Satellite Hacking Handbook

I got interested in the subject many, many years ago. Some time later I built my first project, on hardware that was fairly old even back then: I converted a TV dongle into a receiver and built an antenna out of PVC pipe. It worked, and it was a fun project. Since then I have collected a lot more equipment and point popular dish antennas at the sky looking for something interesting... and a few bigger ideas are waiting to be built.

Over that time I have also been collecting material about satellites: how to receive them, how to take their signals apart into frames and what their security looks like when someone takes a closer look. Bookmarks, repositories, hardware documentation, CTF write-ups, conference recordings. At some point the "sat" folder in my browser started to look like a drawer full of cables, so I decided to put it in order. For myself and for you.

Satellite system / contents

A satellite system is divided into four segments. The table shows which chapters of the handbook cover each of them.

At the end: the link Catalogue and Attachments.

RF in a nutshell

Power and noise

• Decibel (dB) - a relative unit of measurement equal to one tenth of a bel. It expresses the ratio of two values of a power quantity on a logarithmic scale: L = 10·log10(P/P0). +3 dB is roughly double the power, +10 dB ten times the power, -3 dB half the power. Gains and losses of successive elements of a radio chain expressed in dB are simply added up.
• dBm - a unit of power level on a decibel scale relative to 1 mW. 0 dBm = 1 mW, 30 dBm = 1 W, -100 dBm = 0.1 pW.
• Signal-to-noise ratio (SNR) - the ratio of the power of the wanted signal to the power of background noise, usually in dB. SNR decides whether the demodulator locks and how many errors remain after decoding.
• Thermal noise - noise generated by the thermal agitation of charge carriers in a conductor; it is present in every element of the chain. Noise power N = kTB. At 290 K that is -174 dBm per 1 Hz of bandwidth, i.e. about -134 dBm in a 10 kHz bandwidth and about -114 dBm in 1 MHz.
• Noise figure (NF) - a measure of how much an element of the chain (amplifier, cable, receiver) degrades the SNR. Lower is better. The noise of the whole chain is dominated by the first stage (Friis formula), which is why the LNA is mounted at the antenna, before the cable.
• Low-noise amplifier (LNA) - an amplifier for very weak signals designed to add as little noise of its own as possible, so that it does not noticeably degrade the SNR. Example: the G4DDK vLNA has an NF of about 0.3 dB and 25-26 dB of gain at 2.3 GHz.

Sampling and IQ

• Software-defined radio (SDR) - a radio system in which components traditionally implemented in hardware (mixing, filtering, modulation, demodulation, detection) are implemented in software. SDR hardware shifts a chosen slice of the spectrum down to around zero frequency and hands samples to a computer.
• Sampling - the reduction of a continuous-time signal to a discrete-time signal by taking its values (samples) at successive moments. It is the first step of analogue-to-digital conversion.
• Sample rate - the number of samples taken from the signal per unit of time. For SDRs it is given in Msps (million samples per second).
• Sampling theorem (Nyquist-Shannon) - a continuous signal can be reconstructed exactly from its samples if the sample rate is at least twice the highest frequency in the signal. With complex I/Q samples the visible bandwidth equals the sample rate: 2.4 Msps gives about 2.4 MHz of spectrum.
• Aliasing - an irreversible distortion caused by sampling without meeting the conditions of the sampling theorem. Components at false frequencies (aliases) appear in the spectrum. On an SDR this shows up as signals that do not really exist on the displayed frequency; a filter in front of the receiver helps.
• I/Q components - a modulated sinusoid can be decomposed into two sinusoids of the same frequency offset in phase by a quarter cycle: the in-phase (I) and quadrature (Q) components. An SDR records them as pairs of numbers, i.e. complex samples.
• IQ recording size - sample rate × bytes per complex sample × time. An RTL-SDR (2 × 8 bit) at 2.4 Msps writes about 4.8 MB/s, i.e. about 2.9 GB per 10 minutes. The 2 × 16 bit format (e.g. cs16 from a Pluto or B210) takes 4 bytes per sample.

Modulation

• Carrier wave - a periodic waveform of constant frequency generated by the transmitter. It carries no information by itself; information is conveyed by modulating it.
• Modulation - varying one or more properties of the carrier (amplitude, frequency or phase) to transmit information.
• Baud (Bd, symbol rate) - the number of symbol changes per second in a digitally modulated signal. One symbol can carry one or more bits, so the bit rate in bit/s = Bd × bits per symbol.
• Demodulation - recovering data from the received signal. The main types of digital modulation in satellite communication:
  • PSK (phase-shift keying) - data is conveyed by discrete changes of the carrier phase.
    • BPSK - two phase states (0° and 180°), 1 bit per symbol. The most noise-resistant form of PSK; typical for telemetry (e.g. PROBA-1, Tianwen-1).
    • QPSK - four phase states 90° apart, 2 bits per symbol. At the same symbol rate it carries twice as much data as BPSK; used in fast downlinks and DVB-S.
  • FSK (frequency-shift keying) - data is conveyed by shifting the carrier frequency between discrete values at constant amplitude; usually the lower frequency means "0" and the higher one "1". Simple to transmit, common in small satellites. APRS uses its AFSK variant (1200 Bd).
  • MSK and GMSK - continuous-phase FSK with the minimum frequency spacing. In GMSK the pulses pass through a Gaussian filter, which narrows the spectrum. Known from GSM; CubeSats often use it at 4800 or 9600 Bd.
  • QAM - amplitude and phase modulation: data is encoded in amplitude and phase at the same time according to a constellation diagram. Used in DVB and fast data links; DVB-S2 uses the related APSK modulations.
• Samples per symbol - a demodulator usually needs 2-4 samples per symbol. A BPSK signal at 2.048 Mbps (PROBA-1) therefore needs several Msps of continuous recording, more than an RTL-SDR delivers.

Error correction

• Forward error correction (FEC) - adding redundancy to transmitted data so that the receiver detects and corrects some errors itself, without a return channel or retransmission.
• Convolutional code - an error-correcting code in which the output bits depend on the current and several previous input bits. Rate 1/2 means two output bits per input bit. It is decoded with the Viterbi algorithm.
• Reed-Solomon code - a block error-correcting code introduced by I. S. Reed and G. Solomon in 1960. CCSDS most often uses RS(255,223), which corrects up to 16 bad bytes per block.

Propagation and link budget

• Free-space path loss (FSPL) - the decrease in signal strength between two antennas on a line-of-sight path, caused by the wave spreading out in space. FSPL [dB] = 20·log10(d [km]) + 20·log10(f [MHz]) + 32.44. For 2000 km: about 151 dB at 437 MHz and about 165 dB at 2235 MHz.
• Link budget - an accounting of all power gains and losses from the transmitter to the receiver: P_rx = P_tx + G_tx + G_rx - FSPL - losses (cables, polarisation, atmosphere). Example: a CubeSat with 1 W (30 dBm), a 0 dBi satellite antenna, a 10 dBi Yagi and 151 dB FSPL gives about -111 dBm at the receiver input. Thermal noise in a 10 kHz bandwidth is about -134 dBm, so the margin is about 23 dB minus the noise figure of the chain.
• Doppler effect - the change in frequency of a wave for an observer moving relative to its source. For radio waves and speeds much lower than c: Δf ≈ f·v/c, where v is the radial velocity. For a LEO satellite the shift is about ±10 kHz at 437 MHz and about ±50 kHz at 2.2 GHz. Gpredict computes the correction and retunes the radio through Hamlib.

Antennas

• Antenna gain (dBi) - combines the antenna's directivity and radiation efficiency: the power radiated in a given direction compared with an isotropic antenna fed with the same power. For a dish G ≈ η·(πD/λ)², with η ≈ 0.55: 70 cm at 2.25 GHz about 22 dBi, 88 cm about 24 dBi.
• Parabolic antenna - an antenna that uses a parabolic reflector to direct radio waves into a narrow beam; used for microwave links. Beamwidth ≈ 70·λ/D degrees: 70 cm at 2.25 GHz about 13°, 88 cm about 11°, 2.4 m at 8.4 GHz about 1°.
• Circular polarisation - a polarisation state in which the field vector has constant magnitude and rotates at a constant rate in the plane perpendicular to the direction of propagation. RHCP and LHCP denote the direction of rotation. A linear antenna receiving a circular signal loses about 3 dB; an antenna with the opposite circular sense loses much more. Reflection off a dish reverses the sense of polarisation.
• Low-noise block downconverter (LNB) - the device at a satellite dish that amplifies the signal from the 10.7-11.7 and 11.7-12.75 GHz ranges and shifts it to the first intermediate frequency (950-2150 MHz), which a tuner or SDR can receive.

Bands

Band edges follow the NASA convention. SATCOM service names do not always match them; choose hardware by its range in MHz.

Orbits

• Low Earth orbit (LEO) - an orbit with a period of 128 minutes or less, in practice up to about 2000 km. A pass takes a few to a dozen or so minutes, Doppler is large, the antenna has to track. Most CubeSats, the ISS, Iridium.
• Medium Earth orbit (MEO) - above LEO and below GEO, 2000-35,786 km. GNSS constellations fly at about 20,000 km; a satellite stays in view for several hours.
• Molniya orbit (HEO) - a highly elliptical orbit with an inclination of 63.4° and a period of about half a sidereal day. The satellite spends a long time near apogee over high latitudes.
• Geostationary orbit (GEO) - a circular orbit 35,786 km above the equator with a period of one sidereal day (23 h 56 min 4 s). The satellite stays over one point of the equator, so the receiving antenna can be fixed.

Video: an introduction to SDR and LEO satellite reception with a cheap USB receiver - Gerard de Jong, Hacking satellites with Software Defined Radio (BSides Cape Town 2019, 45 min).

How To: decoding without an antenna

An exercise on ready-made recordings. It tests the chain IQ file - demodulation - frames without an antenna and without waiting for a pass.

Environment: DragonOS is a Linux distribution with SDR software preinstalled (Tech Minds overview, 11 min). The tools can also be installed from your own distribution's packages.

1. Download satellite-recordings, recordings prepared for gr-satellites.
2. Run the decoder:
   gr_satellites FUNcube-1 --wavfile satellite-recordings/ao73.wav
   Raw IQ: --rawfile file --iq --samp_rate <Hz>.
3. Open the same recording in Inspectrum and measure the signal width and symbol rate with the cursors. The same measurement is made on an unknown signal before choosing a demodulator.
4. Save your own recordings in SigMF: an IQ data file plus a .sigmf-meta file with frequency, sample rate, time and hardware description.

Unknown protocols: Universal Radio Hacker (demodulation and frame analysis). More recordings with analyses: Daniel Estévez's blog, the author of gr-satellites.

How To: first reception on UHF

Hardware: an RTL-SDR Blog V4, an antenna (V-dipole, QFH or a handheld Yagi such as an Arrow) and a computer. The RTL-SDR V4 needs the RTL-SDR Blog driver; older distribution packages do not support it.

Before the first reception: 10 Common Mistakes Made With Software Defined Radio (Tech Minds, 15 min) - software choice, drivers, coax losses, signal bandwidth, gain settings.

1. Choose a target. SatNOGS DB gives the transmitter frequency, modulation and baud rate. In SatNOGS Network check whether other stations received it in the last few days; no observations usually means the satellite is not transmitting. Good first targets: CubeSats with telemetry in 435-438 MHz and APRS from the ISS (ARISS status).
2. Plan the pass. Gpredict shows passes over the station location and corrects for Doppler. Choose passes with a maximum elevation above 30°; lower down, buildings and trees attenuate the signal.
3. Record. Record the whole pass as IQ in SDR++ or Gqrx. The recording can then be decoded offline many times with different settings.
4. Decode. CubeSat telemetry: gr-satellites. AX.25 and APRS packets: Dire Wolf.
5. Document the session. Fill in the field test card and the recording metadata. Comparing several sessions shows which changes in the chain improve reception.

How To: Iridium (L-band)

Iridium is a LEO satellite constellation transmitting in the 1616-1626.5 MHz band. An RTL-SDR covers this range, but not all 10 MHz at once; an SDR sampling at 10 Msps or more (e.g. a HackRF) receives the whole band. The whole process is shown in Hacking Iridium Satellites With Iridium Toolkit (Tech Minds, 16 min).

1. Antenna. A simple 1.6 GHz patch antenna pointed at the sky.
2. Demodulation. gr-iridium:
   iridium-extractor -D 4 examples/hackrf.conf > output.bits
   The program detects bursts and writes every good frame as a line of bits. For an RTL-SDR pick an example configuration that covers one of the channels (e.g. Ring Alert).
3. Parsing. iridium-toolkit:
   python3 iridium-parser.py -p output.bits > output.parsed
4. Analysis. reassembler.py -i output.parsed -m live-stats shows statistics of received frames; beam-plotter.py plots the satellites' spot beams.

iridium-toolkit can also reassemble messages and voice frames. That is the content of other people's communication, so the ground rules at the top of the handbook apply.

How To: S-band (2.2-2.3 GHz)

S-band is the main band for telemetry and commands of professional missions. Compared with UHF, three things change:

• Losses. FSPL is about 14 dB higher than at 437 MHz over the same distance. It is compensated with antenna gain: a 70 cm dish gives about 22 dBi, 88 cm about 24 dBi.
• Beam. A 70-90 cm dish has a beam of about 11-13°. A LEO satellite on a high pass moves across the sky at up to about 1° per second and leaves the beam within a dozen or so seconds, so the antenna has to track (chapter Tracking).
• Hardware. An RTL-SDR stops at about 1.7 GHz. You need an SDR that tunes to 2.2 GHz and an LNA mounted at the feed, before the cable.

Reference station. UHF-Satcom describes the setup used for most of its receptions: an 88 cm dish, a 3.5-turn helix feed tuned to 2250 MHz and a G4DDK vLNA (NF 0.30-0.33 dB, gain 25-26 dB, +12 V through a bias-tee). The helix is wound left-handed (LHCP) because most S-band downlinks are RHCP and reflection off the dish reverses the sense of polarisation. The page includes feed dimensions, build photos and measurements of cheaper LNAs (VK5EME, LNA4ALL).

Off-the-shelf kit. Discovery Dish (KrakenRF): a 70 cm reflector weighing under 1 kg with interchangeable feeds that include an LNA and filter - S-band 2.2-2.3 GHz, Inmarsat 1.525-1.66 GHz, hydrogen line 1.42 GHz. Price on Crowd Supply: USD 149 for the dish, USD 125 per feed (October 2026). Assembly and feeds: manufacturer documentation. Example of a hydrogen-line dish project: Scanning the Galactic Plane (Photonic, 15 min).

Radio.

Documentation: Pluto, B210, USRP bandwidth and sample rate, HackRF.

First target: PROBA-1. An ESA satellite launched in 2001. It dumps data at 2235 MHz, BPSK, 2.048 Mbps.

1. Check the SatNOGS DB entry and recent observations.
2. Record a pass with a Pluto or B210 (several Msps of continuous IQ).
3. Decode in SatDump, pipeline proba1_dump.
4. To learn how the chain is built: the S-Band-Decoders repository (archived since 2022), where the demodulator, Viterbi decoder and frame decoder are separate programs.

Above 6 GHz. The B210 stops at 6 GHz, so X-band (8 GHz) and Ku-band reception needs a downconverter. In its documentation check the input range, LO and IF frequencies and oscillator stability; LO drift adds to the Doppler shift. For Ku-band an ordinary satellite TV LNB does the job of the downconverter; connecting an LNB to an SDR is shown in Connecting a Ku-band LNB to an SDR (dereksgc, 10 min).

Tracking: rotator and control

With a 10-13° beam, manual pointing is enough only for low, slow passes. A rotator consists of three layers:

When choosing a rotator:

• Overhead passes. An az/el mount on an overhead pass has to turn the azimuth by almost 180° in a few seconds. An XY mount does not have this limitation, which is why it is used in professional LEO stations.
• Wind load. A dish has a large surface. What matters is the torque under wind load and gear backlash, not encoder resolution. The required accuracy grows with frequency: a 2.4 m dish at 8.4 GHz has a beam of about 1°.

An automatic station that schedules passes by itself and uploads results to the network: SatNOGS Setup.

Signal analysis: Tianwen-1 and Falcon 9

Tianwen-1 is the best publicly documented example of the whole path from spectrum to the meaning of packet fields. July 2020, the Chinese probe shortly after launch towards Mars.

1. Recording. Paul Marsh (M0EYT) records the probe's X-band downlink.
2. Physical layer. r00t.cz identifies a PM carrier with subcarriers. Telemetry: BPSK at 16,384 Bd on a 65,536 Hz subcarrier.
3. Coding. A rate 1/2 convolutional code and Reed-Solomon as in CCSDS, with one exception: RS does not use the dual-basis representation assumed by the CCSDS 131.0 standard. A standard CCSDS decoder will not decode the frames until that option is switched off.
4. Frames. AOS frames with separate virtual channels for telemetry, memory dumps, idle fill and playback of stored data.
5. Packets. About 50 active APIDs. APID 0x507 carries the XYZ position in kilometres every 32 seconds, APID 0x500 sun sensor readings.
6. Verification. Daniel Estévez recognises state vectors (position and velocity) in these tables, propagates them in NASA GMAT and compares them with the direction measured by the 20 m antenna in Bochum and by amateur stations.

A second example: in March 2021 radio amateurs in Europe decoded part of the telemetry of the Falcon 9 second stage in orbit. The format was close to a standard one, but extracting the bitstream needed custom tools and working out the data structure meant testing hypotheses. Overview: How Amateur Radio Fans Decoded SpaceX's Telemetry & Engineering Video (Scott Manley, 10 min).

In both cases every stage ends with a result that can be checked: a spectrum, demodulator lock, a valid CRC, field values consistent with the physics of flight. The authors separate identified fields from hypotheses.

Protocols: what's in a frame

Most professional missions use CCSDS standards. The structure resembles a TCP/IP stack. Layers from the bottom:

Small satellites often do not use CCSDS but AX.25 or CSP (CubeSat Space Protocol).

• SDLS is optional. Amateur satellites transmit in the clear: the ITU Radio Regulations prohibit encryption in the amateur service, except for satellite control signals.
• Standard compliance has to be checked. As with Tianwen-1, implementations deviate from CCSDS in the details. Parameters are confirmed on the data.

Ground segment and flight software

This part is software, parsers and networks, i.e. the standard scope of security testing. A basic lab fits both ends of the link on one computer:

• Mission control: OpenC3 COSMOS in Docker or Yamcs. Both send commands and display telemetry.
• Satellite: NASA cFS or F Prime (JPL), running on Linux or in an emulator (QEMU, Renode).
• Test scope: command and packet parsers, authentication in mission control, SLE transport, software updates. Parsers: fuzzing with AFL++ or libFuzzer. Network services: boofuzz. Binaries: Ghidra.

Ready-made labs: the spacecrafthacking repository for the book The Spacecraft Hacker's Handbook (Andrzej Olchawa, Milenko Starcik, No Starch Press, 2026). Its directories match the chapters: mission control, ground segment protocols (SLE), ground systems, flight software, SATCOM terminals and GNSS.

Security research: where to start

Threat models. SPARTA (Aerospace Corporation) and SPACE-SHIELD (ESA) are the MITRE ATT&CK equivalents for space systems: tactics, techniques and countermeasures. NIST good practice: IR 8270 (satellite operations), IR 8401 (ground segment), IR 8323r1 (PNT: positioning, navigation and timing).

CTF. Hack-A-Sat was a US Air Force and Space Force competition run from 2020 to 2023; the 2023 final was played on the Moonlighter satellite in orbit. The qualifier challenges are public, and the Solar Wine team's write-ups describe the solutions step by step.

Talks and demonstrations:

• Whispers Among the Stars - James Pavur, DEF CON Safe Mode 2020, 44 min. Intercepting satellite broadband traffic with about USD 300 of satellite TV equipment.
• Spread Spectrum Satcom Hacking - Colby Moore, DEF CON 23 (2015), 40 min. From reverse engineering to exploiting a spread-spectrum satellite communication system (Globalstar).
• Intercepting Sensitive Satellite Data Is (Scarily) Easier Than I Thought! - saveitforparts, 2026, 29 min. A repeat of the "Don't Look Up" study (UC San Diego) with amateur equipment: unencrypted traffic on GEO satellite links.
• Free Internet - Hacking Foreign Satellites - Peter Fairlie, 2024, 32 min. An internet connection over two GEO satellites and a ground station in Argentina; dial-up speed, about 600 ms latency. The video shows transmitting through other operators' satellites (see the ground rules).

Publications and archives. Awesome Space Security collects papers and talks. Most practical presentations are in the archives of DEF CON, Black Hat and Aerospace Village.

Transmitting (TX)

Transmitting covers two cases: your own bench in the lab, or a link you are licensed for and have the satellite operator's consent to use. In the lab the transmitter works into a dummy load through a coupler and attenuators, not into an antenna.

The full transmit and receive chain is described in the documentation of the discontinued Satlab station: a 2.4 m dish, uplink 2025-2110 MHz, downlink 2200-2290 MHz, GMSK 32-512 kbps. On the TX side an SDR modem with a ceramic filter drives a GaN amplifier with more than 20 W of output, switched on by a PTT signal from the modem. The signal goes through a cavity duplex filter to the feed, which also houses the LNA of the RX chain. Station figures: EIRP 36 dBW, G/T 9 dB/K, beamwidth ±2.25°.

When putting together a TX chain, define:

• the output power and required amplifier back-off,
• TX to RX isolation (transmitter power can damage the receiver),
• a transmit interlock,
• the spectral mask.

All of these items are in the equipment list.

Ready-made stations for comparison:

Pricing is agreed with the manufacturer for a specific configuration.

Catalogue

Links follow the same order as the chapters above. Entries marked "checked" are my own bookmarks that I keep coming back to. Some sites block scripts and return errors to them, so if a link fails in a tool, open it in a browser.

Sections: RF and DSP basics · Recordings and practice data · Frequencies and satellite status · Orbits and passes · SDR · Antennas, RF chain and measurement · Tracking and rotators · Receiver software and decoders · Ground station · S/X-band stations · Protocols and telemetry · Mission control · Flight software and RTOS · Embedded and reverse engineering · SATCOM, DVB and terminals · GNSS and PNT · Threat models, standards and research · CTFs and labs · Books, conferences and communities · Satellite imagery and EO data

RF and DSP basics

• PySDR - Free SDR and DSP textbook written for programmers. The best place to start.
• PySDR: frequency domain - FFT, spectrum, frequency resolution.
• PySDR: sampling and IQ - Sample rate, Nyquist, aliasing and complex samples.
• PySDR: dB and dBm - The units the whole radio chain is calculated in.
• PySDR: digital modulation - ASK, FSK, PSK and QAM with Python examples.
• PySDR: link budget - How to work out whether the signal reaches you at all.
• PySDR: filters - Filter design and cutting a channel out of the spectrum.
• PySDR: synchronisation - Carrier and symbol clock recovery, the core of every demodulator.
• The Scientist and Engineer's Guide to DSP - Classic DSP textbook, all chapters free.
• GNU Radio Tutorials - Official tutorials: from the first flowgraph to your own receiver.
• Hacking satellites with SDR (BSides Cape Town 2019) (video) - Gerard de Jong, 45 min. Introduction to SDR and LEO satellite reception with a cheap USB receiver.
• 10 Common Mistakes Made With SDR (video) - Tech Minds, 15 min. Drivers, cable losses, bandwidth, gain settings.

Recordings and practice data

• satellite-recordings - Satellite recordings for gr-satellites. Decoding without an antenna.
• Daniel Estévez: satellite posts - Signal analyses with recordings and notebooks; the author of gr-satellites.
• SigMF - Open format for IQ recordings with metadata.
• SigMF: specification - Format specification and example files.
• r00t.cz: Tianwen-1 - Analysis of the probe's X-band downlink: modulation, coding, AOS frames, APIDs. A model write-up.
• Daniel Estévez: Tianwen-1 orbit - State vectors from telemetry propagated in GMAT and compared with measurements.
• SatNOGS DB API - Satellite, transmitter and telemetry frame data through an API.
• SLE: sample PCAP (PCAP) - A Space Link Extension session capture to open in Wireshark.
• How Amateur Radio Fans Decoded SpaceX's Telemetry (video) - Scott Manley, 10 min. Radio amateurs decoding Falcon 9 second stage telemetry (2021).

Frequencies and satellite status

• SatNOGS DB (checked) - Satellite and transmitter database: frequency, modulation, baud rate, status.
• SatNOGS DB: PROBA-1 - The 2235 MHz S-band transmitter entry, the first target in How To: S-band.
• SatNOGS Network: observations - Latest receptions by SatNOGS stations. The quickest way to check whether a satellite is still transmitting.
• AMSAT-SM: satellite status - List of transmitters and their current state.
• AMSAT: status - Operator reports on amateur satellite operation.
• AMSAT: linear satellites - Linear transponder parameters, including QO-100.
• IARU: frequency coordination - Amateur satellite frequency filings and allocations, often with modulation details.
• ARISS: ISS station status - What the ISS is transmitting right now: APRS, SSTV, repeater.
• AMSAT-DL - QO-100, microwave stations and deep-space projects.
• Signal Identification Wiki: Satellite (checked) - Catalogue of satellite signals with spectra and audio samples. Helps identify what you see on the waterfall.
• NASA: frequency bands - The L, S, C, X, Ku, K, Ka band split used in this handbook.

Orbits and passes

• Gpredict (checked) - Passes, Doppler and radio and rotator control through Hamlib.
• Gpredict: source - Repository and issue tracker.
• N2YO (checked) - Browser-based tracking and pass predictions with nothing to install.
• Space-Track (checked) - Official catalogue of objects and orbital elements. Requires a free account.
• CelesTrak: orbital elements - Current orbital elements grouped by satellite type.
• CelesTrak: TLE and OMM formats - How the formats differ and why TLE is giving way to OMM (five-digit catalogue numbers are running out).
• Skyfield: satellites - Positions and passes in Python in a few lines.
• python-sgp4 - SGP4 in Python, the same algorithm most trackers use.
• Orekit - Orbital mechanics library (Java) for more serious analysis.
• NASA GMAT - NASA's trajectory analysis tool; used in the Tianwen-1 case.
• Basilisk - Spacecraft dynamics and control simulator.
• NASA 42 - Spacecraft orbit and attitude simulator.
• JPL Horizons - Ephemerides of planets, probes and small Solar System bodies.

SDR

• RTL-SDR Blog V4 - Cheap receiver up to about 1.7 GHz. The first SDR for VHF/UHF.
• RTL-SDR V4: datasheet (PDF) - Receiver parameters and bias-tee power for an LNA.
• RTL-SDR: quick start - Driver installation and first run.
• Airspy R2 - 12-bit receiver up to 1.8 GHz with better dynamic range than an RTL-SDR.
• Airspy Mini - Smaller and cheaper version of the R2.
• SDRplay RSP1B - 14-bit receiver up to 2 GHz; check API support in your software.
• HackRF One - RX/TX 1 MHz-6 GHz, half duplex. General-purpose lab tool.
• HackRF: documentation - Input limits, clock, firmware and CLI tools.
• ADALM-Pluto - Cheap full-duplex transceiver, 325 MHz-3.8 GHz. Good for S-band.
• Pluto: wiki - Manufacturer's instructions, schematics and software.
• Pluto: hardware - Circuit details, board revisions and modifications.
• Pluto: FPGA/HDL - HDL project, if you want to move processing into the FPGA.
• LimeSDR - Family of full-duplex SDRs for your own radio systems.
• USRP B210 - 70 MHz-6 GHz, 2x2, up to 56 MHz bandwidth. The standard in more serious stations.
• UHD: documentation - USRP driver: synchronisation, streaming, parameters.
• USRP: bandwidth and sample rate - How much bandwidth you actually get from a given model and interface.
• RX888 MK2: review (video) - Tech Minds, 14 min. 16-bit receiver with 64 MHz of real-time bandwidth on HF.

Antennas, RF chain and measurement

• SatNOGS: antennas - Overview of station antenna designs with links to the projects.
• QFH: calculator - Quadrifilar helix antenna dimensions for a given frequency.
• QFH: build (G4ILO) - Step by step with dimensions; an older but still useful guide.
• Arrow Antennas - Handheld VHF/UHF Yagis for tracking satellites by hand.
• Elk Antennas - Handheld log-periodic antennas for VHF/UHF.
• UHF-Satcom: S-band reception - 88 cm dish, 3.5-turn helix, LNA comparison. A reference S-band station.
• Discovery Dish (checked) - 70 cm dish with interchangeable active feeds: S-band, Inmarsat, hydrogen line.
• Discovery Dish: documentation - Assembly, feeds, alignment and software.
• RTL-SDR for Budget Radio Astronomy (checked) - The 21 cm hydrogen line on cheap hardware: dish, LNA, DSP. A good first dish project.
• Nooelec - Filters, LNAs and accessories; pick the variant for your band.
• RTL-SDR Blog: store - Receivers, filters, LNAs and antenna kits.
• NanoVNA - Cheap vector network analyser: antenna matching, cable and filter losses.
• NanoVNA V2 - Version up to 3 GHz, so it covers S-band too.
• tinySA - Pocket spectrum analyser for hunting local interference.
• Scanning the Galactic Plane (video) - Photonic, 15 min. Amateur reception of the hydrogen line from the Milky Way.
• Connecting a Ku-band LNB to an SDR (video) - dereksgc, 10 min. How an LNB works and how to connect it to an SDR receiver.
• Hacking Portable Satellite Dishes, part 2 (video) - saveitforparts, 14 min. Portable motorised Ku dishes (Dish Tailgater, VuQube VQ1000) as a cheap positioner.

Tracking and rotators

• SatNOGS: rotators - Overview of the az/el designs used in the SatNOGS network.
• SatNOGS Rotator v3 - Az/el mechanics to build yourself.
• SatNOGS Rotator Controller - Controller electronics, end stops and firmware.
• Rotator controller (Viorel Racoviteanu) (checked) - Arduino controller compatible with tracking software, with code and schematic.
• Hiltron HMAM-XY - Professional XY mount, no overhead-pass problem.
• Hamlib - Common interface for controlling radios (rigctld) and rotators (rotctld).
• Arduino antenna rotator, part 1 (video) - Viorel Racoviteanu, 21 min. Software and prototype of the rotator controller.
• Building An Autonomous Satellite Tracker, part 1 (video) - HamRadioConcepts, 27 min. Building the WB0OEW autonomous tracker: parts list.

Receiver software and decoders

• SDR++ - Spectrum, waterfall, manual reception and IQ recording.
• Gqrx - Alternative receiver; can send audio over UDP to gr-satellites.
• SkyRoof (checked) - SDR program for amateur satellites: tracking, Doppler, reception.
• DX Atlas (checked) - Maps and tools for radio amateurs.
• SatDump - Recording, demodulation and decoding for dozens of missions, including S- and X-band.
• SatDump: documentation - Receivers and IQ files. The interface changes between versions, so read the docs for yours.
• SatDump: pipelines - List of supported missions and their parameters, e.g. proba1_dump.
• SatDump: decoder source - Decoder implementations, a good source for learning frame formats.
• S-Band-Decoders - Archived (2022) PROBA-1/2/V decoders; a clear split into demodulator, Viterbi and frames.
• gr-satellites - Telemetry decoders for many amateur satellites, built on GNU Radio.
• gr-satellites: documentation - Command-line use, input formats and custom decoders.
• GNU Radio - DSP framework for building receivers out of blocks.
• SoapySDR - Common access layer for different SDRs.
• rtl-sdr-blog: driver - The driver required by the RTL-SDR V4.
• Dire Wolf - Software TNC: AX.25 and APRS, including from the ISS.
• Inspectrum - Browsing IQ recordings and measuring symbol rate by hand.
• Universal Radio Hacker - Demodulating and dissecting unknown radio protocols.
• DragonOS Focal (video) - Tech Minds, 11 min. Linux distribution with SDR software preinstalled.

Ground station

• SatNOGS wiki - Building and running SatNOGS network stations.
• SatNOGS: client setup - Client installation and connecting the receiver.
• SatNOGS Setup - An automatic station that schedules passes and uploads results by itself.
• SatNOGS Network - Station map, pass schedule and observation results.
• SatNOGS: repositories - Client and network code and hardware projects.
• SatNOGS Kit: assembly - Assembling and starting the ready-made station kit.
• Ground Station - Web-based station: tracking, SDR, recordings and decoders in one interface.
• Ground Station: tracking console (checked) - Interface screenshots, a quick look at what the project can do.
• Ground Station: Hackers-Arise article - Building a station with this project. Compare the installation with the current README.
• Raspberry Pi: documentation - Station computer: power, USB and storage.

S/X-band stations

• NASA: Ground Data Systems - State of the art of ground stations and operations for small satellites.
• Satlab S-band Ground Station - Discontinued product. Parameters: 2.4 m, TX 2025-2110 MHz, RX 2200-2290 MHz.
• Satlab: station build (PDF) - Full RX/TX chain: SDR modem, GaN HPA, duplex filter, feed with LNA.
• Groundcom Dual S/X - 2.4-4.5 m dishes; S-band TX/RX, X-band RX.
• Orbital Systems 2.4TSX1 (PDF) - Datasheet of a 2.4 m station: positioner, controller, up/downconverter and HPA.
• Remos S/X - Tracking antenna with modem, configured per mission.
• Kratos: antennas - Operator-grade ground station antennas.

Protocols and telemetry

• CCSDS: publications - All standards: TM, TC, AOS, USLP, Space Packet, SLE, CFDP, SDLS. Take the current revision from here, not from someone else's list.
• CCSDSPy - Parsing CCSDS packets in Python.
• spacepackets - CCSDS, ECSS PUS and CFDP packets in Python, including generating test packets.
• libcsp - CubeSat Space Protocol, popular in small satellites.
• XTCE - Standard for describing telemetry and commands, used by Yamcs among others.
• Wireshark - PCAP analysis; has dissectors for some space protocols.
• Scapy - Custom parsers and test packets in Python.
• SLE: lab - Space Link Extension training environment with configuration and samples.
• SLE API (Java) - Implementation of SLE services (fork in the spacecrafthacking organisation).
• ION DTN - Delay-tolerant networking from JPL: communication over long link outages.

Mission control

• OpenC3 COSMOS: installation - Running a local COSMOS in Docker.
• OpenC3 COSMOS: getting started - First project, commands and telemetry.
• OpenC3 COSMOS: security - Authentication and service configuration, a starting point for testing.
• OpenC3 COSMOS: architecture - System components and data flow.
• OpenC3 COSMOS: project template - Starter project.
• OpenC3 COSMOS: source - Platform source code.
• Yamcs: manual - Mission database, links, telemetry and commands.
• Yamcs: source - Source code and example configurations.
• Open MCT - NASA's web-based mission data visualisation.
• Lab: mission control - COSMOS and Yamcs configurations for exercises.
• Lab: ground systems - Exercises on your own F Prime, Yamcs and COSMOS instances.

Flight software and RTOS

• NASA cFS - Core Flight System, NASA's flight software framework.
• NASA cFE - Core Flight Executive, the core of cFS.
• NASA OSAL - Operating system abstraction layer for cFS.
• F Prime - Component-based flight software framework from JPL.
• F Prime: tutorials - Documentation and starter projects.
• RTEMS - RTOS used in many missions; toolchains and BSPs.
• FreeRTOS - Popular RTOS in small satellites.
• Zephyr - RTOS for embedded exercises.
• KubOS - Community archive after the original KubOS repository disappeared.
• Lab: cFS Memory Manager - Older cFS version with Memory Manager for exercises.
• Lab: F Prime - F Prime exercises in a local lab.
• SatNOGS COMMS - Open spacecraft-side TM/TC transceiver: firmware and documentation.

Embedded and reverse engineering

• Ghidra - Firmware and binary analysis.
• GDB - Debugging, including remote debugging on boards and in emulators.
• QEMU - Emulation of processors and whole systems.
• Renode - Emulation of embedded platforms including peripherals.
• OpenOCD - JTAG/SWD for debugging boards.
• sigrok - Logic analysers and bus decoders.
• Binwalk - Unpacking and analysing firmware images.
• AFL++ - Fuzzing parsers and programs.
• libFuzzer - Fuzzing parsers with coverage and sanitizers.
• boofuzz - Fuzzing network services and protocols.
• ChipWhisperer - Side-channel attacks and glitching on training boards.

SATCOM, DVB and terminals

• r00t.cz (checked) - Satellite signal analyses, decoders and receiving projects, including Tianwen-1.
• UHF-Satcom (checked) - Downlink observations, frequencies and reception write-ups across bands.
• GNU Radio: DTV - DVB and digital broadcast blocks in GNU Radio.
• ETSI: standards search - DVB-S/S2/S2X specifications; search by standard number.
• gr-dvbs2rx - DVB-S2 receiver in GNU Radio.
• leandvb - Lightweight DVB-S/S2 receiver and DSP library.
• gr-iridium - Iridium reception and demodulation in GNU Radio.
• iridium-toolkit - Iridium frame parsers and analysis tools.
• Lab: SATCOM terminals - Terminal security exercises in your own lab.
• Hacking Iridium Satellites With Iridium Toolkit (video) - Tech Minds, 16 min. Iridium reception with a patch antenna and decoding with gr-iridium and iridium-toolkit.
• Whispers Among the Stars (DEF CON Safe Mode) (video) - James Pavur, 2020, 44 min. Intercepting satellite broadband traffic with about USD 300 of TV equipment.
• Spread Spectrum Satcom Hacking (DEF CON 23) (video) - Colby Moore, 2015, 40 min. From reverse engineering to vulnerabilities in spread-spectrum satellite communication (Globalstar).
• Intercepting Sensitive Satellite Data (video) - saveitforparts, 2026, 29 min. A repeat of the "Don't Look Up" study with amateur equipment.
• Free Internet - Hacking Foreign Satellites (video) - Peter Fairlie, 2024, 32 min. An internet link over two GEO satellites; transmitting through other operators' satellites.

GNSS and PNT

• ESA Navipedia - GNSS encyclopaedia: signals, measurements, error sources.
• Navipedia: GPS introduction - GPS frequencies and signal structure.
• ESA GNSS Data Processing Vol. I (PDF) - ESA textbook: GNSS observations, modelling and algorithms.
• GPS: interface specifications - Official GPS signal documents.
• Galileo Service Centre - Galileo documentation, status and services.
• GNSS-SDR - Open software GNSS receiver; also processes recordings.
• GNSS-SDR: source - Receiver source code and tests.
• RTKLIB - Position computation and processing of raw observations.
• Lab: GNSS - Material for GNSS research in a lab.

Threat models, standards and research

• SPARTA - Tactics, techniques and countermeasures for space systems (Aerospace Corporation).
• SPACE-SHIELD - ESA's ATT&CK-style knowledge base for threat modelling.
• SATCOM Security (checked) - UCSD/UMD project and the "Don't Look Up" paper (CCS 2025) on unencrypted GEO traffic.
• NIST IR 8270 (PDF) - Introduction to cybersecurity for commercial satellite operations.
• NIST IR 8401 - Cybersecurity Framework profile for the ground segment.
• NIST IR 8323 rev. 1 - Profile for the responsible use of PNT services.
• NASA Technical Standards - Including NASA-STD-1006 on space system protection.
• ECSS: standards - European space engineering standards, including PUS; check the revision.
• NASA CryptoLib - CCSDS SDLS implementation: frame encryption and authentication.
• CISA AA22-076A - Recommendations for SATCOM operators and customers after the KA-SAT attack.

CTFs and labs

• Hack-A-Sat library - Starting point: challenges, material and links to write-ups from all editions.
• Hack-A-Sat 2020: qualifiers - Challenges and files from the first edition.
• Hack-A-Sat 2021: qualifiers - Challenges from the second edition.
• Hack-A-Sat 2022: qualifiers - Challenges from the third edition.
• Hack-A-Sat 2023: qualifiers - Challenges from the edition with the final on the Moonlighter satellite.
• Solar Wine: write-ups - Detailed solutions to Hack-A-Sat challenges.
• spacecrafthacking: labs - Code, configurations and data for the exercises in "The Spacecraft Hacker's Handbook".
• spacecrafthacking: organisation - Software forks used in the labs.
• Aerospace Village - Aerospace workshops and CTFs, including at DEF CON.

Books, conferences and communities

• The Spacecraft Hacker's Handbook (checked) - Andrzej Olchawa, Milenko Starcik, No Starch Press, 2026. Labs in the spacecrafthacking repository.
• Awesome Space Security - Papers, tools and talks on space security.
• Awesome Space - Wider catalogue of space engineering.
• DEF CON media - Slides and recordings of talks, including Aerospace Village.
• Black Hat: archives - Talks on SATCOM, GNSS and flight software.
• CYSAT - European conference on cybersecurity in space.
• Libre Space Community - SatNOGS forum: station building, decoding, troubleshooting.
• AMSAT - Amateur satellite organisation: articles on antennas and stations.
• UKE: exams (checked) - Registration for the Polish radio operator exam, needed to transmit in Poland.

Satellite imagery and EO data

• VLM satellite imagery - Vision-language models for questions about satellite image content.
• Copernicus Data Space - Sentinel data and image browser.
• NASA Earthdata - Catalogues and tools for Earth observation data.
• QGIS - GIS for working with rasters and layers.
• GDAL - Raster data conversion and processing.
• Rasterio - Rasters in Python.
• TorchGeo - Datasets and ML models for geospatial data.
• STAC - Standard for cataloguing geospatial data.
• Awesome Planetary Geology (checked) - Data, mapping tools and planetary geology material.

Attachments

• Equipment list (BOM) - template for a VHF/UHF station plus the S/X/Ku/Ka extension with a TX chain.
• Field test card - what to record after every reception session.
• Lab record - the same for software exercises.
• Recording metadata - JSON template describing an IQ recording.