[ <- back-issue archive · live wire · issue #25 · RF 7D · 2026-11-14 23:03 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #25   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/25.intel :: [ 2026-11-14 23:03 UTC ]
  • KrakenSDR suite rewritten in C++ -- The 5-coherent-channel RTL rig dropped Python entirely: real-time spectrum and audio demod now run concurrently with MUSIC DoA, with a Mode selector for tuner allocation and claimed big speedups on Pi 4/5. Coherent RTL phase calibration plus MUSIC on a Pi 5 is a bench-grade passive radar and foxhunt core [krakenrf/krakensdr_suite].
  • pluto-crpa CRPA anti-jam prototype -- Fresh repo from the GPS-SDR-SIM author: two-element controlled-reception-pattern-array on a PlutoSDR (AD9363 + Zynq-7010), adaptive weights computed on the PS, combined in the PL, and re-transmitted at GPS L1 into a COTS GNSS receiver. A clean open nulling rig you can point at your own jammer [osqzss/pluto-crpa].
  • Lima GNSS spoofing defense -- NY Times piece on Ukraine's Lima system, which jams and spoofs GNSS wholesale -- reportedly relocating receivers to Peru and degrading guidance on some of Russia's best weapons. Field proof that mass meaconing/spoofing beats per-platform hardening [RNT Foundation / NY Times].
  • Telecom GNSS dependence exposed -- Turk Telekom and Calnex walked through GNSS disruption impacts on telecom timing at ITSF 2026 -- the practical case for eLoran/holdover backups when the L1 band goes hostile [RNT Foundation].
  • Phone modem as SDR, now with HRPT -- D325f-SDR v2.0 turns the Qualcomm modem in an old LG D325 into a wideband SDR (Bluetooth TX as LO to get below 800 MHz), now pulling 1.7 GHz Meteor-M HRPT and benchmarked against the RTL-SDR Blog V4 [RTL-SDR.com / Logan Zarov].
  • ESP32-C5 dual-band wardriver, 6 GHz to main -- Pager 6 GHz support promoted to main: 2.4/5/6 GHz capture on one ESP32-C5, with Wardacted log sanitization (hashed MACs) documented for the exports. Pocket tri-band wardriving, no laptop [justcallmekoko/ESP32DualBandWardriver].
  • PortaPack Mayhem PRALINE clock sync -- PRALINE TX/RX clock sync extended to the HackRF Pro's internal 25 MHz TCXO, stale audio spectrum during modulation changes fixed, and SD corruption killed by switching to single-beat SDIO IDMAC transfers [portapack-mayhem/mayhem-firmware].
  • Vanhoef slides push -- Fresh decks at 3ea9f01f: Wisec 2026 (Rathan Appana), PAKE 2026, and a SecDev 2026 paper -- raw Wi-Fi protocol attack research, worth reading before the PDFs circulate [vanhoefm/papers].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #25   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/25.possibilities :: [ 80 sources ]
  • Bench the C++ Kraken DoA against your old Python logs -- Replay stored coherent-IQ captures through both stacks and diff the MUSIC bearing output; then feed the Pi 5 build a 1090 MHz ADS-B source as a passive-radar reference emitter and see if the C++ pipeline holds real-time spectrum + DoA without dropping calibration phase.
  • Scale pluto-crpa from 2 to 4 elements -- The PL weight-combiner is element-count agnostic in principle; port the design to a Pluto + external AD9363 or a pair of synced Plutos, feed it a GPS L1 civil spoofer (GPS-SDR-SIM off-air), and measure null depth on the COTS receiver's C/N0.
  • Hunt 6 GHz WPA3 APs with the C5 wardriver -- Flash the mainline build, sweep a dense urban core for 6 GHz-only 802.11ax/be BSSIDs that 2.4/5 GHz-only rigs miss, and check whether hashed-MAC sanitization survives the WiGLE upload format before you log anything sensitive.
  • Reproduce the Lima relocation effect locally -- HackRF or Pluto + GPS-SDR-SIM, broadcast a Peru ephemeris/almanac set at L1 C/A over the bench, and watch a u-blox and a phone chipset disagree on position -- the classic split between receivers that trust TOA vs. those that sanity-check ephemeris.
  • Fuzz SoapyRemote's hardened stream path -- 0.5.4 bounds stream header bytes/elems in acquireRecv and fails RPC receive on mid-payload peer close; write a malicious SoapyRemote client that sends truncated headers and oversized elem counts to see if the bounds hold across all RPC message types, not just the patched one.
  • Stress the Mayhem SDIO fix under rapid modulation flips -- The single-beat IDMAC change killed SD corruption; hammer the H1/H2 with fast app switches plus simultaneous TX and SD logging, and diff captured IQ files against the pre-fix build to confirm zero torn writes.
  • Grep mt76 for the injection edge cases -- Still the go-to out-of-tree blob for monitor mode and frame injection on MT7610-MT7928; build the latest against 6.12+, run aireplay-ng --test and an FragAttacks-style injection check across MT7921/MT7925, and file what breaks.
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #25   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/25.github :: [ code & repo tradecraft ]

Quiet week on the vendor blogs, which left the git stream doing all the talking. The big noise was KrakenRF ripping Python out of their coherent DoA stack and shipping a full C++ rewrite, osqzss quietly dropping a two-element CRPA anti-jam prototype on PlutoSDR hardware, and the ESP32-C5 wardriver promoting 6 GHz capture to mainline. Meanwhile the usual suspects -- rtl_433, Mayhem, SoapyRemote, morrownr's driver trees -- pushed the kind of small hardening commits that only matter if you actually run the gear. No conferenceware, just firmware and flowgraphs worth pulling tonight.

  • krakenrf/krakensdr_suite -- Full C++ rewrite at 825aa23d: real-time spectrum + audio demod concurrent with MUSIC DoA, Mode selector for tuner allocation, Pi 4/5 speedups. The reference open coherent-array stack, now actually fast.
  • osqzss/pluto-crpa -- New repo: two-element CRPA on AD9363 + Zynq-7010, PS-computed adaptive weights, PL combination, re-radiated at GPS L1 into a COTS receiver. Textbook open anti-jam harness.
  • merbanan/rtl_433 -- 3962dd97 fixes getopt reset/%z on newlib/ESP-IDF, shrinks MAXIMAL_BUF_LENGTH, reopens SDR cleanly, and silences connection handlers before mg_mgr_free -- memory-discipline commits that matter on ESP32 builds.
  • pothosware/SoapyRemote -- 0.5.4 bounds stream header bytes/elems in acquireRecv and fails RPC receive on mid-payload peer close. Tight input hardening on the RPC path every distributed SDR rig leans on.
  • morrownr/rtw89 -- Adds board_elm.bin for Valve's RTL8852CU, bumps 8852C/8922D blobs, backports __counted_by_le for pre-6.10 kernels. Still the fastest path to monitor mode on Realtek Wi-Fi 6/6E/7 silicon.