Just last week we posted about OnAir, a new open-source program that started out as an easy-to-use digital and analog TV decoder for software-defined radios. It also had support for a few digital modes like ADS-B, GNSS and DMR.
In the last week, with the obvious help of Claude AI, OnAir has added experimental support for almost every single analog and digital signal and application out there. Support ranges from digital voice modes like P25 and NXDN, to HF digital modes like HFDL, to aircraft signals like ACARS and VOR/ILS, to ocean radar, to a radio astronomy integrator, to satellite decoders like Iridium and Inmarsat, to cell tower metadata decoders to Wi-Fi and many many more.
Obviously, with these decoders all being vibecoded so quickly, there is no guarantee yet that they will all work as expected. However, we did give some decoders in the program a test with an RTL-SDR. A DMR control channel was successfully decoded, and it read the calls; ADS-B showed aircraft; LTE PCI values were detected with the LTE decoder; and POCSAG messages came in cleanly.
From our own experience with Claude, Opus 5.5 is very capable of vibe-coding decoders, so there is a high chance that most, if not all, of the decoders implemented in this software will work.
OnAir Updated to Add Almost Every Decoder Possible
AI Disclaimer: This software was coded with Claude AI.
Last month we posted about the release of SDR-- (SDR minus minus), an open-source app that lets you visually wire together a receiver on a canvas. Since that time, Julian, the developer of SDR--, has been busy adding support for many decoders, various tools, and improving performance. Julian has also added KrakenSDR support, with radio direction-finding and beamforming blocks. Julian shares the following update for SDR-- V2.20:
New Decoders
Aviation and satellite: VDL2, HFDL, Inmarsat Aero and STD-C, Iridium, Drone Remote ID, 406 MHz beacons
Decoding rate in noise (48 trials per decoder across an SNR range):
ADS-B: 68%, against 56% for readsb and 50% for dump1090-fa
POCSAG: 73%, against 50% for multimon-ng
DMR: 81%, against 60% for dsd-fme
NXDN: 67%, against 23% for dsd-fme
(feel free to verify yourself with cargo xtask compare dsp)
The speed comes from hand-written SIMD kernels (NEON, AVX2, AVX-512), one shared downconversion for all channels on a radio, and a DSP path that never locks or allocates. The noise gains come from decoding IQ directly with coherent receivers and soft decisions.
SDR-- Screenshot
AI Disclaimer: This software is likely to be AI-assisted or vibe-coded.
With AI-in-the-loop reverse engineering, things are heating up, and we're starting to see a gold rush of reverse-engineered Wi-Fi radios turning into software-defined radios. Just yesterday, we posted about h0m3us3r's discovery of how a Gemtek W1700K Wi-Fi 7 router could be turned into a 320 Msps SDR. And the week before, we posted about the ESP32-SDR discovery.
Today, a new Wi-Fi dongle-turned-SDR has been discovered, and this time it is probably the most accessible one. Over on X @luigifcruz, author of the popular CyberEther tool, has announced that he has reverse engineered a commodity US$30 USB 3.0 Wi-Fi dongle with the help of GPT-6 Astra, and discovered a RAW I/Q stream which can be exported over USB3.0. This effectively turns the Wi-Fi dongle into a 2.4 GHz / 5 GHz SDR, capable of exporting 40 Msps at 14-bit ADC resolution. Luigi named the new SDR 'BirriaSDR' after the Birria Taco he was eating at a restaurant while using AI to reverse-engineer the WiFi dongle. The open-source repo is available on GitHub.
This is probably the most accessible of the newly discovered Wi-Fi SDRs because it is cheap, mass-produced, readily available, and has useful export bandwidth. The ESP32-SDR suffers from a lack of usable export bandwidth, meaning that getting usable amounts of IQ data onto a PC is impossible without hacking in an FPGA. The Gemtek W1700K Wi-Fi 7 router has an incredible 320Msps IQ bandwidth and an effective export via Ethernet, but it is expensive and not really available for purchase anywhere anymore.
Luigi has added support for the BirriaSDR in his CyberEther software through an input block and sample flowgraph.
It remains to be seen how popular these dongles will become, and if they'll become a new type of RTL-SDR like device. If there is a sudden influx of purchasers, sellers may put the pricing up. We also note that Wi-Fi dongles are limited to the 2.4/5 GHz bands, where there aren't that many interesting signals to play with. However, as Luigi suggests, modifying the dongle to add a front-end mixer is a possibility. The HackRF already uses a 2.4 GHz IF architecture, so a similar type of front end could be used.
Just last week we posted about ESP32-SDR, which is custom firmware for ESP32's indpendently discovered by two experimenters that transforms them into a full software defined radio.
Now, h0m3us3r, one of the discoverers of the ESP32-SDR hack, has discovered a way to turn a Gemtek W1700K Wi-Fi 7 router, which uses a MediaTek MT7996 chip, into a wideband software-defined receiver. Compared to the ESP32's maximum 80 Msps sample rate, this newly discovered Wi-Fi chip captures a massive 320 MSps. And most importantly, unlike the ESP32, the router has a built-in 10 GbE Ethernet SoC, which lets you stream full-bandwidth data out and ingest it on a PC.
As a result, you can capture the entire 2.4 GHz band and a wide portion of the 5 GHz band live and stream the spectrum to a Linux host running a live spectrum and waterfall display.
Other devices that run the MediaTek MT7996 Wi-Fi chip include the Banana Pi BPI-R4, GL.iNet Flint 4, and Gemtek XR1710G, however it is unclear if this firmware will run on those devices.
The entire 2.4 GHz Wi-Fi Spectrum at the max 320 Msps sample rate.
AI Disclaimer: Claude is listed as a contributor to the repo.
Thank you to RTL-SDR.COM reader Sunny for writing in and submitting a program he's found called 'SDR Signal Analyzer'. This spectrum analysis program lets you use a HackRF, RTL-SDR, or tinySA to scan the entire spectrum between 1 MHz and 6 GHz. Like other spectrum analysis software that offes wideband sweeps, it does this by rapidly returning across the live spectrum, stitching together a wideband picture of the spectrum.
The software also offers IQ demodulation of the common modulation schemes, as well as CTCSS decoding and video decoding from FPV and PAL analog video systems.
The software is free; however, a pro version exists that supports the BladeRF, PlutoSDR, and FobosSDR, and adds markers, OBW, ACPR, calibration in dBm, a scanner mode, a table, neural network signal classification, and other features. The pricing of the Pro version is only available on request.
The program appears to be open source under LGPL-3.0; however, the website notes that you will need to contact them for the source code.
SDR-SA Screenshot
AI Disclaimer: While the authors do not disclose it, it is our opinion that this software may be coded entirely or with the help of AI.
Thank you, Chris, for writing in and sharing news about the recent launch of FliteGrid's hex claiming scheme. FlightGrid is a crowdsourced drone-tracking network that will pay feeders in an eligible hex grid $50 a month to run a drone-detection sensor. Chris explains:
The US government is building out Unmanned Traffic Management (UTM), which will be the equivalent of air traffic control for drones. This will make it possible to automate things like shipping, emergency response, infrastructure inspections, and more all over the country. To do that, they'll need awareness of every drone in the sky just like they have for every plane today, and FliteGrid is our solution to providing it.
The devices themselves are custom sensors that receive Remote ID transmissions. That's the standard the FAA created for drones to transmit identifying information, which it now requires all drones in America to broadcast. Serial number, location, altitude, operator location, etc. Remote ID can be broadcast on four different protocols, so we've got four receivers in each piece of hardware; two WiFi and two Bluetooth. That data is then uploaded onto the SkySafe platform, which provides a realtime map of every drone in the sky.
The catch to getting paid is that you need to 1) pay a $100 refundable deposit to receive their hardware, and 2) place and run it in a hex grid that offers to pay. The paying hex grids are mostly around US airports and critical infrastructure right now, so you'd need to live in, or have access to a roof in those areas to host the device. Payment is given in USDC, a stablecoin cryptocurrency pegged to the US dollar.
FliteGrid Hexes: Red - Claimed, Green - Available to claim with $50 p/m payout, Purple - Requested by community, Black - Requestable.
FliteGrid/SkySafe is able to pay users because operators of critical infrastructure and large facilities such as airports, universities, energy infrastructure, the US military, DHS, and the DOD will pay for real-time awareness of the airspace above them. SkySafe has been around since 2015, has raised around $50M in funding, and has contracts with many of the previously listed organizations. Chris notes that the service has already been used successfully in operations like busting gangs smuggling drugs into prisons via drones.
The FliteGrid sensor appears to be a computing device with WiFi and Bluetooth radios repurposed to detect Remote ID, with each radio connected to a higher-gain external antenna. Recently, on the blog, we have seen DIY Remote ID detectors made from ESP32s and other commodity Bluetooth hardware.
Since a 2024 mandate, drones over 249 g in the USA must transmit Remote ID signals for tracking and identification purposes, similar to how ADS-B is used for larger aircraft. For ADS-B, flight aggregation services such as FlightAware/FlightRadar24/ADS-B Exchange etc. already exist, with volunteer feeders setting up stations that can cover up to 400km. However, unlike ADS-B, Remote ID is transmitted with single-digit milliwatts of power, compared to a minimum of 70W for ADS-B, so its reception range is limited, making a dense distributed reception network like SkySafe for Remote ID very important. Individual SkySafe hex grids cover just under 1km of area.
FliteGrid cannot detect drones that are not transmitting Remote ID, though Chris mentions that government infrastructure and facilities may use normal radar to detect these. A radar detection that does not correlate with a SkySafe detection would confirm that a drone is a potential threat.
Thank you to Kristijonas for writing in and sharing with us his project, OnAir. OnAir is an easy-to-use digital TV decoder for DVB-T2, DVB-T, ATSC 1.0, ATSC 3.0, ISDB-T, and a digital audio decoder for DAB / DAB+ and FM Radio. It also supports Analog TV modes such as PAL, SECAM, and NTSC, and data modes like ADS-B, GNSS (GPS, GLONASS, BeiDou), and DMR.
It supports various wideband SDRs, including HackRF, PlutoSDR, BladeRF, LimeSDR, USRP, Airspy R2, and SDRplay. RTL-SDRs unfortunately do not have enough bandwidth to decode digital TV channels in SDR mode, but the software still supports RTL-SDRs for narrowband signals.
The software is easy to install, with an installer .exe being available for Windows, a .deb file for Debian Linux, and a .dmg file for macOS.
OnAir Screenshot
AI Disclaimer: This software lists Claude as a contributor.
Thank you to Zoltan Doczi for writing in and sharing with us an article he's written explaining how he managed to speed up the ESP32-SDR's sampling time by 50x. The ESP32 has recently been discovered to have undocumented features that let it be used as an SDR. However, ESP32s have very limited USB bandwidth, so the full 80 MS/s I/Q sample rate cannot be sent to a PC, and hence only the spectrum data can be sent to a browser-based UI in bursts with gaps in between.
Previously, the gap was ~42 ms between bursts. However, Zoltan's investigation managed to yield a 50x speedup. The core idea was to implement a data buffer ring across three SRAM banks, so the dump engine never has to stop.
The result is a gapless spectrum output that can rival spectrum analyzers worth thousands of dollars. Zoltan's article explains how the implementation works and provides multiple characterization measurements made with a Signal Hound VSG60 signal generator.
Zoltan's work on the SRAM buffer bank also enabled a real I/Q output, albeit limited to a maximum bandwidth of 250 ksps, which we are now starting to see in some ESP32-SDR projects.
To receive the 250ksps limited I/Q data stream on a PC with SDR++, Zoltan created sdrpp-esp-sdr-source, an SDR++ source module that lets an ESP32 act as a real SDR. And then by using a moRFeus signal generator as an upconverter with LO set at 2259.1 MHz, a 90.9 MHz broadcast FM station is mixed up to 2350 MHz. Zoltan was then able to receive the broadcast FM signal with the ESP32-SDR in SDR++.
The module can also stream the full 80 MHz spectrum to SDR++, but this is spectrum data only - no I/Q, so nothing can be demodulated.
The ESP32-S3 Wi-Fi radio is now listening to the FM broadcast band!
ESP32 Showing the Full BCFM Band Spectrum (Spectrum Only - No IQ Data, No Demod Possible)
