Table of Contents
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
Before you transmit, know your local laws. HackRF One has not been tested for compliance with regulations governing the transmission of radio signals. You are responsible for using your HackRF One legally.
Transmitter apps generate and broadcast RF signals. The list below covers all transmitter apps currently in Mayhem.
Transmitter Apps
| App | Description |
|---|---|
| ADS-B(S) TX | Transmits ADS-B Mode S aircraft transponder frames — for simulation and testing only |
| Adult Toys | Transmits BLE control packets compatible with Love Spouse brand Bluetooth devices |
| APRS TX | Transmits APRS position reports and messages using Bell 202 AFSK at 1200 baud |
| BHT Xy/EP | Transmits BHT streetlight management protocol (Xylos and EPAR variants) |
| BLE TX | Transmits Bluetooth Low Energy 2.4 GHz advertisement packets |
| BLESpam | Transmits spoofed BLE advertisement packets (Apple, Google, Samsung pairing popups) |
| Burger Pager | Transmits signals for restaurant guest pager systems |
| CVS Spam | Transmits CVS pharmacy pager / call system signals |
| EPIRB TX | Transmits 406 MHz EPIRB distress beacon test signals |
| FlipperTX | Transmits sub-GHz signals from Flipper Zero .sub capture files |
| GPS Sim | Transmits a simulated GPS L1 C/A signal to spoof GPS receiver position |
| Hopper | Frequency hopper: transmits a carrier that sweeps across a configurable frequency list |
| Jammer | Transmits noise across a frequency range to disrupt communications — use responsibly and legally |
| KeeLoq TX | Retransmits KeeLoq rolling-code signals loaded from .keeloq capture files |
| Key fob TX | Transmits fixed-code remote keyless entry signals (currently Subaru only) |
| LGE Tool | Transmits LG Electronics service signals |
| MDC TX | Transmits MDC-1200 ANI/PTT ID bursts used in analogue radio systems |
| Morse TX | Encodes text to Morse code (CW) and transmits it as a keyed carrier |
| OOK | Transmits raw On-Off Keying (OOK/ASK) patterns for sub-GHz remote control signals |
| OOK Brute | Sequentially brute-forces OOK remote control code spaces (CAME, Nice, Holtek, Princeton) |
| OOK Editor | Graphical editor for composing and transmitting custom OOK bit patterns |
| P25 TX | Transmits Project 25 (APCO P25) Phase 1 FDMA digital voice frames |
| POCSAG TX | Transmits POCSAG pager messages (numeric and alphanumeric) at 512 / 1200 / 2400 baud |
| RDS | Transmits Radio Data System (RDS) data embedded in an FM carrier |
| Replay | Replays a previously captured .C16 or .C8 IQ recording |
| RTTY TX | Transmits RTTY (Baudot/ITA2) text at standard baud rates |
| SAME TX | Transmits Specific Area Message Encoding (SAME/EAS) emergency alert headers |
| Soundboard | Transmits FM-modulated audio from .WAV files stored on the SD card |
| Spectrum Painter | Transmits a signal whose spectrogram draws an image visible on a spectrum analyser |
| SSTV | Transmits Slow Scan Television (SSTV) image transmissions (Scottie, Martin modes) |
| TEDI/LCR | Transmits TEDI/LCR train identification and signalling protocol messages |
| TouchTunes | Transmits TouchTunes jukebox IR-over-RF remote control signals |
| TPMS TX | Transmits simulated TPMS tyre pressure sensor signals at 315 / 433.9 MHz |
HackRF Transmit Power
HackRF One output power varies significantly across its frequency range:
| Frequency range | Approximate TX power |
|---|---|
| 1 MHz – 10 MHz | 5 to 15 dBm, increasing with frequency |
| 10 MHz – 2150 MHz | 5 to 15 dBm, decreasing with frequency |
| 2150 MHz – 2750 MHz | 13 to 15 dBm (best performance region) |
| 2750 MHz – 4000 MHz | 0 to 5 dBm, decreasing with frequency |
| 4000 MHz – 6000 MHz | −10 to 0 dBm, decreasing with frequency |
Through most of the range below 4 GHz the output power falls between 0 and 10 dBm. The 2150–2750 MHz band delivers the highest and most consistent output.
TX Gain Controls
HackRF provides two TX gain stages: the LNA (IF) gain (0 to 47 dB in 1 dB steps) and the RF amplifier (0 dB or 14 dB). Both are adjustable in Mayhem's transmitter apps via the Amp and LNA fields.
The output power is sufficient for close-range over-the-air experiments and for driving an external power amplifier. If you add an external amplifier, also add an external bandpass filter matched to your operating frequency — HackRF has no built-in filtering and will otherwise radiate harmonics and spurious emissions.
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
Start here
Contributors
How to collaborate
Contributing Guidelines
How to ask questions correctly
Hardware
- PortaPack Versions (which one to buy)
- Features
- HackRF Versions
- Description of the hardware
- Enclosure/cases
- Repairs
- Mods
User manual
Intended use and Legality
- Usage cautions
- First steps
- Firmware update procedure
- User interface
- Powering the PortaPack
- Troubleshooting
- Won't boot
- Config Menu
- Firmware upgrade
- Diagnose firmware update in Windows
- Receive Quality Issues
- No TX/RX
- TX Carrier Only
- H2+ speaker modifications
- Dead Coin Cell Battery
- Factory Defaults
- SD card not recognized by PC with the SD-card over USB selected
- DFU overlay
- Full reset
- SolveBoard
- How to Format SDCard
- What if I don't like some of the apps
Applications
- 📥 Receivers
- 📤 Transmitters
- ADS-B(S) TX
- Adult Toys
- APRS TX
- BHT Xy/EP
- BLE TX
- BLESpam
- Burger Pager
- CVS Spam
- EPIRB
- FlipperTX
- GPS Sim
- Hopper
- Jammer
- KeeLoq TX
- Key fob TX
- LGE Tool
- MDC-1200 TX
- Morse TX
- OOK
- OOK Brute
- OOK Editor
- P25 TX
- POCSAG TX
- RDS
- RTTY TX
- SAME TX
- Signal gen
- Soundboard
- Spectrum Painter
- SSTV
- TEDI/LCR
- TouchTunes
- TPMS TX
- 🔄 Transceivers
- 🟡 Recon
- 🔴 Capture
- ▶️ Replay
- 🖲️ Remote
- 🔍 Looking Glass
- 🛠️ Utilities
- 🎮 Games
- ⚙️ Settings
- 💻 HackRF Mode
Misc
Developer Manual
- Compilation of the firmware
- Compile on WSL with ninja
- How to compile on Windows faster with WSL 2
- Using Docker and Kitematic
- Docker command-line reference
- Using Buddyworks and other CI platforms
- Notes for Buddy.Works (and other CI platforms)
- Using ARM on Debian host
- All in one script for ARM on Debian host
- Compile on Arch based distro (exclude Asahi), or other weird distros
- Dev build versions
- Notes About ccache
- Create a custom map
- Code formatting
- PR process
- Description of the Structure
- Software Dev Guides
- Tools
- Research
- UI Screenshots
- Maintaining
- Creating a prod/stable release (Maintainers only)
- Maintaining rules
- Development States Notes
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
Note
The wiki is incomplete. Please add content and collaborate.
Important
- This is a public wiki. Everything is visible to everyone. Don't use it for personal notes.
- Avoid linking to external tutorials/articles; they may become outdated or contain false information.