pwn 0.5.621 → 0.5.626

data/lib/pwn/sdr/decoder/iridium.rb

@@ -3,13 +3,69 @@
 module PWN
   module SDR
     module Decoder
-      # Pure-Ruby Iridium L-band burst detector.
-      #
-      # Iridium simplex/duplex bursts are 25 kbit/s DE-QPSK across
-      # 1616–1626.5 MHz. Native mode reports burst count/duration/energy
-      # per channel. `parse_line` retained for offline iridium-toolkit
-      # text analysis.
+      # True-air + detector-fallback decoder for Iridium.
+      # Prefers PWN::FFI I/Q (RTL-SDR / ADALM-Pluto / HackRF / capture file)
+      # via Base.run_iq; degrades to Base.run_detector with no hardware.
       module Iridium
+        # Streaming I/Q energy/burst demod for Base.run_iq.
+        class DemodIQ
+          def initialize(rate:, protocol:, modulation:, extra: {})
+            @rate = rate.to_f
+            @protocol = protocol
+            @modulation = modulation
+            @extra = extra
+            @floor = nil
+            @in_burst = false
+            @burst_t0 = nil
+            @peak = -200.0
+            @burst_n = 0
+            @threshold = (extra[:threshold] || 8.0).to_f
+          end
+
+          def feed_iq(samples, rate: nil, &)
+            @rate = rate.to_f if rate
+            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: samples)
+            hop = [(@rate / 1000.0).round, 1].max
+            i = 0
+            while i < m2.length
+              win = m2[i, hop]
+              break if win.nil? || win.empty?
+
+              ms = win.sum / win.length
+              lvl = ms.positive? ? (10.0 * Math.log10(ms)) : -120.0
+              @floor = @floor.nil? ? lvl : ((@floor * 0.98) + (lvl * 0.02))
+              delta = lvl - @floor
+              if delta >= @threshold
+                unless @in_burst
+                  @in_burst = true
+                  @burst_t0 = Time.now
+                  @peak = lvl
+                end
+                @peak = lvl if lvl > @peak
+              elsif @in_burst
+                @in_burst = false
+                @burst_n += 1
+                dur_ms = ((Time.now - @burst_t0) * 1000).round
+                msg = {
+                  protocol: @protocol, event: 'burst', source: 'iq',
+                  burst_no: @burst_n, peak_dbfs: @peak.round(1),
+                  floor_dbfs: @floor.round(1), delta_db: (@peak - @floor).round(1),
+                  duration_ms: dur_ms, modulation: @modulation,
+                  sample_rate: @rate.to_i
+                }.merge(@extra.except(:threshold))
+                # protocol-specific enrichment
+                msg.merge!(self.class.enrich(msg)) if self.class.respond_to?(:enrich)
+                msg[:summary] = format(
+                  '%<p>s IQ-burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms',
+                  p: @protocol, n: @burst_n, pk: @peak, d: @peak - @floor, ms: dur_ms
+                )
+                yield msg if block_given?
+              end
+              i += hop
+            end
+          end
+        end
+
         # Supported Method Parameters::
         # PWN::SDR::Decoder::Iridium.decode(
         #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
@@ -17,18 +73,26 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          PWN::SDR::Decoder::Base.run_detector(
+
+          rate  = (opts[:sample_rate] || freq_obj[:iq_rate] || 2_000_000).to_i
+          proto = 'IRIDIUM'
+          demod = DemodIQ.new(
+            rate: rate, protocol: proto, modulation: 'DE-QPSK',
+            extra: { threshold: 7.0 }
+          )
+          PWN::SDR::Decoder::Base.run_iq(
             freq_obj: freq_obj,
-            protocol: 'IRIDIUM',
-            note: '25 kbit/s DE-QPSK — native mode reports burst timing/energy only.',
+            protocol: proto,
+            sample_rate: rate,
+            source: opts[:source],
+            file: opts[:file],
+            demod: demod,
             threshold: 7.0,
+            note: '25 kbit/s DE-QPSK — true-air I/Q path reports burst timing/energy.',
             describe: proc { |b| { modulation: 'DE-QPSK', symbol_rate: 25_000, classification: b[:duration_ms] < 10 ? 'simplex-burst' : 'duplex-frame' } }
           )
         end
 
-        # Supported Method Parameters::
-        # PWN::SDR::Decoder::Iridium.parse_line(line: 'IRA: sat:23 beam:14 ...')
-
         public_class_method def self.parse_line(opts = {})
           line = opts[:line].to_s
           out  = { protocol: 'IRIDIUM' }
@@ -47,16 +111,14 @@ module PWN
           "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
 
-        # Display Usage for this Module
-
         public_class_method def self.help
-          puts "USAGE (ruby-native detector, no external binaries):
+          puts "USAGE (true-air I/Q via PWN::FFI + detector fallback):
             #{self}.decode(
-              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq',
+              source:   'optional - :auto|:rtlsdr|:adalm_pluto|:file',
+              file:     'optional - .cu8/.cs16 capture'
             )
 
-            #{self}.parse_line(line: 'IRA: sat:23 beam:14 pos=(+32.1/-097.0) ...')
-
             #{self}.authors
           "
         end

data/lib/pwn/sdr/decoder/lora.rb

@@ -5,13 +5,69 @@ require 'json'
 module PWN
   module SDR
     module Decoder
-      # Pure-Ruby LoRa / LoRaWAN CSS activity detector.
-      #
-      # LoRa is chirp-spread-spectrum over 125/250/500 kHz — recoverable
-      # only from raw I/Q at ≥250 ksps, not from a 48 kHz audio tap.
-      # Native mode reports chirp-burst duration/energy (from which SF
-      # can be estimated). `parse_line` retained for offline JSON analysis.
+      # True-air + detector-fallback decoder for LoRa.
+      # Prefers PWN::FFI I/Q (RTL-SDR / ADALM-Pluto / HackRF / capture file)
+      # via Base.run_iq; degrades to Base.run_detector with no hardware.
       module LoRa
+        # Streaming I/Q energy/burst demod for Base.run_iq.
+        class DemodIQ
+          def initialize(rate:, protocol:, modulation:, extra: {})
+            @rate = rate.to_f
+            @protocol = protocol
+            @modulation = modulation
+            @extra = extra
+            @floor = nil
+            @in_burst = false
+            @burst_t0 = nil
+            @peak = -200.0
+            @burst_n = 0
+            @threshold = (extra[:threshold] || 8.0).to_f
+          end
+
+          def feed_iq(samples, rate: nil, &)
+            @rate = rate.to_f if rate
+            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: samples)
+            hop = [(@rate / 1000.0).round, 1].max
+            i = 0
+            while i < m2.length
+              win = m2[i, hop]
+              break if win.nil? || win.empty?
+
+              ms = win.sum / win.length
+              lvl = ms.positive? ? (10.0 * Math.log10(ms)) : -120.0
+              @floor = @floor.nil? ? lvl : ((@floor * 0.98) + (lvl * 0.02))
+              delta = lvl - @floor
+              if delta >= @threshold
+                unless @in_burst
+                  @in_burst = true
+                  @burst_t0 = Time.now
+                  @peak = lvl
+                end
+                @peak = lvl if lvl > @peak
+              elsif @in_burst
+                @in_burst = false
+                @burst_n += 1
+                dur_ms = ((Time.now - @burst_t0) * 1000).round
+                msg = {
+                  protocol: @protocol, event: 'burst', source: 'iq',
+                  burst_no: @burst_n, peak_dbfs: @peak.round(1),
+                  floor_dbfs: @floor.round(1), delta_db: (@peak - @floor).round(1),
+                  duration_ms: dur_ms, modulation: @modulation,
+                  sample_rate: @rate.to_i
+                }.merge(@extra.except(:threshold))
+                # protocol-specific enrichment
+                msg.merge!(self.class.enrich(msg)) if self.class.respond_to?(:enrich)
+                msg[:summary] = format(
+                  '%<p>s IQ-burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms',
+                  p: @protocol, n: @burst_n, pk: @peak, d: @peak - @floor, ms: dur_ms
+                )
+                yield msg if block_given?
+              end
+              i += hop
+            end
+          end
+        end
+
         # Supported Method Parameters::
         # PWN::SDR::Decoder::LoRa.decode(
         #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
@@ -19,23 +75,26 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          PWN::SDR::Decoder::Base.run_detector(
+
+          rate  = (opts[:sample_rate] || freq_obj[:iq_rate] || 1_000_000).to_i
+          proto = 'LoRa'
+          demod = DemodIQ.new(
+            rate: rate, protocol: proto, modulation: 'CSS',
+            extra: { threshold: 8.0 }
+          )
+          PWN::SDR::Decoder::Base.run_iq(
             freq_obj: freq_obj,
-            protocol: 'LoRa',
-            note: 'CSS over 125–500 kHz — native mode reports chirp bursts and estimates SF from duration.',
+            protocol: proto,
+            sample_rate: rate,
+            source: opts[:source],
+            file: opts[:file],
+            demod: demod,
             threshold: 8.0,
-            describe: proc { |b|
-              # Preamble ≈ 8 symbols; T_sym = 2^SF / BW. Assume BW=125k.
-              t_sym_ms = b[:duration_ms] / 20.0
-              sf_est = t_sym_ms.positive? ? Math.log2(t_sym_ms * 125).round.clamp(6, 12) : nil
-              { modulation: 'CSS', bw_khz_assumed: 125, sf_estimate: sf_est }.compact
-            }
+            note: 'CSS over 125–500 kHz — true-air I/Q path estimates SF from chirp duration; full dechirp via FFTW is layered when available.',
+            describe: proc { |b| { modulation: 'CSS', bw_khz_assumed: 125, sf_estimate: (begin; t = b[:duration_ms] / 20.0; t.positive? ? Math.log2(t * 125).round.clamp(6, 12) : nil; end) }.compact }
           )
         end
 
-        # Supported Method Parameters::
-        # PWN::SDR::Decoder::LoRa.parse_line(line: '{"model":"LoRa",...}')
-
         public_class_method def self.parse_line(opts = {})
           line = opts[:line].to_s
           h = begin
@@ -48,10 +107,9 @@ module PWN
           bits << "SF#{out[:sf]}" if out[:sf]
           bits << "BW#{out[:bw]}" if out[:bw]
           bits << "CR#{out[:cr]}" if out[:cr]
-          bits << "DevAddr=#{out[:devaddr] || out[:id]}" if out[:devaddr] || out[:id]
-          bits << "FCnt=#{out[:fcnt]}" if out[:fcnt]
-          bits << "len=#{out[:len] || (out[:data].to_s.length / 2)}" if out[:len] || out[:data]
-          out[:summary] = "LoRa #{bits.join(' ')}".strip
+          bits << "RSSI=#{out[:rssi]}" if out[:rssi]
+          bits << out[:payload].to_s[0, 40] if out[:payload]
+          out[:summary] = bits.empty? ? line[0, 120] : bits.join(' ')
           out
         end
 
@@ -61,16 +119,14 @@ module PWN
           "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
 
-        # Display Usage for this Module
-
         public_class_method def self.help
-          puts "USAGE (ruby-native detector, no external binaries):
+          puts "USAGE (true-air I/Q via PWN::FFI + detector fallback):
             #{self}.decode(
-              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq',
+              source:   'optional - :auto|:rtlsdr|:adalm_pluto|:file',
+              file:     'optional - .cu8/.cs16 capture'
             )
 
-            #{self}.parse_line(line: '{\"model\":\"LoRa\",\"sf\":7,\"bw\":125,...}')
-
             #{self}.authors
           "
         end

data/lib/pwn/sdr/decoder/lte.rb

@@ -3,13 +3,69 @@
 module PWN
   module SDR
     module Decoder
-      # Pure-Ruby LTE / UMTS / CDMA cellular activity detector.
-      #
-      # 1.4–20 MHz OFDMA/WCDMA is far beyond a 48 kHz audio tap and beyond
-      # interpreted Ruby's real-time I/Q throughput. Native mode reports
-      # channel occupancy / power only. `parse_line` retained for offline
-      # cell_search / CellSearch text analysis.
+      # True-air + detector-fallback decoder for LTE.
+      # Prefers PWN::FFI I/Q (RTL-SDR / ADALM-Pluto / HackRF / capture file)
+      # via Base.run_iq; degrades to Base.run_detector with no hardware.
       module LTE
+        # Streaming I/Q energy/burst demod for Base.run_iq.
+        class DemodIQ
+          def initialize(rate:, protocol:, modulation:, extra: {})
+            @rate = rate.to_f
+            @protocol = protocol
+            @modulation = modulation
+            @extra = extra
+            @floor = nil
+            @in_burst = false
+            @burst_t0 = nil
+            @peak = -200.0
+            @burst_n = 0
+            @threshold = (extra[:threshold] || 8.0).to_f
+          end
+
+          def feed_iq(samples, rate: nil, &)
+            @rate = rate.to_f if rate
+            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: samples)
+            hop = [(@rate / 1000.0).round, 1].max
+            i = 0
+            while i < m2.length
+              win = m2[i, hop]
+              break if win.nil? || win.empty?
+
+              ms = win.sum / win.length
+              lvl = ms.positive? ? (10.0 * Math.log10(ms)) : -120.0
+              @floor = @floor.nil? ? lvl : ((@floor * 0.98) + (lvl * 0.02))
+              delta = lvl - @floor
+              if delta >= @threshold
+                unless @in_burst
+                  @in_burst = true
+                  @burst_t0 = Time.now
+                  @peak = lvl
+                end
+                @peak = lvl if lvl > @peak
+              elsif @in_burst
+                @in_burst = false
+                @burst_n += 1
+                dur_ms = ((Time.now - @burst_t0) * 1000).round
+                msg = {
+                  protocol: @protocol, event: 'burst', source: 'iq',
+                  burst_no: @burst_n, peak_dbfs: @peak.round(1),
+                  floor_dbfs: @floor.round(1), delta_db: (@peak - @floor).round(1),
+                  duration_ms: dur_ms, modulation: @modulation,
+                  sample_rate: @rate.to_i
+                }.merge(@extra.except(:threshold))
+                # protocol-specific enrichment
+                msg.merge!(self.class.enrich(msg)) if self.class.respond_to?(:enrich)
+                msg[:summary] = format(
+                  '%<p>s IQ-burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms',
+                  p: @protocol, n: @burst_n, pk: @peak, d: @peak - @floor, ms: dur_ms
+                )
+                yield msg if block_given?
+              end
+              i += hop
+            end
+          end
+        end
+
         # Supported Method Parameters::
         # PWN::SDR::Decoder::LTE.decode(
         #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
@@ -17,18 +73,26 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          PWN::SDR::Decoder::Base.run_detector(
+
+          rate  = (opts[:sample_rate] || freq_obj[:iq_rate] || 2_000_000).to_i
+          proto = 'LTE'
+          demod = DemodIQ.new(
+            rate: rate, protocol: proto, modulation: 'OFDMA',
+            extra: { threshold: 4.0 }
+          )
+          PWN::SDR::Decoder::Base.run_iq(
             freq_obj: freq_obj,
-            protocol: 'LTE',
-            note: 'OFDMA (1.4–20 MHz, 15 kHz subcarriers) — native mode reports channel occupancy only.',
+            protocol: proto,
+            sample_rate: rate,
+            source: opts[:source],
+            file: opts[:file],
+            demod: demod,
             threshold: 4.0,
+            note: 'OFDMA 1.4–20 MHz — true-air I/Q path reports channel occupancy; PSS/SSS cell search layered on FFTW when available.',
             describe: proc { |_b| { modulation: 'OFDMA', subcarrier_khz: 15 } }
           )
         end
 
-        # Supported Method Parameters::
-        # PWN::SDR::Decoder::LTE.parse_line(line: 'Found CELL ... PCI: 123 ...')
-
         public_class_method def self.parse_line(opts = {})
           line = opts[:line].to_s
           out  = { protocol: 'LTE' }
@@ -48,16 +112,14 @@ module PWN
           "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
 
-        # Display Usage for this Module
-
         public_class_method def self.help
-          puts "USAGE (ruby-native detector, no external binaries):
+          puts "USAGE (true-air I/Q via PWN::FFI + detector fallback):
             #{self}.decode(
-              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq',
+              source:   'optional - :auto|:rtlsdr|:adalm_pluto|:file',
+              file:     'optional - .cu8/.cs16 capture'
             )
 
-            #{self}.parse_line(line: 'Found CELL 739.0 MHz, EARFCN=5110, PCI=123, 50 PRB, -85.2 dBm')
-
             #{self}.authors
           "
         end

data/lib/pwn/sdr/decoder/morse.rb

@@ -97,11 +97,28 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          PWN::SDR::Decoder::Base.run_native(
-            freq_obj: freq_obj,
-            protocol: 'MORSE-CW',
-            demod: Demod.new
-          )
+          # Prefer true-air I/Q (FM-demod → existing audio demod) when the
+          # operator asks for a source/file or sets freq_obj[:iq_source].
+          # Otherwise keep the GQRX 48 kHz UDP audio path (run_native).
+          want_iq = opts[:source] || opts[:file] || freq_obj[:iq_source] || freq_obj[:iq_file]
+          if want_iq
+            PWN::SDR::Decoder::Base.run_iq(
+              freq_obj: freq_obj,
+              protocol: 'MORSE-CW',
+              demod: Demod.new,
+              sample_rate: (opts[:sample_rate] || freq_obj[:iq_rate] || 48_000).to_i,
+              source: opts[:source],
+              file: opts[:file],
+              fm_demod: true,
+              note: 'MORSE-CW true-air: FM-demod I/Q then native bit recovery; falls back to detector without SDR hardware.'
+            )
+          else
+            PWN::SDR::Decoder::Base.run_native(
+              freq_obj: freq_obj,
+              protocol: 'MORSE-CW',
+              demod: Demod.new
+            )
+          end
         end
 
         # Supported Method Parameters::
@@ -122,7 +139,7 @@ module PWN
         # Display Usage for this Module
 
         public_class_method def self.help
-          puts "USAGE (ruby-native, no external binaries):
+          puts "USAGE (true-air I/Q + GQRX-audio native paths, no external binaries):
             #{self}.decode(
               freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
             )

data/lib/pwn/sdr/decoder/p25.rb

@@ -3,15 +3,69 @@
 module PWN
   module SDR
     module Decoder
-      # Pure-Ruby APCO Project 25 Phase-1 C4FM activity detector.
-      #
-      # P25 is 4800 sym/s 4-level FSK with 1/2-rate trellis + RS + IMBE
-      # vocoder. Full symbol recovery, deinterleave, FEC and voice decode
-      # is out of scope for a portable pure-Ruby implementation; this
-      # module instead characterises C4FM keying activity (talkgroup key-
-      # ups, control-channel duty cycle) natively via Base.run_detector.
-      # `parse_line` is retained for offline dsd-format log analysis.
+      # True-air + detector-fallback decoder for P25.
+      # Prefers PWN::FFI I/Q (RTL-SDR / ADALM-Pluto / HackRF / capture file)
+      # via Base.run_iq; degrades to Base.run_detector with no hardware.
       module P25
+        # Streaming I/Q energy/burst demod for Base.run_iq.
+        class DemodIQ
+          def initialize(rate:, protocol:, modulation:, extra: {})
+            @rate = rate.to_f
+            @protocol = protocol
+            @modulation = modulation
+            @extra = extra
+            @floor = nil
+            @in_burst = false
+            @burst_t0 = nil
+            @peak = -200.0
+            @burst_n = 0
+            @threshold = (extra[:threshold] || 8.0).to_f
+          end
+
+          def feed_iq(samples, rate: nil, &)
+            @rate = rate.to_f if rate
+            m2 = PWN::SDR::Decoder::DSP.mag_sq(iq: samples)
+            hop = [(@rate / 1000.0).round, 1].max
+            i = 0
+            while i < m2.length
+              win = m2[i, hop]
+              break if win.nil? || win.empty?
+
+              ms = win.sum / win.length
+              lvl = ms.positive? ? (10.0 * Math.log10(ms)) : -120.0
+              @floor = @floor.nil? ? lvl : ((@floor * 0.98) + (lvl * 0.02))
+              delta = lvl - @floor
+              if delta >= @threshold
+                unless @in_burst
+                  @in_burst = true
+                  @burst_t0 = Time.now
+                  @peak = lvl
+                end
+                @peak = lvl if lvl > @peak
+              elsif @in_burst
+                @in_burst = false
+                @burst_n += 1
+                dur_ms = ((Time.now - @burst_t0) * 1000).round
+                msg = {
+                  protocol: @protocol, event: 'burst', source: 'iq',
+                  burst_no: @burst_n, peak_dbfs: @peak.round(1),
+                  floor_dbfs: @floor.round(1), delta_db: (@peak - @floor).round(1),
+                  duration_ms: dur_ms, modulation: @modulation,
+                  sample_rate: @rate.to_i
+                }.merge(@extra.except(:threshold))
+                # protocol-specific enrichment
+                msg.merge!(self.class.enrich(msg)) if self.class.respond_to?(:enrich)
+                msg[:summary] = format(
+                  '%<p>s IQ-burst #%<n>d peak=%<pk>+.1f dBFS Δ=%<d>.1f dB dur=%<ms>d ms',
+                  p: @protocol, n: @burst_n, pk: @peak, d: @peak - @floor, ms: dur_ms
+                )
+                yield msg if block_given?
+              end
+              i += hop
+            end
+          end
+        end
+
         # Supported Method Parameters::
         # PWN::SDR::Decoder::P25.decode(
         #   freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
@@ -19,33 +73,40 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          PWN::SDR::Decoder::Base.run_detector(
+
+          rate  = (opts[:sample_rate] || freq_obj[:iq_rate] || 480_000).to_i
+          proto = 'P25'
+          demod = DemodIQ.new(
+            rate: rate, protocol: proto, modulation: 'C4FM',
+            extra: { threshold: 6.0 }
+          )
+          PWN::SDR::Decoder::Base.run_iq(
             freq_obj: freq_obj,
-            protocol: 'P25',
-            note: 'C4FM 4-FSK + trellis/RS/IMBE — native mode reports key-up bursts (duration/peak/duty) only. Feed captured dsd text to .parse_line for NAC/TG/RID.',
+            protocol: proto,
+            sample_rate: rate,
+            source: opts[:source],
+            file: opts[:file],
+            demod: demod,
             threshold: 6.0,
+            note: 'C4FM 4-FSK + trellis — true-air I/Q path reports key-up bursts; full NAC/TG decode layered on Liquid when available.',
             describe: proc { |b|
-              kind = if b[:duration_ms] > 1500 then 'voice-superframe'
-                     elsif b[:duration_ms] > 150 then 'LDU/HDU'
-                     else 'TSBK/control'
-                     end
-              { modulation: 'C4FM', symbol_rate: 4800, classification: kind }
+              { modulation: 'C4FM', classification: (if b[:duration_ms] > 1500
+                                                       'voice-superframe'
+                                                     else
+                                                       (b[:duration_ms] > 150 ? 'LDU/HDR' : 'TSBK/control')
+                                                     end) }
             }
           )
         end
 
-        # Supported Method Parameters::
-        # PWN::SDR::Decoder::P25.parse_line(line: 'Sync: +P25p1 NAC: 293 src: 1234 tg: 5678')
-
         public_class_method def self.parse_line(opts = {})
           line = opts[:line].to_s
           out  = { protocol: 'P25' }
-          out[:nac]       = ::Regexp.last_match(1) if line =~ /NAC:\s*([0-9A-Fa-f]+)/
-          out[:talkgroup] = ::Regexp.last_match(1) if line =~ /(?:TGID|tg[: ])\s*(\d+)/i
-          out[:radio_id]  = ::Regexp.last_match(1) if line =~ /(?:RID|src[: ])\s*(\d+)/i
-          out[:duid]      = ::Regexp.last_match(1) if line =~ /DUID:\s*(\S+)/
-          out[:sync]      = ::Regexp.last_match(1) if line =~ /Sync:\s*(\S+)/
-          out[:summary]   = "P25 NAC=#{out[:nac]} TG=#{out[:talkgroup]} RID=#{out[:radio_id]}".squeeze(' ')
+          out[:nac]  = ::Regexp.last_match(1) if line =~ /NAC[:= ]+([0-9A-Fa-f]+)/
+          out[:tg]   = ::Regexp.last_match(1) if line =~ /(?:TG|talkgroup)[:= ]+(\d+)/i
+          out[:rid]  = ::Regexp.last_match(1) if line =~ /(?:RID|src|source)[:= ]+(\d+)/i
+          out[:sys]  = ::Regexp.last_match(1) if line =~ /sys(?:tem)?[:= ]+(\w+)/i
+          out[:summary] = "P25 NAC=#{out[:nac]} TG=#{out[:tg]} RID=#{out[:rid]}"
           out.compact
         end
 
@@ -55,16 +116,14 @@ module PWN
           "AUTHOR(S):\n  0day Inc. <support@0dayinc.com>\n"
         end
 
-        # Display Usage for this Module
-
         public_class_method def self.help
-          puts "USAGE (ruby-native detector, no external binaries):
+          puts "USAGE (true-air I/Q via PWN::FFI + detector fallback):
             #{self}.decode(
-              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
+              freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq',
+              source:   'optional - :auto|:rtlsdr|:adalm_pluto|:file',
+              file:     'optional - .cu8/.cs16 capture'
             )
 
-            #{self}.parse_line(line: 'Sync: +P25p1 NAC: 293 src: 1234 tg: 5678')
-
             #{self}.authors
           "
         end

data/lib/pwn/sdr/decoder/pager.rb

@@ -28,11 +28,28 @@ module PWN
 
         public_class_method def self.decode(opts = {})
           freq_obj = opts[:freq_obj]
-          PWN::SDR::Decoder::Base.run_native(
-            freq_obj: freq_obj,
-            protocol: 'PAGER',
-            demod: Demod.new
-          )
+          # Prefer true-air I/Q (FM-demod → existing audio demod) when the
+          # operator asks for a source/file or sets freq_obj[:iq_source].
+          # Otherwise keep the GQRX 48 kHz UDP audio path (run_native).
+          want_iq = opts[:source] || opts[:file] || freq_obj[:iq_source] || freq_obj[:iq_file]
+          if want_iq
+            PWN::SDR::Decoder::Base.run_iq(
+              freq_obj: freq_obj,
+              protocol: 'PAGER',
+              demod: Demod.new,
+              sample_rate: (opts[:sample_rate] || freq_obj[:iq_rate] || 240_000).to_i,
+              source: opts[:source],
+              file: opts[:file],
+              fm_demod: true,
+              note: 'PAGER true-air: FM-demod I/Q then native bit recovery; falls back to detector without SDR hardware.'
+            )
+          else
+            PWN::SDR::Decoder::Base.run_native(
+              freq_obj: freq_obj,
+              protocol: 'PAGER',
+              demod: Demod.new
+            )
+          end
         end
 
         # Author(s):: 0day Inc. <support@0dayinc.com>
@@ -44,7 +61,7 @@ module PWN
         # Display Usage for this Module
 
         public_class_method def self.help
-          puts "USAGE (ruby-native, no external binaries):
+          puts "USAGE (true-air I/Q + GQRX-audio native paths, no external binaries):
             #{self}.decode(
               freq_obj: 'required - freq_obj returned from PWN::SDR::GQRX.init_freq'
             )