Software-Defined Radio (SDR)
A radio whose tuning, demodulation, and decoding happen in software on raw IQ samples, so one piece of hardware can receive (and sometimes transmit) almost any protocol you can describe.
Software-Defined Radio (SDR) moves the parts of a radio that were traditionally fixed silicon, the tuning, filtering, and demodulation, into software running on a general-purpose computer. The hardware shrinks to a wideband front end that converts RF to a stream of digital samples; the host then does the actual signal processing. One SDR can therefore receive (and, on transmit-capable models, generate) almost any waveform you can describe in code, which is exactly why it is the workhorse of wireless security work.
What it is
A conventional receiver is built for one job: an FM radio demodulates FM and nothing else. An SDR instead exposes the raw signal. Its front end tunes to a center frequency, filters a slice of bandwidth around it, and an ADC digitizes that slice into IQ samples, pairs of numbers (in-phase and quadrature) that together capture both the amplitude and the phase of the signal. From there everything is math on a sample buffer. Change the software and the same dongle becomes an ADS-B receiver, a pager decoder, a LoRa sniffer, or a spectrum analyzer, with no change to the hardware.
Why it matters
Wireless attacks live or die on being able to see the signal. SDR gives you a universal ear: point it at a frequency, record the IQ, and inspect what is actually on the air rather than trusting a datasheet. For a security learner it collapses a shelf of protocol-specific receivers into one device and one workflow, capture, analyze, and (with a transmit-capable radio) replay. Rolling-code remotes, sensor telemetry, sub-GHz industrial links, and unknown ISM-band chatter all become approachable from the same setup.
The IQ signal chain
Reception is a pipeline (see the diagram):
| Stage | What happens |
|---|---|
| Antenna | picks up the RF energy at the target band |
| Tuner / mixer | down-converts the chosen center frequency to baseband |
| ADC | samples the analog baseband into digital IQ pairs |
| Host DSP | filters, demodulates, recovers timing, and decodes bits |
The single most important number is the sample rate, which sets how much bandwidth you can see at once (a 2.4 Msps stream shows roughly 2.4MHz of spectrum). To capture a signal cleanly you must center on it and use a sample rate wide enough to contain its whole bandwidth, then let software pull out the modulation.
How it is used
The everyday loop is survey, capture, decode, and optionally replay:
# 1. Survey the band visually to find active signals.
gqrx # waterfall + demodulators, GUI
# 2. Record raw IQ around a center frequency for offline work.
rtl_sdr -f 433920000 -s 2400000 -g 40 capture.iq
# 3. Decode a known protocol straight from the air.
rtl_433 -f 433.92M # weather sensors, TPMS, remotes
# 4. Build a custom flowgraph for an unknown or bespoke waveform.
gnuradio-companion # source -> filter -> demod -> sink
GNU Radio is the reference framework for assembling a receive or transmit chain block by block; Universal Radio Hacker (URH) is the fast path for reverse-engineering an unknown digital signal (detect the modulation, slice the bits, diff two captures). With a transmit-capable radio the same IQ you recorded can be played back to reproduce the on-air event.
Pitfalls
- RX only vs TX capable. The cheap dongles receive but cannot transmit. Replay and injection need a HackRF, a LimeSDR, or a purpose-built sub-GHz transmitter, not an RTL-SDR.
- Sample rate and aliasing. If your sample rate is narrower than the signal, you clip its edges or fold in aliases. Widen the rate or re-center; a mangled capture is often just undersampling.
- Front-end limits. Antenna, gain, and dynamic range matter. A strong nearby transmitter can desensitize the receiver, and the wrong antenna for the band gives you noise where there should be a signal.
- Legality. Receiving is broadly permissive, but transmitting on licensed or ISM bands is regulated. Keep transmit tests on your own hardware, at low power, and inside the rules.