The station's second radio: a HackRF One (1 MHz to 6 GHz, 8-bit, up to 20 MS/s) with a PortaPack screen running the Mayhem firmware. Plugged into this machine it works as a USB receiver for the spectrum survey; unplugged it is a handheld with its own apps. The first half of this page lists what we built for it. The second lists every app Mayhem v2.4.0 ships, and which ones this unit can use today.
This station only receives. Mayhem includes transmit apps, and they are listed below because the firmware has them, not because they are used here. Transmitting needs the right licence for the frequency and mode (many of these apps would be illegal to use on the air at all), and nothing at this station transmits from the HackRF.
| Part | State |
|---|---|
| HackRF One | An older board (before r6). Antenna: its own small whip, indoors. |
| Firmware | Mayhem v2.4.0, flashed 16 October 2026 (the previous flash would not boot). |
| Use | Receive only. |
| Screen | Works but faint. Holding UP while it boots picks the right display driver, and Settings › Display › Invert colors makes it readable; the panel itself is probably worn. |
| SD card | None fitted. Everything that saves files, and every app Mayhem loads from the card, is unavailable until one is added. |
| Mode on this machine | After a power cycle Mayhem starts as a standalone handheld. It has to be switched to HackRF mode (from its menu, or by sending hackrf to its USB console) before the survey can open it. |
| Capability | What it does | Range and mode | Where you see it |
|---|---|---|---|
| Wideband spectrum survey | Sweeps continuously, finds every signal against each hop's noise floor, and keeps a catalog of channels with width, strength and how often each is on. Has the radio to itself, so it never waits for listeners. Runs as the survey-hackrf service (bin/survey with the HackRF chosen). | 24 MHz to 6 GHz; 20 MS/s hops keeping the flat middle 14 MHz; about 40 s a pass. | /radio/spectrum (the HackRF is the default view): 24-hour waterfall, catalog, decoded examples. |
| Spur rejection | Looks at each hop twice, 3.3 MHz apart, and keeps the quieter reading, so the HackRF's own tuning spurs drop out (3 to 6 GHz went from about 870 signals a pass to 120). Harmonics of its 10 MHz clock are marked as spurs. | Mostly matters above 2.2 GHz. | Behind the survey; spurs never reach the catalog. |
Our own sweeper (ext/sweep) | A small C program on SoapySDR that retunes one open device, averages Hann-windowed FFTs per hop and prints rtl_power-style CSV. The same code drives the RSP1. | Any range the radio covers. | Behind the survey. |
| Signal identification | The survey tunes in to catalogued signals one at a time with the station's decoders. On the HackRF so far that has produced FM broadcast audio, narrowband FM and AM voice, aviation ACARS and VDL2 messages, and an Emergency Alert System tone. Amateur, weather and broadcast facts are published; aviation and broadcast programmes are kept for the station owner; cellular, paging, public safety and government bands are only measured. | Below 1.7 GHz. Above that everything is measured only. | Examples on /radio/spectrum. |
| Licence lookup | Names who is licensed on each signal found, from FCC and Canadian licence records; refreshed by the licenses timer, which restarts both surveys. | Every catalogued channel. | Catalog on /radio/spectrum. |
| RSP1 vs HackRF comparison | Shows, band by band and channel by channel, what each receiver found and which heard a shared signal more clearly. | 24 MHz to 1.7 GHz side by side; above 1.7 GHz HackRF only. | /radio/spectrum/compare |
| Digital and trunked hunt | Borrows a radio (the HackRF whenever the RSP1 is busy) to listen to up to 24 land-mobile signals at once and say which are P25, DMR, NXDN or analog, and which are trunked control channels. Uses a HackRF gain split (LNA 32, VGA 30, amp on) that reads the local P25 control channel at 81 % good frames. Run by hand with bin/hunt --radio hackrf. | VHF, UHF, T-band, 220, 700, 800 and 900 MHz land mobile. | Owner-only, since public safety metadata isn't ours to publish. |
| Separate radio lock | The HackRF has its own lock beside the RSP1's, so the two radios never wait on each other. | Holder shown on /radio/status. | |
| Health on the status page | Shows whether the HackRF is on USB and what holds it. | /radio/status |
| Tool | What it's for |
|---|---|
| HackRF tools 0.10.0 | hackrf_info, hackrf_transfer, hackrf_spiflash, hackrf_clock, hackrf_biast, hackrf_debug, hackrf_cpldjtag, hackrf_operacake: checking the board, raw IQ, flashing and low-level settings. |
| SoapyHackRF | Lets every SoapySDR program here (the sweeper, the survey's decoders, the hunt) open the HackRF the same way as the RSP1. |
| dfu-util 0.11 | Recovery: with the board in DFU mode it loads a HackRF image into RAM so the flash can be rewritten. This is how the unit was brought back on 16 October. |
| Mayhem USB console | When standalone, Mayhem shows up as a serial port. It switches the unit into HackRF mode and can read the screen back, which helped while the display was hard to see. |
Checked against the v2.4.0 source and the firmware image flashed on this unit. Mayhem keeps a core set of apps in flash and loads the rest from the SD card's APPS folder, so without a card only the built-in ones appear.
| App | Menu | What it does | On this unit |
|---|---|---|---|
| Looking Glass | Home | Wideband spectrum and waterfall across a range you set, wider than one tuning. | Works |
| Audio | Receive | Listen to AM (DSB, USB, LSB, CW), NFM and WFM, plus AMFM for HF weather fax and SPEC, a live spectrum and waterfall of the tuned window. | Works (recording audio needs a card) |
| Search | Receive | Steps through a frequency range and stops on anything active. | Works |
| Recon | Home | Scans saved frequency lists, stopping on activity. | Needs its lists on a card |
| ADS-B | Receive | Aircraft on 1090 MHz, with details and a map view. | Works (maps need a card) |
| AIS Boats | Receive | Ship positions and names on 162 MHz. | Works |
| APRS | Receive | Amateur packet positions and messages on 144.390 MHz. | Works |
| POCSAG | Receive | Decodes POCSAG pagers. | Works (paging is only measured at this station, never published) |
| Radiosonde | Receive | Weather balloon telemetry around 400 MHz. | Works |
| Weather | Receive | Wireless weather station sensors on 433 and 915 MHz. | Works |
| SubGhzD | Receive | Decodes common sub-GHz remote and sensor protocols. | Works |
| BLE Rx | Receive | Bluetooth Low Energy advertisements on 2.4 GHz. | Works |
| Capture | Home | Records raw IQ to the card. | Needs a card |
| Replay | Home | Transmits a recorded IQ file or playlist. | Firmware supports; needs a card; not used here (receive only) |
| APRS TX, BLE Tx, OOK, RDS, TouchTune | Transmit | Send APRS packets, Bluetooth advertisements, on-off-keyed remote codes, FM RDS data, and jukebox remote codes. | Firmware supports; not used here (receive only) |
| Mic | Transceiver | Push-to-talk voice transmit with receive between overs. | Firmware supports; not used here (receive only) |
| File Manager, Freq. Manager, Notepad, IQ Trim | Utilities | Browse files, edit frequency lists, edit text, cut IQ recordings. | Need a card |
| Settings, HackRF mode, Flash Utility, Debug | Main menu | Radio, display and clock settings; hand the board to a computer as a plain HackRF; flash firmware from the card; diagnostics. | Work (Flash Utility needs a card) |
All of these need a card with the v2.4.0 APPS folder, so none are available on this unit yet.
Receive:
Transmit (firmware supports; not used here):
Jammers, GPS simulation, false distress beacons and alert headers are illegal to put on the air in the US whatever your licence.
Utilities:
Games and debug: 2048, Battleship, Blackjack, Breakout, Dino, Doom, Morse practice, Snake, Space Invaders, Tetris; Audio Test, MCU temperature, font viewer, external sensors, memory debug.
Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.
Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.