[ <- back-issue archive · live wire · issue #31 · RF 7D · 2026-11-15 01:47 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #31   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/31.intel :: [ 2026-11-15 01:47 UTC ]
  • KrakenSDR V2 suite goes full C++ -- The 5-channel coherent RTL-SDR direction finder ripped out its Python layer entirely: real-time spectrum and audio demod now run concurrently with MUSIC DoA estimation, and a Mode selector carves up tuner allocation. Claimed big speedups on Pi 4/5 mean a battery-powered passive radar / foxhunt core just got lighter and quieter [@krakenrf].
  • pluto-crpa two-element CRPA anti-jam prototype -- osqzss shipped a controlled-reception-pattern-array rig on PlutoSDR (AD9363 + Zynq-7010): adaptive weights computed on the PS, combined in the PL, re-transmitted at GPS L1 into a COTS GNSS receiver. A clean open bench for nulling jammers in hardware instead of post-processing [@osqzss].
  • Lima GNSS spoofing pushes drones into Peru -- Ukraine's Lima system layers spoofing on top of jamming, feeding false position fixes so drones and guided weapons (Oreshnik included) resolve to coordinates in Peru. Russian kit still leans hard on GNSS despite Chayka/eLoran alternatives -- spoof-vs-spoof is now the operating mode [RNT Foundation].
  • Turk Telecom holdover measurements: GNSS loss is a hard failure -- ITSF 2026 bench data shows there is no re-sync grace when GNSS drops at a base station: holdover runs out and timing/sync degrades silently. Anyone planning a GNSS-denial test against cellular backhaul should read the degradation curves first [RNT Foundation].
  • PortaPack Mayhem hardens TX/RX clocking and SDIO -- Fixed stale audio spectrum on modulation changes, extended PRALINE TX/RX clock sync to the HackRF Pro's internal 25 MHz TCXO, and killed SD write corruption by switching to single-beat SDIO IDMAC transfers. Clock sync on a handheld TX rig is the difference between a clean spoofer waveform and splatter [@portapack-mayhem].
  • LG phone modem as SDR, Bluetooth TX as LO -- The D325f-SDR repurposes a Qualcomm cellular modem as a receiver, using the phone's Bluetooth transmitter as local oscillator for sub-800 MHz tuning; app 2.0 adds Meteor-M HRPT reception plus an SNR bench against the RTL-SDR Blog V4. Covert RX with zero extra hardware hanging off it [RTL-SDR.com].
  • ESP32-C5 dual-band wardriver covers 2.4/5/6 GHz -- Pager 6 GHz support promoted to main, Wardacted log sanitization documented -- hashed MACs in exported logs. A pocket wardriver sweeping three bands while looking like a keychain [@justcallmekoko].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #31   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/31.possibilities :: [ 83 sources ]
  • Bench the C++ MUSIC DoA against the old Python stack -- Run both suites on the same Pi 5 with the same coherent calibration, feed a 2 m handheld at 433 MHz, and log DoA error vs. SNR across the Mode selector settings. If the C++ rewrite really holds real-time demod plus MUSIC, you have a walk-around passive radar trigger rig for under $400.
  • Extend pluto-crpa to a 4-element null ring -- The repo proves 2-element CRPA on one Pluto; chain a second AD9363 or move to a LimeSDR with shared clocking, push the weight combination into more PL fabric, and test null depth against a chirp jammer at GPS L1 (1575.42 MHz) on the bench before fielding it against a real spoofer.
  • Reproduce the Lima spoofing geometry locally -- HackRF or Pluto + GPS-SDR-Sim, craft a false ephemeris/position offset that walks a COTS receiver's fix a fixed distance away, and measure how long the receiver holds the spoofed fix before RAIM flags it. The Peru-scale offset is the interesting part -- huge jumps that still pass receiver sanity checks.
  • Map cellular holdover degradation under deliberate GNSS denial -- Use the Turk Telecom/Calnex curves as a target: jam L1 in a lab cage around a small eNodeB or srsRAN testbed synced off GNSS and time how long sync holds before backhaul errors surface. That's your dwell-time budget for any GNSS-denial op against timing-dependent infra.
  • Fuzz SoapyRemote's freshly bounded stream headers -- 0.5.4 added bounds on stream header bytes/elems in acquireRecv and mid-payload peer-close handling, which is maintainer-speak for "someone could crash or worse the RPC path." Fire truncated and oversized stream headers at a SoapyRemote server from a hostile client and see what the bounds actually catch.
  • Hunt 6 GHz WPA3 APs with the ESP32-C5 wardriver -- Flash the new main branch, sweep a dense urban core on 5.925-7.125 GHz, and diff capture volume against a 5 GHz-only rig. 6 GHz-only APs with no 2.4/5 beacon presence are invisible to classic wardriving -- this is where the fresh dataset lives.
  • Grep vanhoefm's fresh Wisec/SecDev decks for new Wi-Fi primitives -- Slides for Wisec 2026 (Rathan Appana), PAKE 2026, and SecDev 2026 just landed at 3ea9f01f. Pull them, read the attack mechanics, and pre-build the monitor-mode + injection harness (mt76 or rtw89 out-of-tree) before the papers drop publicly.
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #31   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/31.github :: [ code & repo tradecraft ]

Quiet week on the vendor blogs, loud week in the git stream. The DF and anti-jam corners did the heavy lifting: KrakenRF shipped a full C++ rewrite of the coherent 5-channel DoA stack, osqzss dropped a two-element CRPA anti-jam prototype on Pluto hardware, and the PortaPack Mayhem crew tightened TX/RX clock sync and SDIO corruption paths in the same push. Wardriving tooling crept into 6 GHz, and the out-of-tree Wi-Fi driver blobs kept the monitor-mode/injection pipeline alive for MediaTek and Realtek silicon. Nothing conference-grade -- just firmware and DSP commits worth pulling tonight.

  • krakenrf/krakensdr_suite -- Python gone, C++ in: real-time spectrum and audio demod concurrent with MUSIC DoA, Mode selector for tuner allocation, claimed big Pi 4/5 speedups at head 825aa23d. The coherent-RTL passive radar core just got a battery budget.
  • osqzss/pluto-crpa -- New repo: two-element CRPA anti-jam on PlutoSDR (AD9363 + Zynq-7010), adaptive weights on the PS, combined in the PL, re-transmitted at GPS L1 into a COTS receiver. Textbook open anti-jam harness.
  • portapack-mayhem/mayhem-firmware -- PRALINE TX/RX clock sync extended to the HackRF Pro's internal 25 MHz TCXO, stale audio spectrum on modulation change fixed, SD corruption killed via single-beat SDIO IDMAC transfers at 7756e195. Clocking fixes on a TX-capable handheld are never cosmetic.
  • justcallmekoko/ESP32DualBandWardriver -- 6 GHz Pager support promoted to main, Wardacted log sanitization with hashed MACs documented. Three-band capture on an ESP32-C5 keychain.
  • morrownr/rtw89 -- board_elm.bin firmware added for Valve's RTL8852CU, 8852C/8922D blobs bumped, __counted_by_le backported for pre-6.10 kernels. Still the injection workhorse for Realtek Wi-Fi 6/6E/7 outside the mainline tree.