AI-assisted RF Hacking with GNU Radio
This recording is not on YouTube. It plays from the DEF CON media server; the button opens the file there.
Where
Radio Frequency Village
DEF CON 34
Duration
40 min
Shows how an AI assistant driving GNU Radio through a custom MCP server can detect SDRs, build flow graphs, and demodulate a proprietary sub-GHz protocol.
Summary
The talk argues that software-defined radio is a good fit for generative AI. GNU Radio flow graphs are visual, open source, and built on Python, so a model can write them, run them, read the output, and iterate. The speaker says experiments that once took months of setup can now be tested in hours, with AI acting as a force multiplier that still needs a skilled operator at the controls.
The middle section covers a GNU Radio MCP server the speaker built. It lets an assistant detect attached hardware, ask which antenna port to use before transmitting, load, save and validate flow graphs, search blocks, and look up band allocations and common modulations offline. Templates let a team fix recurring generation mistakes once and share the result. The live demo was affected by network trouble, so the speaker showed an FM receiver build and described, rather than ran, a demodulator for a custom CC1101 protocol, a two-radio modulation link, and a known-key dewhitening attack against a Meshtastic-style payload. He also warned that transmitting on an unterminated port can destroy hardware.
The takeaway is that models are improving and some of these tool features are being built into them, but domain-specific tooling and checks still help. Practitioners should verify AI-generated RF code and keep a human validating results. The speaker pointed attendees to a flag-capture challenge running on the demo hardware.
Materials
Related talks
Radio Frequency Village·37 min
hamspiced
Walks a self-described non-expert through building resonant NFC repeater antennas, from LC tank circuits and VNA tuning to parasitic-capacitance PCB designs.
Radio Frequency Village·27 min
Dalton
Shows how a HackRF-based tool passively observes Bluetooth Classic and Low Energy traffic, recovering piconet clocks and device addresses over the air.
Radio Frequency Village·46 min
Iceman
Surveys a year of Proxmark firmware and client changes, covering new RFID attacks, community contributions, and the Proxmark 5 hardware.
