DEV Community

Ashen Chathuranga
Ashen Chathuranga

Posted on

Exploring the RF Spectrum: Building an ADS-B Transmitter in Rust for HackRF One

#hackrf #adsb #sdr #rust

If you are a fan of aviation and software-defined radio (SDR), chances are you've played around with tracking airplanes using ADS-B (Automatic Dependent Surveillance-Broadcast). We usually do this by building receivers to listen to the sky. But what if you wanted to test your receivers, understand the protocol deeply, or simulate fake flight paths in an RF-shielded lab?

Enter adsb-tx—an open-source, Rust-based ADS-B signal generator and transmitter built specifically for the HackRF One SDR.

CRUCIAL DISCLAIMER: Transmitting on 1090 MHz (the standard ADS-B frequency) is illegal in most countries without proper aviation authorization. This tool is intended strictly for educational and research purposes. Always use an RF-shielded environment or test on non-aviation ISM bands (like 433 MHz) with low gain.

Why Rust + HackRF?

Software-defined radio demands high performance, especially when generating baseband signals at millions of samples per second (2 Msps in this case). Rust provides the perfect blend of memory safety, speed, and modern tooling to handle raw bit manipulation, fast CRC calculations, and signal modulation without the typical C/C++ memory headaches.

Core Features

The adsb-tx tool isn't just a basic static signal spoofer. It is a full-featured CLI application designed to generate Mode S extended squitter (DF17) messages:

  • Multiple Message Types: Generates Aircraft ID, Airborne Position, and Airborne Velocity messages.
  • Proper CPR Encoding: It handles the complex Compact Position Reporting (CPR) algorithm natively, dispatching both even and odd position frames so receivers can lock onto an accurate global position.
  • Flight Simulation: You can input a starting coordinate, altitude, speed, and heading, and the tool will simulate a moving aircraft over time, continuously updating its broadcasted coordinates.
  • Flexible Outputs: Not near your HackRF? You can output the raw binary signal directly to a file (.bin) or stdout for analysis with other tools.

Under the Hood: Technical Details

If you love RF engineering and protocol design, the architecture of adsb-tx is quite elegant:

  1. Message Formatting: Creates 112-bit DF17 Mode S messages using a custom 24-bit CRC matching the aviation specification.
  2. Modulation Scheme: Uses On-Off Keying (OOK) at 2 Msps.
  3. Encoding: Implements Manchester encoding for the data bits, prepended by the standard ADS-B preamble (0xA1 0x40).

The codebase is split beautifully into modules handling CLI parsing, encoding, modulation, CRC, and flight simulation, making it a great codebase to study if you want to learn how RF signals are constructed in software.

Getting Started

Assuming you have a Rust toolchain and the HackRF tools (hackrf_transfer) installed on your system, getting this running is trivial.

git clone https://github.com/ktauchathuranga/adsb-tx.git
cd adsb-tx
cargo build --release
Enter fullscreen mode Exit fullscreen mode

Transmitting a Single Message

You can transmit a single stationary airborne position on a safe testing frequency (e.g., 433 MHz):

./target/release/adsb-tx single \
  --icao 0x4B1A2B \
  --msg-type pos \
  --lat 7.0 --lon 80.0 --alt 35000 \
  --freq 433000000 \
  --tx-gain 0 \
  --repeat 100
Enter fullscreen mode Exit fullscreen mode

Simulating a Flight Path

Want to watch a plane fly across your decoder screen? Use the simulate subcommand. The tool will calculate the trajectory and emit dynamically updating position frames:

./target/release/adsb-tx simulate \
  --icao 0x4B1A2B \
  --callsign NOCATS \
  --start-lat 7.0 \
  --start-lon 80.0 \
  --alt 35000 \
  --speed 450 \
  --heading 90 \
  --duration 60 \
  --update-interval 1000 \
  --freq 433000000 \
  --tx-gain 0
Enter fullscreen mode Exit fullscreen mode

Testing Your Transmissions

If you want to verify your signals, you can loop this back into an RTL-SDR or another HackRF tuned to your test frequency using decoding tools like dump1090, SDRangel, or the author's own Rust-based adsb decoder.

Final Thoughts

The adsb-tx repository is an awesome example of using modern languages to tackle traditional RF problems. Whether you are exploring SDR for the first time, studying aviation telemetry protocols, or looking for a cool Rust side project to read through, I highly recommend checking out this repository.

Link to repo: https://github.com/ktauchathuranga/adsb-tx

Drop a star on the repo if you find it useful, and let me know in the comments what kind of SDR projects you're building!

Top comments (0)