.-. .-. (: `--------------------' :) ) intel brief // #27 ( (: .--------------------. :) `-' `-'
- osqzss/pluto-crpa -- Fresh repo: a two-element CRPA anti-jam prototype on PlutoSDR (AD9363 + Zynq-7010), adaptive weights computed on the PS, combined in the PL, and re-radiated at GPS L1 (1575.42 MHz) into a stock GNSS receiver. Textbook null-steering lab you can build for under $200 [osqzss/pluto-crpa].
- krakenrf/krakensdr_suite -- The 5-coherent-channel RTL rig's DoA stack got rewritten from Python into C++: real-time spectrum and audio demod running concurrently with MUSIC direction finding, with claimed big speedups on Pi 4/5 and a Mode selector for tuner allocation. Coherent RTL phase calibration plus MUSIC on a Pi 5 is a bench-grade passive radar and foxhunt core [krakenrf/krakensdr_suite].
- portapack-mayhem/mayhem-firmware -- PRALINE TX/RX clock sync now extends to the HackRF Pro's internal 25 MHz TCXO, stale audio spectrum during modulation changes is fixed, and SD corruption was killed by switching to single-beat SDIO IDMAC transfers. Clock sync on a handheld means tighter spoofing and replay timing off the same reference [portapack-mayhem/mayhem-firmware].
- RNT Foundation on Lima -- NY Times coverage of Ukraine's Lima system, which jams and spoofs GNSS to drag drones and GPS fixes thousands of kilometers off -- reportedly countering some of Russia's best weapons including Oreshnik missiles. Meaconing at continental scale, not just local spoof [RNT Foundation].
- Turk Telecom GNSS disruption talk -- ITSF 2026 presentation from Turk Telecom and Calnex on what happens to telecom timing when GNSS is disrupted -- a field report on single-point-of-failure PTP/GNSS architectures from people who watched it break [RNT Foundation].
- Daniel Estevez high-sensitivity ADS-B receiver -- EA4GPZ shipped a new ADS-B receiver application built to beat existing open source decoders on weak signals and message collisions at 1090 MHz -- worth a head-to-head against readsb/dump1090 on a marginal antenna [Daniel Estevez / @destevez].
- D325f-SDR LG phone SDR -- App 2.0 for the Qualcomm cellular modem in an old LG D325 turned into a general SDR, using the phone's own Bluetooth transmitter as an LO to reach below 800 MHz -- now pulling Meteor-M HRPT at 1.7 GHz with an SNR comparison against the RTL-SDR Blog V4 [RTL-SDR.com].
- justcallmekoko/ESP32DualBandWardriver -- ESP32-C5 dual-band wardriver with 6 GHz support promoted to main: 2.4/5/6 GHz capture in one pocket unit, hashed MACs in exported logs. The C5's 802.11ax radio makes it the cheapest tri-band sniffing brick going [justcallmekoko/ESP32DualBandWardriver].
.-. .-. (: `----------------------' :) ) possibilities // #27 ( (: .----------------------. :) `-' `-'
- Scale the Pluto CRPA to a real jammer bench -- Pull the two-element weights code, feed a second Pluto as a CW and chirp jammer at L1, and measure null depth vs. jammer angle on the COTS receiver's C/N0. Then try extending to a third element with an external splitter and see if the PS-side adaptive loop keeps up under swept jamming [inspired by osqzss/pluto-crpa].
- Benchmark the C++ Kraken DoA against the old Python stack -- Same antenna array, same calibration run, diff MUSIC bearing error and update rate between the Python and C++ builds on a Pi 4. Then point the coherent channels at 1090 MHz ADS-B and see whether the passive radar ambiguity function survives the rewrite [inspired by krakenrf/krakensdr_suite].
- Test PRALINE clock sync for tight GNSS replay -- With the HackRF Pro TCXO now disciplined, measure drift between recorded GPS samples and live L1 signal over a 10-minute replay; if the sync holds, single-antenna meacon-style spoofing from a PortaPack becomes dramatically more plausible. Worth a u-blox receiver on the bench as the victim [inspired by portapack-mayhem/mayhem-firmware].
- Fuzz the openwifi FPGA baseband with malformed 802.11 PHY frames -- Grab the PlutoSky R2 board files now on the compatibility list, inject deliberately mangled PLCP headers and oversize PSDU lengths from a second radio, and watch the RX state machine in the PL for hangs or silent drops. An open baseband is a fuzzing target nobody hammers [inspired by open-sdr/openwifi].
- Race-test the rtl_433 SDR reopen path -- The recent commits fix SDR reopen and shrink MAXIMAL_BUF_LENGTH; yank the USB dongle mid-decode and hot-plug it back to see if the reopen path leaks file descriptors or wedges the mg_mgr loop on ESP-IDF builds. Also diff the newlib getopt fix for portability to your own ESP32 ISM sniffers [inspired by merbanan/rtl_433].
- Head-to-head ADS-B decoders on a marginal link -- Run the new EA4GPZ receiver, readsb, and dump1090-fa on the same RTL-SDR V4 and IQ dump, and score message recovery rate on overlapping DF17 frames and weak -30 dB frames. The collision-recovery logic is where the interesting diff lives [inspired by Daniel Estevez].
- Hunt 6 GHz WPA3 with the ESP32-C5 wardriver -- Flash the main branch, sweep a dense urban core for 6 GHz 802.11ax BSSIDs, and check how many expose transition-mode PMF-disabled 2.4 GHz twins -- the classic downgrade seam. Log sanitization is documented, so your wardrive output is already hash-safe for upload [inspired by justcallmekoko/ESP32DualBandWardriver].
- Abuse the phone-modem SDR trick on other Qualcomm handsets -- The Bluetooth-transmitter-as-LO trick should generalize to any phone with an accessible modem diag interface; grep for other LG/Samsung models with the same WCDMA chipset and see how low the tunable range really goes. A pocket SDR nobody clocks as one [inspired by RTL-SDR.com].
.-. .-. (: `---------------------' :) ) github brief // #27 ( (: .---------------------. :) `-' `-'
Quiet on the conference circuit, loud on the bench. The git stream this month was dominated by people rewriting RF stacks in C++ instead of Python, bolting clock discipline onto handheld transmitters, and quietly hardening the ISM-band and 802.11 tooling we all actually run at 2 AM. Two new repos worth your attention: a two-element CRPA anti-jam prototype on a PlutoSDR, and the KrakenSDR DoA suite dropping Python entirely. Meanwhile the wardriving and Wi-Fi audit side got steady maintenance -- hcxtools counting PMKs honestly, sparrow-wifi closing a scan teardown race, and the WiGLE client fixing an IMS wedge. Nothing flashy, all load-bearing.
- osqzss/pluto-crpa -- New repo: two-element CRPA anti-jam on PlutoSDR (AD9363 + Zynq-7010), weights combined in the programmable logic, re-transmitted at GPS L1 into a COTS receiver, adaptive weights on the PS. The cheapest credible null-steering rig we've seen published.
- krakenrf/krakensdr_suite -- Full C++ rewrite of the 5-channel coherent RTL DoA stack: real-time spectrum plus audio demod concurrent with MUSIC, Mode selector for tuner allocation, big speedups claimed on Pi 4/5. Diff the calibration code against the old Python version before you trust the phase bookkeeping.
- portapack-mayhem/mayhem-firmware -- PRALINE TX/RX clock sync extended to the HackRF Pro internal 25 MHz TCXO, stale audio spectrum fix on modulation change, and SD write corruption killed via single-beat SDIO IDMAC transfers. The clock sync commit is the one that matters for anyone doing timed replay.
- ZerBea/hcxtools -- Improved status messages, a confirmed-PMK counter, and zeroed PMKs no longer counted as confirmed -- small but honest accounting fixes in the PMKID/EAPOL capture-to-hash pipeline. Worth pulling before your next capture session so your hash counts aren't lying to you.
- merbanan/rtl_433 -- Commits fix getopt reset/%z on newlib/ESP-IDF, shrink MAXIMAL_BUF_LENGTH, reopen SDR cleanly, and silence connection handlers before mg_mgr_free(). The ESP-IDF fixes mean your ESP32 ISM sniffer builds just got less crash-prone.