO T-Display P4

LakeShark Update: Using an LR2021 LoRa Chip as an SDR for Portable P25, POCSAG and FM Reception on the ESP32-P4

Back in September, we posted about LakeShark, Samuel Reynolds’ (aka SAMS0N1TE) T-Display P4 ESP32-P4 firmware that turns a USB-connected RTL-SDR into a handheld P25 Phase 1, POCSAG, and FM receiver.

Samuel has now written in to share news that with the T-Display P4 variant containing a Semtech LR2021 LoRa chip, LakeShark no longer needs an RTL-SDR at all. Instead, it can pull raw I/Q samples directly out of the built-in LR2021 LoRa transceiver chip and demodulate them on the ESP32-P4. Back in May, we posted Zoltán Papp and team's discovery that showed how an LR2021 could receive ADS-B. But this relied on the chip’s built-in OOK mode.

With raw I/Q available, the chip’s built-in modes no longer limit what it can receive. Both of the LR2021’s RF paths work, providing continuous coverage from 100 MHz to 2.74 GHz, and no upconverters, external tuners, or extra front-end hardware are used. The sample rate is relatively low at 250 Ksps max, meaning only a narrow bandwidth slice is available, but this is more than large enough for narrowband channels like P25. Samuel notes that it’s pretty unreal being able to listen to his local analog NFM fire department channels from such a low-power chip.

Smanuel notes that the LR2021 is still pretty new, and few products use them. However, it is possible to DIY a receiver for about $28 with Waveshare’s Core2021 LR2021 modules and their ESP32-P4-WIFI6 board. Samuel also has an experimental transmit path working, which has sent custom waveforms, temperature packets and P25 test-tone bursts. In one test, an independent receiver decoded 72 P25 voice frames from a single transmission and recovered the expected tone.

The radio access layer has been released as a separate project called LR2021-SDR. It includes a portable C library, capture firmware, waveform tools and measurements, along with graphs from a real received P25 call and a recording of the recovered transmit tone. The updated handheld firmware is available on the LakeShark GitHub.

LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).
LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).

LakeShark: P25 Phase 1, FM, POCSAG, ADS-B and Sub-GHz with an RTL-SDR on the LilyGO T-Display P4 (ESP32-P4)

Thank you to Samuel Reynolds (aka SAMS0N1TE on GitHub), for writing in and sharing with us his project called 'LakeShark'. LakeShark is firmware for the LilyGO T-Display P4 (an ESP32-P4-based microcontroller with a 4.1 Inch touchscreen, detachable keyboard, GPS, and nine-axis motion sensor), which allows a USB-connected RTL-SDR Blog V3 or V4 to be used for P25 Phase 1 trunking, FM, POCSAG, ADS-B, and sub-GHz capture. Samuel writes:

LakeShark supports P25 Phase I conventional and trunked voice, analog FM, POCSAG pager decoding and 1090 MHz ADS-B, with a spectrum display and waterfall for tuning around.

There are a few other things that might interest your readers:

  • Passive sub-GHz pulse recording with export to Flipper .sub files, so captures can be transferred to a Flipper and opened in its Sub-GHz app.'
  • Offline maps showing aircraft and MeshCore nodes, plus GPS track recording with GPX export.
  • Mixed P25/FM scan lists and a field journal for saving notes with radio readings, position and sensor data.
  • MeshCore messaging and LoRa experiments using the onboard SX1262. The optional MIX-RF keyboard adds CC1101, nRF24 and NFC tools.

The T-Display-P4 touchscreen works on its own, but you can also use the keyboard or connect a Flipper Zero over Bluetooth. LakeShark also supports a headless ESP32-P4 Nano receiver controlled from the Flipper. That lets you keep the radio and antenna in a bag while tuning from the Flipper.

Version 2.2.0 is available now. Experimental work includes manually tuned P25 Phase II decoding, HackRF support and GPS-based scan filtering. Those have separate limitations documented in the wiki. Next steps include live-RF validation, Phase II automatic call following and further work on portable power and everyday usability.

There’s also an experimental CELL WATCH app for surveying cellular-band activity and comparing it against a saved baseline. It’s meant for spotting changes worth investigating, rather than identifying a cell site as malicious or claiming to detect an IMSI catcher.

LakeShark builds on xtrsdr, OP25 and other open-source projects. ADS-B Scope also provided a reference for part of the aircraft position decoding. Full credits are in the README.

Showcase, photos and overview:
https://terminalbay.com/?m=lakeshark-showcase

Source and credits:
https://github.com/SAMS0N1TE/LakeShark

Version 2.2.0 downloads:
https://github.com/SAMS0N1TE/LakeShark/releases/tag/v2.2.0

Flipper companion app:
https://github.com/SAMS0N1TE/LakeShark-Flipper

Wiki and guides:
https://terminalbay.com/?m=wiki

LakeShark is part of a growing repertoire of ESP32-P4 microcontroller RTL-SDR applications. Just last week we posted about OrcSDR, a standalone RTL-SDR application built around the M5Stack Tab5. Back in May, we also posted about a portable open-source 1090 MHz ADS-B firmware for the LILYGO T-Display-P4.

Previously, RTL-SDR applications have only run on full general-purpose CPUs running an OS like Windows/Linux/MacOS/Android. But the ESP32-P4 has shown that commodity microcontrollers are now powerful enough to run an RTL-SDR too, via custom bare-metal drivers and software.

LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).
LakeShark running on A LilyGO T-Display-P4 next to a HackRF (left) and a Flipper Zero (right).
LarkShark Screens
LarkShark Screens