[ <- back-issue archive · live wire · issue #48 · RF 30D · 2026-11-15 05:08 UTC ]
 .-.                    .-. 
(: `--------------------' :)
 )   intel brief // #48   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/48.intel :: [ 2026-11-15 05:08 UTC ]
  • Turk Telekom GNSS holdover failure -- Calnex ITSF 2026 field measurements show base-station sync silently rots the instant GNSS drops: no re-sync grace, holdover exhausts, timing degrades underneath live traffic. Treat GNSS denial as a hard operational kill -- the exact failure a $30 L1 spoofer produces [RNT Foundation].
  • KrakenSDR V2 suite rewritten in C++ -- The 5-channel coherent RTL-SDR direction finder shed its Python layer: real-time spectrum and audio demod now run concurrently with MUSIC DoA estimation, with a Mode selector carving tuner allocation. Claimed big speedups on Pi 4/5 mean a battery-powered passive DF and foxhunt rig just got lighter [krakenrf].
  • PortaPack Mayhem nightly n_261115 -- 7756e195 fixes stale audio spectrum updates during modulation changes, extends PRALINE TX/RX clock sync to the HackRF Pro's internal 25 MHz TCXO, and kills SD write corruption by switching to single-beat SDIO IDMAC transfers. If you trusted the old spectrum display during sweep captures, rerun them [@portapack-mayhem].
  • 5 GHz drone video demod on an ESP32 -- [Twotoz] abuses the ESP32's hidden SDR capability to demod 5 GHz analog FPV drone video, turning a $3 MCU into a downconverter-free drone-feed sniffer. No HackRF, no laptop -- just the radio silicon already on the board [Hackaday].
  • Galileo OSNMA degraded by jamming -- Finnish Geospatial Research Institute study: strong GNSS jamming degrades Galileo L-band OSNMA, so nav-message authentication helps against spoofing but does nothing against jamming-induced loss. Crypto on the nav message, nothing on the carrier [RNT Foundation].
  • Hubble Network BLE-to-satellite field test -- Off-the-shelf 2.4 GHz BLE chips push small packets up to a ~7-satellite LEO constellation, verified from Budapest. A consumer PHY reaching orbit means the uplink is also reachable from your bench [RTL-SDR.com].
  • more1090 high-sensitivity ADS-B receiver -- Daniel Estevez's more1090 targets weak-signal and message-collision scenarios at 1090 MHz with a high-sensitivity demod/decode chain that outperforms existing open-source receivers. Code is public -- worth benching against dump1090 on a crowded TIS-B day [Daniel Estevez].
  • Kismet userspace-wifi -- uwifi builds Linux USB Wi-Fi drivers unmodified in userspace on libusb, giving monitor-mode capture on macOS and other no-kernel-monitor platforms. Full 802.11 sniffing without touching a kernel extension [kismetwireless].
 .-.                      .-. 
(: `----------------------' :)
 )   possibilities // #48   ( 
(: .----------------------. :)
 `-'                      `-'
> /var/archive/digest/48.possibilities :: [ 459 sources ]
  • Build a two-element CRPA anti-jam rig on PlutoSDR -- Clone the repo, load the AD9363 + Zynq-7010 bitstream, and test adaptive null-steering against a GPS L1 jammer while watching the COTS receiver's C/N0. Then flip it: characterize how much jammer power the weights can actually reject before the null breaks [inspired by osqzss/pluto-crpa].
  • Reactive-jam a chosen AP with modwifi -- Grab an AWUS036NHA (Atheros AR9271), load the patched driver, and test reactive jamming that kills beacons and probe responses from a target SSID while leaving neighbors untouched. Measure how long client association state machines take to give up [inspired by vanhoefm/modwifi].
  • Sniff 5 GHz FPV with a bare ESP32 -- Reproduce the demod flow on an ESP32-S3, sweep the 5.8 GHz analog video band, and log which FPV channels are active in your area. Cheap enough to bolt one per channel into a capture array [inspired by Hackaday].
  • Fuzz Meshtastic identity fields over LoRa -- Diff the new UNSIGNED_IDENTITY_UPDATE_IGNORED NotificationType and DeviceMetadata.ble_address field, then craft nodeinfo packets that flip identity mid-session and see which firmware versions accept the swap. The address field is a fresh spoofing surface [inspired by meshtastic/protobufs].
  • Bench the C++ KrakenSDR DoA stack on a Pi 5 -- Build the new suite, run MUSIC DoA and audio demod concurrently, and characterize coherent phase drift across the 5 RTL tuners over a thermal cycle. Then point it at a 2.4 GHz beacon source and test single-transmitter geolocation accuracy against GPS truth [inspired by krakenrf].
  • Probe srsRAN's new bound checks with malformed NAS -- Stand up srsRAN 26.10 against Open5GS over ZMQ, then feed truncated PDCP/GTP-U/NAS PDUs at the newly added length and bound checks. Fresh guard code is a map of what the maintainers think crashes [inspired by srsran].
  • Map GNSS holdover decay with a $30 spoofer -- Replay L1 C/A with a HackRF and a GPS-SDR-SIM scenario, then log how long a COTS timing receiver's holdover stays within spec after signal loss. Quantify the silent-degradation window before alarms fire [inspired by RNT Foundation].
 .-.                     .-. 
(: `---------------------' :)
 )   github brief // #48   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/48.github :: [ code & repo tradecraft ]

Repo traffic this stretch runs straight at the capture and DFing stack: Kismet shipped a userspace libusb Wi-Fi driver path for monitor mode on platforms with no kernel monitor, a new parallel ESP32-C3/C5 sniffer array merges 13 channels of 2.4 GHz into one Wireshark timeline, and the KrakenSDR DoA stack got rebuilt in C++ for real-time coherent work on a Pi. Meanwhile the bladeRF-wiphy VHDL modem closed RX timing and scaled TX for 12-bit IQ, and openwifi picked up PlutoSky R2 board support -- the open 802.11 baseband bench keeps widening.

  • kismetwireless/userspace-wifi -- Linux USB Wi-Fi drivers built unmodified in userspace on libusb, giving monitor-mode capture on macOS and other no-kernel-monitor platforms. Zero kernel extension, full frame visibility -- diff the transfer loop against the in-tree drivers to see what libusb URB handling costs you.
  • 7h30th3r0n3/Evil-Sentinel -- DIY parallel 2.4 GHz capture array: one ESP32-C3/C5 sniffer per channel on a powered USB hub, merged into a single live Wireshark timeline, WiFi Coconut style. Passive-only, stdlib Python glue -- cheap full-band visibility.
  • Nuand/bladeRF-wiphy -- Open-source 802.11 VHDL modem fixes RX timing closure, scales TX output by 4 for 12-bit IQ, and writes only the correct double-buffer packet. The double-buffer fix is the one to diff if you were seeing corrupted frames on TX.
  • justcallmekoko/ESP32DualBandWardriver -- ESP32-C5 dual-band wardriver promoted 6 GHz Pager support to main and documented Wardacted log sanitization with hashed MACs in exports. 2.4/5/6 GHz capture on one $5 board.
  • open-sdr/openwifi -- Open 802.11 FPGA baseband plus Linux driver adds PlutoSky R2 board support via PR #510. More COTS carriers means cheaper injection and sniffing rigs running the full PHY in fabric.