SDR / Embedded Firmware
RF & Hardware Security Lab
Sub-GHz protocol research and custom embedded firmware — SDR capture, decode, and replay across real-world radio hardware.
The problem
Wireless is the part of the attack surface most network engineers never touch. Learning it properly means building the hardware, writing the firmware, and capturing real signals — not reading about them.
How it's built
- Embedded C firmware targeting sub-GHz transceivers for capture, decode, and controlled replay
- Bench rigs built around HackRF + PortaPack, CC1101 modules, and ESP32 boards
- Aviation-focused SDR tooling for ADS-B signal validation and receiver testing
- Drone RF work: SiK radio detection and MAVLink telemetry inspection
Outcome
Hands-on fluency across the RF stack — antenna to protocol to firmware — that directly informs how I assess and defend wireless attack surface on a network engagement.
At a glance
- Sub-GHz
- Capture, decode, controlled replay
- Embedded C
- Firmware written, not just flashed
- 4 rigs
- HackRF, CC1101, ESP32, RTL-SDR
Decisions & tradeoffs
Considered: Off-the-shelf sub-GHz tooling
Chose: Writing my own firmware against the transceivers
Why: Canned tools hide the protocol layer that actually matters when assessing wireless exposure.
Tradeoff: Far slower to first result, and hardware debugging on a bench.
Considered: Reading up on RF attack surface
Chose: Building the rigs and capturing real signals
Why: You cannot defend a layer you have never observed directly.
Tradeoff: Equipment and time; all research kept to hardware I own.