The FM broadcast your phone receives, the 315 MHz remote-control signal from your car key, the 1090 MHz ADS-B transponder replies from aircraft — they’re all floating in the electromagnetic space around you.
You just need hardware that can “see” them.
The HackRF One[1] was designed for exactly that — plug it into your PC via USB and tune anywhere from 1 MHz to 6 GHz. Whatever you want to receive, you can receive it. And it doesn’t just receive — it transmits too.
As of today: 8.0k stars, 1.7k forks, 3,444 commits. Designed by Michael Ossmann (Great Scott Gadgets), released under the GPL-2.0 open-source license — hardware schematics, PCB design files, firmware source, and host drivers are all public.
# Ubuntu/Debian one-line install
sudo apt install hackrf
# macOS
brew install hackrf
# Plug in USB, verify detection
hackrf_info
hackrf_info prints the hardware version, serial number, and firmware version. Seeing “Found HackRF board” means everything is ready.
What Is HackRF: Not a TV Dongle, an Open-Source Transceiver
If this is your first contact with SDR, let’s clarify one concept first.
RTL-SDR TV dongle (RTL2832U + R820T2) can receive but not transmit, tops out around 1.7 GHz, with 2.4 MHz bandwidth. The upside: it’s cheap — about $5-8 on the used market.
HackRF One can both receive and transmit, covering 1 MHz to 6 GHz with 20 MHz bandwidth. The price can’t compare — $329 official ($2300+ in some regions) — but what you get is a complete half-duplex transceiver:
- Receive: FM broadcast, aviation ADS-B, NOAA weather satellites, GSM/LTE base stations, WiFi spectrum, remote-control OOK encoding, and more
- Transmit: generate arbitrary baseband waveforms, replay captured signals, conduct RF security research
Core chipset: NXP LPC4320 (dual-core ARM Cortex-M4 + Cortex-M0), MAX2837 transceiver, MAX5864 high-speed ADC/DAC, and Si5351 clock generator. The full board schematic and PCB source files are in the repo’s hardware/ directory — KiCad format, fully reproducible.
First Lesson: Receive FM Broadcast from the Command Line
After installing the hackrf tool package, you get several handy command-line tools. The most used is hackrf_transfer — the general-purpose entry point for receiving and transmitting data.
Capture a 100 MHz FM broadcast spectrum:
# Center frequency 100MHz, sample rate 20Msps, receive 5 seconds, save as IQ file
hackrf_transfer -r fm_sample.iq -f 100000000 -s 20000000 -n 100000000
Parameter explanation:
– -r: receive mode, followed by filename
– -f: center frequency (Hz); 100 MHz is the FM broadcast band
– -s: sample rate (Hz); 20 MHz is HackRF’s maximum bandwidth
– -n: number of samples; 100M samples ≈ 5 seconds
The resulting .iq file is raw baseband IQ sampling. Next, use it to listen to the broadcast:
Build an FM demodulation flow graph with GNU Radio (WBFM Receive → Audio Sink), or simply use Gqrx[2], select HackRF as the input device, tune to 100 MHz, hit play — and FM broadcast comes out of your computer speakers.
No additional RF front-end needed. Plug in HackRF, screw on an antenna, open the software, and the signal arrives.
Five Practical Use Cases: What HackRF Can Do
ADS-B aircraft tracking. Frequency 1090 MHz, antenna pointing out the window. The open-source tool dump1090 supports HackRF directly:
dump1090 --hackrf --net
Then open http://127.0.0.1:8080 in a browser — the position, altitude, speed, and flight number of every ADS-B-equipped flight above you appear live on a map. No internet, no subscription — the signal comes from the aircraft’s own broadcast.
NOAA weather satellite imagery. Frequencies near 137 MHz (137.1 MHz, 137.62 MHz, 137.9125 MHz). NOAA satellites pass overhead several times a day; a simple V-dipole antenna captures the APT signal. Pair with the noaa-apt[3] decoder and you get black-and-white Earth cloud imagery — the first photo you personally “downloaded” from a satellite.
Spectrum scanning. hackrf_sweep is a dedicated tool for quickly sweeping wide frequency ranges:
hackrf_sweep -f 2400:2480 -w 1000000
Scans the 2.4 GHz WiFi band at 1 MHz steps. Output is CSV containing frequency and signal strength, which you can import into Python/Excel to render spectrum heatmaps. Finding interference sources, checking channel occupancy, analyzing the RF environment — this replaces spectrum analyzers costing tens of thousands of dollars.
Remote-control signal analysis. 315 MHz/433 MHz is the dominant band for car keys, wireless doorbells, and wireless sensors. Pair HackRF with Universal Radio Hacker[4] (URH) to auto-identify OOK/ASK/FSK modulation types, decode binary data, and even replay and generate transmit signals.
GSM base station sniffing. Combined with gr-gsm[5] and AirProbe[6], HackRF can capture GSM downlink signals and parse base station information and channel configurations. This isn’t “cracking” — it’s analyzing the electromagnetic environment around you and understanding how mobile networks are deployed.
PortaPack: Turn HackRF Into a Handheld Device
HackRF’s most popular third-party accessory is the PortaPack[7] — an expansion board with screen, buttons, and battery that plugs directly onto the HackRF. With the Mayhem firmware installed, the HackRF becomes a standalone handheld SDR instrument, free from any computer.
No laptop needed, no Linux command line. A 3.2-inch touchscreen; power on and pick a function: ADS-B reception, spectrum analysis, signal recording, remote-control signal replay. Powered by a Nokia BL-5F battery, lasting about 2-3 hours.
PortaPack + HackRF is the classic combination for RF security research and outdoor signal analysis. One device = spectrum analyzer + signal source + protocol analyzer + recording/playback unit.
Limitations: HackRF Isn’t Perfect
Let’s honestly cover a few of HackRF’s shortcomings before you buy.
8-bit ADC limits dynamic range. HackRF uses the MAX5864, an 8-bit ADC/DAC. Compared with professional SDRs (the USRP B210 is 12-bit), HackRF’s dynamic range is notably narrower — small signals next to strong ones get easily drowned out. For weak-signal capture (satellite telemetry, EME moonbounce), this limitation is prominent.
Half-duplex. HackRF cannot transmit and receive simultaneously. For full-duplex communication (transmitting uplink and receiving downlink at the same time), you need two HackRFs, or move to USRP/bladeRF.
USB 2.0 bandwidth bottleneck. 20 MHz sample rate × 8 bits × 2 (I and Q, 8 bits each) = 40 MB/s; USB 2.0 theoretical bandwidth is 480 Mbps (60 MB/s), but real-world is about 35-40 MB/s. That’s right at the edge — occasional sample drops happen. Dropping the sample rate below 16 MHz is most stable. HackRF’s USB 3.0 successor is still on the way.
No built-in low-noise amplifier. You need to add your own LNA. When receiving weak signals (satellite, deep space), an external LNA is mandatory, or the noise figure will leave you hearing nothing.
Official price is $329. This isn’t a $30 toy like the RTL-SDR. If you only want to listen to FM or watch ADS-B aircraft, an RTL-SDR dongle is perfectly adequate. HackRF’s value lies in its transmit capability and 6 GHz frequency ceiling — two things RTL-SDR can never do.
Spend 30 seconds installing the hackrf tool package, plug in the board, and run your first hackrf_info — you’re standing at the doorway of the electromagnetic world.
Not reading about signals through someone else’s article, but seeing them with your own computer, your own antenna, your own eyes.
At Aomway, we live in this electromagnetic world every day — our FPV video transmitters, antennas, and telemetry systems all operate in the spectrum HackRF can explore. Whether you’re using an SDR like HackRF to verify your antenna’s real-world performance, sweep the 2.4/5.8 GHz bands for interference before a race, or analyze remote-control links for security research, the fundamentals covered here — IQ sampling, bandwidth, dynamic range, LNA requirements — are exactly the engineering constraints behind our products. Questions about SDR, RF front-ends, antennas, or our FPV solutions? Contact us at [email protected].
Frequently Asked Questions
1. HackRF vs RTL-SDR: which should I buy?
It depends entirely on your goal. If you want to listen to FM radio, track ADS-B aircraft, decode NOAA satellite imagery, or scan the spectrum cheaply, the RTL-SDR dongle ($5-30) is more than enough — receive-only covers most hobbyist use cases. Choose HackRF if you need (a) transmit capability — replaying signals, generating arbitrary waveforms, RF security research; or (b) frequencies above 1.7 GHz up to 6 GHz. The 20 MHz bandwidth and half-duplex transceiver also matter for more advanced projects. Rule of thumb: start with RTL-SDR to learn SDR fundamentals; upgrade to HackRF when you hit a wall — you’ll appreciate the difference with context.
2. Is it legal to transmit with HackRF?
Transmitting on licensed bands without authorization is illegal in virtually every country — this includes the FM broadcast band, aviation frequencies, and cellular bands. However, transmitting is legal (with appropriate licensing) on ISM bands like 2.4 GHz and 5.8 GHz at power levels below regulatory limits (e.g., FCC Part 15 / CE limits), and on amateur radio bands if you hold an amateur license. Always check your local regulations before transmitting. For beginners, the safest path: use HackRF in receive mode first, and only experiment with transmit on ISM bands at low power (ideally through a dummy load or attenuator, not an antenna) to avoid unintended interference.
3. Do I need extra hardware to use HackRF effectively?
At minimum, an antenna appropriate for your target band. For ADS-B (1090 MHz), a simple quarter-wave or commercial 1090 MHz antenna works; for FM (100 MHz), a telescopic antenna or half-wave dipole. A cheap SMA pigtail and tripod help with positioning. For weak-signal work (satellites, deep space), an external LNA is strongly recommended since HackRF has no built-in LNA. If you plan to transmit, add an attenuator and consider a low-pass filter to suppress harmonics. The PortaPack accessory makes it portable but is optional for desktop use.
4. Why does my HackRF drop samples at 20 MHz sample rate?
This is the USB 2.0 bandwidth limit. At 20 Msps with 8-bit I/Q, the data rate is ~40 MB/s, right at the practical ceiling of USB 2.0 (35-40 MB/s real-world). Sample drops manifest as gaps in IQ data, broken decodes, or choppy audio. Solutions: (1) reduce sample rate to 16 MHz or below for most applications — the difference is barely noticeable for FM/ADS-B; (2) use a shorter, higher-quality USB cable and direct connection (avoid hubs); (3) close other USB devices competing for bandwidth; (4) for truly demanding wideband capture, consider a USB 3.0 SDR like the HackRF’s successors, USRP, or bladeRF.
5. Can I decode 5G or modern encrypted signals with HackRF?
You can capture the RF energy of 5G NR signals (3.3-4.2 GHz, 24-28 GHz in some regions), but decoding them is a different story. 5G uses complex OFDM waveforms and, more importantly, is heavily encrypted — user data is protected by 5G-AKA and integrity algorithms, and base station signaling is also encrypted in modern deployments. What you can do: analyze spectrum occupancy, measure signal strength, identify band usage, and study the RF characteristics. The same applies to modern GSM/4G in many cases. For learning purposes, capture and analyze the physical-layer waveforms (with tools like srsRAN or MATLAB) to understand structure — but realistic “decoding” of protected content is neither feasible nor legal. Focus on the spectrum-awareness use cases: interference hunting, coverage analysis, and RF forensics.
