pwn 0.5.618 → 0.5.620

data/lib/pwn/sdr/decoder/gsm.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'shellwords'
+
 module PWN
   module SDR
     module Decoder
@@ -7,14 +9,32 @@ module PWN
       #
       # GSM is 270.833 kbit/s GMSK — it CANNOT be recovered from GQRX's 48 kHz
       # demodulated-audio UDP tap. This module therefore drives the SDR
-      # directly via `grgsm_livemon_headless` (from gr-gsm) which publishes
-      # decoded Um bursts as GSMTAP on udp/4729, then reads them back with
+      # directly via `grgsm_livemon_headless` (from gr-gsm), which publishes
+      # decoded Um bursts as GSMTAP on udp/4729, and reads them back with
       # `tshark` for structured field extraction (MCC/MNC/LAC/CI/ARFCN, paging
       # IMSIs/TMSIs, System Information messages, etc.).
       #
       # Interface matches PWN::SDR::Decoder::Flex / ::RDS so the GQRX
       # dispatcher (`decoder: :gsm`) works uniformly.
+      #
+      # NOTE: grgsm_livemon_headless opens the SDR hardware itself. If GQRX
+      # already owns the device, pass a distinct `--args` string via
+      # freq_obj[:sdr_args] (e.g. 'rtl=1' or 'hackrf=0') or stop GQRX's DSP
+      # first (`U DSP 0`).
       module GSM
+        TSHARK_FIELDS = %w[
+          frame.time
+          gsmtap.arfcn
+          gsmtap.chan_type
+          gsm_a.imsi
+          gsm_a.tmsi
+          e212.mcc
+          e212.mnc
+          gsm_a.lac
+          gsm_a.bssmap.cell_ci
+          gsm_a.dtap.msg_rr_type
+        ].freeze
+
         # Supported Method Parameters::
         # PWN::SDR::Decoder::GSM.decode(
         #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
@@ -24,26 +44,25 @@ module PWN
           freq_obj = opts[:freq_obj]
           raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
 
-          hz   = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
-          gain = (freq_obj[:rf_gain] || 40).to_s.to_f
-
-          tshark_fields = %w[
-            frame.time
-            gsmtap.arfcn
-            gsmtap.chan_type
-            gsm_a.imsi
-            gsm_a.tmsi
-            e212.mcc
-            e212.mnc
-            gsm_a.lac
-            gsm_a.bssmap.cell_ci
-            gsm_a.dtap.msg_rr_type
-          ]
-
-          direct_cmd = "sh -c 'grgsm_livemon_headless -f #{hz} -g #{gain} >/dev/null 2>&1 & " \
-                       'LMPID=$!; trap "kill $LMPID 2>/dev/null" EXIT; sleep 2; ' \
-                       'tshark -i lo -l -Y gsmtap -T fields -E separator=\| ' \
-                       "#{tshark_fields.map { |f| "-e #{f}" }.join(' ')}'"
+          hz       = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          gain     = (freq_obj[:rf_gain] || 40).to_s.to_f
+          sdr_args = freq_obj[:sdr_args].to_s
+          gsmtap   = (freq_obj[:gsmtap_port] || 4729).to_i
+
+          grgsm = ['grgsm_livemon_headless', '-f', hz.to_s, '-g', gain.to_s]
+          grgsm.push('--args', sdr_args) unless sdr_args.empty?
+
+          tshark = ['tshark', '-i', 'lo', '-l', '-n',
+                    '-f', "udp port #{gsmtap}",
+                    '-Y', 'gsmtap',
+                    '-T', 'fields', '-E', 'separator=|']
+          TSHARK_FIELDS.each { |f| tshark.push('-e', f) }
+
+          # bash -c '<grgsm> >/dev/null 2>&1 & pid=$!; trap ... ; <tshark>'
+          inner = "#{Shellwords.join(grgsm)} >/dev/null 2>&1 & " \
+                  'LMPID=$!; trap "kill $LMPID 2>/dev/null" EXIT INT TERM; ' \
+                  "sleep 2; exec #{Shellwords.join(tshark)}"
+          direct_cmd = "bash -c #{Shellwords.escape(inner)}"
 
           PWN::SDR::Decoder::Base.run_pipeline(
             freq_obj: freq_obj,
@@ -63,6 +82,7 @@ module PWN
           f = line.split('|', -1)
           out = {
             protocol: 'GSM',
+            frame_time: f[0],
             arfcn: f[1],
             chan_type: f[2],
             imsi: f[3],
@@ -80,13 +100,13 @@ module PWN
             out[:imsi_msin] = out[:imsi][6..]
           end
 
-          summary_bits = []
-          summary_bits << "ARFCN=#{out[:arfcn]}" if out[:arfcn]
-          summary_bits << "MCC/MNC=#{out[:mcc]}/#{out[:mnc]}" if out[:mcc]
-          summary_bits << "LAC=#{out[:lac]} CI=#{out[:cell_id]}" if out[:lac]
-          summary_bits << "IMSI=#{out[:imsi]}" if out[:imsi]
-          summary_bits << "TMSI=#{out[:tmsi]}" if out[:tmsi]
-          out[:summary] = "GSM #{summary_bits.join(' ')}".strip
+          bits = []
+          bits << "ARFCN=#{out[:arfcn]}" if out[:arfcn]
+          bits << "MCC/MNC=#{out[:mcc]}/#{out[:mnc]}" if out[:mcc]
+          bits << "LAC=#{out[:lac]} CI=#{out[:cell_id]}" if out[:lac]
+          bits << "IMSI=#{out[:imsi]}" if out[:imsi]
+          bits << "TMSI=#{out[:tmsi]}" if out[:tmsi]
+          out[:summary] = "GSM #{bits.join(' ')}".strip
           out
         end
 
@@ -107,6 +127,7 @@ module PWN
             NOTE: Requires `grgsm_livemon_headless` (gr-gsm) and `tshark`.
                   GSM cannot be decoded from GQRX's 48 kHz audio tap; this
                   module drives the SDR directly and reads GSMTAP on lo:4729.
+                  Set freq_obj[:sdr_args] (e.g. 'rtl=1') if GQRX owns device 0.
 
             #{self}.parse_line(line: 'ts|arfcn|chan|imsi|tmsi|mcc|mnc|lac|ci|rr')
 

data/lib/pwn/sdr/decoder/iridium.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # Iridium L-band (1.616–1.6265 GHz) burst decoder. Drives gr-iridium's
+      # `iridium-extractor` against the SDR to demodulate 25 kbit/s DE-QPSK
+      # simplex/duplex bursts, then pipes them through iridium-toolkit's
+      # `iridium-parser.py` for frame classification (IRA/IBC/IDA/ISY/VOC/...).
+      module Iridium
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Iridium.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz       = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          gain     = (freq_obj[:rf_gain] || 40).to_s.to_f
+          sdr_args = (freq_obj[:sdr_args] || 'rtl=0').to_s
+
+          inner = "iridium-extractor -D 4 --multi-frame -c #{hz} -r 2000000 " \
+                  "-g #{gain} -o - #{Shellwords.escape(sdr_args)} 2>/dev/null " \
+                  '| iridium-parser.py --harder /dev/stdin'
+          direct_cmd = "bash -c #{Shellwords.escape(inner)}"
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'IRIDIUM',
+            required_bins: %w[iridium-extractor iridium-parser.py],
+            direct_cmd: direct_cmd,
+            line_match: /^(IRA|IBC|IDA|ISY|ITL|MSG|VOC|RAW):/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Iridium.parse_line(line: 'IRA: sat:23 beam:14 ...')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'IRIDIUM' }
+          out[:frame_type] = ::Regexp.last_match(1) if line =~ /^([A-Z]{3}):/
+          out[:sat]        = ::Regexp.last_match(1) if line =~ /sat:(\d+)/
+          out[:beam]       = ::Regexp.last_match(1) if line =~ /beam:(\d+)/
+          out[:pos]        = ::Regexp.last_match(1) if line =~ /pos=\(([^)]+)\)/
+          out[:ra_id]      = ::Regexp.last_match(1) if line =~ /ric:(\d+)/
+          out[:summary]    = "IRIDIUM #{out[:frame_type]} sat=#{out[:sat]} beam=#{out[:beam]}"
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires `iridium-extractor` (gr-iridium) and
+                  `iridium-parser.py` (iridium-toolkit). Owns the SDR.
+
+            #{self}.parse_line(line: 'IRA: sat:23 beam:14 pos=(+32.1/-097.0) ...')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/lora.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # LoRa / LoRaWAN CSS decoder for the 433 / 868 / 902–928 MHz ISM
+      # allocations. Chirp-spread-spectrum needs raw I/Q, so this drives
+      # `rtl_433` (which ships a native LoRa demod, protocol #264) directly.
+      # Emits one JSON line per decoded uplink containing SF/BW/CR, DevAddr,
+      # FCnt, and raw PHYPayload hex.
+      module LoRa
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::LoRa.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz       = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          sdr_args = freq_obj[:sdr_args].to_s
+
+          cmd = ['rtl_433', '-f', hz.to_s, '-s', '1024k',
+                 '-R', '264', '-F', 'json', '-M', 'level']
+          cmd.push('-d', sdr_args) unless sdr_args.empty?
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'LoRa',
+            required_bins: %w[rtl_433],
+            direct_cmd: Shellwords.join(cmd),
+            line_match: /^\s*{/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::LoRa.parse_line(line: '{"model":"LoRa",...}')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          h = begin
+            JSON.parse(line, symbolize_names: true)
+          rescue StandardError
+            { unparsed: line }
+          end
+          out = { protocol: 'LoRa' }.merge(h)
+          bits = []
+          bits << "SF#{out[:sf]}" if out[:sf]
+          bits << "BW#{out[:bw]}" if out[:bw]
+          bits << "CR#{out[:cr]}" if out[:cr]
+          bits << "DevAddr=#{out[:devaddr] || out[:id]}" if out[:devaddr] || out[:id]
+          bits << "FCnt=#{out[:fcnt]}" if out[:fcnt]
+          bits << "len=#{out[:len] || (out[:data].to_s.length / 2)}" if out[:len] || out[:data]
+          out[:summary] = "LoRa #{bits.join(' ')}".strip
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires `rtl_433` >= 23.x (native LoRa demod). Owns SDR.
+
+            #{self}.parse_line(line: '{\"model\":\"LoRa\",\"sf\":7,\"bw\":125,...}')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/lte.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require 'shellwords'
+
+module PWN
+  module SDR
+    module Decoder
+      # LTE / UMTS / CDMA / PCS / AWS wideband cellular cell-search decoder.
+      #
+      # 1.4–20 MHz OFDMA/WCDMA cannot be recovered from GQRX audio; this
+      # module drives srsRAN's `cell_search` (or `LTE-Cell-Scanner`'s
+      # `CellSearch`) directly against the SDR to enumerate physical cells:
+      # EARFCN, PCI, CP type, RSRP/RSRQ, PSS/SSS correlation.
+      module LTE
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::LTE.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          hz       = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          gain     = (freq_obj[:rf_gain] || 40).to_s.to_f
+          sdr_args = (freq_obj[:sdr_args] || 'driver=rtlsdr').to_s
+
+          direct_cmd =
+            if PWN::SDR::Decoder::Base.bin_available?(bin: 'cell_search')
+              # srsRAN cell_search takes a band number; fall back to explicit
+              # DL frequency via -s/-e range when unavailable.
+              "cell_search -a #{Shellwords.escape(sdr_args)} -g #{gain} -s #{hz} -e #{hz}"
+            else
+              "CellSearch -s #{hz / 1_000_000.0} -e #{hz / 1_000_000.0} -g #{gain}"
+            end
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'LTE',
+            required_bins: %w[cell_search],
+            direct_cmd: direct_cmd,
+            line_match: /(CELL|PCI|EARFCN|Found|RSRP|CID)/i,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::LTE.parse_line(line: 'Found CELL ... PCI: 123 ... PRB: 50 ... -85.0 dBm')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'LTE' }
+          out[:earfcn] = ::Regexp.last_match(1) if line =~ /EARFCN[:= ]+(\d+)/i
+          out[:pci]    = ::Regexp.last_match(1) if line =~ /(?:PCI|N_id_cell|Id)[:= ]+(\d{1,3})/i
+          out[:prb]    = (::Regexp.last_match(1) || ::Regexp.last_match(2)) if line =~ /(?:PRB[:= ]+(\d+)|(\d+)\s*PRB)/i
+          out[:cp]     = ::Regexp.last_match(1) if line =~ /\b(Normal|Extended)\b\s*CP/i
+          out[:rsrp]   = ::Regexp.last_match(1) if line =~ /(-?\d+(?:\.\d+)?)\s*dBm/
+          out[:freq_mhz] = ::Regexp.last_match(1) if line =~ /(\d{3,4}\.\d)\s*MHz/
+          out[:summary] = "LTE PCI=#{out[:pci]} EARFCN=#{out[:earfcn]} PRB=#{out[:prb]} RSRP=#{out[:rsrp]}dBm"
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires srsRAN `cell_search` (or LTE-Cell-Scanner
+                  `CellSearch`). Owns the SDR — set freq_obj[:sdr_args].
+
+            #{self}.parse_line(line: 'Found CELL 739.0 MHz, EARFCN=5110, PCI=123, 50 PRB, -85.2 dBm')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/morse.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # CW / Morse decoder for the amateur CW sub-bands (cw20/cw40/cw80,
+      # amateur_30m). GQRX's CW demodulator produces a ~700 Hz sidetone in the
+      # 48 kHz UDP audio stream; multimon-ng's MORSE_CW demod recovers the
+      # dit/dah timing and prints decoded characters one line at a time.
+      module Morse
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Morse.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'MORSE-CW',
+            required_bins: %w[sox multimon-ng],
+            decode_cmd: 'multimon-ng -q -t raw -a MORSE_CW -',
+            line_match: /\S/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Morse.parse_line(line: 'CQ CQ DE W1AW')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s.gsub(/^MORSE(?:_CW)?:\s*/i, '').strip
+          out  = { protocol: 'MORSE-CW', text: line }
+          if (m = line.match(/\b([A-Z0-9]{1,3}\d[A-Z]{1,4})\b/))
+            out[:callsign] = m[1]
+          end
+          out[:summary] = "CW #{line}"[0, 120]
+          out
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            #{self}.parse_line(line: 'CQ CQ DE W1AW W1AW K')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/p25.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # APCO Project 25 (P25) Phase-1 C4FM decoder for the 700/800 MHz
+      # public-safety allocations. GQRX supplies NBFM-discriminator audio via
+      # the UDP tap; `dsd` (Digital Speech Decoder) recovers the C4FM symbol
+      # stream and prints trunking-control frames (NAC, TGID, RID, DUID, ...).
+      module P25
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::P25.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+
+          # dsd expects 48 kHz s16le on stdin — bypass Base's 22 050 Hz resample
+          # by asking for 48 000 (sox becomes a passthrough / format guard).
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'P25',
+            required_bins: %w[sox dsd],
+            resample_hz: 48_000,
+            decode_cmd: 'dsd -q -i - -o /dev/null -f1',
+            line_match: /(NAC|TGID|TG:|RID|src:|P25|Sync:)/i,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::P25.parse_line(line: 'Sync: +P25p1 NAC: 293 src: 1234 tg: 5678')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'P25' }
+          out[:nac]       = ::Regexp.last_match(1) if line =~ /NAC:\s*([0-9A-Fa-f]+)/
+          out[:talkgroup] = ::Regexp.last_match(1) if line =~ /(?:TGID|tg[: ])\s*(\d+)/i
+          out[:radio_id]  = ::Regexp.last_match(1) if line =~ /(?:RID|src[: ])\s*(\d+)/i
+          out[:duid]      = ::Regexp.last_match(1) if line =~ /DUID:\s*(\S+)/
+          out[:sync]      = ::Regexp.last_match(1) if line =~ /Sync:\s*(\S+)/
+          out[:summary]   = "P25 NAC=#{out[:nac]} TG=#{out[:talkgroup]} RID=#{out[:radio_id]}".squeeze(' ')
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            NOTE: Requires `dsd`. Set GQRX demod to Narrow FM, ~12.5 kHz.
+
+            #{self}.parse_line(line: 'Sync: +P25p1 NAC: 293 src: 1234 tg: 5678')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/pager.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # Combined pager decoder for the mixed-protocol `pager_all` band plan.
+      #
+      # Runs multimon-ng with FLEX + FLEX_NEXT + POCSAG512/1200/2400 enabled
+      # simultaneously and dispatches each output line to the appropriate
+      # per-protocol parser (::Flex-style or ::POCSAG.parse_line).
+      module Pager
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Pager.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+
+          decode_cmd = 'multimon-ng -q -t raw -e -u -p ' \
+                       '-a FLEX -a FLEX_NEXT ' \
+                       '-a POCSAG512 -a POCSAG1200 -a POCSAG2400 -'
+
+          PWN::SDR::Decoder::Base.run_pipeline(
+            freq_obj: freq_obj,
+            protocol: 'PAGER',
+            required_bins: %w[sox multimon-ng],
+            decode_cmd: decode_cmd,
+            line_match: /^(FLEX|POCSAG)/,
+            parser: proc { |line| parse_line(line: line) }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Pager.parse_line(line: 'FLEX|... or POCSAG1200: ...')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          return PWN::SDR::Decoder::POCSAG.parse_line(line: line) if line.start_with?('POCSAG')
+
+          # FLEX / FLEX_NEXT — pipe- or space-delimited (see ::Flex for format).
+          delim  = line.start_with?('FLEX: ') ? ' ' : '|'
+          parts  = line.split(delim)
+          proto  = line.start_with?('FLEX_NEXT') ? 'FLEX_NEXT' : 'FLEX'
+          types  = %w[ALN BIN HEX NUM TON TONE UNK]
+          t_idx  = parts.index { |p| types.include?(p) }
+          out    = { protocol: proto, raw_inspected: line.inspect }
+          out[:capcode]      = parts.find { |p| p.match?(/^\[?\d{7,10}\]?$/) }
+          out[:type]         = t_idx ? parts[t_idx] : nil
+          out[:type_payload] = t_idx ? parts[(t_idx + 1)..].join(delim) : nil
+          out[:summary]      = "#{proto} RIC=#{out[:capcode]} #{out[:type]}: #{out[:type_payload]}"
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE:
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            #{self}.parse_line(line: 'FLEX|3200|...|ALN|MESSAGE')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/pocsag.rb

@@ -5,7 +5,8 @@ module PWN
     module Decoder
       # POCSAG (CCIR Radiopaging Code No. 1) decoder for pager networks.
       #
-      # Pipeline: GQRX UDP audio → sox 48k→22.05k → multimon-ng POCSAG512/1200/2400.
+      # Pipeline (identical shape to PWN::SDR::Decoder::Flex):
+      #   GQRX 48 kHz s16le UDP audio → sox → 22 050 Hz → multimon-ng.
       #
       # multimon-ng emits lines of the form:
       #   POCSAG1200: Address:  123456  Function: 3  Alpha:   FIRE ALARM ZONE 4
@@ -13,8 +14,8 @@ module PWN
       #   POCSAG2400: Address:  987654  Function: 1  Skyper:  ...
       #   POCSAG1200: Address:  123456  Function: 2  Alpha:   <partial><EOT>
       #
-      # This module parses those into { protocol, baud, address, function,
-      # function_desc, type, type_desc, message } and JSON-logs each page.
+      # Each line is parsed into { protocol, baud, address/capcode, function,
+      # function_desc, type, type_desc, message } and JSON-logged.
       module POCSAG
         FUNCTION_DESC = {
           0 => 'Numeric (Tone/A)',
@@ -38,12 +39,19 @@ module PWN
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
 
+          # -e  hide empty messages
+          # -u  heuristically prune unlikely decodes (cuts BCH false-positives)
+          # -p  emit partially received messages (still useful intel)
+          # -f alpha  force Alpha framing when function bits are ambiguous —
+          #           mirrors the behaviour operators expect from Flex ALN.
+          decode_cmd = 'multimon-ng -q -t raw -e -u -p -f alpha ' \
+                       '-a POCSAG512 -a POCSAG1200 -a POCSAG2400 -'
+
           PWN::SDR::Decoder::Base.run_pipeline(
             freq_obj: freq_obj,
             protocol: 'POCSAG',
             required_bins: %w[sox multimon-ng],
-            decode_cmd: 'multimon-ng -q -t raw -e -u -p ' \
-                        '-a POCSAG512 -a POCSAG1200 -a POCSAG2400 -f auto -',
+            decode_cmd: decode_cmd,
             line_match: /^POCSAG(?:512|1200|2400):/,
             parser: proc { |line| parse_line(line: line) }
           )
@@ -54,14 +62,14 @@ module PWN
 
         public_class_method def self.parse_line(opts = {})
           line = opts[:line].to_s
-          out  = { protocol: 'POCSAG' }
+          out  = { protocol: 'POCSAG', raw_inspected: line.inspect }
 
           if (m = line.match(/^POCSAG(\d+):/))
             out[:baud] = m[1].to_i
           end
           if (m = line.match(/Address:\s*(\d+)/i))
             out[:address] = m[1].to_i
-            out[:capcode] = m[1]
+            out[:capcode] = m[1].rjust(7, '0')
           end
           if (m = line.match(/Function:\s*(\d+)/i))
             fn = m[1].to_i
@@ -70,11 +78,18 @@ module PWN
           end
           if (m = line.match(/\b(Alpha|Numeric|Skyper|Tone):\s*(.*)$/i))
             type = m[1].capitalize
-            out[:type]      = type
-            out[:type_desc] = TYPE_DESC[type] || 'Unknown'
-            out[:message]   = m[2].to_s.gsub(/<[A-Z]{2,3}>/, '').strip
+            out[:type]         = type
+            out[:type_desc]    = TYPE_DESC[type] || 'Unknown'
+            out[:type_payload] = m[2].to_s.gsub(/<[A-Z]{2,4}>/, '').strip
+            out[:message]      = out[:type_payload]
           end
-          out[:summary] = "POCSAG#{out[:baud]} RIC=#{out[:capcode]} F#{out[:function]} #{out[:type]}: #{out[:message]}"
+
+          bits = []
+          bits << "POCSAG#{out[:baud]}" if out[:baud]
+          bits << "RIC=#{out[:capcode]}" if out[:capcode]
+          bits << "F#{out[:function]}(#{out[:function_desc]})" if out[:function]
+          bits << "#{out[:type]}: #{out[:message]}" if out[:type]
+          out[:summary] = bits.join(' ')
           out
         end