A full‑length tutorial on using the Mayhem firmware for HackRF One with the PortaPack H2. Learn how to tune in aircraft, ships and satellites, decode pagers and remotes, explore the spectrum, transmit digital modes and understand the core SDR concepts behind each tool.
Software defined radio (SDR) lets you treat radio signals like software – tune any frequency within the hardware’s range, decode or encode arbitrary modulation schemes, and process everything in software.
The HackRF One is a popular SDR that can transmit and receive from roughly 1 MHz–6 GHz with sample rates between 2 MS/s and 20 MS/s. Alone it requires a computer and moderate to advanced knowledge of SDR and various other low-levle tools and concepts. Think of it as an advanced automotive diagnostic tool that only a trained technician can use effectively.
The [PortaPack H2] is a separate module entirely from the HackRF, and on its own it is essentially useless. It provides no SDR capabilities on its own. However, when combined with the HackRF — literally, the PortaPack plugs directly into the HackRF "motherboard" — the device effectively becomes a portable, battery‑powered SDR transceiver, complete with a touch interface, speaker, and microphone. When you flash Mayhem firmware onto the PortaPack, you unlock dozens of applications for listening, scanning, decoding, transmitting and experimenting with wireless protocols . This guide walks through the major apps, offers tips for maximizing reception quality, and stresses the importance of staying within legal boundaries.
Legal note: Mayhem includes tools that transmit data or noise across licensed bands. Transmitting outside of allowed frequencies and power levels is illegal in most countries. Always understand your local laws and use these features responsibly. Never exceed the HackRF’s maximum safe output or input levels, and always use appropriate filters to avoid interference .
Hardware setup • HackRF One + PortaPack H2: The Mayhem firmware is designed for the HackRF One combined with a PortaPack H2. The HackRF is a half‑duplex transceiver; the PortaPack adds buttons, a screen, an audio amp and a microSD slot. • Flash Mayhem: Download the latest Mayhem release from the official repository and flash the firmware using the provided scripts. Unzip the mayhem_vX.Y.Z_COPY_TO_SDCARD.zip archive onto a formatted microSD card and insert it into the PortaPack . • Antenna & filtering: Use antennas matched to the frequency of interest (e.g. 2.4 GHz whip for Wi‑Fi, VHF whip for marine bands). Inline band‑pass or notch filters drastically reduce unwanted signals and improve sensitivity . Avoid running the HackRF without an antenna attached. • Gain settings: The HackRF has three gain controls: AMP (14 dB), LNA (0–40 dB) and VGA (0–62 dB). Start with AMP off, adjust LNA for sensitivity, then fine‑tune VGA to maximize the signal without clipping . Excessive gain increases noise; use filters and distance to isolate the signal. • SD card files: Some Mayhem applications require additional data (e.g. world maps, frequency lists). These files are included in the COPY_TO_SDCARD archive and must be extracted intact; do not rename files or change directory structure .
Mayhem groups its applications into menus such as Receive, Transmit, Capture, Replay, Search, Utilities, Settings and Games. Each app appears with a color indicator: green means fully implemented, yellow is functional but missing features, orange indicates a beta or unstable app, and red flags destructive utilities . Use the rotary encoder or touch screen to move between pages and select apps. Within each app you’ll see status bars showing frequency, gain settings, bandwidth and modulation. Most controls can be changed via the encoder or the keypad.
These applications tune and decode various radio protocols. They sit under the Receive or Search menus.
ADS‑B Receiver Automatic Dependent Surveillance‑Broadcast (ADS‑B) is used by aircraft to broadcast their position, altitude and other telemetry. The Mayhem ADS‑B app receives real‑time ADS‑B messages on 978 MHz–1090 MHz and displays the aircraft on a map. You can zoom with the encoder and tap on a plane to view details such as flight number, squawk code and altitude . Enable the AMP preamp only when necessary; a short 1/4‑wave antenna and the LNA usually provide enough gain. The app logs each aircraft’s details to a *.LOG file on the microSD card for later analysis .
AIS Boats Commercial vessels use the Automatic Identification System (AIS) to broadcast position, speed and identification. Mayhem’s AIS app listens on 161.975 MHz and 162.025 MHz (channels 87B and 88B) and decodes vessel names and MMSI numbers. Select the channel, adjust AMP/LNA/VGA and watch the list fill with nearby ships . Tapping a vessel entry shows more details (location updates may lag depending on the ship’s reporting interval). You can add additional AIS channels via the SD card if you live near a busy port.
NOAA APT Note: The NOAA POES satellites providing APT images were decommissioned in 2025. The NOAA APT app demodulates analog weather images from low‑Earth‑orbit satellites like NOAA‑15, 18 and 19. Frequencies are 137.100 MHz (NOAA‑19), 137.620 MHz (NOAA‑15) and 137.9125 MHz (NOAA‑18). Choose an appropriate antenna (a QFH or V‑dipole for VHF), set LNA and VGA for a strong but non‑clipping signal, press Start to record, and Mayhem will capture the pass into a WAV file . Use third‑party software (e.g. WXtoImg) to convert the audio into a visible weather image. The app automatically names files based on date and satellite number .
The Automatic Packet Reporting System (APRS) uses AX.25 packets to convey positions, messages and telemetry. Mayhem’s APRS app decodes these packets, showing columns for Source, Location, Hits and Time . Use the presets for North America (144.39 MHz), Europe/UK (144.8 MHz) and other regions, or tune manually. The signal strength bar lets you quickly see which stations are strongest. If your HackRF seems deaf, turn on AMP and increase LNA; but beware of overload when near strong transmitters . The underlying AFSK demodulator supports several modem profiles (Bell‑202, Bell‑103, V.21, V.23) selectable under Modem Setup . Note that the standalone AFSK app is currently marked beta and displays random characters due to incomplete implementation .
POCSAG is a FSK pager protocol used by amateur and commercial pagers. The POCSAG app displays decoder status, bit and codeword counts, detected baud rate (512/1200/2400 bps) and messages. Set the frequency (often 439.9875 MHz for amateur pagers), adjust the squelch and gain, and watch the messages scroll in with timestamps, addresses and message content . Configuration options allow logging to POCSAG.TXT, hiding bad data and ignoring specific addresses . A companion POCSAG TX app lets you craft and transmit your own pager messages by specifying bitrate, address, function (A/B/C/D), phase and the message text . Please be mindful of legal restrictions when transmitting on paging frequencies.
Radioteletype (RTTY) was an early digital mode that still sees use in amateur contests and utility stations. The RTTY RX app decodes text messages, displaying the frequency and gain settings in the status bar and the decoded message in the main area. Tune to a known RTTY station, adjust gain and watch the characters appear. The companion RTTY TX app lets you configure baud rate, shift (mark/space), polarity, mark and space offsets and message content, then press START to transmit. Try 170 Hz shift at 45 baud for classic amateur RTTY.
Many car tire pressure monitoring systems (TPMS) and low‑power wireless weather stations use ASK/OOK modulation around 315 MHz (US/Japan), 433.92 MHz (EU/Asia), 868 MHz (EU) or 915 MHz (US). The TPMS app decodes sensor IDs, pressure, temperature and flags, writing logs to TPMS.TXT. The Weather app decodes outdoor temperature/humidity sensors; choose units (C/F), set the frequency, and adjust AMP/LNA/VGA for best reception.
These apps decode common car and garage‑door remotes. Set the frequency (usually 315 MHz or 433.92 MHz), choose the appropriate AM/FSK modulation, and Mayhem will display the decoded key code. The SubCar app targets car keys while SubGhzD supports a wider set of remotes and decodes protocols implemented under /firmware/baseband/fprotos.
For radio direction‑finding games or locating unknown emitters, the Fox Hunt app plays the received AM audio through the speaker and shows a signal strength meter . Use a directional antenna and rotate until the bar peaks. If you connect an external GPS and orientation module, the map will show your position and heading, allowing you to drop markers to triangulate the source.
The built‑in scanner sweeps a list of frequencies or a continuous range, examining about 20 frequencies per second . It pauses on strong signals (color‑coded: grey scanning, yellow analyzing, green found) and respects wait timers for signal activity and loss (Wsa, Wsl). You can load frequency lists from /FREQMAN/SCANNER.TXT, start/stop scanning with a button, adjust squelch to set the detection threshold and manually delete or add frequencies to the list . For example, scanning the broadcast FM band turns the PortaPack into a simple radio tuner.
The Search app sweeps a user‑defined range, triggering when the average signal exceeds a threshold. Wide ranges (> 2.5 MHz) are internally divided into slices and scanned sequentially. When a signal is detected the display locks the frequency and shows the detected slices and mean signal level . Settings include min/max frequency, LNA and VGA gain, trigger threshold and “Snap to” which rounds found frequencies to the nearest 12.5 kHz channel .
This wideband spectrum viewer provides waterfall and peak‑hold modes over ranges defined in /LOOKINGGLASS/PRESETS.TXT. Choose a preset (e.g. 88–108 MHz FM broadcast), adjust gain and filter, and watch spectral peaks scroll by. Additional features include beep alerts for peaks, a marker that jumps to the audio receiver, FFT resolution settings and live/peak/average view modes .
The Detector app looks for digital bursts from LoRa devices, remote controls and TETRA uplinks. Each preset contains a list of center frequencies; for example the Remotes preset scans 315 MHz and 433.92 MHz, while EU868 scans LoRa channels across 868 MHz . You can set a beep threshold and adjust gain. When a burst is detected the app plays a tone and logs the event.
Transmission apps are powerful but must be used with great care.
Tip
Always keep output power low when transmitting — thee HackRF's power output is typically in the range of 0–10 dBm. Use filters to avoid harmonics.
OOK TX transmits on–off keyed signals used by key fobs and simple remotes. Select the encoder type (e.g. PT2262, HT6P20, UM3750), set the frequency, symbol rate and gain, and press Start.
The OOK Editor extends this by letting youspecify a custom symbol pattern, repeat count, pause length and sample rate. You can import .ook files from the SD card and even design new remote codes; refer to the file format documentation in the app .
The POCSAG TX app allows you to craft pager messages. Choose the bitrate (512/1200/2400 bps), address, function (A/B/C/D), message type (numeric, alphanumeric or address only), phase (P/N) and the message itself. For RTTY, configure baud rate, frequency shift and polarity in the RTTY TX app before transmitting.
Use the SSTV app to transmit 24‑bit BMP images (320×256 pixels) in modes like Scottie‑1/2/DX, Martin‑1/2 or SC2‑180. Choose the image, mode and frequency, then press Start. Because these modes use FM modulation, always ensure your transmissions are in allowed FM bands.
If you also happen to own a [Flipper Zero] – a multi-tool for geeks/pen-testers with a tamagotchi-like aesthetic – you can transmit .sub files using FlipperTX.
Select a file within SUBGHZ/, set the frequency and gain, and press Start.
The Soundboard plays WAV files and transmits them as FM; you can enable
CTCSS or pilot tones for compatibility with professional audio receivers .
Files must be mono, 8–16 bit and 24–48 kHz; place them in the appropriate
directory on the SD card.
This powerful tool generates and transmits fake GPS signals to simulate location. Generate a .c8 baseband file using gps-sdr-sim on a PC, copy it to the SD card along with a .txt file specifying the sample rate and center frequency (e.g. 1575420000) . Mayhem supports 1.25 MHz, 2.5 MHz and 2.6 MHz sample rates. Use extreme caution: transmitting fake GPS can interfere with critical systems and is illegal in many regions . Only operate inside a Faraday cage or shielded environment.
Load a file of frequencies (*.phop) into the Hopper app and Mayhem will hop through them sequentially or randomly at configurable dwell times . This feature is intended for testing frequency‑hopping spread spectrum (FHSS) receivers or as part of stress testing; again, ensure legal compliance before use.
The Jammer app transmits noise or sweeps across up to three configured frequency ranges. You can choose noise types (random CW, swept sine, random FSK), adjust dwell and hop times, enable jitter and select the total transmit and sleep durations.
Caution
Jamming radio services is illegal in most jurisdictions; this app exists purely for educational and [shielded‑lab testing] only.
Never broadcast outside license‑free bands unless you hold the appropriate amateur or professional license.
Mayhem includes novelty apps like BLE Spam and CVS Spam that can offer humorous capabilities, (broadcasts Bluetooth Low Energy advertisement packets with payloads to annoy or prank smartphones), CVS Spam (plays audio messages used in pharmacy intercoms) , and Burger Pager (pings restaurant pagers around 467.75 MHz) . These are fun demonstrations but should never be used in real stores; restrict them to shielded test setups.
The chart below summarises the frequency ranges used by some of the receiver apps. Wider bars indicate wider ranges (e.g. TPMS & Weather), while narrow bars represent single‑channel decoders such as POCSAG.