[ <- back-issue archive · live wire · issue #23 · RF 24H · 2026-11-14 23:03 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #23   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/23.intel :: [ 2026-11-14 23:03 UTC ]
  • KrakenSDR suite rewritten in C++ -- The 5-coherent-channel RTL rig's DoA stack got rebuilt from Python into C++, running real-time spectrum and audio demod concurrently with MUSIC direction finding, with claimed big speedups on Pi 4/5 and a Mode selector for tuner allocation. Coherent RTL phase calibration plus MUSIC on a Pi 5 is a bench-grade passive radar and foxhunt core [krakenrf/krakensdr_suite].
  • PortaPack Mayhem PRALINE clock sync -- Mayhem extended PRALINE TX/RX sync to the HackRF Pro's internal 25 MHz TCXO, killed stale audio spectrum on modulation changes, and stopped SD corruption by switching to single-beat SDIO IDMAC transfers. TCXO-locked TX framing means your replayed bursts now stay on-frequency across long captures [portapack-mayhem/mayhem-firmware].
  • Turk Telekom GNSS-only timing disruption -- Umut Keten (Turk Telekom) and Bryan Hovey (Calnex) walked ITSF 2026 through what happens to a national carrier's sync plane when GNSS is the only holdover: L1 jamming and spoofing cascading straight into backhaul timing. Textbook case for why PTP/ePRTC holdover matters when the 1575.42 MHz feed dies [RNT Foundation].
  • rtl_433 buffer and lifecycle hardening -- Commits fix getopt reset/%z on newlib/ESP-IDF, shrink MAXIMAL_BUF_LENGTH, reopen the SDR cleanly, and silence connection handlers before mg_mgr_free(). The ESP-IDF fix means the ISM-band decoder now behaves on embedded targets -- worth re-running your 433/868/915 MHz sensor sweeps on an ESP32 build [merbanan/rtl_433].
  • Evil-M5Project ships new Evil-* payloads -- The M5Stack Cardputer/AtomS3 WiFi scan-monitor-interact toolkit pushed fresh binaries with additional Evil-* payload builds, and Evil-Flasher Tab5 v1.5.8 now embeds the C6 firmware for one-shot WebSerial flashing. An ESP32-C6 in your pocket doing probe/beacon games is a cheap 802.11 bench [7h30th3r0n3].
  • LimeSDR Micro VSPA gains scheduled streaming -- FPGA-side firmware adds scheduled stream start at a specific time plus Rx DFT bin measurement with Hann windowing. Time-scheduled Tx start is exactly what you want for TDD-style burst experiments and repeatable GNSS spoofing timelines on L1 [myriadrf/LimeSDR-Micro_VSPA].
  • WiGLE Android 2.112 fixes IMS wedge -- The wardriving client fixed an IMS wedge when toggling Wi-Fi and added a filter icon exposing display/logging/alert state. Small patch, but anyone who has had a wardrive session die mid-run because the radio stack wedged appreciates it [wiglenet/wigle-wifi-wardriving].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #23   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/23.possibilities :: [ 30 sources ]
  • Bench the C++ MUSIC DoA against the old Python stack -- Flash the new suite on a Pi 5, feed a known 2.4 GHz beacon or 433 MHz FSK source at fixed bearings, and diff MUSIC angle accuracy and update rate against the legacy Python kraken. Then try two simultaneous emitters and see how the Mode selector tuner allocation handles ambiguity [inspired by krakenrf/krakensdr_suite].
  • Measure PRALINE TCXO drift under replay -- With PRALINE now locked to the 25 MHz TCXO, capture a long sub-GHz burst (garage, TPMS at 315/433.92 MHz), replay it across a temperature sweep, and log frequency error on a second SDR to quantify how far the internal reference can be trusted for evidential replay work [inspired by portapack-mayhem/mayhem-firmware].
  • Hunt GNSS single-point-of-failure networks near you -- Replicate the Turk Telekom/Calnex methodology: use a GPSDO-disciplined receiver and a cheap L1 spoofer sim to characterize how small-cell backhaul and PTP grandmasters in your area degrade when GNSS is denied, mapping which sites lack holdover [inspired by RNT Foundation].
  • Port rtl_433 onto ESP32-C6 and fuzz the newlib path -- The getopt/%z newlib fix implies embedded builds are now first-class; build for ESP-IDF, feed it malformed OOK/FSK sensor frames at 433.92 and 868.3 MHz via a HackRF, and hammer the shrunken MAXIMAL_BUF_LENGTH path for overflow behavior [inspired by merbanan/rtl_433].
  • Abuse scheduled stream start for burst-timed spoofing -- Use the FPGA scheduled-start plus Hann-windowed Rx DFT bins to build a deterministic L1 C/A spoofing timeline: measure the victim receiver's bin response, then fire the spoofed signal at a pre-scheduled sample index for repeatable lab demos [inspired by myriadrf/LimeSDR-Micro_VSPA].
  • Baseline aircraft and ships in Kismet for passive radar -- The new baseline-transport rules that track aircraft/ships per-run pair nicely with an ADS-B SDR and tar1090 overlays; run Kismet on 1090 MHz alongside a Wi-Fi monitor interface and cross-correlate contact timing with 2.4/5 GHz beacon anomalies for a cheap passive-detection testbed [inspired by kismetwireless/kismet].
  • Stress Evil-M5Project C6 firmware injection paths -- Pull the embedded C6 firmware from Evil-Flasher, run it against your own lab AP, and check which Evil-* payloads still land on WPA3-SAE-only networks versus WPA2 -- then diff the C6 driver behavior against an Atheros ath9k_htc injection rig for frame-fidelity comparison [inspired by 7h30th3r0n3/Evil-M5Project].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #23   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/23.github :: [ code & repo tradecraft ]

Thin dispatch day on the blogs, but the git wire was loud: coherent-DF and firmware hackers did the heavy lifting. The KrakenSDR crew ripped Python out of their DoA pipeline entirely and rebuilt it in C++ so MUSIC runs alongside live spectrum and audio demod on a Pi, Mayhem bolted PRALINE sync onto the HackRF Pro's 25 MHz TCXO and fixed SDIO corruption the right way, and LimeSDR Micro's FPGA gained scheduled stream start plus Hann-windowed Rx DFT bins -- the kind of quiet hardware features that make timed burst experiments reproducible. Meanwhile rtl_433 quietly fixed its embedded lifecycle bugs, WiGLE patched a radio-stack wedge, and GNU Radio's VOLK and GR4 trees kept churning. Nothing conference-grade, just bench-grade.

  • krakenrf/krakensdr_suite -- Full C++ rewrite of the 5-channel coherent RTL direction finder: real-time spectrum and audio demod concurrent with MUSIC DoA, Mode selector for tuner usage, Pi 4/5 speedups. Pull it if you run a Kraken -- the Python GIL was the old bottleneck.
  • portapack-mayhem/mayhem-firmware -- PRALINE TX/RX clock sync extended to the HackRF Pro internal 25 MHz TCXO, stale audio spectrum on modulation change fixed, and SD write corruption killed via single-beat SDIO IDMAC transfers. Clean fix for a long-standing filesystem-corruption complaint.
  • myriadrf/LimeSDR-Micro_VSPA -- Adds scheduled stream start at a specific time and Rx DFT bin measurement with Hann windowing, plus common-code refactors. Scheduled Tx start is a genuinely useful primitive for TDD and replay work.
  • merbanan/rtl_433 -- getopt reset/%z fixes for newlib/ESP-IDF, MAXIMAL_BUF_LENGTH shrink, clean SDR reopen, and connection handlers silenced before mg_mgr_free(). Embedded ISM decoding just got less flaky.
  • wiglenet/wigle-wifi-wardriving -- Release 2.112 fixes the IMS wedge when toggling Wi-Fi and adds a filter icon showing display/logging/alert state. Small, tight, and it keeps long wardrive sessions from dying mid-run.