Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
987 changes: 987 additions & 0 deletions HACKRF_PORTAPACK/DETECTION_GUIDE.md

Large diffs are not rendered by default.

814 changes: 814 additions & 0 deletions HACKRF_PORTAPACK/LEGAL.md

Large diffs are not rendered by default.

1,075 changes: 1,075 additions & 0 deletions HACKRF_PORTAPACK/PERSONAL_RECALL_SETUP.md

Large diffs are not rendered by default.

473 changes: 473 additions & 0 deletions HACKRF_PORTAPACK/QUICK_START.md

Large diffs are not rendered by default.

500 changes: 500 additions & 0 deletions HACKRF_PORTAPACK/README.md

Large diffs are not rendered by default.

57 changes: 57 additions & 0 deletions HACKRF_PORTAPACK/SDCARD/CAPTURES/README_CAPTURES.TXT
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
# CAPTURES Directory
# Store your captured drone signals here

## Purpose
This directory is for storing captured RF signals from YOUR OWN drones only.

## Legal Notice
⚠️ **WARNING: FOR YOUR OWN EQUIPMENT ONLY** ⚠️

It is LEGAL to:
- Capture signals from YOUR OWN drone
- Record YOUR OWN transmitter's control signals
- Analyze YOUR OWN equipment's RF patterns

It is ILLEGAL to:
- Capture and replay signals from drones you don't own
- Record others' control signals with intent to interfere
- Use captured signals to control equipment you don't own

## File Naming Convention
Use descriptive names for your captures:
- `my_drone_rth_2023-12-25.c16` - Return to home signal
- `my_quad_failsafe.c16` - Failsafe trigger
- `my_tx_binding.c16` - Binding sequence
- `range_test_capture.c16` - Range test signals

## Capture Format
HackRF/PortaPack typically saves in these formats:
- `.c16` - Complex 16-bit samples (int16_t I/Q pairs)
- `.c8` - Complex 8-bit samples
- `.wav` - WAV format for audio-band signals

## Capture Settings to Record
When saving a capture, also document:
1. Center frequency
2. Sample rate
3. Gain settings (IF, BB, RF)
4. Bandwidth
5. Date and time
6. Drone model and transmitter type
7. Purpose of capture (RTH, failsafe, etc.)

## Storage Management
- Captures can be large files (MB to GB)
- Use appropriate sample rates for your protocol
- Delete old captures when no longer needed
- Keep your SD card organized

## Next Steps
After capturing signals from YOUR drone:
1. Analyze them using PortaPack's analyzer tools
2. Identify the exact frequencies and timing
3. Create replay files in the REPLAYS directory
4. Test in a safe, controlled environment
5. Document your settings

See PERSONAL_RECALL_SETUP.md for detailed capture procedures.
20 changes: 20 additions & 0 deletions HACKRF_PORTAPACK/SDCARD/FREQMAN/DRONE_SCAN_1G2.TXT
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
# PortaPack Mayhem FREQMAN File
# 1.2 GHz Band - FPV Video Links
# LEGAL USE: Receive-only monitoring (always legal)
# Common 1.2-1.3 GHz analog video transmission frequencies

f=1200000000,m=WFM,bw=6000000,d=1.2G Ch 1
f=1220000000,m=WFM,bw=6000000,d=1.22G Ch 2
f=1240000000,m=WFM,bw=6000000,d=1.24G Ch 3
f=1258000000,m=WFM,bw=6000000,d=1.258G Ch E1
f=1259000000,m=WFM,bw=6000000,d=1.259G Ch E2
f=1260000000,m=WFM,bw=6000000,d=1.26G Ch E3
f=1261000000,m=WFM,bw=6000000,d=1.261G Ch E4
f=1262000000,m=WFM,bw=6000000,d=1.262G Ch E5
f=1263000000,m=WFM,bw=6000000,d=1.263G Ch E6
f=1264000000,m=WFM,bw=6000000,d=1.264G Ch E7
f=1265000000,m=WFM,bw=6000000,d=1.265G Ch E8
f=1266000000,m=WFM,bw=6000000,d=1.266G Ch 4
f=1280000000,m=WFM,bw=6000000,d=1.28G Ch 5
f=1300000000,m=WFM,bw=6000000,d=1.3G Ch 6
f=1320000000,m=WFM,bw=6000000,d=1.32G Ch 7
56 changes: 56 additions & 0 deletions HACKRF_PORTAPACK/SDCARD/FREQMAN/DRONE_SCAN_2G4.TXT
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
# PortaPack Mayhem FREQMAN File
# 2.4 GHz Band - DJI, WiFi, and RC Control
# LEGAL USE: Receive-only monitoring (always legal)
# Common 2.4 GHz drone control and WiFi frequencies

f=2400000000,m=AM,bw=1000000,d=2.4G ISM Lower
f=2401000000,m=AM,bw=1000000,d=2.401G Ch 1
f=2402000000,m=AM,bw=1000000,d=2.402G WiFi BT
f=2403000000,m=AM,bw=1000000,d=2.403G Ch 2
f=2404000000,m=AM,bw=1000000,d=2.404G Ch 3
f=2405000000,m=AM,bw=1000000,d=2.405G Ch 4
f=2406000000,m=AM,bw=1000000,d=2.406G Ch 5
f=2407000000,m=AM,bw=1000000,d=2.407G WiFi Ch1
f=2408000000,m=AM,bw=1000000,d=2.408G Ch 6
f=2410000000,m=AM,bw=1000000,d=2.41G Ch 7
f=2412000000,m=AM,bw=1000000,d=2.412G WiFi Ch1
f=2414000000,m=AM,bw=1000000,d=2.414G Ch 8
f=2416000000,m=AM,bw=1000000,d=2.416G Ch 9
f=2417000000,m=AM,bw=1000000,d=2.417G WiFi Ch2
f=2418000000,m=AM,bw=1000000,d=2.418G Ch 10
f=2420000000,m=AM,bw=1000000,d=2.42G Ch 11
f=2422000000,m=AM,bw=1000000,d=2.422G WiFi Ch3
f=2424000000,m=AM,bw=1000000,d=2.424G Ch 12
f=2426000000,m=AM,bw=1000000,d=2.426G Ch 13
f=2427000000,m=AM,bw=1000000,d=2.427G WiFi Ch4
f=2428000000,m=AM,bw=1000000,d=2.428G Ch 14
f=2430000000,m=AM,bw=1000000,d=2.43G Ch 15
f=2432000000,m=AM,bw=1000000,d=2.432G WiFi Ch5
f=2434000000,m=AM,bw=1000000,d=2.434G Ch 16
f=2436000000,m=AM,bw=1000000,d=2.436G Ch 17
f=2437000000,m=AM,bw=1000000,d=2.437G WiFi Ch6
f=2438000000,m=AM,bw=1000000,d=2.438G Ch 18
f=2440000000,m=AM,bw=1000000,d=2.44G Ch 19
f=2442000000,m=AM,bw=1000000,d=2.442G WiFi Ch7
f=2444000000,m=AM,bw=1000000,d=2.444G Ch 20
f=2446000000,m=AM,bw=1000000,d=2.446G Ch 21
f=2447000000,m=AM,bw=1000000,d=2.447G WiFi Ch8
f=2448000000,m=AM,bw=1000000,d=2.448G Ch 22
f=2450000000,m=AM,bw=1000000,d=2.45G ISM Ctr
f=2452000000,m=AM,bw=1000000,d=2.452G WiFi Ch9
f=2454000000,m=AM,bw=1000000,d=2.454G Ch 23
f=2456000000,m=AM,bw=1000000,d=2.456G Ch 24
f=2457000000,m=AM,bw=1000000,d=2.457G WiFi Ch10
f=2458000000,m=AM,bw=1000000,d=2.458G Ch 25
f=2460000000,m=AM,bw=1000000,d=2.46G Ch 26
f=2462000000,m=AM,bw=1000000,d=2.462G WiFi Ch11
f=2464000000,m=AM,bw=1000000,d=2.464G Ch 27
f=2466000000,m=AM,bw=1000000,d=2.466G Ch 28
f=2467000000,m=AM,bw=1000000,d=2.467G WiFi Ch12
f=2468000000,m=AM,bw=1000000,d=2.468G Ch 29
f=2470000000,m=AM,bw=1000000,d=2.47G Ch 30
f=2472000000,m=AM,bw=1000000,d=2.472G WiFi Ch13
f=2474000000,m=AM,bw=1000000,d=2.474G Ch 31
f=2476000000,m=AM,bw=1000000,d=2.476G Ch 32
f=2478000000,m=AM,bw=1000000,d=2.478G Ch 33
f=2480000000,m=AM,bw=1000000,d=2.48G ISM Upper
45 changes: 45 additions & 0 deletions HACKRF_PORTAPACK/SDCARD/FREQMAN/DRONE_SCAN_433.TXT
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
# PortaPack Mayhem FREQMAN File
# 433 MHz Band - Common RC Control Frequencies
# LEGAL USE: Receive-only monitoring (always legal)
# This file contains common 433 MHz drone control frequencies

f=433050000,m=AM,bw=150000,d=433.05 RC Ch 1
f=433075000,m=AM,bw=150000,d=433.075 RC Ch 2
f=433100000,m=AM,bw=150000,d=433.10 RC Ch 3
f=433125000,m=AM,bw=150000,d=433.125 RC Ch 4
f=433150000,m=AM,bw=150000,d=433.15 RC Ch 5
f=433175000,m=AM,bw=150000,d=433.175 RC Ch 6
f=433200000,m=AM,bw=150000,d=433.20 RC Ch 7
f=433225000,m=AM,bw=150000,d=433.225 RC Ch 8
f=433250000,m=AM,bw=150000,d=433.25 RC Ch 9
f=433275000,m=AM,bw=150000,d=433.275 RC Ch 10
f=433300000,m=AM,bw=150000,d=433.30 RC Ch 11
f=433325000,m=AM,bw=150000,d=433.325 RC Ch 12
f=433350000,m=AM,bw=150000,d=433.35 RC Ch 13
f=433375000,m=AM,bw=150000,d=433.375 RC Ch 14
f=433400000,m=AM,bw=150000,d=433.40 RC Ch 15
f=433425000,m=AM,bw=150000,d=433.425 RC Ch 16
f=433450000,m=AM,bw=150000,d=433.45 RC Ch 17
f=433475000,m=AM,bw=150000,d=433.475 RC Ch 18
f=433500000,m=AM,bw=150000,d=433.50 RC Ch 19
f=433525000,m=AM,bw=150000,d=433.525 RC Ch 20
f=433550000,m=AM,bw=150000,d=433.55 RC Ch 21
f=433575000,m=AM,bw=150000,d=433.575 RC Ch 22
f=433600000,m=AM,bw=150000,d=433.60 RC Ch 23
f=433625000,m=AM,bw=150000,d=433.625 RC Ch 24
f=433650000,m=AM,bw=150000,d=433.65 RC Ch 25
f=433675000,m=AM,bw=150000,d=433.675 RC Ch 26
f=433700000,m=AM,bw=150000,d=433.70 RC Ch 27
f=433725000,m=AM,bw=150000,d=433.725 RC Ch 28
f=433750000,m=AM,bw=150000,d=433.75 RC Ch 29
f=433775000,m=AM,bw=150000,d=433.775 RC Ch 30
f=433800000,m=AM,bw=150000,d=433.80 RC Ch 31
f=433825000,m=AM,bw=150000,d=433.825 RC Ch 32
f=433850000,m=AM,bw=150000,d=433.85 RC Ch 33
f=433875000,m=AM,bw=150000,d=433.875 RC Ch 34
f=433900000,m=AM,bw=150000,d=433.90 RC Ch 35
f=433920000,m=AM,bw=150000,d=433.92 ISM Center
f=433925000,m=AM,bw=150000,d=433.925 RC Ch 36
f=433950000,m=AM,bw=150000,d=433.95 RC Ch 37
f=433975000,m=AM,bw=150000,d=433.975 RC Ch 38
f=434000000,m=AM,bw=150000,d=434.00 RC Ch 39
54 changes: 54 additions & 0 deletions HACKRF_PORTAPACK/SDCARD/FREQMAN/DRONE_SCAN_5G8.TXT
Original file line number Diff line number Diff line change
@@ -0,0 +1,54 @@
# PortaPack Mayhem FREQMAN File
# 5.8 GHz Band - FPV Video Downlinks
# LEGAL USE: Receive-only monitoring (always legal)
# Common 5.8 GHz FPV video transmission frequencies (Band A/B/E/F/R)

# Band A (Boscam A)
f=5865000000,m=WFM,bw=6000000,d=5.865G Band A1
f=5845000000,m=WFM,bw=6000000,d=5.845G Band A2
f=5825000000,m=WFM,bw=6000000,d=5.825G Band A3
f=5805000000,m=WFM,bw=6000000,d=5.805G Band A4
f=5785000000,m=WFM,bw=6000000,d=5.785G Band A5
f=5765000000,m=WFM,bw=6000000,d=5.765G Band A6
f=5745000000,m=WFM,bw=6000000,d=5.745G Band A7
f=5725000000,m=WFM,bw=6000000,d=5.725G Band A8

# Band B (Boscam B)
f=5733000000,m=WFM,bw=6000000,d=5.733G Band B1
f=5752000000,m=WFM,bw=6000000,d=5.752G Band B2
f=5771000000,m=WFM,bw=6000000,d=5.771G Band B3
f=5790000000,m=WFM,bw=6000000,d=5.790G Band B4
f=5809000000,m=WFM,bw=6000000,d=5.809G Band B5
f=5828000000,m=WFM,bw=6000000,d=5.828G Band B6
f=5847000000,m=WFM,bw=6000000,d=5.847G Band B7
f=5866000000,m=WFM,bw=6000000,d=5.866G Band B8

# Band E (Boscam E / DJI)
f=5705000000,m=WFM,bw=6000000,d=5.705G Band E1
f=5685000000,m=WFM,bw=6000000,d=5.685G Band E2
f=5665000000,m=WFM,bw=6000000,d=5.665G Band E3
f=5645000000,m=WFM,bw=6000000,d=5.645G Band E4
f=5885000000,m=WFM,bw=6000000,d=5.885G Band E5
f=5905000000,m=WFM,bw=6000000,d=5.905G Band E6
f=5925000000,m=WFM,bw=6000000,d=5.925G Band E7
f=5945000000,m=WFM,bw=6000000,d=5.945G Band E8

# Band F (Fatshark/Immersion)
f=5740000000,m=WFM,bw=6000000,d=5.740G Band F1
f=5760000000,m=WFM,bw=6000000,d=5.760G Band F2
f=5780000000,m=WFM,bw=6000000,d=5.780G Band F3
f=5800000000,m=WFM,bw=6000000,d=5.800G Band F4
f=5820000000,m=WFM,bw=6000000,d=5.820G Band F5
f=5840000000,m=WFM,bw=6000000,d=5.840G Band F6
f=5860000000,m=WFM,bw=6000000,d=5.860G Band F7
f=5880000000,m=WFM,bw=6000000,d=5.880G Band F8

# Band R (Raceband)
f=5658000000,m=WFM,bw=6000000,d=5.658G Race R1
f=5695000000,m=WFM,bw=6000000,d=5.695G Race R2
f=5732000000,m=WFM,bw=6000000,d=5.732G Race R3
f=5769000000,m=WFM,bw=6000000,d=5.769G Race R4
f=5806000000,m=WFM,bw=6000000,d=5.806G Race R5
f=5843000000,m=WFM,bw=6000000,d=5.843G Race R6
f=5880000000,m=WFM,bw=6000000,d=5.880G Race R7
f=5917000000,m=WFM,bw=6000000,d=5.917G Race R8
32 changes: 32 additions & 0 deletions HACKRF_PORTAPACK/SDCARD/FREQMAN/DRONE_SCAN_915.TXT
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
# PortaPack Mayhem FREQMAN File
# 915 MHz ISM Band - RC Control and Telemetry
# LEGAL USE: Receive-only monitoring (always legal)
# Common frequencies for drone control and telemetry systems

f=902000000,m=AM,bw=200000,d=902.0 ISM Lower
f=903000000,m=AM,bw=200000,d=903.0 Telemetry
f=904000000,m=AM,bw=200000,d=904.0 Telemetry
f=905000000,m=AM,bw=200000,d=905.0 Telemetry
f=906000000,m=AM,bw=200000,d=906.0 RC/Telem
f=907000000,m=AM,bw=200000,d=907.0 RC/Telem
f=908000000,m=AM,bw=200000,d=908.0 RC/Telem
f=909000000,m=AM,bw=200000,d=909.0 RC Ch 1
f=910000000,m=AM,bw=200000,d=910.0 RC Ch 2
f=911000000,m=AM,bw=200000,d=911.0 RC Ch 3
f=912000000,m=AM,bw=200000,d=912.0 RC Ch 4
f=913000000,m=AM,bw=200000,d=913.0 RC Ch 5
f=914000000,m=AM,bw=200000,d=914.0 RC Ch 6
f=915000000,m=AM,bw=200000,d=915.0 ISM Center
f=916000000,m=AM,bw=200000,d=916.0 RC Ch 7
f=917000000,m=AM,bw=200000,d=917.0 RC Ch 8
f=918000000,m=AM,bw=200000,d=918.0 RC Ch 9
f=919000000,m=AM,bw=200000,d=919.0 RC Ch 10
f=920000000,m=AM,bw=200000,d=920.0 RC Ch 11
f=921000000,m=AM,bw=200000,d=921.0 RC Ch 12
f=922000000,m=AM,bw=200000,d=922.0 RC Ch 13
f=923000000,m=AM,bw=200000,d=923.0 RC Ch 14
f=924000000,m=AM,bw=200000,d=924.0 RC Ch 15
f=925000000,m=AM,bw=200000,d=925.0 RC Ch 16
f=926000000,m=AM,bw=200000,d=926.0 RC/Telem
f=927000000,m=AM,bw=200000,d=927.0 RC/Telem
f=928000000,m=AM,bw=200000,d=928.0 ISM Upper
38 changes: 38 additions & 0 deletions HACKRF_PORTAPACK/SDCARD/FREQMAN/DRONE_SCAN_ALL.TXT
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
# PortaPack Mayhem FREQMAN File
# Comprehensive Multi-Band Drone Detection
# LEGAL USE: Receive-only monitoring (always legal)
# Key frequencies across all drone bands for quick scanning

# 433 MHz ISM Band - RC Control
f=433920000,m=AM,bw=150000,d=433.92 ISM RC

# 868 MHz ISM Band (EU)
f=868000000,m=AM,bw=200000,d=868.0 EU ISM

# 915 MHz ISM Band - RC/Telemetry
f=915000000,m=AM,bw=200000,d=915.0 ISM RC

# 1.2 GHz - FPV Video
f=1258000000,m=WFM,bw=6000000,d=1.258G FPV

# GPS L1
f=1575420000,m=AM,bw=2000000,d=1575.42 GPS L1

# 2.4 GHz - DJI/WiFi Control
f=2400000000,m=AM,bw=1000000,d=2.4G Lower
f=2450000000,m=AM,bw=1000000,d=2.45G Center
f=2480000000,m=AM,bw=1000000,d=2.48G Upper

# 5.8 GHz - FPV Video (Most Common)
f=5658000000,m=WFM,bw=6000000,d=5.658G Race R1
f=5695000000,m=WFM,bw=6000000,d=5.695G Race R2
f=5732000000,m=WFM,bw=6000000,d=5.732G Race R3
f=5769000000,m=WFM,bw=6000000,d=5.769G Race R4
f=5806000000,m=WFM,bw=6000000,d=5.806G Race R5
f=5843000000,m=WFM,bw=6000000,d=5.843G Race R6
f=5880000000,m=WFM,bw=6000000,d=5.880G Race R7
f=5917000000,m=WFM,bw=6000000,d=5.917G Race R8
f=5865000000,m=WFM,bw=6000000,d=5.865G Band A1
f=5845000000,m=WFM,bw=6000000,d=5.845G Band A2
f=5825000000,m=WFM,bw=6000000,d=5.825G Band A3
f=5805000000,m=WFM,bw=6000000,d=5.805G Band A4
13 changes: 13 additions & 0 deletions HACKRF_PORTAPACK/SDCARD/FREQMAN/DRONE_SCAN_GPS.TXT
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# PortaPack Mayhem FREQMAN File
# GPS L1 Band - 1575.42 MHz
# LEGAL USE: Receive-only monitoring (always legal)
# WARNING: GPS jamming is illegal and dangerous
# This file is for MONITORING ONLY

f=1575420000,m=AM,bw=2000000,d=GPS L1 Center
f=1575410000,m=AM,bw=2000000,d=GPS L1 -10kHz
f=1575430000,m=AM,bw=2000000,d=GPS L1 +10kHz
f=1575400000,m=AM,bw=2000000,d=GPS L1 -20kHz
f=1575440000,m=AM,bw=2000000,d=GPS L1 +20kHz
f=1575390000,m=AM,bw=2000000,d=GPS L1 -30kHz
f=1575450000,m=AM,bw=2000000,d=GPS L1 +30kHz
46 changes: 46 additions & 0 deletions HACKRF_PORTAPACK/SDCARD/FREQMAN/PERSONAL_CROSSFIRE.TXT
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
# PortaPack Mayhem FREQMAN File
# TBS Crossfire (CRSF) Protocol Template - FOR YOUR OWN DRONES ONLY
# WARNING: Transmitting to drones you don't own is ILLEGAL
#
# This template requires customization with YOUR drone's specific frequencies
# Follow the PERSONAL_RECALL_SETUP.md guide to capture your own signals
#
# TBS Crossfire Specifications:
# - 868 MHz (EU) or 915 MHz (US) ISM bands
# - Long-range digital protocol
# - LoRa-based modulation
# - Multiple power levels
# - User must capture their own binding and settings

# 915 MHz CRSF TEMPLATE (US/International)
f=915000000,m=AM,bw=500000,d=CRSF 915M Center [TEMPLATE]
f=913000000,m=AM,bw=500000,d=CRSF 915M-2 [TEMPLATE]
f=917000000,m=AM,bw=500000,d=CRSF 915M+2 [TEMPLATE]
f=911000000,m=AM,bw=500000,d=CRSF 915M-4 [TEMPLATE]
f=919000000,m=AM,bw=500000,d=CRSF 915M+4 [TEMPLATE]

# 868 MHz CRSF TEMPLATE (EU)
f=868000000,m=AM,bw=500000,d=CRSF 868M Center [TEMPLATE]
f=866000000,m=AM,bw=500000,d=CRSF 868M-2 [TEMPLATE]
f=870000000,m=AM,bw=500000,d=CRSF 868M+2 [TEMPLATE]
f=864000000,m=AM,bw=500000,d=CRSF 868M-4 [TEMPLATE]
f=872000000,m=AM,bw=500000,d=CRSF 868M+4 [TEMPLATE]

# INSTRUCTIONS:
# TBS Crossfire uses frequency hopping and binding
# This protocol is designed for security and long range
#
# For YOUR own drone:
# 1. Determine if using 868 MHz (EU) or 915 MHz (US) version
# 2. Power on YOUR TBS Crossfire transmitter
# 3. Ensure YOUR drone is bound to YOUR transmitter
# 4. Use HackRF in receive mode to capture signals
# 5. Identify the center frequency and hopping pattern
# 6. Replace template frequencies with YOUR actual values
# 7. Capture YOUR RTH or failsafe command
# 8. Test in a safe, controlled environment
#
# Note: Crossfire has built-in encryption and hopping
# Replay requires capturing the complete protocol sequence
#
# See PERSONAL_RECALL_SETUP.md for detailed instructions
Loading