Open methodology · Electronic Cats

A north for RF research and auditing.

RFSAM — Radio Frequency Security Assessment Methodology

A field guide to RF security — pick a technology, get the kit and the method.

RF research and auditing have plenty of tools and scattered knowledge, but no single map. Faced with an unknown signal or device, where do you start — and how do you know what you've missed? RFSAM is meant to be that north: an open, structured reference that walks you from the spectrum up through the signal, link, crypto, attack and application layers, per protocol, with a verification procedure and a real worked example at each step. It doesn't claim to invent RF security — OSSTMM, BSAM and a deep body of research came first. It aims to organise that landscape into something you can navigate by, whether you're auditing a device or learning the field.

WHERE TO START

START HERE
Wayfinder

Have a device or an unknown signal and no idea where to begin? Pick a technology and walk the six-step descent — each step hands you the exact kit (hardware + software) for that move and the reason to pick it. An interactive map from “what is this?” to “take it over.”

THE REFERENCE
Procedures

The verification procedures. For each protocol and layer: what to check, a step-by-step method, a real field case, known attacks with references, and remediation — the entries you cite in an assessment.

THE MODEL
Methodology

The layer descent — spectrum → signal → link → crypto → attack → application — and the prior work RFSAM stands on (OSSTMM, BSAM, the SDR-pentest lineage). Read this to understand how it is organised.

THE KIT
Tools

Every piece of hardware and software behind the wayfinder kits — filterable by technology and linked to its source.

THE DESCENT

Every protocol is assessed by the same descent — six layers from the open air down to what the device trusts. The Wayfinder walks you down it; the Procedures verify each floor.

SP
Spectrum
What is transmitting, where, and whether you can see it at all.
PHY
Signal / PHY
From waveform to bits: modulation, demodulation, channelisation.
LL
Link / Protocol
Frame structure, addressing, identifiers, discovery data.
CR
Crypto
Pairing, key exchange, confidentiality and integrity of the link.
AT
Attack
Active interaction: injection, replay, hijack, rogue infrastructure.
AP
Application
What the device trusts above the link: auth, signing, updates.

TECHNOLOGIES · 15 mapped in the Wayfinder

Bluetooth Low Energy
2.400–2.480 GHz
Wayfinder → · 7 procedures
Bluetooth Classic
2.402–2.480 GHz (BR/EDR)
Wayfinder → · 6 procedures
Wi-Fi (802.11)
2.4 / 5 / 6 GHz
Wayfinder → · 3 procedures
LoRa / LoRaWAN
ISM sub-GHz (US915 / EU868)
Wayfinder → · 4 procedures
LTE / 4G
Licensed cellular
Wayfinder → · 4 procedures
RFID / NFC
125 kHz LF / 13.56 MHz HF
Wayfinder → · 3 procedures
Sub-GHz ISM / Remotes
315 / 433 / 868 / 915 MHz
Wayfinder → · 5 procedures
Zigbee / 802.15.4
2.4 GHz (+ 868/915 MHz)
Wayfinder → · 3 procedures
Z-Wave
Sub-GHz, region-specific (~868/908 MHz)
Wayfinder → · 2 procedures
Thread / Matter
2.4 GHz (802.15.4)
Wayfinder → · 2 procedures
GNSS / GPS
L-band (e.g. GPS L1 1575.42 MHz)
Wayfinder → · 2 procedures
ADS-B (aviation)
1090 MHz / 978 MHz UAT
Wayfinder → · 2 procedures
5G NR
FR1 sub-6 GHz / FR2 mmWave
Wayfinder → · 2 procedures
GSM / 2G
850 / 900 / 1800 / 1900 MHz
Wayfinder → · 2 procedures
Ultra-Wideband
3.1–10.6 GHz
Wayfinder → · 2 procedures