SDR & RF Hacking
Introduction to Software Defined Radio (SDR), signal analysis, and replay attacks. Learn how to capture, analyze, and replay radio signals using hardware like HackRF and RTL-SDR, and software tools like URH and GQRX.
Warning
SDR Hardware Overview
Choosing the right SDR hardware depends on whether you need receive-only or full transmit capability.
| Device | Freq Range | TX/RX | Bandwidth | Price |
|---|---|---|---|---|
| RTL-SDR v3 | 24 MHz – 1.7 GHz (500 kHz–24 MHz via HF direct sampling) | RX only | 3.2 MHz | ~$30 |
| HackRF One | 1 MHz – 6 GHz | TX + RX | 20 MHz | ~$300 |
| YARD Stick One | 300–928 MHz | TX + RX | N/A (packet) | ~$100 |
| Flipper Zero | 300–928 MHz | TX + RX | N/A (packet) | ~$170 |
| BladeRF 2.0 micro | 47 MHz – 6 GHz | Full duplex | 56 MHz | ~$480 |
Start With RTL-SDR
GQRX Setup & Visualization
GQRX is a GUI SDR receiver that provides real-time FFT spectrum and waterfall display. It's the go-to tool for initial signal discovery and characterization.
# Install GQRX on Kali/Debian
sudo apt install gqrx-sdr
# Start GQRX
gqrx
# CLI alternative: rtl_power for spectrum scanning
# Scan 400–440 MHz range and output CSV heatmap
rtl_power -f 400M:440M:100k -g 50 -i 10 -e 1h scan.csv
# Convert to heatmap image — heatmap.py ships with keenerd/rtl-sdr-misc
# (github.com/keenerd/rtl-sdr-misc/tree/master/heatmap), not with rtl_power
python3 heatmap.py scan.csv scan.png
# Quick signal check: rtl_fm for FM demodulation
rtl_fm -f 433.92M -s 250k -r 48k - | aplay -r 48000 -f S16_LE
# Record raw I/Q samples for offline analysis
rtl_sdr -f 433920000 -s 2048000 -g 40 capture.binSignal Analysis Fundamentals
Signal analysis involves visualizing and interpreting radio signals to understand their properties. The most common visualization tool is the waterfall display, which shows frequency over time, with color intensity representing signal strength.
Key Concepts
- Frequency: The specific radio frequency the signal is operating on (e.g., 433.92 MHz).
- Bandwidth: The range of frequencies the signal occupies.
- Modulation: How data is encoded onto the carrier wave. Common types include:
- ASK (Amplitude Shift Keying): Data is represented by varying the amplitude.
- OOK (On-Off Keying): A simple form of ASK where the carrier is present for '1' and absent for '0'.
- FSK (Frequency Shift Keying): Data is represented by varying the frequency.
Common Frequency Reference
Quick reference for common frequencies encountered during wireless assessments.
| Frequency | Use | Modulation | Notes |
|---|---|---|---|
| 315 MHz | Car key fobs (US), garage doors | OOK/ASK | Fixed or rolling code |
| 433.92 MHz | Key fobs (EU), weather stations, doorbells | OOK/ASK/FSK | ISM band, most common sub-GHz |
| 868 MHz | LoRa, alarm systems (EU), smart meters | FSK/CSS | EU ISM band |
| 915 MHz | LoRa, RFID (US), Zigbee (US) | FSK/CSS | US ISM band |
| 1.575 GHz | GPS L1 (civilian) | BPSK | GPS spoofing target |
Recording a Signal
Use hackrf_transfer to capture a signal to a file.
hackrf_transfer -r capture.bin -f 433920000 -s 2000000Replaying a Signal
Transmit the captured signal back on the same frequency. The -x flag sets TX gain (0–47 dB).
hackrf_transfer -t capture.bin -f 433920000 -s 2000000 -x 47Replay Attacks
A replay attack involves capturing a valid signal (e.g., from a car key fob or garage door remote) and retransmitting it later to trigger the same action. This is effective against simple systems that use fixed codes.
Information
Modern systems use "Rolling Codes" (or Hopping Codes), where the code changes with every button press. If you capture a code and replay it, the receiver will reject it because it expects a new, unique code.
Universal Radio Hacker (URH)
URH is a complete suite for investigating wireless protocols. It handles signal recording, demodulation, protocol analysis, and fuzzing in a single GUI. Far more capable than raw I/Q inspection for structured protocols.
# Install URH (PyPI package "urh"; there is no "universal-radio-hacker" apt package)
pipx install urh
# Launch GUI
urh
# URH Workflow:
# 1. Record → capture signal from SDR device
# 2. Interpretation → auto-detect modulation (ASK/FSK/PSK)
# 3. Analysis → identify protocol structure, preamble, sync word
# 4. Generator → craft custom packets for fuzzing/replay
# 5. Simulator → emulate protocol exchanges
# Raw I/Q capture from the CLI (GUI alternative)
# urh_cli has no "record" subcommand — use -rx with -r (raw) and -file
urh_cli -rx -r -d HackRF -f 433920000 -s 2000000 -file capture.complexURH Protocol Analysis
Flipper Zero
The Flipper Zero is a portable multi-tool for pentesters and geeks in a toy-like body. It supports Sub-GHz, NFC, RFID, Infrared, and more. It significantly simplifies the process of capturing and replaying signals compared to using a laptop with an SDR dongle.
For Sub-GHz attacks, the Flipper Zero can:
- Read and save signals from remotes.
- Emulate saved signals (Replay Attack).
- Analyze frequency usage.
Jamming & Detection
Understanding RF jamming is critical for both attack simulation and defensive assessment. During a physical security audit, testing whether alarm systems fail-open under jamming can reveal serious vulnerabilities.
| Jamming Type | Method | Detection |
|---|---|---|
| Broadband | Continuous noise across wide spectrum | Easy — elevated noise floor visible on spectrum analyzer |
| Narrowband | Targeted CW or modulated signal on specific frequency | Moderate — requires monitoring the specific channel |
| Reactive | Transmits only when target signal detected | Hard — looks like interference, not continuous |
Legal Notice
Verify It Worked
| Check | Expected | Where to look |
|---|---|---|
| SDR recognised and recording | rtl_sdr or hackrf_transfer opens the device and writes a non-empty capture file | The tool output and capture.bin |
| Signal recorded and replayed | hackrf_transfer -r capture.bin ... writes a file and -t capture.bin ... -x 47 transmits it back | The capture and replay commands |
| Spectrum measured | rtl_power -f 400M:440M:100k ... scan.csv produces a CSV you can render with heatmap.py | scan.csv and scan.png |
| Replay outcome understood | Replaying a fixed code triggers the action, while a rolling-code receiver rejects the replayed code | The receiver behaviour |
Practice Labs
Hands-on SDR and RF practice with common tooling.