HackRF One: Getting Started with Software Defined Radio for Security Research

Software Defined Radio has transformed the way security researchers interact with the radio frequency spectrum. Instead of buying a different piece of hardware for every protocol you want to analyze, an SDR like the HackRF One lets you receive and transmit across a massive frequency range using software alone.

In this guide, we walk through what the HackRF One is, how to set it up, and how it fits into security research and penetration testing workflows.

What Is the HackRF One?

The HackRF One is an open-source SDR platform designed by Great Scott Gadgets. It is a half-duplex transceiver capable of receiving and transmitting RF signals from 1 MHz to 6 GHz. That range covers virtually every consumer wireless protocol in use today — from AM radio to WiFi, Bluetooth, cellular, GPS, and beyond.

Unlike receive-only SDR dongles (like the RTL-SDR), the HackRF One can also transmit, making it suitable for security research that involves replaying or generating signals.

Key Features and Specifications

• Frequency range: 1 MHz to 6 GHz
• Half-duplex transceiver (receive or transmit, not simultaneously)
• Bandwidth: up to 20 MHz
• Sample rate: up to 20 Msps (million samples per second)
• Resolution: 8-bit quadrature samples
• Interface: USB 2.0 High Speed
• Power: USB bus powered — no external supply needed
• Open source: hardware design, firmware, and host software are all open source
• SMA antenna connector with compatibility for a wide range of antennas

PortaPack H2 Add-On

The optional PortaPack H2 turns the HackRF One into a standalone portable device with:

• Touchscreen LCD display
• Built-in battery
• On-device signal capture, replay, and analysis
• No laptop required for field work

Setting Up Your HackRF One

Software Installation

Windows

1. Download and install SDR# (SDRSharp) from airspy.com
2. Install the Zadig USB driver tool
3. Plug in the HackRF One and use Zadig to install the WinUSB driver
4. In SDR#, select "HackRF One" as the source and click Play

Linux

1. Install dependencies: sudo apt install hackrf libhackrf-dev gnuradio gqrx-sdr
2. Plug in the HackRF One
3. Verify detection: hackrf_info
4. Launch GQRX or GNU Radio Companion for visualization

macOS

1. Install via Homebrew: brew install hackrf gnuradio
2. Use GQRX or GNU Radio Companion as your frontend

Your First Capture

1. Connect the ANT500 antenna (included)
2. Open your SDR software and set the center frequency to 100 MHz (FM radio band)
3. You should immediately see FM broadcast stations as peaks in the spectrum
4. Tune to a station and select WFM (Wide FM) demodulation to listen

Real-World Use Cases for Security Research

Wireless Protocol Analysis

The HackRF One is the go-to tool for analyzing unknown wireless protocols. When you encounter a device transmitting on an unfamiliar frequency, you can:

1. Use the spectrum analyzer to locate the signal
2. Capture the raw IQ data for offline analysis
3. Decode the modulation scheme (ASK, FSK, PSK, etc.)
4. Reverse-engineer the protocol using tools like Universal Radio Hacker

Replay Attacks

For authorized penetration testing, the HackRF One can capture and replay RF signals:

• Garage door openers using fixed codes
• Wireless doorbells and alarm sensors
• Car key fobs (fixed code systems only — rolling codes require more sophisticated attacks)
• Industrial remote controls operating on sub-GHz frequencies

GPS Simulation

Security researchers testing GPS-dependent systems can use the HackRF One with GPS-SDR-SIM to generate synthetic GPS signals. This is valuable for testing:

• Fleet management system resilience
• Drone geofencing bypass scenarios
• Navigation system spoofing detection

Important: GPS simulation must only be conducted in a shielded environment (Faraday cage) to avoid interfering with real GPS signals, which is illegal.

Cellular and Pager Analysis

The frequency range covers cellular bands and pager frequencies:

• Capture and decode POCSAG pager messages (unencrypted pager traffic)
• Analyze cellular signal strength and tower locations
• Study GSM/LTE signal patterns for coverage analysis

Bluetooth and WiFi Reconnaissance

While dedicated tools exist for Bluetooth and WiFi, the HackRF One can provide spectrum-level visibility:

• Identify WiFi channel utilization across the 2.4 GHz and 5 GHz bands
• Detect Bluetooth devices by their frequency hopping patterns
• Find rogue transmitters or interference sources

Essential Software Tools

• GNU Radio — the primary framework for building SDR signal processing flows
• GQRX — real-time spectrum analyzer with waterfall display
• Universal Radio Hacker — protocol analysis and reverse engineering
• SDR# — Windows-focused SDR receiver with plugin support
• Inspectrum — offline signal analysis and measurement
• GPS-SDR-SIM — GPS signal generation for testing
• gr-gsm — GSM signal analysis toolkit

Tips for Getting the Most Out of Your HackRF

1. Antennas matter — the included ANT500 is decent, but frequency-specific antennas dramatically improve performance
2. Use shielding — when transmitting, always use a Faraday cage or direct cable connection to avoid interference
3. Record everything — capture raw IQ files for offline analysis rather than trying to decode in real-time
4. Pair with PortaPack — the H2 add-on makes field work vastly more practical
5. Update firmware — Great Scott Gadgets regularly releases firmware updates with bug fixes and new features

Who Should Buy This?

The HackRF One is essential for:

• RF security researchers analyzing wireless protocols
• Penetration testers conducting wireless assessments
• SIGINT enthusiasts monitoring the radio spectrum
• Hardware hackers building custom radio projects
• Students learning about radio frequency communication and digital signal processing

If your work involves understanding, testing, or securing anything that communicates wirelessly, the HackRF One is a foundational tool. Combined with the PortaPack H2, it becomes a completely portable RF analysis platform.

Conclusion

The HackRF One democratized access to wideband RF analysis and transmission. For under $400 (with PortaPack), you get a tool that covers 1 MHz to 6 GHz with full transmit and receive capability. In the world of security research, that kind of coverage is invaluable.

Whether you are reverse-engineering an IoT device protocol, testing the RF security of a facility, or learning the fundamentals of software defined radio, the HackRF One is where you start.

Disclaimer: Always operate within legal boundaries. RF transmission is regulated in every jurisdiction. Ensure you have authorization before transmitting and always comply with local radio regulations.