[ <- back-issue archive · live wire · issue #37 · RF 30D · 2026-11-15 03:10 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #37   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/37.intel :: [ 2026-11-15 03:10 UTC ]
  • KrakenSDR V2 suite rewritten in C++ -- The 5-channel coherent RTL-SDR direction finder shed its Python layer entirely: real-time spectrum and audio demod now run concurrently with MUSIC DoA estimation, with a Mode selector carving up tuner usage. Coherent RTL phase calibration plus MUSIC on a Pi 5 is a battery-grade passive radar and foxhunt core, no laptop required [@krakenrf].
  • pluto-crpa: two-element CRPA anti-jam on PlutoSDR -- Fresh repo from the GPS-SDR-SIM author: AD9363 + Zynq-7010 with adaptive weights computed on the PS, combined in the PL, and re-transmitted at GPS L1 (1575.42 MHz) into a COTS GNSS receiver. A textbook controlled-reception-pattern-array bench you can jam against tonight [@osqzss].
  • Lima GNSS spoofing pushes drones into Peru -- Ukraine's Lima system layers spoofed position fixes on top of raw GNSS jamming, convincing drones and guided munitions they're over Peru. Russian kit still leans hard on GNSS despite Chayka/eLoran fallbacks -- spoofing beats jamming when the target has INS dead-reckoning [RNT Foundation].
  • Turk Telekom holdover measurements: GNSS loss is a hard failure -- ITSF 2026 field data shows base-station timing sync degrades silently once GNSS holdover runs out; no re-sync grace period exists. Every eNodeB on a single GNSS reference is one jammer away from cascading timing collapse [RNT Foundation].
  • ESP32DualBandWardriver v2.4.1 ships 6 GHz recon payload -- The ESP32-C5 dual-band wardriver now bundles a WiFi Pineapple Pager payload for 6 GHz recon, installable from the fork while the Hak5 library submission sits in review. Sub-$20 pocket hardware sweeping 2.4/5/6 GHz straight to WiGLE [@justcallmekoko].
  • PortaPack Mayhem: PRALINE clock sync + SDIO fix -- 7756e195 extends PRALINE TX/RX clock sync to the HackRF Pro's internal 25 MHz TCXO, fixes stale audio spectrum during modulation changes, and kills SD write corruption by switching to single-beat SDIO IDMAC transfers. Rerun any sweep captures you trusted against the old display [@portapack-mayhem].
  • High-sensitivity ADS-B receiver from EA4GPZ -- Daniel Estevez is building an open-source 1090 MHz receiver explicitly targeting weak-signal and message-collision scenarios where dump1090-class decoders fall over. Worth a diff against readsb's CRC and overlap handling [@ddestevez].
  • SDRangel v8.2.0 rips out DSDcc/mbelib -- New DSD demod/modulator covers DMR, D-Star, Yaesu C4FM, M17, and dPMR off Airspy/HackRF/LimeSDR/RTL-SDR, replacing the long-in-the-tooth DSDcc stack. Cleaner digital-voice decode across the whole bench [@f4exb].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #37   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/37.possibilities :: [ 245 sources ]
  • Bench-jam the pluto-crpa CRPA prototype -- Build the two-element rig, feed it a live L1 signal plus a coherent jammer from a second PlutoSDR, and sweep jammer power/JAMMER geometry to find where the adaptive weights stop nulling. Two elements means one spatial null -- test whether a two-source jammer defeats it outright [inspired by osqzss/pluto-crpa].
  • Hunt spoofing artifacts with the Kraken C++ DoA core -- Point the 5-channel MUSIC stack at a GNSS spoofer's transmit site: a spoofed COTS receiver reports one position, but the Kraken gives you the actual bearing to the spoofer. Diff the new C++ DoA output against the old Python branch for calibration regressions before trusting bearings in the field [inspired by krakenrf/krakensdr_suite].
  • Fuzz SoapyRemote's freshly bounded stream parser -- 0.5.4 added bounds checks in acquireRecv and mid-payload peer-close handling; that's maintainer language for "somebody found truncation bugs." Fire malformed/truncated RPC stream headers at a SoapyRemote server from a rogue client and see if the new bounds actually hold [inspired by pothosware/SoapyRemote].
  • Stress-test readsb's DF filter and Beast framing -- The --filter-DF bitset shift got clamped and GNS HULC messages are now framed in readBeast(); craft Beast-protocol input with out-of-range DF values and malformed HULC frames against a local readsb instance to check the clamp edge [inspired by wiedehopf/readsb].
  • Re-audit mt76 monitor mode and injection after the firmware drop -- mt7996 firmware came off the skip-picks list; rebuild the out-of-tree driver on a MT7925/MT7996 card and re-run your aircrack suite -- monitor mode, frame injection, and FCS handling on the new blob before you trust it in the field [inspired by morrownr/mt76].
  • Map Meshtastic proto churn onto LoRa wire framing -- Protobufs bumped to v2.8.2.31; capture Meshtastic LoRa traffic with rtl_433-adjacent flowgraphs or a HackRF at the default 869.525 MHz EU slot and diff the serialized protobuf framing against the old proto to see what shifted on-air [inspired by meshtastic/Meshtastic-Android].
  • Sweep 6 GHz with the ESP32-C5 wardriver + Pineapple Pager -- Flash v2.4.1, walk a 6 GHz WPA3 neighborhood, and check whether the C5's radio sniffs 320 MHz channels and MLO Beacons that 2.4/5 GHz-only wardrivers miss entirely; WiGLE ingest is already wired [inspired by justcallmekoko/ESP32DualBandWardriver].
  • Replay GNSS-loss timing collapse in the lab -- Feed a lab eNodeB or PTP grandmaster from a GPS simulator, then cut the antenna and log holdover drift against the Turk Telekom curves. Cheap GPS sim + u-blox + a PTP-capable switch gets you the whole failure-mode bench [inspired by RNT Foundation].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #37   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/37.github :: [ code & repo tradecraft ]

Quiet month for loud CVEs, loud month for hardware. The git stream was dominated by people tightening the physical layer: krakenrf threw out Python and rebuilt the whole coherent DF stack in C++, osqzss quietly dropped a two-element CRPA anti-jam prototype on PlutoSDR hardware, and the Mayhem crew kept grinding clock-sync and SDIO corruption fixes into HackRF firmware. Wardriving tooling crept up-band -- the ESP32-C5 dual-band wardriver now carries a 6 GHz Pineapple Pager payload -- while maintainers across volk, SoapyRemote, and readsb shipped small hardening diffs that read like somebody found an edge case and didn't blog about it. No conferenceware, no hype -- just firmware, flowgraphs, and driver diffs worth pulling tonight.

  • krakenrf/krakensdr_suite -- Full C++ rewrite at 825aa23d: real-time spectrum and audio demod run concurrently with MUSIC DoA, Mode selector allocates the five coherent RTL tuners, claimed big speedups on Pi 4/5. Pull it if you want a pocket passive radar without dragging a laptop.
  • osqzss/pluto-crpa -- New repo: two-element CRPA on PlutoSDR (AD9363 + Zynq-7010), adaptive weights on the PS, combined in the PL, re-transmitted at GPS L1 into a stock GNSS receiver. The GPS-SDR-SIM author shipping an anti-jam rig is the best news this window.
  • portapack-mayhem/mayhem-firmware -- 7756e195 extends PRALINE TX/RX clock sync to the HackRF Pro internal 25 MHz TCXO and kills SD write corruption via single-beat SDIO IDMAC transfers. If you trusted the old audio spectrum display during modulation changes, rerun those captures.
  • justcallmekoko/ESP32DualBandWardriver -- v2.4.1 adds a WiFi Pineapple Pager payload for 6 GHz recon on the ESP32-C5, installable from the fork while the Hak5 library submission sits in review. Sub-$20 tri-band wardriving straight to WiGLE.
  • pothosware/SoapyRemote -- 0.5.4 bounds stream header bytes/elems in acquireRecv and fails RPC receive on mid-payload peer close. Malformed-stream hardening with zero fanfare -- exactly the kind of diff worth fuzzing around.