The Universal Radio Hacker (URH) is a complete suite for wireless protocol investigation with native support for many common Software Defined Radios. URH allows easy demodulation of signals combined with an automatic detection of modulation parameters making it a breeze to identify the bits and bytes that fly over the air. As data often gets encoded before transmission, URH offers customizable decodings to crack even sophisticated encodings like CC1101 data whitening. When it comes to protocol reverse-engineering, URH is helpful in two ways. You can either manually assign protocol fields and message types or let URH automatically infer protocol fields with a rule-based intelligence. Finally, URH entails a fuzzing component aimed at stateless protocols and a simulation environment for stateful attacks.
Getting started
In order to get started
- view the installation instructions on this page,
- download the official userguide (PDF),
- watch the demonstration videos (YouTube),
- check out the wiki for more information such as supported devices or
- read some articles about URH for inspiration.
If you like URH, please this repository and join our Slack channel. We appreciate your support!
Citing URH
We encourage researchers working with URH to cite this WOOT’18 paper or directly use the following BibTeX entry.URH BibTeX entry for your research paper
Installation
URH runs on Windows, Linux and macOS. Click on your operating system below to view installation instructions.WindowsLinuxmacOSUpdate your installationRunning from source
Articles
Hacking stuff with URH
- Hacking Burger Pagers
- Reverse-engineer and Clone a Remote Control
- Reverse-engineering Weather Station RF Signals
- Reverse-engineering Wireless Blinds
- Attacking Logitech Wireless Presenters (German Article)
- Attacking Wireless Keyboards
- Reverse-engineering a 433MHz Remote-controlled Power Socket for use with Arduino
General presentations and tutorials on URH
- Hackaday Article
- RTL-SDR.com Article
- Short Tutorial on URH with LimeSDR Mini
- Brute-forcing a RF Device: a Step-by-step Guide
- Hacking wireless sockets like a NOOB
External decodings
See wiki for a list of external decodings provided by our community! Thanks for that!