RF and SDR Fundamentals

Radio Frequency (RF) is the invisible attack surface that surrounds every modern environment. Key fobs, garage doors, building access cards, wireless sensors, drones, medical telemetry, and IoT devices all transmit over the air.

Unlike a network cable, RF cannot be physically contained. Anyone with a receiver in range can listen, and many systems were designed before security was a priority.

• Many RF protocols send data in cleartext.
• Replay protection is frequently absent or weak.
• Legacy industrial and access-control gear is rarely patched.

As a practitioner, understanding RF lets you assess risks that traditional network tooling completely misses.

A radio signal is an electromagnetic wave described by three core properties:

• Frequency — cycles per second, measured in Hertz (Hz). Common targets sit at 315 MHz, 433 MHz, 868 MHz, 915 MHz, 2.4 GHz.
• Amplitude — the strength or height of the wave.
• Phase — the timing offset of the wave relative to a reference.

Modulation encodes data by varying one of these properties. Demodulation reverses the process to recover the original bits.

Recognizing how a target modulates data is the first step in capturing and interpreting its transmissions.

You will encounter a handful of modulation families repeatedly in the field:

• ASK / OOK (Amplitude/On-Off Keying) — bits represented by carrier presence or absence. Extremely common in cheap 433 MHz remotes.
• FSK (Frequency Shift Keying) — bits shift the carrier frequency. Used by many sensors and BLE.
• PSK (Phase Shift Keying) — bits shift the phase. Used in higher-throughput links.
• GFSK — a Gaussian-filtered FSK variant used by Bluetooth.

Identifying the modulation tells you which decoder to apply when analyzing a capture.

A Software-Defined Radio (SDR) moves signal processing from fixed hardware into software. Instead of a chip dedicated to one frequency and one protocol, an SDR digitizes a wide chunk of spectrum and lets software do demodulation.

This flexibility is what makes SDR the universal tool for RF research:

• One device can analyze garage remotes, pagers, ADS-B, and more.
• New protocols are supported by writing code, not buying hardware.
• Both receive and (with capable hardware) transmit are possible.

The cost is complexity: you must understand sampling, filtering, and demodulation yourself.

SDR hardware ranges from cheap receivers to full transceivers:

• RTL-SDR — about 20 USD, receive only, roughly 24 MHz to 1.7 GHz. Perfect for learning and listening.
• HackRF One — transmit and receive, 1 MHz to 6 GHz, half-duplex. A common research workhorse.
• bladeRF / USRP — full-duplex, higher sample rates, used for serious protocol work.

A typical setup pairs the SDR with appropriate antennas. Transmitting requires legal authorization and proper antennas to avoid hardware damage and interference.

SDRs convert analog RF into a stream of digital samples. The sample rate determines how much bandwidth you can observe at once.

The Nyquist theorem states you must sample at least twice the bandwidth of the signal you want to capture. An SDR running at 2 Msps can faithfully represent about 2 MHz of bandwidth.

• Too low a sample rate aliases the signal and corrupts your capture.
• Too high a rate strains USB throughput and CPU, causing dropped samples.

Samples are stored as I/Q pairs (In-phase and Quadrature), which together encode both amplitude and phase.

A practical SDR workflow relies on a small set of mature tools:

• GQRX / SDR++ — graphical receivers for live spectrum browsing.
• GNU Radio — a flowgraph environment for building custom demodulators.
• Universal Radio Hacker (URH) — capture, demodulate, and decode digital protocols visually.
• rtl_433 — decodes hundreds of known 433 MHz devices automatically.

Start by surveying spectrum, then move to URH or GNU Radio for deeper analysis.

Before attacking anything, you reconnoiter. Tune to the expected band and watch the waterfall display for bursts of energy when the target device transmits.

Example: listen on the common 433.92 MHz ISM band with an RTL-SDR and let rtl_433 auto-decode nearby devices.

The waterfall reveals center frequency, bandwidth, and burst timing, all of which guide your next steps.

RF work is heavily regulated and the rules differ by country. Receiving is generally less restricted than transmitting, but interpreting certain communications can still be illegal.

• Transmitting on licensed bands without authorization is a criminal offense in most jurisdictions.
• Jamming is almost universally illegal, even for testing.
• Only test devices you own or are explicitly authorized to assess.

Use a Faraday-shielded environment for transmit testing so your signals do not leak into the real world. Document your authorization scope before any active RF test.

The full analysis pipeline turns raw RF into meaningful data:

• Capture — record I/Q samples at the correct frequency and rate.
• Demodulate — apply ASK, FSK, or PSK decoding to recover a bitstream.
• Clock recovery — find the symbol rate to align bits correctly.
• Decode — interpret encoding such as Manchester, then parse the protocol frame.

Tools like URH let you do all of this visually, highlighting preambles, sync words, and payloads so you can reverse a proprietary protocol step by step.

Understanding RF fundamentals directly informs defense:

• Assume any wireless link can be observed and choose encrypted, authenticated protocols.
• Require rolling codes or challenge-response so captured transmissions cannot be replayed.
• Monitor critical bands for unexpected energy that may indicate jamming or spoofing.
• Inventory wireless devices; legacy 433 MHz gear often has no security at all.

The goal of RF research is not just to break systems but to evaluate and harden the wireless surfaces organizations forget they have.

Test your understanding of SDR sampling fundamentals.

You now have the RF and SDR foundation for wireless security work:

• Radio signals are defined by frequency, amplitude, and phase, with data encoded through modulation such as ASK, FSK, and PSK.
• An SDR digitizes spectrum and demodulates in software, making one device able to analyze many protocols.
• Sample rate must obey Nyquist; samples are stored as I/Q pairs.
• The toolchain spans GQRX, GNU Radio, URH, and rtl_433, moving from survey to decode.
• Transmitting and jamming are legally restricted; always work within authorized scope and shielded environments.

Next you will apply these fundamentals to specific protocols, starting with Bluetooth.