An Ultimate Satellite Hacking Handbook

I got interested in the subject many, many years ago. Some time later I built my first project (NOAA), on hardware that was fairly old even back then: I converted a TV dongle into a receiver and built an antenna out of PVC pipe. It worked, and it was a fun project. Since then I have collected a lot more equipment and point popular dish antennas at the sky looking for something interesting... and a few bigger ideas are waiting to be built.

Over that time I have also been collecting material about satellites: how to receive them, how to take their signals apart into frames and what their security looks like when someone takes a closer look. Bookmarks, repositories, hardware documentation, CTF write-ups, conference recordings. At some point the "sat" folder in my browser started to look like a drawer full of cables, so I decided to put it in order. For myself and for you.

A satellite system is divided into four segments. The table shows which chapters of the handbook cover each of them.

At the end: the link Catalogue and Attachments.

Band edges follow the NASA convention. SATCOM service names do not always match them; choose hardware by its range in MHz.

Video: an introduction to SDR and LEO satellite reception with a cheap USB receiver - Gerard de Jong, Hacking satellites with Software Defined Radio (BSides Cape Town 2019, 45 min).

An exercise on ready-made recordings. It tests the chain IQ file - demodulation - frames without an antenna and without waiting for a pass.

Environment: DragonOS is a Linux distribution with SDR software preinstalled (Tech Minds overview, 11 min). The tools can also be installed from your own distribution's packages.

Unknown protocols: Universal Radio Hacker (demodulation and frame analysis). More recordings with analyses: Daniel Estévez's blog, the author of gr-satellites.

Hardware: an RTL-SDR Blog V4, an antenna (V-dipole, QFH or a handheld Yagi such as an Arrow) and a computer. The RTL-SDR V4 needs the RTL-SDR Blog driver; older distribution packages do not support it.

Before the first reception: 10 Common Mistakes Made With Software Defined Radio (Tech Minds, 15 min) - software choice, drivers, coax losses, signal bandwidth, gain settings.

Iridium is a LEO satellite constellation transmitting in the 1616-1626.5 MHz band. An RTL-SDR covers this range, but not all 10 MHz at once; an SDR sampling at 10 Msps or more (e.g. a HackRF) receives the whole band. The whole process is shown in Hacking Iridium Satellites With Iridium Toolkit (Tech Minds, 16 min).

iridium-toolkit can also reassemble messages and voice frames. That is the content of other people's communication, so the ground rules at the top of the handbook apply.

S-band is the main band for telemetry and commands of professional missions. Compared with UHF, three things change:

Reference station. UHF-Satcom describes the setup used for most of its receptions: an 88 cm dish, a 3.5-turn helix feed tuned to 2250 MHz and a G4DDK vLNA (NF 0.30-0.33 dB, gain 25-26 dB, +12 V through a bias-tee). The helix is wound left-handed (LHCP) because most S-band downlinks are RHCP and reflection off the dish reverses the sense of polarisation. The page includes feed dimensions, build photos and measurements of cheaper LNAs (VK5EME, LNA4ALL).

Off-the-shelf kit. Discovery Dish (KrakenRF): a 70 cm reflector weighing under 1 kg with interchangeable feeds that include an LNA and filter - S-band 2.2-2.3 GHz, Inmarsat 1.525-1.66 GHz, hydrogen line 1.42 GHz. Price on Crowd Supply: USD 149 for the dish, USD 125 per feed (October 2026). Assembly and feeds: manufacturer documentation. Example of a hydrogen-line dish project: Scanning the Galactic Plane (Photonic, 15 min).

Documentation: Pluto, B210, USRP bandwidth and sample rate, HackRF.

First target: PROBA-1. An ESA satellite launched in 2001. It dumps data at 2235 MHz, BPSK, 2.048 Mbps.

Above 6 GHz. The B210 stops at 6 GHz, so X-band (8 GHz) and Ku-band reception needs a downconverter. In its documentation check the input range, LO and IF frequencies and oscillator stability; LO drift adds to the Doppler shift. For Ku-band an ordinary satellite TV LNB does the job of the downconverter; connecting an LNB to an SDR is shown in Connecting a Ku-band LNB to an SDR (dereksgc, 10 min).

With a 10-13° beam, manual pointing is enough only for low, slow passes. A rotator consists of three layers:

An automatic station that schedules passes by itself and uploads results to the network: SatNOGS Setup.

Tianwen-1 is the best publicly documented example of the whole path from spectrum to the meaning of packet fields. July 2020, the Chinese probe shortly after launch towards Mars.

A second example: in March 2021 radio amateurs in Europe decoded part of the telemetry of the Falcon 9 second stage in orbit. The format was close to a standard one, but extracting the bitstream needed custom tools and working out the data structure meant testing hypotheses. Overview: How Amateur Radio Fans Decoded SpaceX's Telemetry & Engineering Video (Scott Manley, 10 min).

In both cases every stage ends with a result that can be checked: a spectrum, demodulator lock, a valid CRC, field values consistent with the physics of flight. The authors separate identified fields from hypotheses.

Most professional missions use CCSDS standards. The structure resembles a TCP/IP stack. Layers from the bottom:

Small satellites often do not use CCSDS but AX.25 or CSP (CubeSat Space Protocol).

This part is software, parsers and networks, i.e. the standard scope of security testing. A basic lab fits both ends of the link on one computer:

Ready-made labs: the spacecrafthacking repository for the book The Spacecraft Hacker's Handbook (Andrzej Olchawa, Milenko Starcik, No Starch Press, 2026). Its directories match the chapters: mission control, ground segment protocols (SLE), ground systems, flight software, SATCOM terminals and GNSS.

Threat models. SPARTA (Aerospace Corporation) and SPACE-SHIELD (ESA) are the MITRE ATT&CK equivalents for space systems: tactics, techniques and countermeasures. NIST good practice: IR 8270 (satellite operations), IR 8401 (ground segment), IR 8323r1 (PNT: positioning, navigation and timing).

CTF. Hack-A-Sat was a US Air Force and Space Force competition run from 2020 to 2023; the 2023 final was played on the Moonlighter satellite in orbit. The qualifier challenges are public, and the Solar Wine team's write-ups describe the solutions step by step.

Publications and archives. Awesome Space Security collects papers and talks. Most practical presentations are in the archives of DEF CON, Black Hat and Aerospace Village.

Transmitting covers two cases: your own bench in the lab, or a link you are licensed for and have the satellite operator's consent to use. In the lab the transmitter works into a dummy load through a coupler and attenuators, not into an antenna.

The full transmit and receive chain is described in the documentation of the discontinued Satlab station: a 2.4 m dish, uplink 2025-2110 MHz, downlink 2200-2290 MHz, GMSK 32-512 kbps. On the TX side an SDR modem with a ceramic filter drives a GaN amplifier with more than 20 W of output, switched on by a PTT signal from the modem. The signal goes through a cavity duplex filter to the feed, which also houses the LNA of the RX chain. Station figures: EIRP 36 dBW, G/T 9 dB/K, beamwidth ±2.25°.

When putting together a TX chain, define:

All of these items are in the equipment list.

Pricing is agreed with the manufacturer for a specific configuration.

Links follow the same order as the chapters above. Entries marked "checked" are my own bookmarks that I keep coming back to. Some sites block scripts and return errors to them, so if a link fails in a tool, open it in a browser.

Sections: RF and DSP basics · Recordings and practice data · Frequencies and satellite status · Orbits and passes · SDR · Antennas, RF chain and measurement · Tracking and rotators · Receiver software and decoders · Ground station · S/X-band stations · Protocols and telemetry · Mission control · Flight software and RTOS · Embedded and reverse engineering · SATCOM, DVB and terminals · GNSS and PNT · Threat models, standards and research · CTFs and labs · Books, conferences and communities · Satellite imagery and EO data