pwn 0.5.617 → 0.5.620

data/lib/pwn/sdr/decoder/lte.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # LTE / UMTS / CDMA / PCS / AWS wideband cellular cell-search decoder.
+      #
+      # 1.4–20 MHz OFDMA/WCDMA cannot be recovered from GQRX audio; this
+      # module drives srsRAN's `cell_search` (or `LTE-Cell-Scanner`'s
+      # `CellSearch`) directly against the SDR to enumerate physical cells:
+      # EARFCN, PCI, CP type, RSRP/RSRQ, PSS/SSS correlation.
+      module LTE
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::LTE.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz       = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          gain     = (freq_obj[:rf_gain] || 40).to_s.to_f
+          sdr_args = (freq_obj[:sdr_args] || 'driver=rtlsdr').to_s
+
+          direct_cmd =
+            if PWN::SDR::Decoder::Base.bin_available?(bin: 'cell_search')
+              # srsRAN cell_search takes a band number; fall back to explicit
+              # DL frequency via -s/-e range when unavailable.
+              "cell_search -a #{Shellwords.escape(sdr_args)} -g #{gain} -s #{hz} -e #{hz}"
+            else
+              "CellSearch -s #{hz / 1_000_000.0} -e #{hz / 1_000_000.0} -g #{gain}"
+            end
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'LTE',
+            required_bins: %w[cell_search],
+            direct_cmd: direct_cmd,
+            line_match: /(CELL|PCI|EARFCN|Found|RSRP|CID)/i,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::LTE.parse_line(line: 'Found CELL ... PCI: 123 ... PRB: 50 ... -85.0 dBm')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'LTE' }
+          out[:earfcn] = ::Regexp.last_match(1) if line =~ /EARFCN[:= ]+(\d+)/i
+          out[:pci]    = ::Regexp.last_match(1) if line =~ /(?:PCI|N_id_cell|Id)[:= ]+(\d{1,3})/i
+          out[:prb]    = (::Regexp.last_match(1) || ::Regexp.last_match(2)) if line =~ /(?:PRB[:= ]+(\d+)|(\d+)\s*PRB)/i
+          out[:cp]     = ::Regexp.last_match(1) if line =~ /\b(Normal|Extended)\b\s*CP/i
+          out[:rsrp]   = ::Regexp.last_match(1) if line =~ /(-?\d+(?:\.\d+)?)\s*dBm/
+          out[:freq_mhz] = ::Regexp.last_match(1) if line =~ /(\d{3,4}\.\d)\s*MHz/
+          out[:summary] = "LTE PCI=#{out[:pci]} EARFCN=#{out[:earfcn]} PRB=#{out[:prb]} RSRP=#{out[:rsrp]}dBm"
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires srsRAN `cell_search` (or LTE-Cell-Scanner
+                  `CellSearch`). Owns the SDR — set freq_obj[:sdr_args].
+
+            #{self}.parse_line(line: 'Found CELL 739.0 MHz, EARFCN=5110, PCI=123, 50 PRB, -85.2 dBm')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/morse.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # CW / Morse decoder for the amateur CW sub-bands (cw20/cw40/cw80,
+      # amateur_30m). GQRX's CW demodulator produces a ~700 Hz sidetone in the
+      # 48 kHz UDP audio stream; multimon-ng's MORSE_CW demod recovers the
+      # dit/dah timing and prints decoded characters one line at a time.
+      module Morse
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Morse.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'MORSE-CW',
+            required_bins: %w[sox multimon-ng],
+            decode_cmd: 'multimon-ng -q -t raw -a MORSE_CW -',
+            line_match: /\S/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Morse.parse_line(line: 'CQ CQ DE W1AW')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s.gsub(/^MORSE(?:_CW)?:\s*/i, '').strip
+          out  = { protocol: 'MORSE-CW', text: line }
+          if (m = line.match(/\b([A-Z0-9]{1,3}\d[A-Z]{1,4})\b/))
+            out[:callsign] = m[1]
+          end
+          out[:summary] = "CW #{line}"[0, 120]
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            #{self}.parse_line(line: 'CQ CQ DE W1AW W1AW K')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/p25.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # APCO Project 25 (P25) Phase-1 C4FM decoder for the 700/800 MHz
+      # public-safety allocations. GQRX supplies NBFM-discriminator audio via
+      # the UDP tap; `dsd` (Digital Speech Decoder) recovers the C4FM symbol
+      # stream and prints trunking-control frames (NAC, TGID, RID, DUID, ...).
+      module P25
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::P25.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+
+          # dsd expects 48 kHz s16le on stdin — bypass Base's 22 050 Hz resample
+          # by asking for 48 000 (sox becomes a passthrough / format guard).
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'P25',
+            required_bins: %w[sox dsd],
+            resample_hz: 48_000,
+            decode_cmd: 'dsd -q -i - -o /dev/null -f1',
+            line_match: /(NAC|TGID|TG:|RID|src:|P25|Sync:)/i,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::P25.parse_line(line: 'Sync: +P25p1 NAC: 293 src: 1234 tg: 5678')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'P25' }
+          out[:nac]       = ::Regexp.last_match(1) if line =~ /NAC:\s*([0-9A-Fa-f]+)/
+          out[:talkgroup] = ::Regexp.last_match(1) if line =~ /(?:TGID|tg[: ])\s*(\d+)/i
+          out[:radio_id]  = ::Regexp.last_match(1) if line =~ /(?:RID|src[: ])\s*(\d+)/i
+          out[:duid]      = ::Regexp.last_match(1) if line =~ /DUID:\s*(\S+)/
+          out[:sync]      = ::Regexp.last_match(1) if line =~ /Sync:\s*(\S+)/
+          out[:summary]   = "P25 NAC=#{out[:nac]} TG=#{out[:talkgroup]} RID=#{out[:radio_id]}".squeeze(' ')
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires `dsd`. Set GQRX demod to Narrow FM, ~12.5 kHz.
+
+            #{self}.parse_line(line: 'Sync: +P25p1 NAC: 293 src: 1234 tg: 5678')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/pager.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # Combined pager decoder for the mixed-protocol `pager_all` band plan.
+      #
+      # Runs multimon-ng with FLEX + FLEX_NEXT + POCSAG512/1200/2400 enabled
+      # simultaneously and dispatches each output line to the appropriate
+      # per-protocol parser (::Flex-style or ::POCSAG.parse_line).
+      module Pager
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Pager.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+
+          decode_cmd = 'multimon-ng -q -t raw -e -u -p ' \
+                       '-a FLEX -a FLEX_NEXT ' \
+                       '-a POCSAG512 -a POCSAG1200 -a POCSAG2400 -'
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'PAGER',
+            required_bins: %w[sox multimon-ng],
+            decode_cmd: decode_cmd,
+            line_match: /^(FLEX|POCSAG)/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Pager.parse_line(line: 'FLEX|... or POCSAG1200: ...')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          return PWN::SDR::Decoder::POCSAG.parse_line(line: line) if line.start_with?('POCSAG')
+
+          # FLEX / FLEX_NEXT — pipe- or space-delimited (see ::Flex for format).
+          delim  = line.start_with?('FLEX: ') ? ' ' : '|'
+          parts  = line.split(delim)
+          proto  = line.start_with?('FLEX_NEXT') ? 'FLEX_NEXT' : 'FLEX'
+          types  = %w[ALN BIN HEX NUM TON TONE UNK]
+          t_idx  = parts.index { |p| types.include?(p) }
+          out    = { protocol: proto, raw_inspected: line.inspect }
+          out[:capcode]      = parts.find { |p| p.match?(/^\[?\d{7,10}\]?$/) }
+          out[:type]         = t_idx ? parts[t_idx] : nil
+          out[:type_payload] = t_idx ? parts[(t_idx + 1)..].join(delim) : nil
+          out[:summary]      = "#{proto} RIC=#{out[:capcode]} #{out[:type]}: #{out[:type_payload]}"
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            #{self}.parse_line(line: 'FLEX|3200|...|ALN|MESSAGE')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/pocsag.rb

@@ -5,7 +5,8 @@ module PWN
     module Decoder
       # POCSAG (CCIR Radiopaging Code No. 1) decoder for pager networks.
       #
-      # Pipeline: GQRX UDP audio → sox 48k→22.05k → multimon-ng POCSAG512/1200/2400.
+      # Pipeline (identical shape to PWN::SDR::Decoder::Flex):
+      #   GQRX 48 kHz s16le UDP audio → sox → 22 050 Hz → multimon-ng.
       #
       # multimon-ng emits lines of the form:
       #   POCSAG1200: Address:  123456  Function: 3  Alpha:   FIRE ALARM ZONE 4
@@ -13,8 +14,8 @@ module PWN
       #   POCSAG2400: Address:  987654  Function: 1  Skyper:  ...
       #   POCSAG1200: Address:  123456  Function: 2  Alpha:   <partial><EOT>
       #
-      # This module parses those into { protocol, baud, address, function,
-      # function_desc, type, type_desc, message } and JSON-logs each page.
+      # Each line is parsed into { protocol, baud, address/capcode, function,
+      # function_desc, type, type_desc, message } and JSON-logged.
       module POCSAG
         FUNCTION_DESC = {
           0 => 'Numeric (Tone/A)',
@@ -38,12 +39,19 @@ module PWN
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
 
+          # -e  hide empty messages
+          # -u  heuristically prune unlikely decodes (cuts BCH false-positives)
+          # -p  emit partially received messages (still useful intel)
+          # -f alpha  force Alpha framing when function bits are ambiguous —
+          #           mirrors the behaviour operators expect from Flex ALN.
+          decode_cmd = 'multimon-ng -q -t raw -e -u -p -f alpha ' \
+                       '-a POCSAG512 -a POCSAG1200 -a POCSAG2400 -'
+
           PWN::SDR::Decoder::Base.run_pipeline(
             freq_obj: freq_obj,
             protocol: 'POCSAG',
             required_bins: %w[sox multimon-ng],
-            decode_cmd: 'multimon-ng -q -t raw -e -u -p ' \
-                        '-a POCSAG512 -a POCSAG1200 -a POCSAG2400 -f auto -',
+            decode_cmd: decode_cmd,
             line_match: /^POCSAG(?:512|1200|2400):/,
             parser: proc { |line| parse_line(line: line) }
           )
@@ -54,14 +62,14 @@ module PWN
 
         public_class_method def self.parse_line(opts = {})
           line = opts[:line].to_s
-          out  = { protocol: 'POCSAG' }
+          out  = { protocol: 'POCSAG', raw_inspected: line.inspect }
 
           if (m = line.match(/^POCSAG(\d+):/))
             out[:baud] = m[1].to_i
           end
           if (m = line.match(/Address:\s*(\d+)/i))
             out[:address] = m[1].to_i
-            out[:capcode] = m[1]
+            out[:capcode] = m[1].rjust(7, '0')
           end
           if (m = line.match(/Function:\s*(\d+)/i))
             fn = m[1].to_i
@@ -70,11 +78,18 @@ module PWN
           end
           if (m = line.match(/\b(Alpha|Numeric|Skyper|Tone):\s*(.*)$/i))
             type = m[1].capitalize
-            out[:type]      = type
-            out[:type_desc] = TYPE_DESC[type] || 'Unknown'
-            out[:message]   = m[2].to_s.gsub(/<[A-Z]{2,3}>/, '').strip
+            out[:type]         = type
+            out[:type_desc]    = TYPE_DESC[type] || 'Unknown'
+            out[:type_payload] = m[2].to_s.gsub(/<[A-Z]{2,4}>/, '').strip
+            out[:message]      = out[:type_payload]
           end
-          out[:summary] = "POCSAG#{out[:baud]} RIC=#{out[:capcode]} F#{out[:function]} #{out[:type]}: #{out[:message]}"
+
+          bits = []
+          bits << "POCSAG#{out[:baud]}" if out[:baud]
+          bits << "RIC=#{out[:capcode]}" if out[:capcode]
+          bits << "F#{out[:function]}(#{out[:function_desc]})" if out[:function]
+          bits << "#{out[:type]}: #{out[:message]}" if out[:type]
+          out[:summary] = bits.join(' ')
           out
         end
 

data/lib/pwn/sdr/decoder/rfid.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # RFID decoder covering LF (125/134 kHz), HF (13.56 MHz) and UHF
+      # (860–960 MHz EPC Gen2). Near-field ASK/load-modulation is not
+      # recoverable from GQRX audio, so this drives a Proxmark3 (LF/HF) via
+      # `pm3 -c '...'` or `nfc-list` (HF), and `rtl_433` in flex/analyzer mode
+      # for UHF backscatter — whichever tool is present.
+      module RFID
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::RFID.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+
+          direct_cmd, bins, proto =
+            if hz < 1_000_000
+              ["pm3 -c 'lf search'", %w[pm3], 'RFID-LF']
+            elsif hz.between?(13_000_000, 14_000_000)
+              if PWN::SDR::Decoder::Base.bin_available?(bin: 'pm3')
+                ["pm3 -c 'hf search'", %w[pm3], 'RFID-HF']
+              else
+                ['nfc-list -v', %w[nfc-list], 'RFID-HF']
+              end
+            else
+              ["rtl_433 -f #{hz} -A -F json", %w[rtl_433], 'RFID-UHF']
+            end
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: proto,
+            required_bins: bins,
+            direct_cmd: direct_cmd,
+            line_match: /(UID|EPC|TAG|ATQA|SAK|EM4|HID|ISO|Chipset|"model")/i,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::RFID.parse_line(line: 'UID: 04 A1 B2 C3 D4 E5 F6')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'RFID' }
+          out[:uid]  = ::Regexp.last_match(1).delete(' ') if line =~ /UID[:=]?\s*((?:[0-9A-Fa-f]{2}\s*){4,10})/
+          out[:epc]  = ::Regexp.last_match(1) if line =~ /EPC[:=]?\s*([0-9A-Fa-f]+)/
+          out[:atqa] = ::Regexp.last_match(1) if line =~ /ATQA[:=]?\s*([0-9A-Fa-f ]+)/
+          out[:sak]  = ::Regexp.last_match(1) if line =~ /SAK[:=]?\s*([0-9A-Fa-f]+)/
+          out[:tag]  = ::Regexp.last_match(1) if line =~ /(EM4\w+|HID\w*|Mifare\w*|NTAG\w*|ISO\s?\d+)/i
+          out[:summary] = "RFID #{out[:tag]} UID=#{out[:uid] || out[:epc]}".squeeze(' ')
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: LF/HF need a Proxmark3 (`pm3`) or libnfc reader; UHF uses
+                  `rtl_433 -A`. Band chosen automatically from freq_obj[:freq].
+
+            #{self}.parse_line(line: 'UID: 04 A1 B2 C3 D4 E5 F6  SAK: 08  Mifare Classic 1K')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/rtl433.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # Generic ISM/keyfob/sensor decoder backed by `rtl_433`.
+      #
+      # Covers the OOK/ASK/FSK device zoo on 300–315 / 390 / 433.92 / 868 /
+      # 902–928 MHz: car/garage keyfobs, TPMS, weather stations, utility
+      # meters, doorbells, alarm PIRs, etc. rtl_433 owns the SDR directly and
+      # emits one JSON object per decoded frame (`-F json`), which this module
+      # merges verbatim into the freq_obj log line.
+      module RTL433
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::RTL433.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz       = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          gain     = freq_obj[:rf_gain]
+          sdr_args = freq_obj[:sdr_args].to_s
+
+          cmd = ['rtl_433', '-f', hz.to_s, '-F', 'json', '-M', 'level', '-M', 'protocol']
+          cmd.push('-g', gain.to_s) if gain
+          cmd.push('-d', sdr_args) unless sdr_args.empty?
+          direct_cmd = Shellwords.join(cmd)
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'RTL433',
+            required_bins: %w[rtl_433],
+            direct_cmd: direct_cmd,
+            line_match: /^\s*{/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::RTL433.parse_line(line: '{"time":"...","model":"..."}')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          h = begin
+            JSON.parse(line, symbolize_names: true)
+          rescue StandardError
+            { unparsed: line }
+          end
+          out = { protocol: 'RTL433' }.merge(h)
+
+          bits = []
+          bits << out[:model].to_s if out[:model]
+          bits << "id=#{out[:id]}" if out[:id]
+          bits << "ch=#{out[:channel]}" if out[:channel]
+          bits << "code=#{out[:code]}" if out[:code]
+          bits << "cmd=#{out[:cmd] || out[:button]}" if out[:cmd] || out[:button]
+          bits << "temp=#{out[:temperature_C]}C" if out[:temperature_C]
+          bits << "rssi=#{out[:rssi]}" if out[:rssi]
+          out[:summary] = bits.empty? ? line[0, 120] : bits.join(' ')
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires `rtl_433`. Owns the SDR directly (pass
+                  freq_obj[:sdr_args] like ':1' or 'driver=hackrf' to select
+                  a device other than the one GQRX is holding).
+
+            #{self}.parse_line(line: '{\"model\":\"Acurite-Tower\",\"id\":1234,...}')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/rtty.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # RTTY (Radioteletype, ITA2/Baudot) decoder for the amateur RTTY
+      # sub-bands (rtty20/rtty40/rtty80). GQRX supplies FM-demodulated audio
+      # containing the classic 170 Hz-shift 45.45-baud mark/space tones;
+      # `minimodem` recovers the 5-bit Baudot stream and prints ASCII.
+      module RTTY
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::RTTY.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+
+          # minimodem reads s16le mono from stdin at the rate we hand it; keep
+          # sox at 22 050 Hz (Base default) and tell minimodem the same.
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'RTTY',
+            required_bins: %w[sox minimodem],
+            decode_cmd: 'minimodem --rx --quiet --rtty -R 22050 -f -',
+            line_match: /\S/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::RTTY.parse_line(line: 'RYRYRY DE W1AW')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s.strip
+          out  = { protocol: 'RTTY', text: line }
+          if (m = line.match(/\bDE\s+([A-Z0-9]{1,3}\d[A-Z]{1,4})\b/))
+            out[:callsign] = m[1]
+          end
+          out[:summary] = "RTTY #{line}"[0, 120]
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            #{self}.parse_line(line: 'RYRYRY CQ CQ DE W1AW')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end