pwn 0.5.617 → 0.5.620

data/lib/pwn/sdr/decoder/apt.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # NOAA APT (Automatic Picture Transmission) decoder for the 137 MHz
+      # polar-orbiting weather satellites (NOAA-15/18/19). APT is a 2400 Hz
+      # AM subcarrier inside a 34 kHz-wide FM downlink; GQRX's UDP audio is
+      # recorded to a WAV, then handed to `noaa-apt` (or `satdump`) to render
+      # the two-channel visible/IR image strip.
+      module APT
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::APT.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          stamp   = Time.now.strftime('%Y%m%d_%H%M%S')
+          wav_out = "/tmp/apt_#{stamp}.wav"
+          png_out = "/tmp/apt_#{stamp}.png"
+
+          # Record 11 025 Hz WAV (noaa-apt's native rate) until [ENTER],
+          # emitting a heartbeat line per second so the spinner stays live,
+          # then decode to PNG on exit.
+          inner = 'sox -t raw -e signed-integer -b 16 -r 22050 -c 1 - ' \
+                  "-t wav -r 11025 #{Shellwords.escape(wav_out)} & SOXPID=$!; " \
+                  'trap "kill $SOXPID 2>/dev/null" EXIT INT TERM; ' \
+                  'while kill -0 $SOXPID 2>/dev/null; do ' \
+                  "echo APT_REC seconds=$SECONDS file=#{wav_out}; sleep 1; done"
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'NOAA-APT',
+            required_bins: %w[sox noaa-apt],
+            decode_cmd: "bash -c #{Shellwords.escape(inner)}",
+            line_match: /^APT_REC/,
+            parser: proc { |line| { protocol: 'NOAA-APT', wav: wav_out, png: png_out, summary: line.strip } }
+          )
+
+          return unless File.exist?(wav_out) && File.size(wav_out).positive?
+
+          system('noaa-apt', wav_out, '-o', png_out)
+
+          puts "[*] APT image written: #{png_out}" if File.exist?(png_out)
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires `sox` and `noaa-apt`. Set GQRX to FM, ~34 kHz BW.
+                  Records the pass to /tmp/apt_<ts>.wav, decodes to PNG on exit.
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/bluetooth.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # Bluetooth Classic (BR/EDR) & BLE advertising decoder for 2.402–2.480 GHz.
+      #
+      # 1 Mbit/s GFSK with 79 (BR/EDR) or 40 (BLE) FHSS channels cannot be
+      # recovered from GQRX audio. This module drives an Ubertooth One via
+      # `ubertooth-rx` (LAP/UAP discovery) or `ubertooth-btle -f -p` (BLE
+      # advertising follow) directly and structures each output line.
+      module Bluetooth
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Bluetooth.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          ble = freq_obj[:ble] || freq_obj[:mode].to_s.casecmp('ble').zero?
+          direct_cmd = ble ? 'ubertooth-btle -f -p' : 'ubertooth-rx -z'
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: ble ? 'BLE' : 'BT-BR/EDR',
+            required_bins: [ble ? 'ubertooth-btle' : 'ubertooth-rx'],
+            direct_cmd: direct_cmd,
+            line_match: /(LAP|AdvA|ADV_|SCAN_|BD_ADDR|systime)/i,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Bluetooth.parse_line(line: 'systime=... LAP=9e8b33 ...')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'Bluetooth' }
+          out[:lap]      = ::Regexp.last_match(1) if line =~ /LAP[=: ]([0-9a-fA-F]{6})/
+          out[:uap]      = ::Regexp.last_match(1) if line =~ /UAP[=: ]([0-9a-fA-F]{2})/
+          out[:bd_addr]  = ::Regexp.last_match(1) if line =~ /(?:AdvA|BD_ADDR)[=: ]([0-9a-fA-F:]{12,17})/
+          out[:pdu_type] = ::Regexp.last_match(1) if line =~ /\b(ADV_\w+|SCAN_\w+|CONNECT_REQ)\b/
+          out[:channel]  = ::Regexp.last_match(1) if line =~ /ch[=: ]?(\d{1,2})\b/i
+          out[:rssi]     = ::Regexp.last_match(1) if line =~ /rssi[=: ]?(-?\d+)/i
+          out[:summary]  = "BT #{out.values_at(:pdu_type, :bd_addr, :lap).compact.join(' ')}".strip
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires an Ubertooth One and `ubertooth-rx` /
+                  `ubertooth-btle`. Set freq_obj[:ble] = true for BLE mode.
+
+            #{self}.parse_line(line: 'systime=... ch=37 LAP=9e8b33 ...')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/dect.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # DECT (Digital Enhanced Cordless Telecommunications) decoder for the
+      # 1.880–1.900 GHz (EU) / 1.920–1.930 GHz (US DECT-6.0) allocation.
+      # 1.152 Mbit/s GFSK across 10 TDMA carriers requires raw I/Q; this
+      # module drives gr-dect2's `dect_cli` (or the `re-DECTed` toolkit)
+      # directly and structures each RFPI/PP scan line.
+      module DECT
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::DECT.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          # DECT carriers are 1.728 MHz apart; ch0 = 1 897.344 MHz (EU).
+          ch = ((1_897_344_000 - hz) / 1_728_000.0).round.clamp(0, 9)
+
+          direct_cmd =
+            if PWN::SDR::Decoder::Base.bin_available?(bin: 'dect_cli')
+              "dect_cli -s #{ch}"
+            else
+              "dectrx -c #{ch}"
+            end
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'DECT',
+            required_bins: %w[dect_cli],
+            direct_cmd: direct_cmd,
+            line_match: /(RFPI|FP|PP|slot|carrier|RSSI)/i,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::DECT.parse_line(line: 'RFPI: 01 23 45 67 89 slot 4 carrier 3 RSSI -55')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'DECT' }
+          out[:rfpi]    = ::Regexp.last_match(1).delete(' ') if line =~ /RFPI[:=]?\s*((?:[0-9A-Fa-f]{2}\s*){5})/
+          out[:slot]    = ::Regexp.last_match(1) if line =~ /slot\s*(\d+)/i
+          out[:carrier] = ::Regexp.last_match(1) if line =~ /carrier\s*(\d+)/i
+          out[:rssi]    = ::Regexp.last_match(1) if line =~ /RSSI[:=]?\s*(-?\d+)/i
+          out[:role]    = ::Regexp.last_match(1) if line =~ /\b(FP|PP)\b/
+          out[:summary] = "DECT RFPI=#{out[:rfpi]} slot=#{out[:slot]} carrier=#{out[:carrier]}"
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires gr-dect2's `dect_cli` (or re-DECTed `dectrx`).
+                  Owns the SDR directly.
+
+            #{self}.parse_line(line: 'RFPI: 01 23 45 67 89 slot 4 carrier 3')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/gps.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # GNSS / GPS L1-C/A (1575.42 MHz) & L2C (1227.60 MHz) decoder. BPSK/DSSS
+      # at 1.023 / 10.23 Mcps needs raw I/Q, so this drives `gnss-sdr` (or
+      # `rtl_gps`) directly and structures the PVT / NMEA lines it emits
+      # (satellite PRNs acquired, C/N0, computed position fix, UTC time).
+      module GPS
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::GPS.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          conf = (freq_obj[:gnss_conf] || '/usr/share/gnss-sdr/conf/gnss-sdr_GPS_L1_rtlsdr_realtime.conf').to_s
+          direct_cmd = "gnss-sdr --config_file=#{Shellwords.escape(conf)}"
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'GPS',
+            required_bins: %w[gnss-sdr],
+            direct_cmd: direct_cmd,
+            line_match: /(PVT|Position|PRN|Tracking|\$G[PN])/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::GPS.parse_line(line: 'Position at ... Lat = 32.7 [deg], Long = -97.1 ...')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'GPS' }
+          out[:prn]  = ::Regexp.last_match(1) if line =~ /PRN[ =]?(\d{1,2})/
+          out[:cn0]  = ::Regexp.last_match(1) if line =~ /CN0[ =]?([\d.]+)/i
+          out[:lat]  = ::Regexp.last_match(1) if line =~ /Lat(?:itude)?\s*=\s*(-?[\d.]+)/i
+          out[:lon]  = ::Regexp.last_match(1) if line =~ /Long(?:itude)?\s*=\s*(-?[\d.]+)/i
+          out[:alt]  = ::Regexp.last_match(1) if line =~ /Height\s*=\s*(-?[\d.]+)/i
+          out[:utc]  = ::Regexp.last_match(1) if line =~ /UTC\s*=?\s*([\d:.-]+T?[\d:.]*)/
+          out[:nmea] = line if line.start_with?('$G')
+          out[:summary] = if out[:lat]
+                            "GPS FIX #{out[:lat]},#{out[:lon]} alt=#{out[:alt]}m"
+                          elsif out[:prn]
+                            "GPS PRN#{out[:prn]} CN0=#{out[:cn0]}"
+                          else
+                            "GPS #{line[0, 100]}"
+                          end
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires `gnss-sdr` and an active-antenna-biased front end.
+                  Override the receiver config via freq_obj[:gnss_conf].
+
+            #{self}.parse_line(line: 'Position ... Lat = 32.7 Long = -97.1 Height = 210')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/gsm.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'shellwords'
+
 module PWN
   module SDR
     module Decoder
@@ -7,14 +9,32 @@ module PWN
       #
       # GSM is 270.833 kbit/s GMSK — it CANNOT be recovered from GQRX's 48 kHz
       # demodulated-audio UDP tap. This module therefore drives the SDR
-      # directly via `grgsm_livemon_headless` (from gr-gsm) which publishes
-      # decoded Um bursts as GSMTAP on udp/4729, then reads them back with
+      # directly via `grgsm_livemon_headless` (from gr-gsm), which publishes
+      # decoded Um bursts as GSMTAP on udp/4729, and reads them back with
       # `tshark` for structured field extraction (MCC/MNC/LAC/CI/ARFCN, paging
       # IMSIs/TMSIs, System Information messages, etc.).
       #
       # Interface matches PWN::SDR::Decoder::Flex / ::RDS so the GQRX
       # dispatcher (`decoder: :gsm`) works uniformly.
+      #
+      # NOTE: grgsm_livemon_headless opens the SDR hardware itself. If GQRX
+      # already owns the device, pass a distinct `--args` string via
+      # freq_obj[:sdr_args] (e.g. 'rtl=1' or 'hackrf=0') or stop GQRX's DSP
+      # first (`U DSP 0`).
       module GSM
+        TSHARK_FIELDS = %w[
+          frame.time
+          gsmtap.arfcn
+          gsmtap.chan_type
+          gsm_a.imsi
+          gsm_a.tmsi
+          e212.mcc
+          e212.mnc
+          gsm_a.lac
+          gsm_a.bssmap.cell_ci
+          gsm_a.dtap.msg_rr_type
+        ].freeze
+
         # Supported Method Parameters::
         # PWN::SDR::Decoder::GSM.decode(
         #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
@@ -24,26 +44,25 @@ module PWN
           freq_obj = opts[:freq_obj]
           raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
 
-          hz   = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
-          gain = (freq_obj[:rf_gain] || 40).to_s.to_f
-
-          tshark_fields = %w[
-            frame.time
-            gsmtap.arfcn
-            gsmtap.chan_type
-            gsm_a.imsi
-            gsm_a.tmsi
-            e212.mcc
-            e212.mnc
-            gsm_a.lac
-            gsm_a.bssmap.cell_ci
-            gsm_a.dtap.msg_rr_type
-          ]
-
-          direct_cmd = "sh -c 'grgsm_livemon_headless -f #{hz} -g #{gain} >/dev/null 2>&1 & " \
-                       'LMPID=$!; trap "kill $LMPID 2>/dev/null" EXIT; sleep 2; ' \
-                       'tshark -i lo -l -Y gsmtap -T fields -E separator=\| ' \
-                       "#{tshark_fields.map { |f| "-e #{f}" }.join(' ')}'"
+          hz       = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          gain     = (freq_obj[:rf_gain] || 40).to_s.to_f
+          sdr_args = freq_obj[:sdr_args].to_s
+          gsmtap   = (freq_obj[:gsmtap_port] || 4729).to_i
+
+          grgsm = ['grgsm_livemon_headless', '-f', hz.to_s, '-g', gain.to_s]
+          grgsm.push('--args', sdr_args) unless sdr_args.empty?
+
+          tshark = ['tshark', '-i', 'lo', '-l', '-n',
+                    '-f', "udp port #{gsmtap}",
+                    '-Y', 'gsmtap',
+                    '-T', 'fields', '-E', 'separator=|']
+          TSHARK_FIELDS.each { |f| tshark.push('-e', f) }
+
+          # bash -c '<grgsm> >/dev/null 2>&1 & pid=$!; trap ... ; <tshark>'
+          inner = "#{Shellwords.join(grgsm)} >/dev/null 2>&1 & " \
+                  'LMPID=$!; trap "kill $LMPID 2>/dev/null" EXIT INT TERM; ' \
+                  "sleep 2; exec #{Shellwords.join(tshark)}"
+          direct_cmd = "bash -c #{Shellwords.escape(inner)}"
 
           PWN::SDR::Decoder::Base.run_pipeline(
             freq_obj: freq_obj,
@@ -63,6 +82,7 @@ module PWN
           f = line.split('|', -1)
           out = {
             protocol: 'GSM',
+            frame_time: f[0],
             arfcn: f[1],
             chan_type: f[2],
             imsi: f[3],
@@ -80,13 +100,13 @@ module PWN
             out[:imsi_msin] = out[:imsi][6..]
           end
 
-          summary_bits = []
-          summary_bits << "ARFCN=#{out[:arfcn]}" if out[:arfcn]
-          summary_bits << "MCC/MNC=#{out[:mcc]}/#{out[:mnc]}" if out[:mcc]
-          summary_bits << "LAC=#{out[:lac]} CI=#{out[:cell_id]}" if out[:lac]
-          summary_bits << "IMSI=#{out[:imsi]}" if out[:imsi]
-          summary_bits << "TMSI=#{out[:tmsi]}" if out[:tmsi]
-          out[:summary] = "GSM #{summary_bits.join(' ')}".strip
+          bits = []
+          bits << "ARFCN=#{out[:arfcn]}" if out[:arfcn]
+          bits << "MCC/MNC=#{out[:mcc]}/#{out[:mnc]}" if out[:mcc]
+          bits << "LAC=#{out[:lac]} CI=#{out[:cell_id]}" if out[:lac]
+          bits << "IMSI=#{out[:imsi]}" if out[:imsi]
+          bits << "TMSI=#{out[:tmsi]}" if out[:tmsi]
+          out[:summary] = "GSM #{bits.join(' ')}".strip
           out
         end
 
@@ -107,6 +127,7 @@ module PWN
             NOTE: Requires `grgsm_livemon_headless` (gr-gsm) and `tshark`.
                   GSM cannot be decoded from GQRX's 48 kHz audio tap; this
                   module drives the SDR directly and reads GSMTAP on lo:4729.
+                  Set freq_obj[:sdr_args] (e.g. 'rtl=1') if GQRX owns device 0.
 
             #{self}.parse_line(line: 'ts|arfcn|chan|imsi|tmsi|mcc|mnc|lac|ci|rr')
 

data/lib/pwn/sdr/decoder/iridium.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # Iridium L-band (1.616–1.6265 GHz) burst decoder. Drives gr-iridium's
+      # `iridium-extractor` against the SDR to demodulate 25 kbit/s DE-QPSK
+      # simplex/duplex bursts, then pipes them through iridium-toolkit's
+      # `iridium-parser.py` for frame classification (IRA/IBC/IDA/ISY/VOC/...).
+      module Iridium
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Iridium.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz       = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          gain     = (freq_obj[:rf_gain] || 40).to_s.to_f
+          sdr_args = (freq_obj[:sdr_args] || 'rtl=0').to_s
+
+          inner = "iridium-extractor -D 4 --multi-frame -c #{hz} -r 2000000 " \
+                  "-g #{gain} -o - #{Shellwords.escape(sdr_args)} 2>/dev/null " \
+                  '| iridium-parser.py --harder /dev/stdin'
+          direct_cmd = "bash -c #{Shellwords.escape(inner)}"
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'IRIDIUM',
+            required_bins: %w[iridium-extractor iridium-parser.py],
+            direct_cmd: direct_cmd,
+            line_match: /^(IRA|IBC|IDA|ISY|ITL|MSG|VOC|RAW):/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Iridium.parse_line(line: 'IRA: sat:23 beam:14 ...')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'IRIDIUM' }
+          out[:frame_type] = ::Regexp.last_match(1) if line =~ /^([A-Z]{3}):/
+          out[:sat]        = ::Regexp.last_match(1) if line =~ /sat:(\d+)/
+          out[:beam]       = ::Regexp.last_match(1) if line =~ /beam:(\d+)/
+          out[:pos]        = ::Regexp.last_match(1) if line =~ /pos=\(([^)]+)\)/
+          out[:ra_id]      = ::Regexp.last_match(1) if line =~ /ric:(\d+)/
+          out[:summary]    = "IRIDIUM #{out[:frame_type]} sat=#{out[:sat]} beam=#{out[:beam]}"
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires `iridium-extractor` (gr-iridium) and
+                  `iridium-parser.py` (iridium-toolkit). Owns the SDR.
+
+            #{self}.parse_line(line: 'IRA: sat:23 beam:14 pos=(+32.1/-097.0) ...')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/lora.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # LoRa / LoRaWAN CSS decoder for the 433 / 868 / 902–928 MHz ISM
+      # allocations. Chirp-spread-spectrum needs raw I/Q, so this drives
+      # `rtl_433` (which ships a native LoRa demod, protocol #264) directly.
+      # Emits one JSON line per decoded uplink containing SF/BW/CR, DevAddr,
+      # FCnt, and raw PHYPayload hex.
+      module LoRa
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::LoRa.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz       = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          sdr_args = freq_obj[:sdr_args].to_s
+
+          cmd = ['rtl_433', '-f', hz.to_s, '-s', '1024k',
+                 '-R', '264', '-F', 'json', '-M', 'level']
+          cmd.push('-d', sdr_args) unless sdr_args.empty?
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'LoRa',
+            required_bins: %w[rtl_433],
+            direct_cmd: Shellwords.join(cmd),
+            line_match: /^\s*{/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::LoRa.parse_line(line: '{"model":"LoRa",...}')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          h = begin
+            JSON.parse(line, symbolize_names: true)
+          rescue StandardError
+            { unparsed: line }
+          end
+          out = { protocol: 'LoRa' }.merge(h)
+          bits = []
+          bits << "SF#{out[:sf]}" if out[:sf]
+          bits << "BW#{out[:bw]}" if out[:bw]
+          bits << "CR#{out[:cr]}" if out[:cr]
+          bits << "DevAddr=#{out[:devaddr] || out[:id]}" if out[:devaddr] || out[:id]
+          bits << "FCnt=#{out[:fcnt]}" if out[:fcnt]
+          bits << "len=#{out[:len] || (out[:data].to_s.length / 2)}" if out[:len] || out[:data]
+          out[:summary] = "LoRa #{bits.join(' ')}".strip
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires `rtl_433` >= 23.x (native LoRa demod). Owns SDR.
+
+            #{self}.parse_line(line: '{\"model\":\"LoRa\",\"sf\":7,\"bw\":125,...}')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end