LakeShark Update: Using an LR2021 LoRa Chip as an SDR for Portable P25, POCSAG and FM Reception on the ESP32-P4

Back in September, we posted about LakeShark, Samuel Reynolds’ (aka SAMS0N1TE) T-Display P4 ESP32-P4 firmware that turns a USB-connected RTL-SDR into a handheld P25 Phase 1, POCSAG, and FM receiver.

Samuel has now written in to share news that with the T-Display P4 variant containing a Semtech LR2021 LoRa chip, LakeShark no longer needs an RTL-SDR at all. Instead, it can pull raw I/Q samples directly out of the built-in LR2021 LoRa transceiver chip and demodulate them on the ESP32-P4. Back in May, we posted Zoltán Papp and team's discovery that showed how an LR2021 could receive ADS-B. But this relied on the chip’s built-in OOK mode.

With raw I/Q available, the chip’s built-in modes no longer limit what it can receive. Both of the LR2021’s RF paths work, providing continuous coverage from 100 MHz to 2.74 GHz, and no upconverters, external tuners, or extra front-end hardware are used. The sample rate is relatively low at 250 Ksps max, meaning only a narrow bandwidth slice is available, but this is more than large enough for narrowband channels like P25. Samuel notes that it’s pretty unreal being able to listen to his local analog NFM fire department channels from such a low-power chip.

Smanuel notes that the LR2021 is still pretty new, and few products use them. However, it is possible to DIY a receiver for about $28 with Waveshare’s Core2021 LR2021 modules and their ESP32-P4-WIFI6 board. Samuel also has an experimental transmit path working, which has sent custom waveforms, temperature packets and P25 test-tone bursts. In one test, an independent receiver decoded 72 P25 voice frames from a single transmission and recovered the expected tone.

The radio access layer has been released as a separate project called LR2021-SDR. It includes a portable C library, capture firmware, waveform tools and measurements, along with graphs from a real received P25 call and a recording of the recovered transmit tone. The updated handheld firmware is available on the LakeShark GitHub.

LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).
LakeShark Running on A LilyGO T-Display-P4 next to a HackRF (left) and Flipper Zero (right).

Demod Updates: Adds Support for OpenWebRX, FT8 Decoding, CarPlay and an Android Version

Back in July, we posted about Demod, an iOS and iPadOS SDR receiver app that works as a client for rtl_tcp, SpyServer, and KiwiSDR. The developer, Alphonse, recently wrote in again to share updates. Alphonse writes:

Since the launch, Demod has added:

  • OpenWebRX support on top of KiwiSDR, SpyServer and rtl_tcp. Public receivers are browsable on a built-in map, so it can be tried without any hardware.
  • FT8, CW and RTTY decoding on the phone.
  • Identify. Tap an unknown signal and it measures it, checks the shortwave broadcast schedules against the receiver's location and the time, and names the likely station and how far away it is.
  • Live on-device transcription and translation of what you're listening to.
  • CarPlay, and a "car radio" Seek that jumps to the next real signal for the current mode and stops there (the next AM station, SSB voice or CW signal). It also works from headphones and the steering wheel. 
  • A band scanner, recording and 15-second rewind of live radio, and Siri ("Tune Demod", "Ask Demod what this signal is").
  • A three-pane iPad layout, a mains-hum filter, an auto-contrast waterfall and squelch that works on every source.

Android: Demod is now on Google Play, with the same receiver support and decoders. Android Auto support coming soon.

Alphonse has also decided to share with the community 15 free codes for each platform that let you download the app for free. These codes are first come, first served, so if a code no longer works, it will have already been claimed.

iOS (iPhone/iPad) — redeem in the App Store app: tap your profile photo → Redeem Gift Card or Code. Or tap the link directly: https://apps.apple.com/redeem?ctx=offercodes&id=6782193839&code=CODE1
KTKAWEXFT36F,
LWPN4RNLTFMK, HMJKF39KLPN9, FM7JEHP7H7XA, 3F9PALW93KYM, MJ7TH3E9E3W9 ,P7P3NJR66XKT, K7WKYKNNRPMY, 94WLYNRLKNFR, 4XE7WAYHX4PN, 3KLPHAE9TTHX, MY64T9JWW3HA ,TXWWHNPMNYAX, LPJALTHR966K, EMRLANKKF7L6

Android — redeem in the Play Store app: profile icon → Payments & subscriptions → Redeem code. Or tap the link: https://play.google.com/redeem?code=CODE1
3SD4H680XKNUGNP9V6SXT8U,
68XKMWQEGUXLW2T6W41XEUR, 2N8E2KY22V9L49D92NQ86DX, VHG4UJPUJ6DGRVZGYGA331Z, 3N48JPPJ8F5RUA9S2E55C2N, 7N4BMSA3X1J893QQGC9H6ZM, VVQBLBGFBJED9GU7Y3UZQZK, NTC82UE8KT1RMSFF9GW1LVA, LBLKS33KUG3PQML1KYVK2P2, 9THCT76YXV61HAFK9ZY22J7, CMF62T6LA46V6PVCUZ4BYZG, S895G4U1E5FZ3QZA255FPU1, QQR944S4BUCA1XKCEBAJPPU, PDYWFXGWUJBV9C9UACTJ065, EXZRMG3RB3XJUEB42Z6KTZH

Demod iOS and Android Client for WebSDRs
Demod iOS and Android Client for WebSDRs

FoxSDR Adds Airports & Navaids Plugin

Thank you to Steven, the developer of FoxSDR, for writing in and sharing that he has added a new plugin called "Airports & Navaids", which improves the airband listening experience. Steven writes:

  • Type an airport, hear its tower. Enter a code such as EGLL, KORD, LHR or ORD and press LISTEN. FoxSDR loads that airport’s tower, ground, clearance, approach and departure frequencies from a built-in table, so the lookup needs no internet connection. “Nearest airports” lists the six closest to you.
  • Every channel at once. Each ticked frequency plays at the same time with its own squelch. Every channel is levelled, so a tower 5 km away and an aircraft 80 km away come out at the same loudness.
  • Scans when it has to. If the airport spans more than your radio can hear in one go, FoxSDR scans between blocks and stops where the talking is.
  • Your own frequencies, AM and NFM. Add channels by hand, so marine, business and public-service channels can play in the same mix at a matching level.
  • Presets. Build lists by hand or import a CSV or an SDR# frequencies.xml, and export them again as CSV.
  • A spectrum that shows who’s talking. Each monitored channel is shaded at its own frequency and brightens while someone is transmitting.
  • Busiest first. FoxSDR records how long each frequency has been heard at your aerial, so after an evening you know which ones are worth ticking.

It’s available in FoxSDR 0.99.66 and later on Windows and Linux, under VIEW › Airband. You can download it at https://foxsdr.com.

FoxSDR Illustration of the Plugin
FoxSDR Illustration of the Plugin

AI Disclaimer: The creator of FoxSDR refers to his company as a frontier AI human-gated software company.

OnAir Adds Decoder Support for Almost Every Signal

Just last week we posted about OnAir, a new open-source program that started out as an easy-to-use digital and analog TV decoder for software-defined radios. It also had support for a few digital modes like ADS-B, GNSS and DMR.

In the last week, with the obvious help of Claude AI, OnAir has added experimental support for almost every single analog and digital signal and application out there. Support ranges from digital voice modes like P25 and NXDN, to HF digital modes like HFDL, to aircraft signals like ACARS and VOR/ILS, to ocean radar, to a radio astronomy integrator, to satellite decoders like Iridium and Inmarsat, to cell tower metadata decoders to Wi-Fi and many many more.

Obviously, with these decoders all being vibecoded so quickly, there is no guarantee yet that they will all work as expected. However, we did give some decoders in the program a test with an RTL-SDR. A DMR control channel was successfully decoded, and it read the calls; ADS-B showed aircraft; LTE PCI values were detected with the LTE decoder; and POCSAG messages came in cleanly.

From our own experience with Claude, Opus 5.5 is very capable of vibe-coding decoders, so there is a high chance that most, if not all, of the decoders implemented in this software will work. 

OnAir Updated to Add Almost Every Decoder Possible
OnAir Updated to Add Almost Every Decoder Possible

AI Disclaimer: This software was coded with Claude AI.

SDR– Updated to V2.2: Many New Decoders, Tools and KrakenSDR Direction Finding and Beamforming Support Added

Last month we posted about the release of SDR-- (SDR minus minus), an open-source app that lets you visually wire together a receiver on a canvas. Since that time, Julian, the developer of SDR--, has been busy adding support for many decoders, various tools, and improving performance. Julian has also added KrakenSDR support, with radio direction-finding and beamforming blocks. Julian shares the following update for SDR-- V2.20:

New Decoders

  • Aviation and satellite: VDL2, HFDL, Inmarsat Aero and STD-C, Iridium, Drone Remote ID, 406 MHz beacons
  • Voice: TETRA, Tetrapol, GSM downlink, DECT, D-STAR, FreeDV, NXDN, dPMR
  • Data: LoRa (LoRaWAN, Meshtastic, MeshCore), ISM sensors, End-of-Train, DSC, BLE, Wi-Fi survey
  • Weather: NOAA APT, Meteor LRPT, WEFAX, radiosondes with landing forecast
  • Broadcast: DVB-T/T2, DVB-S2X, DAB packet mode, DRM with xHE-AAC

Coherent and mobile

  • Direction finding, beamforming and passive radar on the KrakenSDR
  • An iOS app with CarPlay for DF while driving is in TestFlight. Android is coming soon.

Hardware

  • Native Support: KrakenSDR, RTL-SDR Blog V4 Lite, AntSDR, PlutoSDR, SDRplay, Airspy, bladeRF and ESP-SDR
  • NanoVNA and antenna rotators
  • rtl_tcp and ADS-B Beast output for other apps

Tools

  • A satellite node with Doppler correction, plus a map with footprints and tracks
  • A spectrum monitor that classifies signals automatically, and a scanner with priorities and lockouts
  • Antenna calculator, noise figure, PER tester, SID monitor
  • Audio denoise, call recording, and a decoder log grouped by station
  • Event outputs: CSV, desktop notifications, PostgreSQL, InfluxDB

App

  • A redesigned UI with a unified look for every node
  • Multi-user editing, remote access from a browser, built-in HTTPS
  • An MCP server, so an AI assistant can build and tune a canvas

Performance

All measured on an M4 Max, full results at https://sdrmm.com/benchmarks:

  • DSP against GNU Radio:
  • FIR is 3.5x faster
  • NCO is 3x faster
  • FM demod is 4x faster
  • DDC is 1.6x faster
  • A 4096-point FFT is 1.6x faster than FFTW
  • Decoding rate in noise (48 trials per decoder across an SNR range):
  • ADS-B: 68%, against 56% for readsb and 50% for dump1090-fa
  • POCSAG: 73%, against 50% for multimon-ng
  • DMR: 81%, against 60% for dsd-fme
  • NXDN: 67%, against 23% for dsd-fme

(feel free to verify yourself with cargo xtask compare dsp)

The speed comes from hand-written SIMD kernels (NEON, AVX2, AVX-512), one shared downconversion for all channels on a radio, and a DSP path that never locks or allocates. The noise gains come from decoding IQ directly with
coherent receivers and soft decisions.

SDR-- Screenshot
SDR-- Screenshot

AI Disclaimer: This software is likely to be AI-assisted or vibe-coded.

BirriaSDR: 2.4 / 5 GHz SDR Discovery on a Mass-Produced USB3.0 Wi-Fi Dongle

With AI-in-the-loop reverse engineering, things are heating up, and we're starting to see a gold rush of reverse-engineered Wi-Fi radios turning into software-defined radios. Just yesterday, we posted about h0m3us3r's discovery of how a Gemtek W1700K Wi-Fi 7 router could be turned into a 320 Msps SDR. And the week before, we posted about the ESP32-SDR discovery.

Today, a new Wi-Fi dongle-turned-SDR has been discovered, and this time it is probably the most accessible one. Over on X @luigifcruz, author of the popular CyberEther tool, has announced that he has reverse engineered a commodity US$30 USB 3.0 Wi-Fi dongle with the help of GPT-6 Astra, and discovered a RAW I/Q stream which can be exported over USB3.0. This effectively turns the Wi-Fi dongle into a 2.4 GHz / 5 GHz SDR, capable of exporting 40 Msps at 14-bit ADC resolution. Luigi named the new SDR 'BirriaSDR' after the Birria Taco he was eating at a restaurant while using AI to reverse-engineer the WiFi dongle. The open-source repo is available on GitHub.

This is probably the most accessible of the newly discovered Wi-Fi SDRs because it is cheap, mass-produced, readily available, and has useful export bandwidth. The ESP32-SDR suffers from a lack of usable export bandwidth, meaning that getting usable amounts of IQ data onto a PC is impossible without hacking in an FPGA. The Gemtek W1700K Wi-Fi 7 router has an incredible 320Msps IQ bandwidth and an effective export via Ethernet, but it is expensive and not really available for purchase anywhere anymore. 

BirriaSDR supported dongles are any Wi-Fi dongle using the MT7921 chip. These are available in USB dongle format on Amazon, currently for US$26.99. There are also various MT7921 based M.2 and PCIe cards available for anywhere between US$16 and US$34. Many laptops may already have these Wi-Fi cards pre-installed.

Luigi has added support for the BirriaSDR in his CyberEther software through an input block and sample flowgraph.

It remains to be seen how popular these dongles will become, and if they'll become a new type of RTL-SDR like device. If there is a sudden influx of purchasers, sellers may put the pricing up. We also note that Wi-Fi dongles are limited to the 2.4/5 GHz bands, where there aren't that many interesting signals to play with. However, as Luigi suggests, modifying the dongle to add a front-end mixer is a possibility. The HackRF already uses a 2.4 GHz IF architecture, so a similar type of front end could be used.

BirrariaSDR Running in CyberEther
BirrariaSDR Running in CyberEther

Turning a Wi-Fi 7 Router into a 320 Msps SDR

Just last week we posted about ESP32-SDR, which is custom firmware for ESP32's indpendently discovered by two experimenters that transforms them into a full software defined radio.

Now, h0m3us3r, one of the discoverers of the ESP32-SDR hack, has discovered a way to turn a Gemtek W1700K Wi-Fi 7 router, which uses a MediaTek MT7996 chip, into a wideband software-defined receiver. Compared to the ESP32's maximum 80 Msps sample rate, this newly discovered Wi-Fi chip captures a massive 320 MSps. And most importantly, unlike the ESP32, the router has a built-in 10 GbE Ethernet SoC, which lets you stream full-bandwidth data out and ingest it on a PC.

As a result, you can capture the entire 2.4 GHz band and a wide portion of the 5 GHz band live and stream the spectrum to a Linux host running a live spectrum and waterfall display.  

Other devices that run the MediaTek MT7996 Wi-Fi chip include the Banana Pi BPI-R4, GL.iNet Flint 4, and Gemtek XR1710G, however it is unclear if this firmware will run on those devices.

The entire 2.4 GHz Wi-Fi Spectrum at the max 320 Msps sample rate.
The entire 2.4 GHz Wi-Fi Spectrum at the max 320 Msps sample rate.

AI Disclaimer: Claude is listed as a contributor to the repo.

SDR Signal Analyzer: A Windows Spectrum Analyzer for HackRF, RTL-SDR and tinySA

Thank you to RTL-SDR.COM reader Sunny for writing in and submitting a program he's found called 'SDR Signal Analyzer'. This spectrum analysis program lets you use a HackRF, RTL-SDR, or tinySA to scan the entire spectrum between 1 MHz and 6 GHz. Like other spectrum analysis software that offes wideband sweeps, it does this by rapidly returning across the live spectrum, stitching together a wideband picture of the spectrum.

The software also offers IQ demodulation of the common modulation schemes, as well as CTCSS decoding and video decoding from FPV and PAL analog video systems. 

The software is free; however, a pro version exists that supports the BladeRF, PlutoSDR, and FobosSDR, and adds markers, OBW, ACPR, calibration in dBm, a scanner mode, a table, neural network signal classification, and other features. The pricing of the Pro version is only available on request.

The program appears to be open source under LGPL-3.0; however, the website notes that you will need to contact them for the source code.

SDR-SA Screenshot
SDR-SA Screenshot

AI Disclaimer: While the authors do not disclose it, it is our opinion that this software may be coded entirely or with the help of AI.