Tagged: LoRa

Backtrail Pro: An Open-Source App for Discontinued goTenna Mesh Radios and Meshtastic

Thank you to Patrick Gartner for writing in and sharing Backtrail Pro, a new iOS and Android app that brings discontinued goTenna Mesh radios back into use and also supports Meshtastic. The goTenna Mesh is a pocket-sized 1 W radio for the 902 - 928 MHz ISM band that pairs with a phone over Bluetooth for mesh texting without cell service.

The company behind goTenna Mesh has since shifted focus to military and public safety customers with its goTenna Pro line. In 2024, the security researchers who disclosed a series of goTenna vulnerabilities noted that goTenna discontinued support for the goTenna v1 and Mesh and exited the civilian market, around the same time CISA published its advisories on the Pro line. The consumer app has since disappeared, and goTenna was acquired by defense autonomy company Forterra in October 2025, leaving many owners with working radios and no app. With no vendor support, it's also unlikely that the Mesh's disclosed vulnerabilities, such as spoofed message injection with an SDR, will ever be patched.

Backtrail Pro talks to the goTenna Mesh through an independent implementation of its Bluetooth protocol, building on earlier community reverse engineering work. It supports group and direct messages, delivery receipts, location sharing, and optional AES-256 encryption. For Meshtastic radios, it lists every node heard and can change basic radio settings. The goTenna Mesh uses FSK rather than LoRa, so the two radio types can't talk to each other directly. However, with one of each connected to the phone, an optional relay can re-send group messages between the goTenna group and the Meshtastic mesh. The app costs US$0.99 on the Google Play Store and Apple App Store with no account or servers, and the code is open-source under GPL-3.0 and available on GitHub.

Backtrail Pro App for GoTenna Mesh Radios
Backtrail Pro App for GoTenna Mesh Radios

AI Disclaimer: The Backtrail commit on GitHub lists Claude as a co-author.

OrcSDR Update: SSTV, ACARS and Offline Maps Come to the Standalone ESP32-P4 RTL-SDR App

Back in September, we posted about OrcSDR, open-source firmware that runs an RTL-SDR directly on the ESP32-P4 microcontroller-based M5Stack Tab5 tablet, with no PC or Raspberry Pi needed. Erik Elfstrom has now written in again to share that OrcSDR v0.5.0-beta.1 (release notes) is out, with several new features and a lot of stability work.

The main additions are SSTV reception and a dedicated ACARS dashboard. SSTV images are drawn directly on the touchscreen and saved to the SD card, and the ACARS dashboard shows live messages and aircraft lists. Erik has tested SSTV with Robot36, PD120, and Scottie S1 on various RTL-SDR models. Offline maps have also been added to the LoRa/Meshtastic, ADS-B, and FT8 dashboards. There is also a new 'Dead Air' dashboard for logging RF and audio activity, and Erik notes that despite the Halloween timing, it is not a ghost detector.

Erik also notes that a lot of work has gone into fixing layout issues, redraw flicker and memory pressure, and there is now a guided first-run setup. The software is still in beta, and Erik says that not every issue is gone yet. The update can be installed with M5Burner or the browser installer, and the code is open source under AGPL-3.0 and available on GitHub.

Some screenshots of new OrcSDR Features
Some screenshots of new OrcSDR Features

AI Disclaimer: The OrcSDR README notes that the project was created with "extensive AI assistance".

rxx_lora: A Lightweight rtl_fm-Style LoRa Receiver for RTL-SDR and SDRplay, No GNU Radio Required

Thank you to Przemysław Wcisło (SO5DZ) for writing and sharing rxx_lora, a command-line LoRa receiver for RTL-SDR and SDRplay RSP devices. Przemysław notes that it was designed in the spirit of rtl_fm, so there are no GNU Radio flowgraphs to build or maintain. Instead, it is a single small C binary (rtl_lora or rsp_lora, plus file_lora for saved I/Q captures). Decoded packets are printed as JSONL to stdout, so you can pipe them into other programs.

Przemysław writes:

  • It's fast. The entire receive chain (detection, sync, demodulation, FEC) runs from dozens to hundreds times real-time, depending on the PHY parameters and hardware, of course.

  • It's sensitive. I've benchmarked the binary end-to-end over AWGN, and it comes within ~1-2 dB of ideal theoretical LoRa performance. It can easily demodulate Meshtastic's MediumFast preset at -14 dB SNR. I can also vouch for this based on real-world observations. Valid decodes regularly pop up at -12 to -14 dB. I even saw a frame at -17 dB SNR, although it had a bad CRC :)

  • It's stable. It's never crashed on me, apart from when I accidentally wiggled the dongle out of the USB port ;) It should also be stable from a software quality perspective. I've put together an extensive suite of quality gates and tests, including noise tests, tests against previously recorded over-the-air captures... This should make it quite unlikely that an upcoming change will accidentally introduce a major regression.

  • It doesn't require much: librtlsdr, FFTW, a C compiler, and make. Most who have dabbled with RTL-SDRs probably won't need to install a single package on top of what they already have. Python and a few libraries are used for the tests and extra tools, but they're not required for normal operation.

The receiver implements the standard LoRa PHY, so it can be used for Meshtastic, LoRaWAN, MeshCore, APRS-over-LoRa and other LoRa signals. An included Python script also decrypts Meshtastic packets with the default or configured channel keys and prints them in a readable form.

The demodulation core is derived from the gr-lora and gr-lora_sdr GNU Radio projects. The code is open source under GPLv3 and available on GitHub. It runs on Linux, and the README says macOS "probably" works too. The SDRplay version also requires the SDRplay API. For Meshtastic reception, it covers similar ground to the GNU Radio-based Meshtastic_SDR project, which we previously posted about, but with a much smaller footprint.

rxx_lora Decoding Meshtastic Packets with an RTL-SDR
rxx_lora Decoding Meshtastic Packets with an RTL-SDR

AI Disclaimer: Przemysław notes that the sensitivity improvements came from "patient and deliberate use of strong AI tools", and the README states that the project made heavy use of AI for both coding and theoretical exploration.

GridDown Secure Messenger: Using an SX1262 LoRa Radio as a Drone Scanner and Secure Messenger

Back in March, we posted about GridDown, an open-source Android tablet-based situational awareness system designed to operate without an internet connection, which uses sensors such as an RTL-SDR, a SARSAT receiver and an ESP32-S3/SX1262 LoRa radio.

Recently, GridDown developer Cameron wrote in again and shared with us that the LoRa firmware for GridDown has now been released as an open-source project called "GridDown Secure Messenger" (main website).

The project uses a LILYGO T-Deck CYPHER-M8K (an ESP32-S3 with SX1262, 2.8" display, keyboard, and GPS) to implement secure, encrypted off-grid text messaging, and it also doubles as a 900 MHz drone scanner, with the ability to decode drone Remote ID.

Cameron has also provided two YouTube shorts [1] [2], showing the firmware in action.

Example Renders of the GridDown Secure Messenger Running on a LILYGO T-Deck CYPHER-M8K.
Example Renders of the GridDown Secure Messenger Running on a LILYGO T-Deck CYPHER-M8K.

AI Disclaimer: The renders appear to have been AI-generated.

ESP32 Bit Pirate Updates: New LoRa and Meshtastic Analysis Features

Back in September 2025, we posted about the "ESP32 Bus Pirate" firmware, which transforms an ESP32-S3 into a multi-protocol debugging and hacking tool. We later covered an update in March 2026 that added waterfall displays, cellular modem support, and an external radio expander.

Although the ESP32 does not have true SDR capabilities, it can leverage its numerous built-in radio hardware components to achieve a range of interesting SDR-like features. Recently, "Geo," the creator of the ESP32 Bus Pirate, wrote in to share some recent firmware updates with us.

Geo notes that the project is now called "ESP32 Bit Pirate" and now includes LoRa/SX1262 support and Meshtastic analysis features.

ESP32 Bit Pirate can now transmit and receive LoRa packets, monitor RSSI, scan frequency activity, display a simple waterfall view and perform Channel Activity Detection. Radio parameters including frequency, bandwidth, spreading factor, coding rate, transmit power, preamble and sync word can be configured directly from the interface.

Packets can also be recorded to the ESP32 filesystem and replayed later together with their original radio configuration.

A dedicated Meshtastic analysis shell has also been added, allowing users to send, receive and inspect Meshtastic packets. The goal is not to replace a Meshtastic node, but to provide a debugging and experimentation interface for understanding and interacting with LoRa/Meshtastic traffic.

The latest update has also added new LoRa hardware support for the Heltec Vision Master T190 and Heltec WiFi LoRa 32 V4, a browser-based debugging ecosystem, a Python scripting lab, and a BPIO2 USB adapter mode.

The project is entirely open source, and the code can be found on their GitHub page.

ESP32 Bit Pirate LoRa Support Added
ESP32 Bit Pirate LoRa Support Added

NyxScope: A Windows Multi-Protocol SDR Decoder Program with Multiple Digital Native Decoders

WARNING: Multiple people have noted that this program is not working as expected and may be overly buggy.

Recently, we've learned about NyxScope, a multi-protocol SDR receiver program for Windows that comes with multiple native decoders built right into the software. Their own description describes this all-in-one program best:

You get spectrum and waterfall, multiple concurrent VFOs, trunked-radio following, digital voice, aviation and marine tracking, paging, ISM sensors, HD Radio, and transcription, in one binary.

NyxScope includes decoders for P25 Phase 1 and Phase 2 voice, EDACS and NXDN control channels, ADS-B, AIS, ACARS, POCSAG, FLEX, LoRa CSS PHY + LoRaWAN MAC, Morse, RDS, CTCSS/DCS, Iridium decoding (with voice), and also includes a signal classification tool, Bluetooth LE scanner, and Whisper voice-to-text transcriber. It also outsources decoding of other protocols to mature decoding software such as multimon-ng, rtl_433, dsd-neo, nrsc5, direwolf, dumpvdl2, dump978, rs41mod where required, noting that the outsourced decoders are bundled with the software, meaning no extra installation work is required.

The software supports RTL-SDR, HackRF, Airpsy, bladeRF, SDRplay, Fobos and PlutoSDR. It also supports using multiple SDRs used in parallel.

The software does not appear to be open source, but it is provided for free with a limitation of 3 concurrent VFOs and a limitation on recording, transcribing, and pager messages. A perpetual per-machine license for $89.95 can be purchased to lift these restrictions and add access to their FCC frequency lookup database.

AI-Disclaimer: While the developers have not noted any use of AI tools, we suspect that AI was used in the creation of this software.

NyxScope Screenshot Scanning the 800 MHz Band
NyxScope Screenshot Scanning the 800 MHz Band

GridDown: An Offline-First Situational Awareness Platform with RTL-SDR, SARSAT, Meshtastic

Thank you to Cameron from BlackAtlas LLC for submitting their project GridDown, which is an open source Android tablet-based situational awareness system designed to operate without an internet connection. At its core, it appears to be a tablet with custom software, and then you can add sensors such as an RTL-SDR for ADS-B+Remote ID, a SARSAT receiver, and a Meshtastic ESP32-S3+SX1262 device. A demonstration of the UI can be found at https://griddown.blackatlas.tech.

Cameron writes:

[GridDown is] an offline-first situational awareness platform built for emergency preparedness, field response, and tactical operations in infrastructure-degraded environments — designed to work when cell towers are down, internet is unavailable, and operators are fully off-grid.

The platform is a Progressive Web App (~120,000 lines of vanilla JavaScript, no frameworks) that runs on Samsung Galaxy tablets, laptops/PCs, and works completely offline after initial setup. It's built by BlackAtlas LLC and is available for trial at https://griddown.blackatlas.tech.

The system has many facets to it, including:

  • Encrypted voice and text messaging via an ESP32-S3 with SX1262 LoRa transceiver
  • Passive RF sensing with the ESP32-S3 and SX1262.
  • Three passive drone detection methods: WiFi fingerprinting, FAA Remote ID reception, and 900 MHz control/telemetry link detection
  • Automatic gunshot detection via a ES7210 quad-channel I2S microphone on the ESP32-S3.
  • Automatic RF jamming detection
  • SARSAT beacon receiver
  • SSTV Encode/Decode
  • Meshtastic integration
  • APRS via Bluetooth TNC
  • ADS-B reception
  • RadioCode gamma spectrometer integration
  • Offline maps

ADS-B detection is handled by a Raspberry Pi 5 running an RTL-SDR Blog V4 dongle. Cameron writes:

The Pi connects to the tablet's built-in WiFi hotspot (no internet required — the hotspot functions as a local network only), and a Node.js bridge reads aircraft data from readsb and subscribes to the Remote ID receiver's MQTT output, then serves a unified WebSocket and REST API to the tablet. GridDown renders aircraft and drone tracks as heading-rotated silhouette icons on its offline map with altitude labels, age-based alpha fade, and emergency squawk alerting (7500/7600/7700). A 10,000 mAh USB-C PD battery provides approximately 5 hours of field runtime for the Pi.

The full setup script, hub bridge, and hotspot connection scripts ship with the project.

The software is dual-licensed, with it being open source GPL v3 (note that the GitHub link appears to be broken - we have asked for clarification) for non-commercial use, or a commercial licence for hardware bundles and business deployments. 

Alternatively, BlackAtlas LLC is selling ready-to-use kits, with the core tablet coming in at $799. Other bundles include the Tablet + SARSAT receiver for $1,299, the Tablet + Meshtastic bundle for $1,299, and the Tablet + ADS-B/Remote ID bundle for $1,999.

The GridDown Web Interface
The GridDown Web Interface

TEMPEST-LoRa: Emitting LoRa Packets from VGA or HDMI Cables

University researchers from China have recently shown in a research paper that it is possible to maliciously cause a VGA or HDMI cable to emit LoRa compatible packets by simply displaying a full-screen image or video. This has potential security implications as a malicious program could be used to leak sensitive information over the air, completely bypassing any internet or air-gap security systems.

In the past, we have demonstrated that TEMPEST techniques can be used to spy on monitors and security cameras by analyzing the unintentional signals they emit. This research takes the idea a step further by determining what particular images need to be displayed to create a LoRa packet with data. 

In the paper, the researchers mention using either off-the-shelf LoRa devices or low-cost SDRs such as the HackRF to receive the packets. The advantage of the SDR method is that it allows for customization of the frequency and the use of LoRa-like packets, which can achieve even longer ranges and higher data rates. The team show that they were able to achieve a receive range of up to 132 meters and up to 180 kbps of data rate.

TEMPEST-LoRa Test Setup
TEMPEST-LoRa Test Setup
(Demo video) TEMPEST-LoRa: Cross-Technology Covert Communication