Software Defined Radio

urh

urh — Universal Radio Hacker — is the tool built specifically for attacking wireless protocols end to end. It records a signal from your SDR, demodulates it, lets you work out the modulation and encoding interactively, decodes the raw bits into meaningful fields, helps you understand the protocol’s structure, and then — with transmit-capable hardware — lets you craft and send your own frames. It rolls the whole capture → analyze → understand → replay loop into one application, which is exactly the workflow for a garage remote, a wireless doorbell, or an IoT sensor.

URH is primarily a graphical application, launched into its own window from Security → Software Defined Radio → urh. It also ships a command-line interface, urh_cli, for scripted capture and transmission. Official-repo package.

The command-line interface

The GUI is where the reverse-engineering happens, but urh_cli is useful once you know the parameters and want to script capture or replay:

usage: urh_cli [-d DEVICE] [-di DEVICE_IDENTIFIER] [-db {native,gnuradio}]
               [-f FREQUENCY] [-s SAMPLE_RATE] [-b BANDWIDTH] [-g GAIN]
               [-if IF_GAIN] [-bb BASEBAND_GAIN] [-a]
               [-fcorr FREQUENCY_CORRECTION] [-cf CARRIER_FREQUENCY]
               [-ca CARRIER_AMPLITUDE] [-cp CARRIER_PHASE] [-mo MOD_TYPE]
               [-bps BITS_PER_SYMBOL] [-pm PARAMETERS [PARAMETERS ...]]
               [-sps SAMPLES_PER_SYMBOL] [-bl BIT_LENGTH] [-n NOISE]
               [-c CENTER] [-cs CENTER_SPACING] [-t TOLERANCE] [--hex]
               [-e ENCODING] [-m MESSAGES [MESSAGES ...]] [-file FILENAME]
               [-p PAUSE] [-rx] [-tx] [-rt RECEIVE_TIME] [-r] [-h] [-v]
               [project_file]

This is the Command Line Interface for the Universal Radio Hacker.

positional arguments:
  project_file

Software Defined Radio Settings:
  Configure Software Defined Radio options

  -d, --device DEVICE   Choose a Software Defined Radio. Allowed values are
                        AirSpy R2, AirSpy Mini, BladeRF, FUNcube, HackRF,
                        Rad1o, LimeSDR, PlutoSDR, RTL-SDR, RTL-TCP, SDRPlay,
                        SoundCard, USRP
  -di, --device-identifier DEVICE_IDENTIFIER
  -db, --device-backend {native,gnuradio}
  -f, --frequency FREQUENCY
                        Center frequency the SDR shall be tuned to
  -s, --sample-rate SAMPLE_RATE
                        Sample rate to use
  -b, --bandwidth BANDWIDTH
                        Bandwidth to use (defaults to sample rate)
  -g, --gain GAIN       RF gain the SDR shall use
  -if, --if-gain IF_GAIN
                        IF gain to use (only supported for some SDRs)
  -bb, --baseband-gain BASEBAND_GAIN
                        Baseband gain to use (only supported for some SDRs)
  -a, --adaptive-noise  Use adaptive noise when receiving.
  -fcorr, --frequency-correction FREQUENCY_CORRECTION
                        Set the frequency correction for SDR (if supported)

Modulation/Demodulation settings:
  Configure the Modulator/Demodulator. Not required in raw mode.In case of
  RX there are additional demodulation options.

  -cf, --carrier-frequency CARRIER_FREQUENCY
                        Carrier frequency in Hertz (default: 1000.0)
  -ca, --carrier-amplitude CARRIER_AMPLITUDE
                        Carrier amplitude (default: 1)
  -cp, --carrier-phase CARRIER_PHASE
                        Carrier phase in degree (default: 0)
  -mo, --modulation-type MOD_TYPE
                        Modulation type must be one of ASK, FSK, PSK, GFSK,
                        OQPSK (default: FSK)
  -bps, --bits-per-symbol BITS_PER_SYMBOL
                        Bits per symbol e.g. 1 means binary modulation
                        (default: 1).
  -pm, --parameters PARAMETERS [PARAMETERS ...]
                        Parameters for modulation. Separate with spaces
  -sps, --samples-per-symbol SAMPLES_PER_SYMBOL
                        Length of a symbol in samples (default: 100).
  -bl, --bit-length BIT_LENGTH
                        Same as samples per symbol, just there for legacy
                        support (default: 100).
  -n, --noise NOISE     Noise threshold (default: 0.1). Used for RX only.
  -c, --center CENTER   Center between symbols for demodulation (default: 0).
                        Used for RX only.
  -cs, --center-spacing CENTER_SPACING
                        Center spacing between symbols for demodulation
                        (default: 0.1). Value has only effect for modulations
                        with more than 1 bit per symbol. Used only for RX.
  -t, --tolerance TOLERANCE
                        Tolerance for demodulation in samples (default: 5).
                        Used for RX only.

Data configuration:
  Configure which data to send or where to receive it.

  --hex                 Give messages as hex instead of bits
  -e, --encoding ENCODING
                        Specify encoding
  -m, --messages MESSAGES [MESSAGES ...]
                        Messages to send. Give pauses after with a /. Separate
                        with spaces e.g. 1001/42ms 1100/3ns 0001 1111/200. If
                        you give no time suffix after a pause it is assumed to
                        be in samples.
  -file, --filename FILENAME
                        Filename to read messages from in send mode. In
                        receive mode messages will be written to this file
                        instead to STDOUT.
  -p, --pause PAUSE     The default pause which is inserted after a every
                        message which does not have a pause configured.
                        (default: 250ms) Supported time units: s (second), ms
                        (millisecond), µs (microsecond), ns (nanosecond) If
                        you do not give a time suffix the pause is assumed to
                        be in samples.
  -rx, --receive        Enter RX mode
  -tx, --transmit       Enter TX mode
  -rt, --receive-time RECEIVE_TIME
                        How long to receive messages. (default: 3.0) Any
                        negative value means infinite.
  -r, --raw             Use raw mode i.e. send/receive IQ data instead of
                        bits.

Miscellaneous options:
  -h, --help            show this help message and exit
  -v, --verbose

The workflow

In the GUI, URH walks you through four tabs that mirror the attack:

1. Interpretation — record or load a signal and find the modulation (ASK, FSK, PSK), the symbol rate, and the bit boundaries.
2. Analysis — group the decoded bits into messages and fields; URH helps spot checksums, addresses, and repeating structure.
3. Generator — build your own messages from the structure you worked out.
4. Simulator — run interactive, stateful exchanges for protocols that expect a back-and-forth.

Capture live from any SDR here, or bring in a file you dissected in inspectrum.