Software-defined radio (SDR) technology can be used for many interesting technical experiments. With listening only SDR you can do many interesting things, but having a SDR that can also transmit opens many new doors. Here are some interesting videos related to SDR and cyber security:
Universal Radio Hacker – Replay Attack With HackRF
Download here: https://github.com/jopohl/urh
Radio Hacking: Cars, Hardware, and more! – Samy Kamkar – AppSec California 2016
Hacking Car Key Fobs with SDR
Getting Started With The HackRF, Hak5 1707
Hacking Ford Key Fobs Pt. 1 – SDR Attacks with @TB69RR – Hak5 2523
Hacking Ford Key Fobs Pt. 2 – SDR Attacks with @TB69RR – Hak5 2524
Hacking Ford Key Fobs Pt. 3 – SDR Attacks with @TB69RR – Hak5 2525
Hacking Restaurant Pagers with HackRF
Software Defined Spectrum Analyser – Hack RF
Locating Cellular Signal with HackRF Spectrum Analyzer SDR Software
GSM Sniffing: Voice Decryption 101 – Software Defined Radio Series #11
How To Listen To Trunked Police Radio And Why Im Done
Transmitting NTSC/ATSC Video With the HackRF One and Gnuradio
Check also Using a HackRF SDR to Sniff RF Emissions from a Cryptocurrency Hardware Wallet and Obtain the PIN article.
436 Comments
Tomi Engdahl says:
This guy created an analog 1G AMPS cell network and it works with his vintage Motorola!
https://www.reddit.com/r/vintagecomputing/comments/zlqqh1/this_guy_created_an_analog_1g_amps_cell_network/
Tomi Engdahl says:
https://hackaday.com/2021/06/02/how-to-run-a-first-generation-cell-phone-network/
Tomi Engdahl says:
https://philtel.org/2023/05/11/reviving-amps-phones.html
Tomi Engdahl says:
https://www.rtl-sdr.com/running-a-1g-mobile-phone-network-with-a-hackrf/
Tomi Engdahl says:
https://www.oreateai.com/blog/unpacking-the-1g-cellular-system-the-analog-dawn-of-mobile-communication/5f9f7b590d1f53b07b377d2ccf6f3f6a
Tomi Engdahl says:
Lime Microsystems Unveils the LimeSDR Micro, an M.2 Expandable SDR with Vector Accelerator
First FPGA-free LimeSDR is now crowdfunding, with an NXP baseband processor offering the ability to accelerate vector DSP work on-device.
https://www.hackster.io/news/lime-microsystems-unveils-the-limesdr-micro-an-m-2-expandable-sdr-with-vector-accelerator-9c1ef3823d9f
Tomi Engdahl says:
Open-source hardware DAB+ receiver combines ESP32 SoC with Skyworks SI4684 digital radio chip
https://www.cnx-software.com/2026/04/09/open-source-hardware-dab-receiver-combines-esp32-soc-with-skyworks-si4684-chip/
Tomi Engdahl says:
https://oh2ti.fi/2017/06/tetra-lahetteen-tarkastelua/
Tomi Engdahl says:
Running Your Own 3G Network
https://hackaday.com/2026/05/09/running-your-own-3g-network/
CDMA2000 was one of the protocols defined for 3G networks and is now years out of date and being phased out worldwide. Nevertheless, there are still vast numbers of phones that will happily connect to it, creating an opportunity for hackers seeking to run their own cellular networks. [Chrismoos] recently made this endeavour significantly easier by releasing 1xBTS, a Rust implementation of the lower three layers of a CDMA2000 network.
The lowest layer of the stack is an SDR for the actual radio communications. It’s been tested with the USRP B200 and B210, the LimeSDR Mini 2, and the BladeRF Micro 2.0. The code might work with certain other SDRs using the SoapySDR abstraction layer. The SDR is controlled by the base station (BTS) software, which, in turn, is controlled by the base station controller (BSC) over an Abis link. The BSC manages channels and mobile device associations, and exchanges frames with the mobile switching center (MSC), which handles message switching.
The stack includes standard 3G verification; before a handset can authenticate to the network, its details must be added to the home location register (HLR). Once authenticated, the handset can access all standard services: inbound and outbound voice calls via a SIP gateway, inbound and outbound SMS, and data packet transfers. A web dashboard provides a convenient management platform that includes packet tracing.
Tomi Engdahl says:
CDMA2000 1x from RF to core.
A full cellular stack in Rust — SDR air interface, BTS/BSC split, MSC, SMSC, HLR, packet data, and a dashboard.
Get Started
https://1xbts.org/
The air interface is built on CDMA2000 Spread Rate 1, driven by a software-defined radio. Phones connect over a real 1.25 MHz channel — pilot, sync, paging, and traffic channels — using Walsh code spreading and Viterbi decoding. Closed-loop power control runs at 800 Hz to keep signal quality stable as the phone moves.
Tomi Engdahl says:
GSM Phone Network At EMF Camp Built On Raspberry Pi And LimeSDR
https://hackaday.com/2018/08/30/gsm-phone-network-at-emf-camp-built-on-raspberry-pi-and-limesdr/
Tomi Engdahl says:
How To Run A First-Generation Cell Phone Network
https://hackaday.com/2021/06/02/how-to-run-a-first-generation-cell-phone-network/
Tomi Engdahl says:
Building Your Own 4G LTE Base Station
https://hackaday.com/2024/03/03/building-your-own-4g-lte-base-station/
Tomi Engdahl says:
Running Your Own 3G Network
https://hackaday.com/2026/05/09/running-your-own-3g-network/
Tomi Engdahl says:
Astronomers still don’t know exactly what dark matter is, but they sure can detect it—and now so can you. Using a DIY pyramidal horn, an RTL-SDR, and some Excel curve fitting on hydrogen-line spectra, it’s possible to reproduce the flat rotation curve of the Milky Way and see dark matter’s influence without ever leaving Earth. https://spectrum.ieee.org/dark-matter
Tomi Engdahl says:
Get Your Monitor Transmitting VHF With A Browser Tool
https://hackaday.com/2026/08/30/get-your-monitor-transmitting-vhf-with-a-browser-tool/
If you’re intending to transmit on the VHF band, you’re probably going to reach for a handheld or some kind of rackmount rig in your ham shack. But you needn’t bother with all that complexity, when you can use the computer on your desk to spit out such signals using a simple browser tool from [Efe].
The concept is straightforward—[Efe]’s tool manipulates pixel clocks in order to create spurious transmissions from your computer’s graphics hardware. The math pencils out pretty easily—multiply the horizontal resolution by the vertical resolution by the refresh rate, while paying attention to the precise timing of the video standard your monitor is using, and you’ve got your transmission frequency. For example, for a screen displaying 1080p at 60 Hz, with the CEA-861 timing standard, your horizontal and vertical resolutions are 2200 and 1125 respectively when paying attention to the requisite blanking intervals. Multiply those by 60 hz, and you’ll find you’re creating a signal at 148.500 MHz. Leverage this by displaying the right pattern of black and white pixels to maximise changes in voltage state on the HDMI or DisplayPort lines, and you might create a strong enough signal that you can actually pick something up. [Efe] created a tool to display these patterns to send simple Morse code messages over VHF just by flickering your screen just right.
https://waiixd.github.io/vhf-morse-transmitter-monitor/
https://github.com/WaiiXD/vhf-morse-transmitter-monitor
Tomi Engdahl says:
Single wire transmission line
https://youtu.be/it5UMt0lL8I?is=YjDDiWr-rpd6Ew9k
Tomi Engdahl says:
https://hackaday.com/2026/09/09/its-gnu-radio-companion-but-in-the-browser/
The progression of the web browser from a tool for simple static information browsing into a do-everything computing environment has been inexorable, with package after package making the jump. Today it’s the turn of GNU Radio Companion, lowering the barrier to software defined radio considerably. It’s the work of [Marc Lichtman], who’s name you may recall if you have ever used pysdr.org.
Loading it up gives you a very familiar window if you’re used to GNU Radio Companion, and it comes with a set of example flowgraphs that cover a large range of applications. It supports a collection of software-defined radios (SDRs) including the well-known RTL-SDR, and if that’s not enough it can also use your sound card. There is even a set of recorded off-air captures to experiment with.
https://gnuradioworld.com/
Tomi Engdahl says:
https://hackaday.com/2026/09/28/synthetic-aperture-radar-drone-gets-interferometric-imaging/
Tomi Engdahl says:
https://hackaday.com/2026/10/01/sdr-lets-you-patch-together-your-setup/
Tomi Engdahl says:
What are the advantages of using silicon carbide in RF devices?
http://m.hongfeng-abrasives.com/blog/what-are-the-advantages-of-using-silicon-carbide-in-rf-devices-1737459.html
Tomi Engdahl says:
https://hackaday.com/2026/10/03/the-esp32-an-sdr-in-itself/
Tomi Engdahl says:
https://www.macom.com/products/product-detail/MSW2001-200
Tomi Engdahl says:
https://hackaday.com/2026/10/12/wifi-router-does-software-defined-radio/
Tomi Engdahl says:
ESP-SDR Can Now Transmit
https://hackaday.com/2026/10/13/esp-sdr-can-now-transmit/
Well, that was fast! Last week, we reported on two apparently simultaneous hacks using the 2.4 GHz radio inside many ESP32 variants that enabled raw access to the radio samples, turning it into a listen-only software defined radio (SDR) platform. Listen only? That’s only half of the SDR story.
Last weekend, [marble] got started fixing that, and released an early early version of ESP32 firmware that can also transmit, and got it working with gqrx. The demo communicates between an S3 and a C6 using a Hellschreiber mode, something that’s certainly out of the WiFi spec. And it didn’t stop there, either. [marble] is working on 802.15.4 modulation at the moment, which means that maybe soon your ESP32 will speak ZigBee.
https://github.com/cyber-murmel/esp-sdr-zephyr
Tomi Engdahl says:
https://hackaday.com/2026/10/15/a-thermal-camera-that-uses-webusb/
Tomi Engdahl says:
Using An ESP32-C3’s RF Hardware For DVB-S2 Video Transmission
https://hackaday.com/2026/10/14/using-an-esp32-c3s-rf-hardware-for-dvb-s2-video-transmission/
Generally the DVB-S and -S2 standards require a satellite somewhere in Earth orbit to provide a signal to receive, but you can also transmit your own DVB-S2 stream with any RF transmitter if you’re so inclined. Courtesy of recent breakthroughs in using the RF hardware of the ESP32 on a raw level, [SP8ESA] has created the ESP32-DATV project using which you can broadcast a DVB-S2 signal using an ESP32-C3.
While a host PC side application handles the heavy lifting of turning the input video signal into a DVB-S(2) compliant signal, it is the ESP32-C3 that prepares the samples for transmission before sending them off to its RF block, with no external hardware needed.
If this brings to mind the idea of using an off-the-shelf DVB-S2 receiver to play back the signal, the frequency range for DVB-S2 is 10.7 – 12.7 GHz, while the ESP32-C3 is limited to roughly 2.4 GHz courtesy of it targeting only 2.4 GHz Wi-Fi and Bluetooth signals.
https://github.com/SP8ESA/ESP32-DATV
Tomi Engdahl says:
https://hackaday.com/2026/10/15/so-you-want-to-make-your-sdr-work-on-other-frequencies/
Perhaps the most exciting news of the past few weeks in the world of hardware hacking has been the unlocking of hidden SDR functionality in the Wi-Fi radios found on Espressif ESP32 microcontrollers. They can be used as both transmit and receive SDRs, and given that it’s early days for this hack we expect that great things are yet to come.
There’s one snag though, despite speculation that they might be dragged down to much lower frequencies, as far as we know they’re only proven to work around the Wi-Fi frequencies. Though the reality may be wider we’ll take that for a 2.4 GHz part as a 100 MHz slice from 2.4 GHz to 2.5 GHz. Plenty of possibilities there, and they might even work down to 1.8 GHz, but there would be so much more to do if it could work elsewhere in the spectrum. So it’s time to look at the converter, a tried and tested old way to make a radio work on a different frequency.
The ESP32, An SDR In Itself
https://hackaday.com/2026/10/03/the-esp32-an-sdr-in-itself/
Tomi Engdahl says:
Another Wireless Chip Has A Hidden SDR Revealed
https://hackaday.com/2026/10/15/another-wireless-chip-has-a-hidden-sdr-revealed/
The news of the past couple of weeks has seen the ESP32 turned into an software-defined radio (SDR) thanks to a hidden baseband mode, an exciting development by anyone’s standards. It seems unexpected SDRs are like busses in that you wait for ages and two turn up at once, because hot on the heels of the ESP32 story is [Samson1te], revealing the SDR functionality hidden within the LR2021 LoRa chip. This one is especially interesting because as well as a 2.4 GHz radio, the chip sports a radio that works from 150 to 960 MHz.
https://github.com/SAMS0N1TE/lr2021-sdr
LR2021-SDR
A LoRa chip that tunes from 100 MHz to 2.74 GHz and streams 16-bit I/Q.
P25 voice, pagers, FM, Bluetooth LE and custom transmit from the Semtech LR2021 on a handheld, with no SDR dongle.
Tomi Engdahl says:
Building a Real-World SDR
Bridge the gap between SDR experiments and real wireless prototypes, enabling new PHY algorithms to be tested in a working RF system.
https://hackaday.io/project/205674-building-a-real-world-sdr
Tomi Engdahl says:
Turning A Wi-Fi Adapter Into An SDR
https://hackaday.com/2026/10/18/turning-a-wi-fi-adapter-into-an-sdr/
Since the discovery of an undocumented I/Q sampling feature in ESP32 chips about two weeks ago, there’s been a flood of similar features being found in other wireless chips, including LoRa and Wi-Fi chipsets. The latest chip to join their ranks is the MediaTek MT7921AU, often used in Wi-Fi adapters, with two different projects developing independent SDR drivers for it in the last few days.
The first was BirriaSDR, which discovered that the chip exposes raw I/Q samples for debugging and calibration; BirriaSDR instead streams these to the host at 40 Msps in 14-bit resolution, with the option to tune from 2156 to 2610 MHz. BirriaSDR uses libusb to directly communicate with the Wi-Fi adapter and access its registers; it doesn’t make any permanent firmware changes, so the Wi-Fi adapter goes back to its original state after being used as an SDR. BirriaSDR implements an API similar to the RTL-SDR’s.
Mtk79ICAP, by contrast, exposes the MT7921AU’s sampling features over a standard SoapySDR interface. Unlike BirriaSDR, it applies some firmware changes to the chip, and it requires a modified driver to work.
https://github.com/luigifcruz/birriaSDR
BirriaSDR
Turn a supported USB Wi-Fi dongle into an experimental SDR receiver with 14-bit I/Q at 40 MSps complex.
BirriaSDR ships as libbirriasdr, a C11 library with an API modeled on librtlsdr, together with a command-line recorder. It talks to the device from userspace through libusb and includes the source of its own small device program. Start with Build and try, or jump to the API to add the receiver to an application. To see it working without building anything, try the rough proof of concept.
Important
This is experimental software. The tested board starts from a channel 6 initialization profile, and the library can tune anywhere from 2156 to 2610 MHz. Sensitivity across that range, frequency accuracy and gain are not calibrated. Use at your own risk.
Tomi Engdahl says:
Discovering SDRs Everywhere
https://hackaday.com/2026/10/17/discovering-sdrs-everywhere/
To quote commenter [douyarou], “It’s like our little version of a Precambrian explosion”. A bunch of hackers have discovered, independently and building on each other’s work, software-defined radio (SDR) capabilities in more places than you can shake a stick at.
It all started with [Espargos] and [h0m3us3r] apparently independently discovering that the ESP32 family of chips had a “secret” debug mode that allowed direct access to the radio that’s normally used for WiFi. While the 2.4 GHz radio signal is almost always immediately converted into data by the MAC hardware, here they found a way to listen in upstream, to the raw IQ data.
Tomi Engdahl says:
https://hackaday.com/2026/10/19/meshtastic-sniffer-for-dragonos/
Tomi Engdahl says:
5 GHz Drone Video, With An ESP32
https://hackaday.com/2026/10/20/5-ghz-drone-video-with-an-esp32/
With the ESP32 series of microcontrollers having had hidden software-defined radio (SDR) facility revealed, we’re now moving on from the announcement into projects making use of the finding. [Twotoz] has one using an ESP32-C5, to receive and demodulate analog FM video.
You might think that video is something which has largely gone away in 2026, with TV transmissions having made the switch more than a decade ago, and home entertainment appliances having used HDMI for longer. But it’s still very popular in the world of drones however, where it exists as 5 GHz FM transmission.
Analog 5.8 GHz FPV receiver on one Seeed Studio XIAO ESP32-C5 with a passive 6-bit resistor DAC: live FM video in, composite PAL/NTSC out for goggles.
https://github.com/Twotoz/C5VRX
C5VRX-5 uses one live demodulator.
U85Q demodulator in the TX BitScrambler: an untrained 32-phase tracker that keeps the picture locked across VTX deviations, off-centre carriers and multipath instead of dropping out. Board-validated on real video.
Fixed ultrafine IQ (ADC bits 9,6,5,4) at 40 MS/s, no CPU in the sample path.
Tomi Engdahl says:
Receive Analog Video Radio Signals From Scratch
https://hackaday.com/2020/05/31/receive-analog-video-radio-signals-from-scratch/
If you’ve been on the RTL-SDR forums lately you may have seen that a lot of work has been going into the DragonOS software. This is a software-defined radio group that has seen a lot of effort put into a purpose-built Debian-based Linux distribution that can do a lot of SDR out of the box. The latest and most exciting project coming from them involves a method for using the software to receive and demodulate analog video.
Decoding 5GHz NTSC Video from Drones with a HackRF, DragonOS and SigDigger
https://www.rtl-sdr.com/decoding-5ghz-ntsc-video-from-drones-with-a-hackrf-dragonos-and-sigdigger/
Tomi Engdahl says:
https://hackaday.com/2026/10/18/turning-a-wi-fi-adapter-into-an-sdr/