i asked DeepSeek to code me a ADS-B module for SDR++ alongside Claude Free Tier to improve things. and now we have ADS-B tracker built into SDR++ with waterfall

However. Its still very early stage right now. a lot of things are missing

im planning to ask these agents to add more trackers and decoders like AIS vessel tracker. and some more digital decoders and stuff idk about that.

Finally found out where we can look up radio frequencies in Canada, the TAFL search. Tried some hospital pager frequencies, but seem to also get City of Toronto water treatment plants... EFFL Effluent tank is full. Blurred the full email of the Toronto water department. Not sure where the zone humidity is from.

Hello, I am a SWL and I am closely interested in the world of SDR. I would like to participate with my station in the APRS network. I have an RTL-SDR Blog V4 and I managed to configure Direwolf to appear as a beacon on APRS-FI. The website displays me properly on the map, and I can see my station details.

If I understand correctly, every 30 minutes my station sends a position update to the site for my GPS location (which I provided in the direwolf.conf file).

On the other hand, while I can see all the stations my station has heard under the Info section, I feel like there are very few compared to the actual frames received.

Also, according to the data, the stations I receive are only about 40 km away (even though in reality I receive them from much further away). Why doesn't APRS-FI show them? (Filter issue? Incorrect setting?)

And finally, I notice that very few frames per hour are sent to the network (even though once again, my Direwolf window constantly displays incoming receptions).

Thank you very much, and sorry for this very (too) long post.

73

VUURWERK v1.5.1 is out. New: PATROL, a hands-free voice hunt. In the spectrum's VOX mode press 2 and 8 to set a range and 0 to start; the radio walks the band, stops on voices, moves on when they finish, and PTT locks the one you want. Plus a big fix pass: no more keying up when you leave the spectrum with PTT held, no freeze on a flat battery, F+9 and the tone scan no longer disturb your repeater setup, and the main screen refreshes properly. Settings survive the upgrade. UV-K5 V1 only.

https://github.com/Tokeloshe/vuurwerk-firmware/releases/latest/download/vuurwerk-v1.5.1.packed.bin

KC3TFZ 73

Not an SDR project itself, but it only exists because of feeders, so this seemed the right place.

It's a full-screen display for a spare TV or old tablet: a map of the planes over your area and one big card at a time for a flight overhead. Positions come from adsb.lol, with adsb.fi as the fallback, so your coverage is whatever the feeders near you give it. I'm planning to add a feeder of my own.

Routes come from the VRS standing data, checked against position, altitude and heading. Anything that doesn't fit is dropped, and the card says "Route unknown".

I'm looking for about 10 people to run it on a real screen for a week from Thursday 29 October, free. Feeders are ideal: you'll know when it's missing a plane you can see on your own receiver.

Waitlist: https://wingwatch.app

Got tired of classic scanners missing simultaneous conversations or leaving hours of empty noise in recorded files, so I built FalconSDR – a cross-platform, wideband radio scanner with a light and useful web UI.

Instead of stepping channel by channel, it analyzes the entire capture bandwidth of your SDR at once, catching and recording multiple simultaneous conversations in parallel.

Key Features:

• Parallel Wideband Scanning: Monitors the whole SDR bandwidth simultaneously – never misses a parallel reply on another frequency
• Simultaneous scanning of radio bands that are spaced apart from each other.
• Smart Voice Recording: Saves WAV/MP3 per transmission with configurable hold time, squelch, and spectral noise reduction. No hours of empty noise.
• Flight Replay Integration: For aviation bands (VHF 118–138 MHz & Military UHF 225–400 MHz), a single click opens FlightRadar24 or ADS-B Exchange replaying the exact air traffic around your location at the moment of the recording.
• Speech-to-Text (Whisper): Optional automated ATC/voice transcription (including fine-tuned ATC models) via faster-whisper. Can run on a secondary GPU machine on your network.
• Headless Server Mode: Run it on a Raspberry Pi / Mini PC / Home Server and stream live audio or control it from any phone or PC browser.
• Cross-Platform: .deb package for Ubuntu/Debian, standalone Windows installer/portable ZIP, macOS (experimental), or straight from source.
• Hardware Support: Native RTL-SDR support (V3/V4) + SoapySDR (HackRF, Airspy, SDRplay, LimeSDR, USRP).

I would be very pleased if someone were willing to give this solution a try and provide some feedback. Project is fully open source and free.

Installation and evertthing you need to know:

https://github.com/rafafunt/FalconSDR

repo link
I have spent a long time recently building IMSIsting, a bash and GTK4 cellular security toolkit featuring 57 modules spanning 2G through 5G. Every codec in it — including S1AP, NGAP, X2AP, XnAP, HNBAP, RUA, RANAP, M3UA, PFCP, NAS, RRC, LPP, and CMAS — is hand-written (with the help of AI).

To be honest, the software half runs, but the radio half has never been executed because I do not currently own an SDR (Software Defined Radio). Every over-the-air path is written, reviewed, dry-run against a fixture, and then stops right before needing a real radio. hackrf_transfer is wired in, srsRAN configs are generated, and SIB builders produce real octets — but none of it has ever actually been transmitted over the air by anyone.

That is what I need testers for.

The Actual Attack Surface

Here is a breakdown of the available attacks and modules implemented in the toolkit:

1. Identity Capture

• IMSI Catcher — GSM: Full catcher sequence and a forged BCCH carrier a handset can camp on.
• IMSI Catcher — LTE: NAS EMM attach forging, BCD IMSI/IMEI, identity-request sequence, and srsRAN eNB orchestration.
• IMSI Catcher — NR: SSB/MIB/SIB1 construction, RACH handling, gNB orchestration, and SSBs written as samples.
• SUCI De-concealment: X25519 and P-256 profile A/B, HKDF, and MSIN BCD computed.
• TMSI → IMSI De-anonymisation: Cross-capture correlation via forced-identity and location-update bindings.
• Piercer: Paging-occasion maths and the published correlation model.

2. Cipher and Downgrade

• A5/1 Keystream: Asserted against the Briceno/Goldberg/Wagner vector; A5/2 included with its brokenness explicitly stated; A5/1 downgrade forcing sequence.
• Cross-generation Steering / Null Cipher: Forged reject causes, SIB1 forgery, and cipher-change analysis across all four generations.
• ReVoLTE Keystream Reuse: Detection, key recovery, and the two-ciphertexts-one-keystream model.
• GEA Downgrade — GPRS/EDGE: GEA0 computed; GEA1–5 refused by name with stated reasons.
• Cipher Audit + Authentication Oracle: Negotiated-cipher scoring, downgrade detection, and SQN recovery from AUTS.

3. Signalling Forgery

• 17 NAS Pre-authentication Messages: Built as octets (Attach/TAU/Service reject, Identity Request, Authentication Request/Reject/Failure, Security Mode Command/Reject, EPS, and 5GS), each checked against tshark.
• RRC Reconfiguration, Release, Reestablishment-Reject: Handled through generated PER layouts (LTE and NR).
• CMAS / ETWS / PWS Alert Forgery: SIB10/11/12 warning chain with pinned pycrate vectors, plus sib.conf generation.
• GTP-in-GTP and MBMS Session Start: The middlebox gap, fully built and dissected.

4. Core Network and Interconnect

• MAP/TCAP: Byte-exact ATI, SRI, SRI-SM, SAI, PSI, ULR, ISD, RegisterSS, ActivateSS, and M3UA both ways.
• SIP / IMS REGISTER Hijack: Spoofed re-registration and the IMP4GT model.
• 5G SBA: NRF discovery, NGAP procedures, PFCP rules, and AMF/SMF reachability map.
• O-RAN & Slicing: A1 policy poisoning, E2 control shapes, over-broad xApp model, S-NSSAI codec, isolation testing, and 5QI/TSN.
• Carrier API Enumeration & Lawful Interception: X1/HI1 artefact encoding.

5. Baseband, Device, and Radio

• Baseband CVE Catalogue: Reachability checks, L2 frame builders, and forged registration accept/reject.
• NR Access: RAR, backoff, RA-RNTI arithmetic, MAC/DCI, Gold sequence, and scrambling.
• Qualcomm DIAG/NV/EFS/AT Surface: Real framing, NV read/build/write, and EFS paths.
• Jamming: Detection first (barrel, narrowband, and pulsed distinguished from congestion), followed by a waveform constructor behind an explicit lab gate (AWGN/CW/chirp, PSS/SSS/PBCH, PRACH, PRS, GPS C/A, NR SSB).
• GPS C/A and PRS Sequences: Generated from IS-GPS-200N and TS 36.211, asserted against an independent implementation.

6. Tracking, Positioning, and RF

• Timing-advance geolocation, OTDOA/UTDOA/PRS via generated LPP codecs, RF fingerprinting (CFO, IQ imbalance, transients, CSI motion), and behavioural traffic fingerprinting.

7. Protocol Plumbing

• Air interface decode for 2G through 5G (BCCH/CCCH, UTRAN SIBs, MIB/SIB, SSB) and 98 catalogued LTE/5G stack CVEs (including GSM/UMTS and 5G CVE kits).
• TETRA/DMR/GSM-R, NB-IoT, 5G NTN, NR sidelink, VoWiFi IKEv2/EAP-AKA', femtocell S1/Iuh, USSD, OTA binary SMS, and SIM Toolkit proactive commands.
• Custom pcap reader (GSMTAP, Diameter, NGAP, S1AP, GTP, PFCP, RTP) and MAC/RLC/PDCP with RNTI tracking.
• Killchain: Nine built-in chains plus user-defined chains, pause/resume capability, and per-run result reporting.

What I Need an SDR For

• RTL-SDR: Cell scanning, GSM/LTE broadcast decode, tower mapping, jamming detection, and paging observation (cheapest tier, most unexplored surface).
• HackRF One / bladeRF 2.0: Rogue eNB/gNB, IMSI catcher, A5/1 downgrade, TMSI de-anonymisation, and paging transmit.
• USRP B210 + GPSDO: Two-radio baseband work (one radio holds frame structure while the other injects into it).

Bug & Error Reporting Guidelines

If you encounter a bug or error during testing, please provide:

1. Hardware: SDR model, firmware version, and driver.
2. Command / Action: The exact command you ran or the GUI button you clicked.
3. Full Output: Every line of output, including status rows.
4. Expected vs. Got: A brief description in your own words.
5. Capture File: A .pcap file if the radio produced one.

Every real finding will directly help improve the toolkit, and contributors will be credited in the commit history of course.