RF / SDR signal analysis (non-Wi-Fi radio)

When it applies

The scope includes a radio device that isn't Wi-Fi — a wireless remote, key fob, alarm sensor, telemetry link, or ISM-band gadget — and you need to know whether an attacker can eavesdrop on, forge, or replay its traffic. Spectrum use and transmission are heavily regulated: load tradecraft-scope-roe and make scope.txt state the exact devices, frequency bands, and whether transmitting is permitted at all — the default is receive-only. Classic Wi-Fi attacks belong to the wireless domain (wireless-wpa2-attacks, wireless-evil-twin); this skill is generic SDR RF.

Why it works

Cheap SDR hardware (RTL-SDR for receive, HackRF for transmit) turns a wide slice of spectrum into raw I/Q samples. Most low-cost remotes and sensors use simple, unauthenticated modulation (OOK/ASK/2-FSK) with fixed or rolling codes, so the entire protocol is recoverable from a capture: demodulate to symbols, read the bit pattern, and you know exactly what a receiver trusts. Replay and forgery feasibility then falls out of whether the code is fixed, rolling, or challenge-response.