Tagged: POCSAG

LakeShark Update: Using an LR2021 LoRa Chip as an SDR for Portable P25, POCSAG and FM Reception on the ESP32-P4

Back in September, we posted about LakeShark, Samuel Reynolds’ (aka SAMS0N1TE) T-Display P4 ESP32-P4 firmware that turns a USB-connected RTL-SDR into a handheld P25 Phase 1, POCSAG, and FM receiver.

Samuel has now written in to share news that with the T-Display P4 variant containing a Semtech LR2021 LoRa chip, LakeShark no longer needs an RTL-SDR at all. Instead, it can pull raw I/Q samples directly out of the built-in LR2021 LoRa transceiver chip and demodulate them on the ESP32-P4. Back in May, we posted Zoltán Papp and team's discovery that showed how an LR2021 could receive ADS-B. But this relied on the chip’s built-in OOK mode.

With raw I/Q available, the chip’s built-in modes no longer limit what it can receive. Both of the LR2021’s RF paths work, providing continuous coverage from 100 MHz to 2.74 GHz, and no upconverters, external tuners, or extra front-end hardware are used. The sample rate is relatively low at 250 Ksps max, meaning only a narrow bandwidth slice is available, but this is more than large enough for narrowband channels like P25. Samuel notes that it’s pretty unreal being able to listen to his local analog NFM fire department channels from such a low-power chip.

Smanuel notes that the LR2021 is still pretty new, and few products use them. However, it is possible to DIY a receiver for about $28 with Waveshare’s Core2021 LR2021 modules and their ESP32-P4-WIFI6 board. Samuel also has an experimental transmit path working, which has sent custom waveforms, temperature packets and P25 test-tone bursts. In one test, an independent receiver decoded 72 P25 voice frames from a single transmission and recovered the expected tone.

The radio access layer has been released as a separate project called LR2021-SDR. It includes a portable C library, capture firmware, waveform tools and measurements, along with graphs from a real received P25 call and a recording of the recovered transmit tone. The updated handheld firmware is available on the LakeShark GitHub.

LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).
LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).

SDR– Updated to V2.2: Many New Decoders, Tools and KrakenSDR Direction Finding and Beamforming Support Added

Last month we posted about the release of SDR-- (SDR minus minus), an open-source app that lets you visually wire together a receiver on a canvas. Since that time, Julian, the developer of SDR--, has been busy adding support for many decoders, various tools, and improving performance. Julian has also added KrakenSDR support, with radio direction-finding and beamforming blocks. Julian shares the following update for SDR-- V2.20:

New Decoders

  • Aviation and satellite: VDL2, HFDL, Inmarsat Aero and STD-C, Iridium, Drone Remote ID, 406 MHz beacons
  • Voice: TETRA, Tetrapol, GSM downlink, DECT, D-STAR, FreeDV, NXDN, dPMR
  • Data: LoRa (LoRaWAN, Meshtastic, MeshCore), ISM sensors, End-of-Train, DSC, BLE, Wi-Fi survey
  • Weather: NOAA APT, Meteor LRPT, WEFAX, radiosondes with landing forecast
  • Broadcast: DVB-T/T2, DVB-S2X, DAB packet mode, DRM with xHE-AAC

Coherent and mobile

  • Direction finding, beamforming and passive radar on the KrakenSDR
  • An iOS app with CarPlay for DF while driving is in TestFlight. Android is coming soon.

Hardware

  • Native Support: KrakenSDR, RTL-SDR Blog V4 Lite, AntSDR, PlutoSDR, SDRplay, Airspy, bladeRF and ESP-SDR
  • NanoVNA and antenna rotators
  • rtl_tcp and ADS-B Beast output for other apps

Tools

  • A satellite node with Doppler correction, plus a map with footprints and tracks
  • A spectrum monitor that classifies signals automatically, and a scanner with priorities and lockouts
  • Antenna calculator, noise figure, PER tester, SID monitor
  • Audio denoise, call recording, and a decoder log grouped by station
  • Event outputs: CSV, desktop notifications, PostgreSQL, InfluxDB

App

  • A redesigned UI with a unified look for every node
  • Multi-user editing, remote access from a browser, built-in HTTPS
  • An MCP server, so an AI assistant can build and tune a canvas

Performance

All measured on an M4 Max, full results at https://sdrmm.com/benchmarks:

  • DSP against GNU Radio:
  • FIR is 3.5x faster
  • NCO is 3x faster
  • FM demod is 4x faster
  • DDC is 1.6x faster
  • A 4096-point FFT is 1.6x faster than FFTW
  • Decoding rate in noise (48 trials per decoder across an SNR range):
  • ADS-B: 68%, against 56% for readsb and 50% for dump1090-fa
  • POCSAG: 73%, against 50% for multimon-ng
  • DMR: 81%, against 60% for dsd-fme
  • NXDN: 67%, against 23% for dsd-fme

(feel free to verify yourself with cargo xtask compare dsp)

The speed comes from hand-written SIMD kernels (NEON, AVX2, AVX-512), one shared downconversion for all channels on a radio, and a DSP path that never locks or allocates. The noise gains come from decoding IQ directly with
coherent receivers and soft decisions.

SDR-- Screenshot
SDR-- Screenshot

AI Disclaimer: This software is likely to be AI-assisted or vibe-coded.

RTL-SDR Pager: Android App for Receiving and Decoding POCSAG and FLEX Pager Messages

Thank you to Christian from ebcTech.eu for writing in and sharing with us the release of his new Android app called "RTL-SDR Pager" (Google Play Store link). The app is designed to work with an RTL-SDR dongle connected to the Android device. It is capable of decoding POCSAG and FLEX messages. However, Christian notes that he hasn't been able to test FLEX decoding so far because there are no FLEX channels in his area, so he would be interested in any feedback on this.

The app also provides push alerts, allowing you to monitor for a specific RIC or keyword and allows you to save channel lists.

The app offers a free demo that allows up to 50 messages. Upgrading to unlimited messages costs $3.99.

Screenshots of the ebcTech RTL-SDR Pager App
Screenshots of the ebcTech RTL-SDR Pager App

LakeShark: P25 Phase 1, FM, POCSAG, ADS-B and Sub-GHz with an RTL-SDR on the LilyGO T-Display P4 (ESP32-P4)

Thank you to Samuel Reynolds (aka SAMS0N1TE on GitHub), for writing in and sharing with us his project called 'LakeShark'. LakeShark is firmware for the LilyGO T-Display P4 (an ESP32-P4-based microcontroller with a 4.1 Inch touchscreen, detachable keyboard, GPS, and nine-axis motion sensor), which allows a USB-connected RTL-SDR Blog V3 or V4 to be used for P25 Phase 1 trunking, FM, POCSAG, ADS-B, and sub-GHz capture. Samuel writes:

LakeShark supports P25 Phase I conventional and trunked voice, analog FM, POCSAG pager decoding and 1090 MHz ADS-B, with a spectrum display and waterfall for tuning around.

There are a few other things that might interest your readers:

  • Passive sub-GHz pulse recording with export to Flipper .sub files, so captures can be transferred to a Flipper and opened in its Sub-GHz app.'
  • Offline maps showing aircraft and MeshCore nodes, plus GPS track recording with GPX export.
  • Mixed P25/FM scan lists and a field journal for saving notes with radio readings, position and sensor data.
  • MeshCore messaging and LoRa experiments using the onboard SX1262. The optional MIX-RF keyboard adds CC1101, nRF24 and NFC tools.

The T-Display-P4 touchscreen works on its own, but you can also use the keyboard or connect a Flipper Zero over Bluetooth. LakeShark also supports a headless ESP32-P4 Nano receiver controlled from the Flipper. That lets you keep the radio and antenna in a bag while tuning from the Flipper.

Version 2.2.0 is available now. Experimental work includes manually tuned P25 Phase II decoding, HackRF support and GPS-based scan filtering. Those have separate limitations documented in the wiki. Next steps include live-RF validation, Phase II automatic call following and further work on portable power and everyday usability.

There’s also an experimental CELL WATCH app for surveying cellular-band activity and comparing it against a saved baseline. It’s meant for spotting changes worth investigating, rather than identifying a cell site as malicious or claiming to detect an IMSI catcher.

LakeShark builds on xtrsdr, OP25 and other open-source projects. ADS-B Scope also provided a reference for part of the aircraft position decoding. Full credits are in the README.

Showcase, photos and overview:
https://terminalbay.com/?m=lakeshark-showcase

Source and credits:
https://github.com/SAMS0N1TE/LakeShark

Version 2.2.0 downloads:
https://github.com/SAMS0N1TE/LakeShark/releases/tag/v2.2.0

Flipper companion app:
https://github.com/SAMS0N1TE/LakeShark-Flipper

Wiki and guides:
https://terminalbay.com/?m=wiki

LakeShark is part of a growing repertoire of ESP32-P4 microcontroller RTL-SDR applications. Just last week we posted about OrcSDR, a standalone RTL-SDR application built around the M5Stack Tab5. Back in May, we also posted about a portable open-source 1090 MHz ADS-B firmware for the LILYGO T-Display-P4.

Previously, RTL-SDR applications have only run on full general-purpose CPUs running an OS like Windows/Linux/MacOS/Android. But the ESP32-P4 has shown that commodity microcontrollers are now powerful enough to run an RTL-SDR too, via custom bare-metal drivers and software.

LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).
LakeShark running on A LilyGO T-Display-P4 next to a HackRF (left) and a Flipper Zero (right).
LarkShark Screens
LarkShark Screens

SDR–: A Software-Defined Radio Application with Visual Signal Path

Thank you to Julian for writing in and sharing with us his interesting project called SDR-- (SDR minus minus). SDR-- is an open-source app that lets you wire devices, decoders, and displays together on a desktop window or browser-based canvas. It is described as "a software-defined radio application with a visual signal path. Connect devices, decoders, displays, and recorders on a canvas, then pin the controls you use to a rack."

A separate Rust server, which can sit on the same PC or a remote computer (like a Raspberry Pi), handles the DSP. Julian notes that SDR-- has native RTL-SDR support, and decoders for ADS-B, AIS, POCSAG, FT8, SSTV, and RDS are already implemented, with more in progress. The app also has a built-in signal generator and a repository of IQ recordings that can be used for experimentation and testing the various decoders.

The project releases are available on GitHub releases, and they cover Windows, Linux, and MacOS. 

SDR-- Screenshot
SDR-- Screenshot

NyxScope: A Windows Multi-Protocol SDR Decoder Program with Multiple Digital Native Decoders

WARNING: Multiple people have noted that this program is not working as expected and may be overly buggy.

Recently, we've learned about NyxScope, a multi-protocol SDR receiver program for Windows that comes with multiple native decoders built right into the software. Their own description describes this all-in-one program best:

You get spectrum and waterfall, multiple concurrent VFOs, trunked-radio following, digital voice, aviation and marine tracking, paging, ISM sensors, HD Radio, and transcription, in one binary.

NyxScope includes decoders for P25 Phase 1 and Phase 2 voice, EDACS and NXDN control channels, ADS-B, AIS, ACARS, POCSAG, FLEX, LoRa CSS PHY + LoRaWAN MAC, Morse, RDS, CTCSS/DCS, Iridium decoding (with voice), and also includes a signal classification tool, Bluetooth LE scanner, and Whisper voice-to-text transcriber. It also outsources decoding of other protocols to mature decoding software such as multimon-ng, rtl_433, dsd-neo, nrsc5, direwolf, dumpvdl2, dump978, rs41mod where required, noting that the outsourced decoders are bundled with the software, meaning no extra installation work is required.

The software supports RTL-SDR, HackRF, Airpsy, bladeRF, SDRplay, Fobos and PlutoSDR. It also supports using multiple SDRs used in parallel.

The software does not appear to be open source, but it is provided for free with a limitation of 3 concurrent VFOs and a limitation on recording, transcribing, and pager messages. A perpetual per-machine license for $89.95 can be purchased to lift these restrictions and add access to their FCC frequency lookup database.

AI-Disclaimer: While the developers have not noted any use of AI tools, we suspect that AI was used in the creation of this software.

NyxScope Screenshot Scanning the 800 MHz Band
NyxScope Screenshot Scanning the 800 MHz Band

Multimon Pager Decoding on Android

Sarah (aka SignalsEverywhere) has recently released another open-source Android app that enables the multi-signal decoder Multimon-ng to be used on Android. Multimon-ng is a commonly used decoding app, that supports various protocols such as POCSAG/FLEX pagers, as well as DTMF, ZVEI, EAS and more.

The app requires the SDR++ Android app to be running in the background with an SDR like an RTL-SDR connected. The role of SDR++ is to receive the signal and send the demodulated audio over a network connection to the Multimon-NG app, which performs the final decoding.

The app APK can be downloaded from Sarah's website via a minimum $0 donation, or alternatively, built and installed from source.

Multimon-ng on Android!

Tech Minds: Testing Out A New Signals Intelligence Tool Called Intercept

Over on the Tech Minds YouTube channel, Matt has uploaded a video where he tests out 'Intercept', a new tool for RF signals intelligence with RTL-SDRs and other wireless devices. It is open source with code available on GitHub and can be installed on Linux and OSX devices.

Intercept is a tool that combines multiple external decoder tools into one easy-to-access web interface. It is capable of the following:

  • Pager Decoding - POCSAG/FLEX via rtl_fm + multimon-ng
  • 433MHz Sensors - Weather stations, TPMS, IoT devices via rtl_433
  • Aircraft Tracking - ADS-B via dump1090 with real-time map and radar
  • Listening Post - Frequency scanner with audio monitoring
  • Satellite Tracking - Pass prediction using TLE data
  • WiFi Scanning - Monitor mode reconnaissance via aircrack-ng
  • Bluetooth Scanning - Device discovery and tracker detection

We note that features like WiFi and Bluetooth scanning will require a separate WiFi and Bluetooth adapter to be connected. In terms of supported SDR hardware, Intercept supports RTL-SDRs, as well as any SDR supported by SoapySDR.

In the video Matt shows how to install Intercept, and shows it decoding data from the various supported signal types.

Intercept Radio Signals For Intelligence Gathering With An RTL SDR