pwn 0.5.618 → 0.5.621

data/lib/pwn/sdr/decoder/base.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 require 'json'
-require 'open3'
 require 'tty-spinner'
 require 'tty-screen'
 require 'io/wait'
@@ -9,199 +8,205 @@ require 'io/wait'
 module PWN
   module SDR
     module Decoder
-      # Shared pipeline plumbing for every PWN::SDR::Decoder::* module.
+      # Shared, 100 % Ruby-native pipeline plumbing for every
+      # PWN::SDR::Decoder::* module.
       #
-      # Encapsulates the pattern established by PWN::SDR::Decoder::Flex and
-      # PWN::SDR::Decoder::RDS:
+      # Two entry points, neither of which shell out to any external binary:
       #
-      #   1. Bind to the GQRX UDP audio stream (48 kHz s16le mono).
-      #   2. Feed it through `sox` (resample to 22 050 Hz) into an external
-      #      demodulator (multimon-ng, rtl_433, acarsdec, dsd, ...).
-      #   3. Read decoded lines back on a background thread, hand each to a
-      #      caller-supplied parser Proc, merge with freq_obj, JSON-log it.
-      #   4. Show a TTY::Spinner status line and exit cleanly on [ENTER].
+      #   run_native  — Bind the GQRX 48 kHz s16le mono UDP audio tap, unpack
+      #                 the samples with PWN::SDR::Decoder::DSP, hand each
+      #                 chunk to a caller-supplied `demod:` object that
+      #                 responds to `#feed(samples, &emit)`. Every Hash the
+      #                 demodulator emits is merged with freq_obj, JSON-
+      #                 pretty-printed, JSONL-logged, and shown on the
+      #                 spinner. [ENTER] stops cleanly.
       #
-      # Decoders whose external tool needs raw I/Q direct from the SDR (ADSB,
-      # GSM, LoRa, WiFi, ZigBee, ...) can instead pass `direct_cmd:` — Base
-      # will spawn it stand-alone (no UDP → sox bridge) and still handle the
-      # spinner / stdout parser / logging / [ENTER]-to-skip loop uniformly.
+      #   run_detector — For protocols whose bit-rate/bandwidth cannot be
+      #                 recovered from a 48 kHz demodulated-audio tap (GSM,
+      #                 LTE, ADS-B, WiFi, LoRa, GPS, DECT, ZigBee, Bluetooth,
+      #                 Iridium, P25, ISM/RFID …). Pure-Ruby energy / burst
+      #                 characteriser: polls GQRX `l STRENGTH`, and (when the
+      #                 UDP tap is enabled) computes RMS-dBFS on the audio.
+      #                 Emits `{event: 'burst', dbfs:, duration_ms:}` frames
+      #                 whenever the signal crosses an adaptive threshold, so
+      #                 the operator still gets structured, logged intel
+      #                 without ANY external decoding binary.
       module Base
         # Supported Method Parameters::
-        # PWN::SDR::Decoder::Base.run_pipeline(
-        #   freq_obj:    'required - freq_obj Hash from PWN::SDR::GQRX.init_freq',
-        #   protocol:    'required - short name used in banner / log filename',
-        #   decode_cmd:  'optional - shell pipeline reading 22 050 Hz s16le on stdin',
-        #   direct_cmd:  'optional - stand-alone shell cmd (owns the SDR itself)',
-        #   line_match:  'optional - Regexp/String a stdout line must match',
-        #   parser:      'optional - Proc.new { |line| Hash } to structure a line',
-        #   required_bins: 'optional - Array of executables that must exist on PATH',
-        #   resample_hz: 'optional - sox output rate for decode_cmd (default 22050)'
+        # PWN::SDR::Decoder::Base.run_native(
+        #   freq_obj: 'required - freq_obj Hash from PWN::SDR::GQRX.init_freq',
+        #   protocol: 'required - short name for banner / log filename',
+        #   demod:    'required - object responding to #feed(samples,&emit)',
+        #   rate:     'optional - assumed UDP sample rate (default 48000)'
         # )
 
-        public_class_method def self.run_pipeline(opts = {})
-          freq_obj      = opts[:freq_obj]
-          protocol      = opts[:protocol] || 'SIGNAL'
-          decode_cmd    = opts[:decode_cmd]
-          direct_cmd    = opts[:direct_cmd]
-          line_match    = opts[:line_match]
-          parser        = opts[:parser]
-          required_bins = Array(opts[:required_bins])
-          resample_hz   = opts[:resample_hz] || 22_050
+        public_class_method def self.run_native(opts = {})
+          freq_obj = opts[:freq_obj]
+          protocol = opts[:protocol] || 'SIGNAL'
+          demod    = opts[:demod]
+          rate     = (opts[:rate] || 48_000).to_i
 
           raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+          raise 'ERROR: :demod must respond to #feed' unless demod.respond_to?(:feed)
 
-          gqrx_sock = freq_obj[:gqrx_sock]
-          udp_ip    = freq_obj[:udp_ip]   || '127.0.0.1'
-          udp_port  = freq_obj[:udp_port] || 7355
-          freq_obj  = freq_obj.dup
-          freq_obj.delete(:gqrx_sock)
-          freq_obj.delete(:decoder_module)
-
-          skip_freq_char = "\n"
+          udp_ip   = freq_obj[:udp_ip]   || '127.0.0.1'
+          udp_port = freq_obj[:udp_port] || 7355
+          log_obj  = strip_freq_obj(freq_obj: freq_obj)
 
-          puts JSON.pretty_generate(freq_obj)
-          puts "\n*** #{protocol} Decoder ***"
+          puts JSON.pretty_generate(log_obj)
+          puts "\n*** #{protocol} Decoder (ruby-native) ***"
           puts 'Press [ENTER] to continue to next frequency...'
 
-          missing = required_bins.reject { |b| bin_available?(bin: b) }
-          unless missing.empty?
-            puts "[!] Missing required executable(s): #{missing.join(', ')}"
-            puts '    Install them and re-run, or press [ENTER] to skip.'
-          end
-
-          spinner = TTY::Spinner.new(
-            '[:spinner] :status',
-            format: :arrow_pulse,
-            clear: true,
-            hide_cursor: true
+          spinner, max_len = build_spinner(
+            banner: "INFO: Decoding #{protocol} on udp://#{udp_ip}:#{udp_port} @ #{rate} Hz (native)"
           )
-          spinner_overhead = 12
-          max_title_length = [TTY::Screen.width - spinner_overhead, 50].max
-          banner = "INFO: Decoding #{protocol} on udp://#{udp_ip}:#{udp_port} ..."
-          banner = "INFO: Decoding #{protocol} via `#{direct_cmd.to_s.split.first}` ..." if direct_cmd
-          banner = banner[0...max_title_length] if banner.length > max_title_length
-          spinner.update(status: banner)
-          spinner.auto_spin
-
-          log_file = "/tmp/#{protocol.downcase.gsub(/[^a-z0-9]+/, '_')}_decoder_#{Time.now.strftime('%Y%m%d')}.log"
-
-          udp_listener = nil
-          receiver_thread = nil
-          mm_stdin = mm_stdout = mm_stderr = mm_wait_thr = nil
+          log_file = log_path(protocol: protocol)
 
-          if direct_cmd && missing.empty?
-            mm_stdin, mm_stdout, mm_stderr, mm_wait_thr = Open3.popen3(direct_cmd)
-          elsif decode_cmd && missing.empty?
-            udp_listener = PWN::SDR::GQRX.listen_udp(udp_ip: udp_ip, udp_port: udp_port)
+          udp_listener = PWN::SDR::GQRX.listen_udp(udp_ip: udp_ip, udp_port: udp_port)
+          audio_q      = Queue.new
+          current_line = 'Waiting for data frames...'
 
-            full_cmd = 'sox -t raw -e signed-integer -b 16 -r 48000 -c 1 - ' \
-                       "-t raw -e signed-integer -b 16 -r #{resample_hz} -c 1 - | #{decode_cmd}"
-            mm_stdin, mm_stdout, mm_stderr, mm_wait_thr = Open3.popen3(full_cmd)
-
-            receiver_thread = Thread.new do
-              loop do
-                data, = udp_listener.recv(4096)
-                next unless data.to_s.bytesize.positive?
-
-                mm_stdin.write(data)
-                begin
-                  mm_stdin.flush
-                rescue StandardError
-                  nil
-                end
-              end
-            rescue IOError, Errno::EPIPE, Errno::ECONNRESET
-              nil
+          receiver_thread = Thread.new do
+            loop do
+              data, = udp_listener.recv(4096)
+              audio_q.push(data) if data.to_s.bytesize.positive?
             end
+          rescue IOError, Errno::ECONNRESET, Errno::EBADF
+            nil
           end
 
-          current_title = 'Waiting for data frames...'
-          decoder_thread = nil
-          if mm_stdout
-            decoder_thread = Thread.new do
-              buffer = ''
-              loop do
-                chunk = mm_stdout.readpartial(4096)
-                buffer = "#{buffer}#{chunk}"
-                while (line = buffer.slice!(/^.*\n/))
-                  line = line.chomp
-                  next if line.empty?
-                  next if line_match && !match_line?(line: line, matcher: line_match)
-
-                  dec_msg = { decoded_at: Time.now.strftime('%Y-%m-%d %H:%M:%S%z'), raw: line }
-                  dec_msg.merge!(parser.call(line)) if parser.respond_to?(:call)
-                  final_msg = freq_obj.merge(dec_msg)
-
-                  spinner.stop
-                  puts JSON.pretty_generate(final_msg)
-                  spinner.auto_spin
-
-                  File.open(log_file, 'a') { |f| f.puts("#{JSON.generate(final_msg)},") }
-                  disp = dec_msg[:summary] || line
-                  current_title = disp[0...max_title_length]
-                end
-              rescue IOError
-                break
-              end
+          decoder_thread = Thread.new do
+            emit = proc do |msg|
+              next unless msg.is_a?(Hash)
+
+              final = log_obj.merge(decoded_at: Time.now.strftime('%Y-%m-%d %H:%M:%S%z')).merge(msg)
+              spinner.stop
+              puts JSON.pretty_generate(final)
+              spinner.auto_spin
+              File.open(log_file, 'a') { |f| f.puts("#{JSON.generate(final)},") }
+              disp = (msg[:summary] || msg[:raw] || msg.values.compact.first).to_s
+              current_line = disp[0...max_len]
             end
-          elsif gqrx_sock
-            # No external decoder — fall back to live signal-strength telemetry
-            decoder_thread = Thread.new do
-              loop do
-                lvl = PWN::SDR::GQRX.cmd(gqrx_sock: gqrx_sock, cmd: 'l STRENGTH').to_f
-                current_title = "signal #{format('%+.1f', lvl)} dBFS (analog / no external demod)"
-                sleep 0.3
-              end
-            rescue StandardError
-              nil
-            end
-          end
-
-          loop do
-            spinner.update(status: current_title)
-            next unless $stdin.wait_readable(0)
-
-            begin
-              char = $stdin.read_nonblock(1)
-              next unless char == skip_freq_char
-
-              puts "\n[!] ENTER pressed → stopping #{protocol} decoder..."
-              break
-            rescue IO::WaitReadable, EOFError
-              nil
+            loop do
+              raw = audio_q.pop
+              samples = PWN::SDR::Decoder::DSP.unpack_s16le(data: raw)
+              demod.feed(samples, &emit)
             end
+          rescue StandardError => e
+            current_line = "demod error: #{e.class}: #{e.message}"
           end
 
+          wait_for_enter(spinner: spinner, title_ref: -> { current_line })
           spinner.success('Decoding stopped')
         rescue StandardError => e
-          spinner.error("Decoding failed: #{e.message}") if defined?(spinner) && spinner
+          spinner&.error("Decoding failed: #{e.message}") if defined?(spinner)
           raise
         ensure
-          [receiver_thread, decoder_thread].compact.each { |t| t.kill if t.alive? }
-          [mm_stdin, mm_stdout, mm_stderr].compact.each do |io|
-            io.close
-          rescue StandardError
-            nil
-          end
-          begin
-            mm_wait_thr&.value
-          rescue StandardError
-            nil
-          end
+          [receiver_thread, decoder_thread].compact.each { |t| t.kill if t&.alive? }
           PWN::SDR::GQRX.disconnect_udp(udp_listener: udp_listener) if udp_listener
-          spinner.stop if defined?(spinner) && spinner
+          spinner&.stop if defined?(spinner)
         end
 
         # Supported Method Parameters::
-        # PWN::SDR::Decoder::Base.bin_available?(bin: 'multimon-ng')
+        # PWN::SDR::Decoder::Base.run_detector(
+        #   freq_obj:  'required - freq_obj Hash from PWN::SDR::GQRX.init_freq',
+        #   protocol:  'required - short name for banner / log filename',
+        #   note:      'optional - one-line explanation shown once',
+        #   threshold: 'optional - dBFS above rolling floor to call a burst (default 8.0)',
+        #   describe:  'optional - Proc.new { |burst_hash| Hash } extra fields'
+        # )
 
-        public_class_method def self.bin_available?(opts = {})
-          bin = opts[:bin].to_s
-          return false if bin.empty?
+        public_class_method def self.run_detector(opts = {})
+          freq_obj  = opts[:freq_obj]
+          protocol  = opts[:protocol] || 'SIGNAL'
+          note      = opts[:note]
+          threshold = (opts[:threshold] || 8.0).to_f
+          describe  = opts[:describe]
 
-          ENV.fetch('PATH', '').split(File::PATH_SEPARATOR).any? do |dir|
-            File.executable?(File.join(dir, bin))
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+
+          gqrx_sock = freq_obj[:gqrx_sock]
+          udp_ip    = freq_obj[:udp_ip]   || '127.0.0.1'
+          udp_port  = freq_obj[:udp_port] || 7355
+          log_obj   = strip_freq_obj(freq_obj: freq_obj)
+
+          puts JSON.pretty_generate(log_obj)
+          puts "\n*** #{protocol} Signal Detector (ruby-native) ***"
+          puts "[i] #{note}" if note
+          puts 'Press [ENTER] to continue to next frequency...'
+
+          spinner, max_len = build_spinner(
+            banner: "INFO: Characterising #{protocol} activity on #{log_obj[:freq] || "udp://#{udp_ip}:#{udp_port}"} (native)"
+          )
+          log_file = log_path(protocol: protocol)
+
+          udp_listener = begin
+            PWN::SDR::GQRX.listen_udp(udp_ip: udp_ip, udp_port: udp_port)
+          rescue StandardError
+            nil
           end
+
+          current_line = 'Establishing noise floor...'
+          floor    = nil
+          in_burst = false
+          burst_t0 = nil
+          peak     = -200.0
+          burst_n  = 0
+
+          detector_thread = Thread.new do
+            emit = proc do |msg|
+              final = log_obj.merge(decoded_at: Time.now.strftime('%Y-%m-%d %H:%M:%S%z')).merge(msg)
+              spinner.stop
+              puts JSON.pretty_generate(final)
+              spinner.auto_spin
+              File.open(log_file, 'a') { |f| f.puts("#{JSON.generate(final)},") }
+              current_line = (msg[:summary] || '').to_s[0...max_len]
+            end
+
+            loop do
+              lvl = read_level(gqrx_sock: gqrx_sock, udp_listener: udp_listener)
+              if lvl
+                floor = floor.nil? ? lvl : ((floor * 0.98) + (lvl * 0.02))
+                delta = lvl - floor
+                if delta >= threshold
+                  unless in_burst
+                    in_burst = true
+                    burst_t0 = Time.now
+                    peak = lvl
+                  end
+                  peak = lvl if lvl > peak
+                  current_line = format('%<p>s BURST %<l>+.1f dBFS (Δ%<d>+.1f, floor %<f>+.1f)', p: protocol, l: lvl, d: delta, f: floor)[0...max_len]
+                elsif in_burst
+                  in_burst = false
+                  burst_n += 1
+                  dur_ms = ((Time.now - burst_t0) * 1000).round
+                  msg = {
+                    protocol: protocol, event: 'burst', burst_no: burst_n,
+                    peak_dbfs: peak.round(1), floor_dbfs: floor.round(1),
+                    delta_db: (peak - floor).round(1), duration_ms: dur_ms,
+                    summary: format('%<p>s burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms', p: protocol, n: burst_n, pk: peak, d: peak - floor, ms: dur_ms)
+                  }
+                  msg.merge!(describe.call(msg)) if describe.respond_to?(:call)
+                  emit.call(msg)
+                else
+                  current_line = format('%<p>s idle %<l>+.1f dBFS (floor %<f>+.1f, Δ%<d>+.1f)', p: protocol, l: lvl, f: floor, d: delta)[0...max_len]
+                end
+              end
+              sleep(udp_listener ? 0 : 0.1)
+            end
+          rescue StandardError => e
+            current_line = "detector error: #{e.class}: #{e.message}"
+          end
+
+          wait_for_enter(spinner: spinner, title_ref: -> { current_line })
+          spinner.success('Detector stopped')
+        rescue StandardError => e
+          spinner&.error("Detector failed: #{e.message}") if defined?(spinner)
+          raise
+        ensure
+          detector_thread&.kill if defined?(detector_thread) && detector_thread&.alive?
+          PWN::SDR::GQRX.disconnect_udp(udp_listener: udp_listener) if udp_listener
+          spinner&.stop if defined?(spinner)
         end
 
         # Supported Method Parameters::
@@ -218,6 +223,85 @@ module PWN
           end
         end
 
+        # ---------------------------------------------------------------
+        # Internals
+        # ---------------------------------------------------------------
+
+        # Supported Method Parameters::
+        # h = PWN::SDR::Decoder::Base.strip_freq_obj(freq_obj: {...})
+
+        private_class_method def self.strip_freq_obj(opts = {})
+          fo = opts[:freq_obj].dup
+          fo.delete(:gqrx_sock)
+          fo.delete(:decoder_module)
+          fo
+        end
+
+        # Supported Method Parameters::
+        # spinner, max_len = PWN::SDR::Decoder::Base.build_spinner(banner: '...')
+
+        private_class_method def self.build_spinner(opts = {})
+          banner = opts[:banner].to_s
+          spinner = TTY::Spinner.new('[:spinner] :status', format: :arrow_pulse, clear: true, hide_cursor: true)
+          overhead = 12
+          max_len  = [TTY::Screen.width - overhead, 50].max
+          banner   = banner[0...max_len] if banner.length > max_len
+          spinner.update(status: banner)
+          spinner.auto_spin
+          [spinner, max_len]
+        end
+
+        # Supported Method Parameters::
+        # path = PWN::SDR::Decoder::Base.log_path(protocol: 'POCSAG')
+
+        private_class_method def self.log_path(opts = {})
+          protocol = opts[:protocol].to_s
+          "/tmp/#{protocol.downcase.gsub(/[^a-z0-9]+/, '_')}_decoder_#{Time.now.strftime('%Y%m%d')}.log"
+        end
+
+        # Supported Method Parameters::
+        # lvl = PWN::SDR::Decoder::Base.read_level(gqrx_sock:, udp_listener:)
+
+        private_class_method def self.read_level(opts = {})
+          gqrx_sock    = opts[:gqrx_sock]
+          udp_listener = opts[:udp_listener]
+          if udp_listener
+            begin
+              data, = udp_listener.recv(4096)
+              return PWN::SDR::Decoder::DSP.rms_dbfs(samples: PWN::SDR::Decoder::DSP.unpack_s16le(data: data)) if data.to_s.bytesize.positive?
+            rescue IOError, Errno::ECONNRESET, Errno::EBADF
+              nil
+            end
+          end
+          return nil unless gqrx_sock
+
+          PWN::SDR::GQRX.cmd(gqrx_sock: gqrx_sock, cmd: 'l STRENGTH').to_f
+        rescue StandardError
+          nil
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Base.wait_for_enter(spinner:, title_ref:)
+
+        private_class_method def self.wait_for_enter(opts = {})
+          spinner   = opts[:spinner]
+          title_ref = opts[:title_ref]
+          loop do
+            spinner.update(status: title_ref.call)
+            next unless $stdin.wait_readable(0)
+
+            begin
+              char = $stdin.read_nonblock(1)
+              next unless char == "\n"
+
+              puts "\n[!] ENTER pressed → stopping..."
+              break
+            rescue IO::WaitReadable, EOFError
+              nil
+            end
+          end
+        end
+
         # Author(s):: 0day Inc. <support@0dayinc.com>
 
         public_class_method def self.authors
@@ -227,19 +311,22 @@ module PWN
         # Display Usage for this Module
 
         public_class_method def self.help
-          puts "USAGE:
-            #{self}.run_pipeline(
-              freq_obj:      'required - freq_obj from PWN::SDR::GQRX.init_freq',
-              protocol:      'required - short protocol name',
-              decode_cmd:    'optional - stdin pipeline (sox-resampled 22 050 Hz s16le)',
-              direct_cmd:    'optional - stand-alone cmd that owns the SDR',
-              line_match:    'optional - Regexp/String/Array line filter',
-              parser:        'optional - Proc { |line| Hash } structured extractor',
-              required_bins: 'optional - Array of executables that must be on PATH',
-              resample_hz:   'optional - sox output rate (default 22050)'
+          puts "USAGE (100 % ruby-native — no external binaries):
+            #{self}.run_native(
+              freq_obj: 'required - freq_obj from PWN::SDR::GQRX.init_freq',
+              protocol: 'required - short protocol name',
+              demod:    'required - object with #feed(samples,&emit)',
+              rate:     'optional - UDP sample rate (default 48000)'
+            )
+
+            #{self}.run_detector(
+              freq_obj:  'required - freq_obj from PWN::SDR::GQRX.init_freq',
+              protocol:  'required - short protocol name',
+              note:      'optional - explanation shown to operator',
+              threshold: 'optional - dB above floor for burst (default 8.0)',
+              describe:  'optional - Proc { |burst| Hash } extra fields'
             )
 
-            #{self}.bin_available?(bin: 'multimon-ng')
             #{self}.match_line?(line: str, matcher: Regexp|String|Array)
 
             #{self}.authors

data/lib/pwn/sdr/decoder/bluetooth.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # Pure-Ruby Bluetooth Classic (BR/EDR) & BLE activity detector.
+      #
+      # 1 Mbit/s GFSK with 79 (BR/EDR) or 40 (BLE) FHSS channels — native
+      # mode reports per-channel hop bursts and derives channel index from
+      # freq_obj. `parse_line` retained for offline text analysis.
+      module Bluetooth
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Bluetooth.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          hz  = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          ble = freq_obj[:ble] || freq_obj[:mode].to_s.casecmp('ble').zero?
+          ch  = ble ? ((hz - 2_402_000_000) / 2_000_000).clamp(0, 39) : ((hz - 2_402_000_000) / 1_000_000).clamp(0, 78)
+          PWN::SDR::Decoder::Base.run_detector(
+            freq_obj: freq_obj,
+            protocol: ble ? 'BLE' : 'BT-BR/EDR',
+            note: '1 Mbit/s GFSK FHSS — native mode reports single-channel hop bursts only.',
+            threshold: 9.0,
+            describe: proc { |b|
+              { modulation: 'GFSK', channel: ch, hop_slots: (b[:duration_ms] / 0.625).round, classification: ble && [37, 38, 39].include?(ch) ? 'BLE-advertising' : 'data-hop' }
+            }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Bluetooth.parse_line(line: 'systime=... LAP=9e8b33 ...')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'Bluetooth' }
+          out[:lap]      = ::Regexp.last_match(1) if line =~ /LAP[=: ]([0-9a-fA-F]{6})/
+          out[:uap]      = ::Regexp.last_match(1) if line =~ /UAP[=: ]([0-9a-fA-F]{2})/
+          out[:bd_addr]  = ::Regexp.last_match(1) if line =~ /(?:AdvA|BD_ADDR)[=: ]([0-9a-fA-F:]{12,17})/
+          out[:pdu_type] = ::Regexp.last_match(1) if line =~ /\b(ADV_\w+|SCAN_\w+|CONNECT_REQ)\b/
+          out[:channel]  = ::Regexp.last_match(1) if line =~ /ch[=: ]?(\d{1,2})\b/i
+          out[:rssi]     = ::Regexp.last_match(1) if line =~ /rssi[=: ]?(-?\d+)/i
+          out[:summary]  = "BT #{out.values_at(:pdu_type, :bd_addr, :lap).compact.join(' ')}".strip
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE (ruby-native detector, no external binaries):
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            #{self}.parse_line(line: 'systime=... ch=37 LAP=9e8b33 ...')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end

data/lib/pwn/sdr/decoder/dect.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module PWN
+  module SDR
+    module Decoder
+      # Pure-Ruby DECT (1.88–1.90 GHz EU / 1.92–1.93 GHz US) activity detector.
+      #
+      # 1.152 Mbit/s GFSK across 10 TDMA carriers — native mode reports
+      # slot bursts (417 μs) and derives carrier index from freq_obj.
+      # `parse_line` retained for offline text analysis.
+      module DECT
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::DECT.decode(
+        #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+        # )
+
+        public_class_method def self.decode(opts = {})
+          freq_obj = opts[:freq_obj]
+          hz = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          ch = ((1_897_344_000 - hz) / 1_728_000.0).round.clamp(0, 9)
+          PWN::SDR::Decoder::Base.run_detector(
+            freq_obj: freq_obj,
+            protocol: 'DECT',
+            note: '1.152 Mbit/s GFSK 24-slot TDMA — native mode reports slot bursts and carrier index.',
+            threshold: 7.0,
+            describe: proc { |b|
+              slots = (b[:duration_ms] / 0.417).round
+              { modulation: 'GFSK', carrier: ch, tdma_slots: slots, classification: slots >= 24 ? 'FP-beacon-frame' : 'PP-burst' }
+            }
+          )
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::DECT.parse_line(line: 'RFPI: 01 23 45 67 89 slot 4 carrier 3 RSSI -55')
+
+        public_class_method def self.parse_line(opts = {})
+          line = opts[:line].to_s
+          out  = { protocol: 'DECT' }
+          out[:rfpi]    = ::Regexp.last_match(1).delete(' ') if line =~ /RFPI[:=]?\s*((?:[0-9A-Fa-f]{2}\s*){5})/
+          out[:slot]    = ::Regexp.last_match(1) if line =~ /slot\s*(\d+)/i
+          out[:carrier] = ::Regexp.last_match(1) if line =~ /carrier\s*(\d+)/i
+          out[:rssi]    = ::Regexp.last_match(1) if line =~ /RSSI[:=]?\s*(-?\d+)/i
+          out[:role]    = ::Regexp.last_match(1) if line =~ /\b(FP|PP)\b/
+          out[:summary] = "DECT RFPI=#{out[:rfpi]} slot=#{out[:slot]} carrier=#{out[:carrier]}"
+          out.compact
+        end
+
+        # Author(s):: 0day Inc. <support@0dayinc.com>
+
+        public_class_method def self.authors
+          "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
+        end
+
+        # Display Usage for this Module
+
+        public_class_method def self.help
+          puts "USAGE (ruby-native detector, no external binaries):
+            #{self}.decode(
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+            )
+
+            #{self}.parse_line(line: 'RFPI: 01 23 45 67 89 slot 4 carrier 3')
+
+            #{self}.authors
+          "
+        end
+      end
+    end
+  end
+end