OpenSourceSDRLab PortaRF · Volume 12
OpenSourceSDRLab PortaRF Volume 12 — Cheatsheet (the laminate-ready field card)
Hardware quick-facts, port mapping, firmware workflows, hackrf_* commands, Mayhem menu map, regional rules, troubleshooting, pre-engagement checklist
Contents
1. About this volume
Vol 12 is the laminate-ready field card — synthesis of every preceding volume’s most-referenced content for in-the-field reference. Print the relevant sections, laminate, tape inside the gear bag.
The card is designed to answer “what’s the hackrf command for X?”, “is my battery going to last?”, “what’s the legal limit in this region?”, “the unit’s misbehaving — what next?” without having to open a laptop or the Hack Tools wiki.
For deeper content on any item, the volume references in each section point to the full discussion. This card is the index, not the reference.
2. Hardware quick-facts panel
┌──────────────────────────────────────────────────────────────────┐
│ OpenSourceSDRLab PortaRF │
├──────────────────────────────────────────────────────────────────┤
│ RF silicon Clifford Heath modified HackRF │
│ MAX2837 transceiver · RFFC5072 mixer │
│ MAX5864 8-bit ADC/DAC · LPC4320 MCU · Si5351 clock │
│ CLA4611-085LF protection (Heath addition) │
│ TRF37B73 MMIC amps · SKY13453-385LF switches │
│ Frequency 1 MHz – 6 GHz (HackRF silicon limit) │
│ TX power Up to ~+15 dBm │
│ Sample rate Up to 20 MS/s (USB 2.0 bottleneck) │
│ Half-duplex Yes (HackRF inherent limit) │
│ Display 2.4" 240×320 TFT (PortaPack-class) │
│ Input D-pad + encoder + buttons; QWERTY on H4M variants │
│ Battery 1500-3000 mAh LiPo (verify on vendor page) │
│ USB USB-C (5 V / ~1 A; no PD negotiation) │
│ Storage microSD (FAT32, Class 10 / U1 min) │
│ Audio jack Maybe (verify; PortaPack convention) │
│ Form Single-box handheld monolithic │
│ Firmware Mayhem (pre-flashed by vendor) │
│ Status Aspirational (as of 2026-05-13) │
└──────────────────────────────────────────────────────────────────┘
For HackRF silicon details: HackRF One deep dive Vol 2.
For Mayhem details: HackRF One deep dive Vols 4-6.3. External port reference
| Port | Function | Notes |
|---|---|---|
| USB-C (side) | Charge + data | 5 V / ~1 A; no PD negotiation; data + charging simultaneous |
| RP-SMA female (top) | Antenna | Included whip; swap to band-tuned antenna for serious work |
| microSD slot (side) | Mayhem firmware + captures + presets | FAT32; Class 10 / U1 minimum |
| Audio jack (top — verify) | Receiver demodulation output | 3.5 mm TRS line-level; may not be present |
| Power button (side) | On/off | Long-press for shutdown |
4. Firmware update workflows
4.1 Mayhem (frequent)
1. Download latest Mayhem .bin from
https://github.com/portapack-mayhem/mayhem-firmware/releases
(Use portapack-h1_h2-mayhem.bin for H2+ or
portapack-h4m-mayhem.bin for H4M)
2. Verify SHA-256 hash matches the release page
3. Copy .bin to SD card root (FAT32)
4. Insert SD into PortaRF; reboot
5. Mayhem self-flashes (~30-60 seconds)
6. Verify new version on boot screen + Settings → About4.2 HackRF firmware (rare)
# 1. Connect PortaRF via USB-C
# 2. Verify current version
hackrf_info
# 3. Backup factory firmware FIRST
hackrf_spiflash -r portarf_factory_backup_$(date +%Y%m%d).bin
# 4. Flash new firmware
hackrf_spiflash -w hackrf_one_usb_R10.bin
# (use the correct .bin for your HackRF revision)
# 5. Disconnect + reconnect; verify
hackrf_info4.3 If something breaks
- Mayhem brick → reflash known-good .bin from SD; if SD reader broken, vendor RMA
- HackRF firmware brick → DFU mode +
dfu-utilflash factory backup; vendor RMA if DFU unreachable - Both broken → vendor RMA
5. hackrf_* command reference
# === Diagnostics ===
hackrf_info # Identify device, firmware version, S/N
# === Capture I/Q ===
hackrf_transfer -r capture.cfile \
-f 433920000 \ # frequency (Hz)
-s 2000000 \ # sample rate (Hz)
-g 40 # RX gain (dB)
# === Replay captured signal ===
hackrf_transfer -t capture.cfile \
-f 433920000 \ # frequency (Hz)
-s 2000000 \ # sample rate (Hz)
-x 0 # TX gain (dB; 0 conservative)
# === Wideband sweep ===
hackrf_sweep -f 100:6000 # Sweep 100-6000 MHz
hackrf_sweep -f 432:435 -B # Narrower sweep, binary output
# === Calibration ===
hackrf_clock -g # Read current clock config
hackrf_clock -s <ppm> # Set PPM offset
# === Firmware ===
hackrf_spiflash -r backup.bin # Read current firmware
hackrf_spiflash -w firmware.bin # Write new firmware
# === Antenna switch (rare) ===
hackrf_operacake -s 1 # Switch to antenna port 1Cross-ref HackRF One Vol 7 for the full tool catalog with detailed options.
6. Mayhem menu map
Mayhem’s app grid typically organizes apps by category. Exact apps vary by Mayhem version; the categories are stable:
App Grid (Home Screen)
│
├── Receive
│ ├── Narrowband RX
│ ├── Wideband Spectrum
│ ├── Spectrum Painter
│ └── Capture
│
├── Decode
│ ├── ADS-B (1090 MHz)
│ ├── AIS (162 MHz)
│ ├── POCSAG (varies)
│ ├── BTLE (2.4 GHz)
│ ├── NRF (2.4 GHz)
│ ├── ERT (915 MHz)
│ ├── RDS (FM broadcast)
│ ├── TPMS (315/433 MHz)
│ ├── AFSK (varies)
│ └── DTMF (audio)
│
├── Transmit
│ ├── Replay (from SD)
│ ├── Generate (synthesize)
│ ├── Beacon
│ ├── Jam
│ └── BLE Spam
│
├── Capture (alternative path)
│ ├── I/Q Recorder
│ ├── Sub-GHz Capture
│ └── IR Capture
│
├── Tools
│ ├── File Manager
│ ├── Calibration
│ ├── Settings
│ └── About
│
└── Sweep / Scan
├── Wideband Sweep
├── Energy Detect
└── Narrowband ScannerPer-app menus follow PortaPack conventions: encoder for parameter adjust, D-pad for navigation, button for select.
7. Battery + thermal table
7.1 Runtime estimates (2000 mAh battery)
| Mode | Current (mA) | Runtime |
|---|---|---|
| Sleep | 5 | ~360 hours (15 days theoretical) |
| Display off, idle | 30 | ~60 hours |
| Menu navigation | 75 | ~24 hours |
| RX narrowband | 180 | ~10 hours |
| RX wideband sweep | 220 | ~8 hours |
| RX + I/Q capture | 230 | ~7.8 hours |
| TX at +10 dBm | 280 | ~6.4 hours |
| TX at +15 dBm (max) | 430 | ~4.2 hours |
| Wideband replay | 400 | ~4.5 hours |
For 1500 mAh battery, multiply by 0.75. For 3000 mAh, multiply by 1.5.
7.2 Plan engagements
- <2 hours: internal battery only fine
- 2-4 hours: bring USB-C battery pack (5000 mAh+)
- 4-8 hours: bring 10000 mAh USB-C pack
- 8+ hours: bring 20000 mAh pack + opportunistic wall charge
7.3 Thermal warnings
- Continuous TX at +15 dBm for >30 min in hot ambient: pause for cooldown
- Duty-cycle sustained TX: 20 min TX, 10 min idle
- Reduce gain to +10 dBm to cut thermal load by ~50%
- Tether to USB-C for sustained TX sessions
8. Regional rules summary
| Region | Band | TX power | Duty cycle | Notes |
|---|---|---|---|---|
| US (FCC §15.247) | 902-928 MHz | +30 dBm | None (spread spectrum required) | ISM; legal at PortaRF max |
| US (FCC §15.247) | 2400-2483 MHz | +30 dBm | None | Wi-Fi / BLE band |
| US (FCC §15.231) | 100-470 MHz | +27 dBm | Strict periodic only | Garage door / keyfob band |
| EU (ETSI EN 300 220) | 868-868.6 MHz | +14 dBm | 1% | LoRa / Sigfox EU |
| EU (ETSI EN 300 328) | 2400-2483.5 MHz | +20 dBm | Strict | Wi-Fi EU |
| EU (ETSI EN 300 220 g3) | 868.7-869.2 MHz | +27 dBm | 0.1% | Specific sub-band |
| JP (ARIB STD-T108) | 920.6-928 MHz | +13 dBm | 10% | JP sub-GHz ISM |
| UK (Ofcom) | various | varies | varies | Inherits most EU rules |
| Canada (ISED RSS-247) | varies | varies | varies | Inherits some US rules |
Critical: PortaRF can TX in any 1 MHz - 6 GHz frequency. Operator must respect regional rules. Authorization is the only defense.
8.1 Forbidden bands (without authorization)
- Cellular uplinks
- GPS L1 (1575.42 MHz)
- Aviation 108-137 MHz
- Public safety 150-160, 450-470, 700-800 MHz
- Maritime 156-162 MHz (except AIS RX)
- Amateur radio bands (without license)
9. Common errors triage
| Symptom | Cause | Fix |
|---|---|---|
| Device not detected over USB | Charge-only cable | Use data-capable USB-C cable |
hackrf_info says “no device found” | Wrong USB enumeration | Different port; verify with lsusb; reinstall hackrf-tools |
| Mayhem doesn’t self-flash | Wrong filename / location on SD | Verify .bin matches expected name; on SD root |
hackrf_spiflash says no device | Not in DFU mode | Reboot + hold designated button |
| Capture file silent or noisy | Antenna detached or gain wrong | Verify antenna; adjust gain |
| TX power weak | Antenna mismatch or damaged LNA | Check antenna; verify protection chip OK |
| Battery dies fast | Display brightness too high; sustained TX | Dim display; manage TX duty cycle |
| Mayhem hangs mid-app | Corrupted firmware or bad SD card | Reflash Mayhem; replace SD |
| Display blank but unit warm | Hung firmware; possible thermal | Power cycle; cool down; check Mayhem version |
| SD card not detected | Wrong format (exFAT/NTFS) | Reformat as FAT32 |
| File >4 GB needed | FAT32 size limit | Auto-split or smaller captures |
| New Mayhem release misbehaves | Bugs in new version | Flash known-good .bin from backup |
| Replay doesn’t transmit | TX gain too low or wrong band | Verify gain; verify frequency; verify antenna |
10. Troubleshooting flow
Device won't boot?
│
├─ Black screen → SD card formatted FAT32?
│ → Try a different SD card
│ → Reflash Mayhem .bin
│ → If still nothing: vendor RMA
│
├─ Mayhem boots, USB doesn't enumerate
│ → Different USB-C cable
│ → Different USB port on host
│ → Try lsusb / hackrf_info from host
│
└─ Mayhem hangs mid-app
→ Power cycle
→ If persistent: reflash Mayhem
TX doesn't transmit?
│
├─ Antenna attached? Always check first.
├─ Frequency in allowed band?
│ → Some bands locked in Mayhem
│ → Verify region setting
├─ Authorization confirmed?
└─ `hackrf_info` reports OK?
Capture I/Q silent (no data)?
│
├─ Sample rate exceeding ~20 MS/s? Lower the rate.
├─ SD class adequate? Class 10 / U1 minimum.
├─ SD card not corrupted? Try a different card.
└─ Free space sufficient? Check SD.
Battery dying faster than expected?
│
├─ Display brightness at max? Dim it.
├─ Continuous TX? Use battery pack.
├─ Cold ambient? Battery capacity drops.
└─ Battery health degrading? Verify with bench test.
Mayhem firmware update bricks unit?
│
├─ SD reflash with backup .bin
├─ If SD doesn't work: vendor DFU recovery
└─ Worst case: vendor RMA11. Pre-engagement checklist (one-page)
AUTHORIZATION
[ ] Written TX authorization (scope, bands, duty cycle, dates)
[ ] Authorization copy on person
[ ] Escalation contact prepared
REGULATORY
[ ] Region setting in Mayhem matches venue
[ ] Bands within authorized scope
[ ] Power limits within regional rules
[ ] Duty cycle understood
HARDWARE
[ ] Antenna attached (NEVER power on without!)
[ ] Antenna appropriate for operating frequency
[ ] Antenna inspected for damage
[ ] SMA connector inspected
[ ] Spare antennas carried
POWER
[ ] Internal battery ≥80% charged
[ ] USB-C battery pack ≥90% charged (10000+ mAh recommended)
[ ] USB-C cable (data + 3 A capable)
STORAGE
[ ] SD card formatted FAT32
[ ] Adequate free space (calculate: rate × duration × 1.5)
[ ] SD card health verified
[ ] Capture destination plan documented
FIRMWARE
[ ] Mayhem version known-good (locked)
[ ] HackRF firmware version noted
[ ] Mayhem settings at known-good values
OPERATIONAL
[ ] Engagement scope internalized
[ ] Time bounds clear (start/end)
[ ] Sanitization plan post-engagement
[ ] Discovery response plan
[ ] Out-of-band channel ready
FINAL
[ ] All above checked
If any item isn't checked, ABORT. Re-schedule is always cheaper.12. Discovery + response posture
If observed during engagement:
1. Stop transmitting immediately
2. Stay visible (don't hide the unit)
3. Stay calm
4. Identify yourself: "Authorized RF testing for [client]"
5. Have authorization document on person
- Folded paper copy (not just phone PDF)
- Verifiable: authorizing party can confirm by phone
- Specific: names venue, dates, scope
- Recent: current dated
6. Show document; let security/LE verify
7. Don't argue; cooperate
8. Document the interaction (officer names, time, what was said)If escalated to law enforcement:
- Don’t physically resist
- Don’t answer detailed technical questions without counsel
- Get a receipt for any property seized
- Contact pre-arranged legal contact immediately
- Notify authorizing party that engagement was disrupted
13. Engagement closeout checklist
After every engagement:
DATA HANDLING
[ ] Transfer captures from SD to encrypted host
[ ] Verify hashes (sha256sum)
[ ] Sanitize SD card (single-pass overwrite)
[ ] Re-format SD for next engagement
[ ] Encrypt deliverable bundle
HARDWARE CHECKS
[ ] Inspect antenna(s) for damage
[ ] Inspect SMA + USB-C connectors
[ ] Inspect case for new dents/cracks
[ ] Verify charge works (USB-C functional)
[ ] Verify Mayhem boots normally
BATTERY HANDLING
[ ] Recharge to ~80% (for storage)
[ ] Verify runtime matches baseline
[ ] Recharge USB-C pack
[ ] Note any unusual thermal behavior
LOGGING
[ ] Append entry to unit's narrative .md
[ ] Note engagement venue, duration, observations
[ ] Brief retrospective: what worked, what broke, what to change
UPDATING
[ ] Update MY_GEAR if any state changed
[ ] Update tool's CLAUDE.md if findings relevant
[ ] Update engagement record per scope14. Key references in one block
Upstream
OpenSourceSDRLab opensourcesdrlab.com
Mayhem firmware github.com/portapack-mayhem/mayhem-firmware
Mayhem wiki github.com/portapack-mayhem/mayhem-firmware/wiki
HackRF firmware github.com/greatscottgadgets/hackrf
Clifford Heath HackRF github.com/cjheath/hackrf
Tools
hackrf-tools github.com/greatscottgadgets/hackrf
GNU Radio gnuradio.org
SDRangel sdrangel.org
GQRX gqrx.dk
Inspectrum github.com/miek/inspectrum
Universal Radio Hacker github.com/jopohl/urh
Regulatory
US FCC fcc.gov
US 47 CFR fcc.gov/general/title-47-code-federal-regulations
EU ETSI etsi.org
UK Ofcom ofcom.org.uk
Canada ISED ic.gc.ca/eic/site/smt-gst.nsf/eng/home
Japan MIC tele.soumu.go.jp/e/index.htm
Sibling Hack Tools references
HackRF One canonical ../../../HackRF One/03-outputs/HackRF_One_Complete.html
porta inventory ../../../HackRF One/00-inventory/porta.md (the comparison reference)
Hack Tools comparison ../../../_shared/comparison.md
Capability matrix ../../../_shared/capability_matrix.html
Legal/ethics ../../../_shared/legal_ethics.mdThis is the final volume of the OpenSourceSDRLab PortaRF 12-volume series. The series is decision-ready research-baseline as of 2026-05-13. For deeper detail on any topic, navigate to the indicated volume and section. The series will be revised when PortaRF hardware is acquired and bench-verified.