pwn 0.5.621 → 0.5.626

data/lib/pwn/sdr/decoder/base.rb

@@ -11,7 +11,7 @@ module PWN
       # Shared, 100 % Ruby-native pipeline plumbing for every
       # PWN::SDR::Decoder::* module.
       #
-      # Two entry points, neither of which shell out to any external binary:
+      # Three entry points, none of which shell out to any external binary:
       #
       #   run_native  — Bind the GQRX 48 kHz s16le mono UDP audio tap, unpack
       #                 the samples with PWN::SDR::Decoder::DSP, hand each
@@ -21,6 +21,14 @@ module PWN
       #                 pretty-printed, JSONL-logged, and shown on the
       #                 spinner. [ENTER] stops cleanly.
       #
+      #   run_iq      — True-air path. Opens a real SDR front-end via
+      #                 PWN::FFI::{RTLSdr,HackRF,AdalmPluto,SoapySDR} (or
+      #                 reads a capture file), streams interleaved I/Q into
+      #                 a demod that responds to `#feed_iq(iq, rate:, &emit)`
+      #                 (or `#feed` after optional FM-demod). Falls back to
+      #                 run_detector when no hardware/file source is present
+      #                 so the operator still gets structured output.
+      #
       #   run_detector — For protocols whose bit-rate/bandwidth cannot be
       #                 recovered from a 48 kHz demodulated-audio tap (GSM,
       #                 LTE, ADS-B, WiFi, LoRa, GPS, DECT, ZigBee, Bluetooth,
@@ -302,6 +310,299 @@ module PWN
           end
         end
 
+        # Supported Method Parameters::
+        # src = PWN::SDR::Decoder::Base.resolve_iq_source(
+        #   freq_obj:    'required',
+        #   source:      'optional - :auto|:rtlsdr|:hackrf|:adalm_pluto|:soapy|:file',
+        #   sample_rate: 'optional - desired rate Hz',
+        #   file:        'optional - path to .cu8/.cs16/.iq capture'
+        # )
+        # Returns { kind:, rate_hz:, ... } handle, or nil if nothing available.
+
+        public_class_method def self.resolve_iq_source(opts = {})
+          freq_obj = opts[:freq_obj] || {}
+          want     = (opts[:source] || freq_obj[:iq_source] || :auto).to_s.downcase.to_sym
+          rate     = (opts[:sample_rate] || freq_obj[:iq_rate] || 2_048_000).to_i
+          file     = opts[:file] || freq_obj[:iq_file]
+          freq_hz  = begin
+            PWN::SDR.hz_to_i(freq: freq_obj[:freq])
+          rescue StandardError
+            freq_obj[:freq].to_i
+          end
+
+          try = lambda do |kind|
+            case kind
+            when :file
+              return nil if file.to_s.empty? || !File.file?(file.to_s)
+
+              fmt = opts[:iq_format] || freq_obj[:iq_format]
+              fmt ||= file.to_s.end_with?('.cs16', '.sc16') ? :cs16 : :cu8
+              { kind: :file, path: file.to_s, format: fmt.to_sym, rate_hz: rate, freq_hz: freq_hz }
+            when :rtlsdr
+              return nil unless PWN::FFI.available?(mod: :RTLSdr)
+              return nil if PWN::FFI::RTLSdr.list_devices.empty?
+
+              dev = PWN::FFI::RTLSdr.open(index: (opts[:index] || 0).to_i)
+              PWN::FFI::RTLSdr.configure(
+                device: dev, freq_hz: freq_hz, rate_hz: rate,
+                gain_db: opts[:gain_db] || freq_obj[:gain_db],
+                ppm: opts[:ppm] || freq_obj[:ppm] || 0
+              )
+              { kind: :rtlsdr, device: dev, rate_hz: rate, freq_hz: freq_hz, format: :cu8 }
+            when :hackrf
+              return nil unless PWN::FFI.available?(mod: :HackRF)
+
+              dev = PWN::FFI::HackRF.open(serial: opts[:serial])
+              PWN::FFI::HackRF.configure(
+                device: dev, freq_hz: freq_hz, rate_hz: rate,
+                lna_gain: opts[:lna_gain] || 16,
+                vga_gain: opts[:vga_gain] || 20,
+                amp: opts[:amp]
+              )
+              { kind: :hackrf, device: dev, rate_hz: rate, freq_hz: freq_hz, format: :cs8 }
+            when :adalm_pluto, :pluto
+              return nil unless PWN::FFI.available?(mod: :AdalmPluto)
+
+              ctx = PWN::FFI::AdalmPluto.open(uri: opts[:uri] || freq_obj[:pluto_uri])
+              PWN::FFI::AdalmPluto.configure(
+                context: ctx, freq_hz: freq_hz, rate_hz: rate,
+                gain_db: opts[:gain_db] || freq_obj[:gain_db]
+              )
+              handle = PWN::FFI::AdalmPluto.start_rx(
+                context: ctx,
+                samples: (opts[:chunk_samples] || 262_144).to_i
+              )
+              { kind: :adalm_pluto, context: ctx, handle: handle, rate_hz: rate, freq_hz: freq_hz, format: :cs16 }
+            when :soapy
+              return nil unless PWN::FFI.available?(mod: :SoapySDR)
+
+              # Discovery only today — Soapy streaming is layered later.
+              devs = PWN::FFI::SoapySDR.list_devices
+              return nil if devs.empty?
+
+              { kind: :soapy, devices: devs, rate_hz: rate, freq_hz: freq_hz, format: :cf32, streaming: false }
+            end
+          rescue StandardError
+            nil
+          end
+
+          order =
+            case want
+            when :auto
+              %i[file rtlsdr adalm_pluto hackrf soapy]
+            else
+              [want]
+            end
+          order.each do |k|
+            h = try.call(k)
+            return h if h
+          end
+          nil
+        end
+
+        # Supported Method Parameters::
+        # chunk = PWN::SDR::Decoder::Base.read_iq_chunk(source: handle, bytes: 262_144)
+        # Returns raw binary String in the source's native format, or nil on EOF.
+
+        public_class_method def self.read_iq_chunk(opts = {})
+          src   = opts[:source]
+          bytes = (opts[:bytes] || 262_144).to_i
+          raise 'ERROR: :source required' unless src.is_a?(Hash)
+
+          case src[:kind]
+          when :file
+            src[:io] ||= File.open(src[:path], 'rb')
+            data = src[:io].read(bytes)
+            data.to_s.empty? ? nil : data
+          when :rtlsdr
+            PWN::FFI::RTLSdr.read_sync(device: src[:device], bytes: bytes)
+          when :adalm_pluto
+            PWN::FFI::AdalmPluto.read_sync(handle: src[:handle])
+          when :hackrf, :soapy
+            # HackRF is callback-based; Soapy streaming layered later.
+            nil
+          end
+        rescue StandardError
+          nil
+        end
+
+        # Supported Method Parameters::
+        # iq = PWN::SDR::Decoder::Base.unpack_iq(source: handle, data: raw_string)
+        # → interleaved Array<Float> [I0,Q0,…]
+
+        public_class_method def self.unpack_iq(opts = {})
+          src  = opts[:source] || {}
+          data = opts[:data].to_s
+          case (src[:format] || :cu8).to_sym
+          when :cs16 then PWN::SDR::Decoder::DSP.unpack_cs16le(data: data)
+          when :cs8
+            # HackRF signed 8-bit interleaved I/Q
+            data.unpack('c*').map { |v| v / 128.0 }
+          else # :cu8 / unknown
+            PWN::SDR::Decoder::DSP.unpack_cu8(data: data)
+          end
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Base.close_iq_source(source: handle)
+
+        public_class_method def self.close_iq_source(opts = {})
+          src = opts[:source]
+          return unless src.is_a?(Hash)
+
+          case src[:kind]
+          when :file
+            src[:io]&.close
+          when :rtlsdr
+            PWN::FFI::RTLSdr.close(device: src[:device]) if src[:device]
+          when :adalm_pluto
+            PWN::FFI::AdalmPluto.stop_rx(handle: src[:handle]) if src[:handle]
+            PWN::FFI::AdalmPluto.close(context: src[:context]) if src[:context]
+          when :hackrf
+            PWN::FFI::HackRF.close(device: src[:device]) if src[:device]
+          end
+        rescue StandardError
+          nil
+        ensure
+          src[:io] = nil if src.is_a?(Hash)
+        end
+
+        # Supported Method Parameters::
+        # PWN::SDR::Decoder::Base.run_iq(
+        #   freq_obj:    'required - freq_obj Hash',
+        #   protocol:    'required - short name',
+        #   demod:       'required - object with #feed_iq(iq, rate:, &emit)
+        #                            OR #feed(samples, &emit) when fm_demod:true',
+        #   sample_rate: 'optional - Hz (default 2_048_000)',
+        #   source:      'optional - :auto|:rtlsdr|:hackrf|:adalm_pluto|:file',
+        #   file:        'optional - path to capture',
+        #   fm_demod:    'optional - FM-demod I/Q→audio then #feed (default false)',
+        #   chunk_bytes: 'optional - bytes per read (default 262144)',
+        #   fallback:    'optional - :detector|:raise|:silent (default :detector)',
+        #   note:        'optional - shown once when falling back',
+        #   describe:    'optional - Proc for detector fallback'
+        # )
+
+        public_class_method def self.run_iq(opts = {})
+          freq_obj = opts[:freq_obj]
+          protocol = opts[:protocol] || 'SIGNAL'
+          demod    = opts[:demod]
+          rate     = (opts[:sample_rate] || 2_048_000).to_i
+          fm_demod = opts[:fm_demod] ? true : false
+          chunk_b  = (opts[:chunk_bytes] || 262_144).to_i
+          fallback = (opts[:fallback] || :detector).to_sym
+
+          raise 'ERROR: :freq_obj is required' unless freq_obj.is_a?(Hash)
+          raise 'ERROR: :demod required' if demod.nil?
+
+          src = resolve_iq_source(
+            freq_obj: freq_obj,
+            source: opts[:source],
+            sample_rate: rate,
+            file: opts[:file],
+            gain_db: opts[:gain_db],
+            uri: opts[:uri],
+            index: opts[:index],
+            chunk_samples: chunk_b / 4
+          )
+
+          unless src && (src[:kind] != :soapy || src[:streaming] != false)
+            case fallback
+            when :raise
+              raise 'ERROR: no I/Q source available (RTL-SDR / ADALM-Pluto / HackRF / file)'
+            when :silent
+              return nil
+            else
+              return run_detector(
+                freq_obj: freq_obj,
+                protocol: protocol,
+                note: opts[:note] || "No I/Q source — falling back to energy detector. Plug in RTL-SDR/Pluto or pass iq_file: for true-air decode of #{protocol}.",
+                threshold: opts[:threshold],
+                describe: opts[:describe]
+              )
+            end
+          end
+
+          rate = src[:rate_hz] if src[:rate_hz]
+          log_obj = strip_freq_obj(freq_obj: freq_obj).merge(
+            iq_source: src[:kind], iq_rate: rate, iq_format: src[:format]
+          )
+
+          puts JSON.pretty_generate(log_obj)
+          puts "\n*** #{protocol} Decoder (true-air I/Q via #{src[:kind]}) ***"
+          puts 'Press [ENTER] to continue to next frequency...'
+
+          spinner, max_len = build_spinner(
+            banner: "INFO: Air-decoding #{protocol} @ #{rate} Hz from #{src[:kind]}"
+          )
+          log_file = log_path(protocol: protocol)
+          current_line = "Streaming I/Q from #{src[:kind]}..."
+          iq_q = Queue.new
+          stop = false
+
+          reader_thread = Thread.new do
+            loop do
+              break if stop
+
+              raw = read_iq_chunk(source: src, bytes: chunk_b)
+              break if raw.nil?
+
+              iq_q.push(raw) if raw.bytesize.positive?
+            end
+          rescue StandardError => e
+            current_line = "iq-reader: #{e.class}: #{e.message}"
+          ensure
+            iq_q.push(:eof)
+          end
+
+          decoder_thread = Thread.new do
+            emit = proc do |msg|
+              next unless msg.is_a?(Hash)
+
+              final = log_obj.merge(decoded_at: Time.now.strftime('%Y-%m-%d %H:%M:%S%z')).merge(msg)
+              spinner.stop
+              puts JSON.pretty_generate(final)
+              spinner.auto_spin
+              File.open(log_file, 'a') { |f| f.puts("#{JSON.generate(final)},") }
+              disp = (msg[:summary] || msg[:raw] || msg.values.compact.first).to_s
+              current_line = disp[0...max_len]
+            end
+
+            loop do
+              raw = iq_q.pop
+              break if raw == :eof || stop
+              next unless raw.is_a?(String)
+
+              iq = unpack_iq(source: src, data: raw)
+              if fm_demod && demod.respond_to?(:feed)
+                audio = PWN::SDR::Decoder::DSP.fm_demod_iq(iq: iq)
+                demod.feed(audio, &emit)
+              elsif demod.respond_to?(:feed_iq)
+                demod.feed_iq(iq, rate: rate, &emit)
+              elsif demod.respond_to?(:feed)
+                # magnitude envelope as last-resort real signal
+                demod.feed(PWN::SDR::Decoder::DSP.mag_sq(iq: iq).map { |v| Math.sqrt(v) }, &emit)
+              else
+                raise 'ERROR: demod must respond to #feed_iq or #feed'
+              end
+            end
+          rescue StandardError => e
+            current_line = "iq-demod: #{e.class}: #{e.message}"
+          end
+
+          wait_for_enter(spinner: spinner, title_ref: -> { current_line })
+          stop = true
+          spinner.success('Air-decode stopped')
+        rescue StandardError => e
+          spinner&.error("Air-decode failed: #{e.message}") if defined?(spinner)
+          raise
+        ensure
+          stop = true if defined?(stop)
+          [reader_thread, decoder_thread].compact.each { |th| th.kill if th&.alive? }
+          close_iq_source(source: src) if defined?(src) && src
+          spinner&.stop if defined?(spinner)
+        end
+
         # Author(s):: 0day Inc. <support@0dayinc.com>
 
         public_class_method def self.authors
@@ -319,6 +620,17 @@ module PWN
               rate:     'optional - UDP sample rate (default 48000)'
             )
 
+            #{self}.run_iq(
+              freq_obj:    'required - freq_obj Hash',
+              protocol:    'required - short protocol name',
+              demod:       'required - #feed_iq(iq, rate:, &emit) or #feed',
+              sample_rate: 'optional - Hz (default 2_048_000)',
+              source:      'optional - :auto|:rtlsdr|:hackrf|:adalm_pluto|:file',
+              file:        'optional - .cu8/.cs16 capture path',
+              fm_demod:    'optional - FM-demod then #feed (default false)',
+              fallback:    'optional - :detector|:raise|:silent (default :detector)'
+            )
+
             #{self}.run_detector(
               freq_obj:  'required - freq_obj from PWN::SDR::GQRX.init_freq',
               protocol:  'required - short protocol name',
@@ -327,6 +639,7 @@ module PWN
               describe:  'optional - Proc { |burst| Hash } extra fields'
             )
 
+            #{self}.resolve_iq_source(freq_obj:, source: :auto, sample_rate:, file:)
             #{self}.match_line?(line: str, matcher: Regexp|String|Array)
 
             #{self}.authors

data/lib/pwn/sdr/decoder/bluetooth.rb

@@ -3,12 +3,75 @@
 module PWN
   module SDR
     module Decoder
-      # Pure-Ruby Bluetooth Classic (BR/EDR) & BLE activity detector.
-      #
-      # 1 Mbit/s GFSK with 79 (BR/EDR) or 40 (BLE) FHSS channels — native
-      # mode reports per-channel hop bursts and derives channel index from
-      # freq_obj. `parse_line` retained for offline text analysis.
+      # True-air + detector-fallback decoder for Bluetooth.
+      # Prefers PWN::FFI I/Q (RTL-SDR / ADALM-Pluto / HackRF / capture file)
+      # via Base.run_iq; degrades to Base.run_detector with no hardware.
       module Bluetooth
+        # Streaming I/Q energy/burst demod for Base.run_iq.
+        class DemodIQ
+          def initialize(rate:, protocol:, modulation:, extra: {})
+            @rate = rate.to_f
+            @protocol = protocol
+            @modulation = modulation
+            @extra = extra
+            @floor = nil
+            @in_burst = false
+            @burst_t0 = nil
+            @peak = -200.0
+            @burst_n = 0
+            @threshold = (extra[:threshold] || 8.0).to_f
+          end
+
+          def feed_iq(samples, rate: nil, &)
+            @rate = rate.to_f if rate
+            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: samples)
+            hop = [(@rate / 1000.0).round, 1].max
+            i = 0
+            while i < m2.length
+              win = m2[i, hop]
+              break if win.nil? || win.empty?
+
+              ms = win.sum / win.length
+              lvl = ms.positive? ? (10.0 * Math.log10(ms)) : -120.0
+              @floor = @floor.nil? ? lvl : ((@floor * 0.98) + (lvl * 0.02))
+              delta = lvl - @floor
+              if delta >= @threshold
+                unless @in_burst
+                  @in_burst = true
+                  @burst_t0 = Time.now
+                  @peak = lvl
+                end
+                @peak = lvl if lvl > @peak
+              elsif @in_burst
+                @in_burst = false
+                @burst_n += 1
+                dur_ms = ((Time.now - @burst_t0) * 1000).round
+                msg = {
+                  protocol: @protocol, event: 'burst', source: 'iq',
+                  burst_no: @burst_n, peak_dbfs: @peak.round(1),
+                  floor_dbfs: @floor.round(1), delta_db: (@peak - @floor).round(1),
+                  duration_ms: dur_ms, modulation: @modulation,
+                  sample_rate: @rate.to_i
+                }.merge(@extra.except(:threshold))
+                # protocol-specific enrichment
+                msg.merge!(self.class.enrich(msg: msg)) if self.class.respond_to?(:enrich)
+                msg[:summary] = format(
+                  '%<p>s IQ-burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms',
+                  p: @protocol, n: @burst_n, pk: @peak, d: @peak - @floor, ms: dur_ms
+                )
+                yield msg if block_given?
+              end
+              i += hop
+            end
+          end
+
+          # Protocol-specific enrichment of an IQ-burst message (channel TBD).
+          public_class_method def self.enrich(opts = {})
+            msg = opts[:msg] || {}
+            msg.merge(channel: nil)
+          end
+        end
+
         # Supported Method Parameters::
         # PWN::SDR::Decoder::Bluetooth.decode(
         #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
@@ -19,20 +82,32 @@ module PWN
           hz  = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
           ble = freq_obj[:ble] || freq_obj[:mode].to_s.casecmp('ble').zero?
           ch  = ble ? ((hz - 2_402_000_000) / 2_000_000).clamp(0, 39) : ((hz - 2_402_000_000) / 1_000_000).clamp(0, 78)
-          PWN::SDR::Decoder::Base.run_detector(
+
+          rate  = (opts[:sample_rate] || freq_obj[:iq_rate] || 2_000_000).to_i
+          proto = ble ? 'BLE' : 'BT-BR/EDR'
+          demod = DemodIQ.new(
+            rate: rate, protocol: proto, modulation: 'GFSK',
+            extra: { threshold: 9.0 }
+          )
+          PWN::SDR::Decoder::Base.run_iq(
             freq_obj: freq_obj,
-            protocol: ble ? 'BLE' : 'BT-BR/EDR',
-            note: '1 Mbit/s GFSK FHSS — native mode reports single-channel hop bursts only.',
+            protocol: proto,
+            sample_rate: rate,
+            source: opts[:source],
+            file: opts[:file],
+            demod: demod,
             threshold: 9.0,
+            note: '1 Mbit/s GFSK FHSS — true-air I/Q path reports hop-burst density per tuned channel.',
             describe: proc { |b|
-              { modulation: 'GFSK', channel: ch, hop_slots: (b[:duration_ms] / 0.625).round, classification: ble && [37, 38, 39].include?(ch) ? 'BLE-advertising' : 'data-hop' }
+              { modulation: 'GFSK', channel: begin
+                b[:channel]
+              rescue StandardError
+                nil
+              end, hop_slots: (b[:duration_ms] / 0.625).round }
             }
           )
         end
 
-        # Supported Method Parameters::
-        # PWN::SDR::Decoder::Bluetooth.parse_line(line: 'systime=... LAP=9e8b33 ...')
-
         public_class_method def self.parse_line(opts = {})
           line = opts[:line].to_s
           out  = { protocol: 'Bluetooth' }
@@ -52,16 +127,14 @@ module PWN
           "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
 
-        # Display Usage for this Module
-
         public_class_method def self.help
-          puts "USAGE (ruby-native detector, no external binaries):
+          puts "USAGE (true-air I/Q via PWN::FFI + detector fallback):
             #{self}.decode(
-              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq',
+              source:   'optional - :auto|:rtlsdr|:adalm_pluto|:file',
+              file:     'optional - .cu8/.cs16 capture'
             )
 
-            #{self}.parse_line(line: 'systime=... ch=37 LAP=9e8b33 ...')
-
             #{self}.authors
           "
         end

data/lib/pwn/sdr/decoder/dect.rb

@@ -3,12 +3,69 @@
 module PWN
   module SDR
     module Decoder
-      # Pure-Ruby DECT (1.88–1.90 GHz EU / 1.92–1.93 GHz US) activity detector.
-      #
-      # 1.152 Mbit/s GFSK across 10 TDMA carriers — native mode reports
-      # slot bursts (417 μs) and derives carrier index from freq_obj.
-      # `parse_line` retained for offline text analysis.
+      # True-air + detector-fallback decoder for DECT.
+      # Prefers PWN::FFI I/Q (RTL-SDR / ADALM-Pluto / HackRF / capture file)
+      # via Base.run_iq; degrades to Base.run_detector with no hardware.
       module DECT
+        # Streaming I/Q energy/burst demod for Base.run_iq.
+        class DemodIQ
+          def initialize(rate:, protocol:, modulation:, extra: {})
+            @rate = rate.to_f
+            @protocol = protocol
+            @modulation = modulation
+            @extra = extra
+            @floor = nil
+            @in_burst = false
+            @burst_t0 = nil
+            @peak = -200.0
+            @burst_n = 0
+            @threshold = (extra[:threshold] || 8.0).to_f
+          end
+
+          def feed_iq(samples, rate: nil, &)
+            @rate = rate.to_f if rate
+            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: samples)
+            hop = [(@rate / 1000.0).round, 1].max
+            i = 0
+            while i < m2.length
+              win = m2[i, hop]
+              break if win.nil? || win.empty?
+
+              ms = win.sum / win.length
+              lvl = ms.positive? ? (10.0 * Math.log10(ms)) : -120.0
+              @floor = @floor.nil? ? lvl : ((@floor * 0.98) + (lvl * 0.02))
+              delta = lvl - @floor
+              if delta >= @threshold
+                unless @in_burst
+                  @in_burst = true
+                  @burst_t0 = Time.now
+                  @peak = lvl
+                end
+                @peak = lvl if lvl > @peak
+              elsif @in_burst
+                @in_burst = false
+                @burst_n += 1
+                dur_ms = ((Time.now - @burst_t0) * 1000).round
+                msg = {
+                  protocol: @protocol, event: 'burst', source: 'iq',
+                  burst_no: @burst_n, peak_dbfs: @peak.round(1),
+                  floor_dbfs: @floor.round(1), delta_db: (@peak - @floor).round(1),
+                  duration_ms: dur_ms, modulation: @modulation,
+                  sample_rate: @rate.to_i
+                }.merge(@extra.except(:threshold))
+                # protocol-specific enrichment
+                msg.merge!(self.class.enrich(msg)) if self.class.respond_to?(:enrich)
+                msg[:summary] = format(
+                  '%<p>s IQ-burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms',
+                  p: @protocol, n: @burst_n, pk: @peak, d: @peak - @floor, ms: dur_ms
+                )
+                yield msg if block_given?
+              end
+              i += hop
+            end
+          end
+        end
+
         # Supported Method Parameters::
         # PWN::SDR::Decoder::DECT.decode(
         #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
@@ -16,23 +73,26 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          hz = PWN::SDR.hz_to_i(freq: freq_obj[:freq])
-          ch = ((1_897_344_000 - hz) / 1_728_000.0).round.clamp(0, 9)
-          PWN::SDR::Decoder::Base.run_detector(
+
+          rate  = (opts[:sample_rate] || freq_obj[:iq_rate] || 2_000_000).to_i
+          proto = 'DECT'
+          demod = DemodIQ.new(
+            rate: rate, protocol: proto, modulation: 'GFSK',
+            extra: { threshold: 7.0 }
+          )
+          PWN::SDR::Decoder::Base.run_iq(
             freq_obj: freq_obj,
-            protocol: 'DECT',
-            note: '1.152 Mbit/s GFSK 24-slot TDMA — native mode reports slot bursts and carrier index.',
+            protocol: proto,
+            sample_rate: rate,
+            source: opts[:source],
+            file: opts[:file],
+            demod: demod,
             threshold: 7.0,
-            describe: proc { |b|
-              slots = (b[:duration_ms] / 0.417).round
-              { modulation: 'GFSK', carrier: ch, tdma_slots: slots, classification: slots >= 24 ? 'FP-beacon-frame' : 'PP-burst' }
-            }
+            note: '1.152 Mbit/s GFSK 24-slot TDMA — true-air I/Q path reports slot bursts.',
+            describe: proc { |b| { modulation: 'GFSK', tdma_slots: (b[:duration_ms] / 0.417).round, classification: (b[:duration_ms] / 0.417).round >= 24 ? 'FP-beacon-frame' : 'PP-burst' } }
           )
         end
 
-        # Supported Method Parameters::
-        # PWN::SDR::Decoder::DECT.parse_line(line: 'RFPI: 01 23 45 67 89 slot 4 carrier 3 RSSI -55')
-
         public_class_method def self.parse_line(opts = {})
           line = opts[:line].to_s
           out  = { protocol: 'DECT' }
@@ -51,16 +111,14 @@ module PWN
           "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
 
-        # Display Usage for this Module
-
         public_class_method def self.help
-          puts "USAGE (ruby-native detector, no external binaries):
+          puts "USAGE (true-air I/Q via PWN::FFI + detector fallback):
             #{self}.decode(
-              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq',
+              source:   'optional - :auto|:rtlsdr|:adalm_pluto|:file',
+              file:     'optional - .cu8/.cs16 capture'
             )
 
-            #{self}.parse_line(line: 'RFPI: 01 23 45 67 89 slot 4 carrier 3')
-
             #{self}.authors
           "
         end