Software-defined radio (SDR) technology can be used for many interesting technical experiments. With listening only SDR you can do many interesting things, but having a SDR that can also transmit opens many new doors. Here are some interesting videos related to SDR and cyber security:
Universal Radio Hacker – Replay Attack With HackRF
Download here: https://github.com/jopohl/urh
Radio Hacking: Cars, Hardware, and more! – Samy Kamkar – AppSec California 2016
Hacking Car Key Fobs with SDR
Getting Started With The HackRF, Hak5 1707
Hacking Ford Key Fobs Pt. 1 – SDR Attacks with @TB69RR – Hak5 2523
Hacking Ford Key Fobs Pt. 2 – SDR Attacks with @TB69RR – Hak5 2524
Hacking Ford Key Fobs Pt. 3 – SDR Attacks with @TB69RR – Hak5 2525
Hacking Restaurant Pagers with HackRF
Software Defined Spectrum Analyser – Hack RF
Locating Cellular Signal with HackRF Spectrum Analyzer SDR Software
GSM Sniffing: Voice Decryption 101 – Software Defined Radio Series #11
How To Listen To Trunked Police Radio And Why Im Done
Transmitting NTSC/ATSC Video With the HackRF One and Gnuradio
Check also Using a HackRF SDR to Sniff RF Emissions from a Cryptocurrency Hardware Wallet and Obtain the PIN article.
417 Comments
Tomi Engdahl says:
This guy created an analog 1G AMPS cell network and it works with his vintage Motorola!
https://www.reddit.com/r/vintagecomputing/comments/zlqqh1/this_guy_created_an_analog_1g_amps_cell_network/
Tomi Engdahl says:
https://hackaday.com/2021/06/02/how-to-run-a-first-generation-cell-phone-network/
Tomi Engdahl says:
https://philtel.org/2023/05/11/reviving-amps-phones.html
Tomi Engdahl says:
https://www.rtl-sdr.com/running-a-1g-mobile-phone-network-with-a-hackrf/
Tomi Engdahl says:
https://www.oreateai.com/blog/unpacking-the-1g-cellular-system-the-analog-dawn-of-mobile-communication/5f9f7b590d1f53b07b377d2ccf6f3f6a
Tomi Engdahl says:
Lime Microsystems Unveils the LimeSDR Micro, an M.2 Expandable SDR with Vector Accelerator
First FPGA-free LimeSDR is now crowdfunding, with an NXP baseband processor offering the ability to accelerate vector DSP work on-device.
https://www.hackster.io/news/lime-microsystems-unveils-the-limesdr-micro-an-m-2-expandable-sdr-with-vector-accelerator-9c1ef3823d9f
Tomi Engdahl says:
Open-source hardware DAB+ receiver combines ESP32 SoC with Skyworks SI4684 digital radio chip
https://www.cnx-software.com/2026/04/09/open-source-hardware-dab-receiver-combines-esp32-soc-with-skyworks-si4684-chip/
Tomi Engdahl says:
https://oh2ti.fi/2017/06/tetra-lahetteen-tarkastelua/
Tomi Engdahl says:
Running Your Own 3G Network
https://hackaday.com/2026/05/09/running-your-own-3g-network/
CDMA2000 was one of the protocols defined for 3G networks and is now years out of date and being phased out worldwide. Nevertheless, there are still vast numbers of phones that will happily connect to it, creating an opportunity for hackers seeking to run their own cellular networks. [Chrismoos] recently made this endeavour significantly easier by releasing 1xBTS, a Rust implementation of the lower three layers of a CDMA2000 network.
The lowest layer of the stack is an SDR for the actual radio communications. It’s been tested with the USRP B200 and B210, the LimeSDR Mini 2, and the BladeRF Micro 2.0. The code might work with certain other SDRs using the SoapySDR abstraction layer. The SDR is controlled by the base station (BTS) software, which, in turn, is controlled by the base station controller (BSC) over an Abis link. The BSC manages channels and mobile device associations, and exchanges frames with the mobile switching center (MSC), which handles message switching.
The stack includes standard 3G verification; before a handset can authenticate to the network, its details must be added to the home location register (HLR). Once authenticated, the handset can access all standard services: inbound and outbound voice calls via a SIP gateway, inbound and outbound SMS, and data packet transfers. A web dashboard provides a convenient management platform that includes packet tracing.
Tomi Engdahl says:
CDMA2000 1x from RF to core.
A full cellular stack in Rust — SDR air interface, BTS/BSC split, MSC, SMSC, HLR, packet data, and a dashboard.
Get Started
https://1xbts.org/
The air interface is built on CDMA2000 Spread Rate 1, driven by a software-defined radio. Phones connect over a real 1.25 MHz channel — pilot, sync, paging, and traffic channels — using Walsh code spreading and Viterbi decoding. Closed-loop power control runs at 800 Hz to keep signal quality stable as the phone moves.
Tomi Engdahl says:
GSM Phone Network At EMF Camp Built On Raspberry Pi And LimeSDR
https://hackaday.com/2018/08/30/gsm-phone-network-at-emf-camp-built-on-raspberry-pi-and-limesdr/
Tomi Engdahl says:
How To Run A First-Generation Cell Phone Network
https://hackaday.com/2021/06/02/how-to-run-a-first-generation-cell-phone-network/
Tomi Engdahl says:
Building Your Own 4G LTE Base Station
https://hackaday.com/2024/03/03/building-your-own-4g-lte-base-station/
Tomi Engdahl says:
Running Your Own 3G Network
https://hackaday.com/2026/05/09/running-your-own-3g-network/
Tomi Engdahl says:
Astronomers still don’t know exactly what dark matter is, but they sure can detect it—and now so can you. Using a DIY pyramidal horn, an RTL-SDR, and some Excel curve fitting on hydrogen-line spectra, it’s possible to reproduce the flat rotation curve of the Milky Way and see dark matter’s influence without ever leaving Earth. https://spectrum.ieee.org/dark-matter
Tomi Engdahl says:
Get Your Monitor Transmitting VHF With A Browser Tool
https://hackaday.com/2026/08/30/get-your-monitor-transmitting-vhf-with-a-browser-tool/
If you’re intending to transmit on the VHF band, you’re probably going to reach for a handheld or some kind of rackmount rig in your ham shack. But you needn’t bother with all that complexity, when you can use the computer on your desk to spit out such signals using a simple browser tool from [Efe].
The concept is straightforward—[Efe]’s tool manipulates pixel clocks in order to create spurious transmissions from your computer’s graphics hardware. The math pencils out pretty easily—multiply the horizontal resolution by the vertical resolution by the refresh rate, while paying attention to the precise timing of the video standard your monitor is using, and you’ve got your transmission frequency. For example, for a screen displaying 1080p at 60 Hz, with the CEA-861 timing standard, your horizontal and vertical resolutions are 2200 and 1125 respectively when paying attention to the requisite blanking intervals. Multiply those by 60 hz, and you’ll find you’re creating a signal at 148.500 MHz. Leverage this by displaying the right pattern of black and white pixels to maximise changes in voltage state on the HDMI or DisplayPort lines, and you might create a strong enough signal that you can actually pick something up. [Efe] created a tool to display these patterns to send simple Morse code messages over VHF just by flickering your screen just right.
https://waiixd.github.io/vhf-morse-transmitter-monitor/
https://github.com/WaiiXD/vhf-morse-transmitter-monitor
Tomi Engdahl says:
Single wire transmission line
https://youtu.be/it5UMt0lL8I?is=YjDDiWr-rpd6Ew9k