Automating Indoor RF Heatmapping with a PlutoSDR, Raspberry Pi 5 and LiDAR SLAM

Researchers at Tokyo City University in Japan recently showed in an academic paper how indoor mapping via LiDAR SLAM (simultaneous localization and mapping) and SDR can be combined to generate accurate indoor RF heatmaps. Mapping WiFi reception in indoor spaces can be challenging because accurate indoor localization is often lacking (GPS doesn't work), so it is usually done through manual measurements.

In this system, the researchers used a Raspberry Pi with a LiDAR sensor and Google Cartographer SLAM running on a connected PC to automatically locate and map out the indoor space. At the same time, a PlutoSDR measures the WiFi SNR. The result is a relative SNR WiFi heatmap.

They then derive a 3D model from the collected LiDAR SLAM data and put it into an RF ray-tracing simulation. Finally, they compared their real-world results with the ray-tracing simulation and found the results matched.

Combining LiDAR SLAM + WiFi SNR Measurements for Indoor Signal Strength Mapping
Combining LiDAR SLAM + WiFi SNR Measurements for Indoor Signal Strength Mapping

InjectEave: Eavesdropping on Headphones by Injecting a Carrier and Listening to the Modulated Retransmission

Researchers from the Hong Kong University of Science and Technology (Guangzhou) and the Hong Kong Polytechnic University recently published a paper titled "Injected and Leaked: Actively Inducing Side-Channel Leakage Using Electromagnetic Injection and Hardware Nonlinearity".

The paper describes how an attacker can use a directional antenna to transmit a carrier signal toward an electronic device, where nonlinearities in its components modulate the signal, which connected cables then re-radiate as unintentional antennas. The attacker can then receive the modulated carrier at the same frequency as it is transmitted and demodulate the modulated sidebands.

The Injecteave Process
The Injecteave Process

In their experiments, they used a USRP B210 software-defined radio to transmit the CW injection signal at anywhere from 0 to 8 MHz (the exact frequency for a device is not specified in the paper for ethical considerations), and a spectrum analyzer to receive the injection-induced EM leakage. The spectrum analyzer demodulates the received mixed signal, then routes the baseband to a PC for further processing. They show how various wired and wireless headphones exhibited injection-induced leakage via the amplifier, and how landline desk phones, smart fans, and lamps were also susceptible.

They also show a real-world application where they eavesdropped on audio from headphones and desk phones through walls in a hotel, meeting room, and office. 

InjectEave: Real World Examples
InjectEave: Real World Examples

Bluewatch: Detecting new Bluetooth Devices in your Neighbourhood via a Raspberry Pi

Thank you to p0larpatch for writing in and sharing with us his project called "Bluewatch," which uses a Raspberry Pi to detect when new Bluetooth devices appear in your neighborhood. While Bluewatch doesn't use an SDR and only uses a standalone Raspberry Pi, it may still interest our readers. p0larpatch explains the project below:

Get alerts when new Bluetooth devices appear in your local neighbourhood.

The real strength shows up once you actually start using it: categorize the devices you already know, your own phones, your TV, the smart plugs, the neighbour's robot lawnmower, whatever's expected around you, and BlueWatch filters all of that familiar traffic out of the way.

What's left standing out is the interesting part: the moment an unrecognized device enters the radio range of whatever's running BlueWatch, it surfaces immediately instead of being buried under dozens of devices you've already triaged.

The dashboard stops being a wall of MAC addresses and turns into an actual presence radar for your surroundings. You notice the one device that doesn't belong, not the fifty that do.

Bluewatch Screenshot: Detecting Bluetooth Devices
Bluewatch Screenshot: Detecting Bluetooth Devices

Frugal Radio: A Six SDR Setup with KrakenSDR and SDRplay for ADSB, ACARS, VDL2, P25

Over on YouTube, Rob from the 'Frugal Radio' channel has uploaded a video showing his multi-SDR monitoring setup that consists of a KrakenSDR, SDRplay RSP1A, and a cheap 12-year-old computer. The KrakenSDR is a 5-channel coherent SDR based on RTL-SDRs, and when connected to a computer, it appears as five independent RTL-SDRs that you can use for any purpose.

Rob currently uses three out of the five channels on the KrakenSDR to monitor three aviation digital signals: ADS-B, ACARS, and VDL2. The SDRplay is used on the same PC to monitor a 700 MHz P25 digital voice system. Rob uses the ADSB.im Docker image, which lets users feed multiple flight aggregation services, such as ADSBExchange, FlightRadar24, FlightAware, etc., all on one device. 

In the future, Rob hopes to add Inmarsat L-band reception with the spare channels on the KrakenSDR, which will be received by a Discovery Dish.

6 x SDR, 4 x monitor PC decoding ADSB, ACARS, VDL2, P25

SDR–: A Software-Defined Radio Application with Visual Signal Path

Thank you to Julian for writing in and sharing with us his interesting project called SDR-- (SDR minus minus). SDR-- is an open-source app that lets you wire devices, decoders, and displays together on a desktop window or browser-based canvas. It is described as "a software-defined radio application with a visual signal path. Connect devices, decoders, displays, and recorders on a canvas, then pin the controls you use to a rack."

A separate Rust server, which can sit on the same PC or a remote computer (like a Raspberry Pi), handles the DSP. Julian notes that SDR-- has native RTL-SDR support, and decoders for ADS-B, AIS, POCSAG, FT8, SSTV, and RDS are already implemented, with more in progress. The app also has a built-in signal generator and a repository of IQ recordings that can be used for experimentation and testing the various decoders.

The project releases are available on GitHub releases, and they cover Windows, Linux, and MacOS. 

SDR-- Screenshot
SDR-- Screenshot

AVARE ADS-B Receiver for Android Updated

All the way back in 2014, we posted about Avare ADS-B Receiver, which back then was a simple RTL-SDR ADS-B receiver and map for Android devices. The author of this app, TFL, recently wrote in and shared that the app is now a modern, fully featured ADS-B app, having added many new features such as UAT decoding with aviation weather products and NEXRAD weather radar/lightning strikes shown on the map, aircraft pictures, better SDR support, traffic filters, and audio alerts.

ADSB Receiver lets you collect live air traffic data directly on your Android device using any RTL-SDR (RTL2832U) dongle and an OTG cable. No cloud. No fees. Just raw RF decoded in real time.

  • Dual-band reception — 1090 MHz Extended Squitter (ES) for worldwide traffic, and 978 MHz UAT for US general aviation traffic plus integrated weather products (METAR, TAF, PIREP, SIGMET, AIRMET, WINDS, NOTAM)
  • Live aircraft details — tap any target on the map to pull a live photo alongside aircraft type and registered operator
  • NEXRAD weather imagery — receive official NEXRAD radar images over UAT 978 MHz
  • Network send/receive
    • Forward all received data to any GDL90-capable EFB app (AvareX, ForeFlight, iFlyGPS, DroidEFB, and others)
    • Stream dump1090/dump978 frames to any SDR tool on your network, or ingest from an external source
  • Bias Tee and Gain support — power an external LNA or active antenna, adjust Gain as needed
  • Proximity alerts — configurable range-based traffic warnings with optional callsign filtering; useful for drone pilots monitoring airspace
  • Data logging — save all received data
  • Metric support — instead of imperial values

Webpage: https://hiz.ch/index.php/adsb-receiver-avare-adsb

Play Store Links:

https://play.google.com/store/apps/details?id=bs.Avare.ADSB
https://play.google.com/store/apps/details?id=bs.Avare.ADSB.Pro

AVARE ADS-B Receiver Android App
AVARE ADS-B Receiver Android App

FoxSDR: A From-Scratch Software-Defined Radio Receiver for Windows

Thank you to an anonymous contributor (known only as wonderingStars on GitHub) for writing and sharing their project, 'FoxSDR'. FoxSDR is advertised as a 'software-defined radio receiver written from scratch'. Like most receiver programs, it includes a spectrum and waterfall and various demodulation modes.

Key features include a Windows desktop application and optional browser-based interface, a built-in ADS-B decoder and map, and native support for drivers for the HackRF, Airspy R2/Mini/HF+, RTL-SDR, SDRplay RSPs, Mirics MSi2500, RX888 mk2 and the ALDAMN-Pluto. Being browser-based means that the server can run remotely and be placed close to the antenna to reduce signal losses, and the SDR can be accessed from any networked device. They have also recently added AIS, APRS, SSTV, Morse, RTTY, POCSAG, Inmarsat-C, ACARS, SSTV, NOAA APT, GOES HRIT/LRIT, WEFAX, two-tone paging, EAS/SAME alerts, 406 MHz distress beacons, VOR, ERT utility meters, 433 MHz weather sensors, a satellite pass predictor and map, a band survey engine, and OpenStreetMap map imagery.

The contributor writes that FoxSDR is currently Windows-only; however, they will add full Linux support once the Windows version is completely stable. They note that they are in the final stages of the beta and that, based on telemetry, they have over 100 installs in the last month and a few dozen people using it on any given day. They note that their three-year development plan includes support for all operating systems, including Android.

FoxSDR Interface
FoxSDR Interface

Using a Fruit Fly Brain to Tune an RTL-SDR FM Radio

You may have seen in the news that researchers have recently mapped the brain and nervous system of a fruit fly and digitally simulated it in what they call a 'connectome'. Without additional training, the connectome exhibited fruit fly-like behavior when connected to a virtual body, suggesting that the fruit fly's behavior is encoded in its brain structure.

The fly brain neural network can also be hacked into performing other tasks. Various researchers have already repurposed it for tasks like controlling robots, driving a simulated car, playing virtual games like Beat Saber and Doom, trading crypto, and more. One novel fly brain application related to RTL-SDRs was submitted to us by Nik K (SV1EEX). Nik used the fruit fly connectome to tune an RTL-SDR-based FM radio. Nik writes:

Can the reconstructed nervous system of a fruit fly navigate the FM broadcast band and find a radio station?

I built an open-source experiment to test that question using an RTL-SDR Blog V4 and the published adult male Drosophila melanogaster CNS connectome: 165,122 traced neurons connected by more than 10 million signed neural edges.

The RTL-SDR V4 scans the real 87.5–108 MHz broadcast band and creates a panoramic RF environment. Instead of giving the software a list of stations, I convert that measured spectrum into an egocentric visual scene and present it through the 892 retinotopic optic columns used by the connectome simulation. Activity produced by anatomically identified DNa02 descending neurons moves a virtual receiver left or right along the dial.

The experiment also gives the simulated biomimetic fly a substituted RF “mechanosensory” channel. Spectral shape is mapped to bilateral Johnston’s-organ input, while the 19 kHz stereo pilot and 57 kHz RDS subcarrier stimulate JO-A and JO-B populations. This helps distinguish stations that appear similar in power and occupied bandwidth. These mappings are engineered sensory substitutions; they are not a claim that biological flies can detect radio waves.

In one preliminary run on a panorama recorded with the RTL-SDR Blog V4, the connectome-driven controller started at 97.750 MHz. Without receiving the target frequency directly, it entered the predefined ±100 kHz acquisition region around the hidden 95.200 MHz target after 33 actions and stopped at 95.126973 MHz.

The result is deliberately reported as a single preliminary observation. The repository separates external acquisition from neural DNp09 lock events and includes random, visual-only and direct-peak controllers for controlled comparisons.

I describe the resulting system as a connectome-driven virtual embodied agent operating in an RF-derived sensory environment—effectively, a digital fruit-fly nervous system whose world is the FM spectrum and whose movement consists of tuning a radio.

The complete source code, Windows setup, RTL-SDR V4 compatibility fixes, connectome setup procedure, technical manual, experimental protocol, limitations and acquisition dashboard are available here:

https://github.com/z1000biker/DrosophilarRFsensory

The project builds on the open-source flycoinrh implementation and the published adult male Drosophila CNS connectome.

Fly Brain FM Dial
Fly Brain FM Dial