1.1 About this Volume

This is the first of a ten-volume deep dive on LakeShark — the open-source firmware by Samuel Reynolds (GitHub SAMS0N1TE) that turns a LilyGO T-Display P4 development board into a self-contained radio scanner that needs no computer, no Raspberry Pi, and no phone to decode trunked public-safety voice, aircraft transponders, and pager traffic. The reader is assumed to be an engineer comfortable with RF concepts, SDR terminology, and embedded toolchains; this is a reference for the person deciding whether to build one and how to think about what it can and cannot do, not a getting-started card.

The volume lays out the project’s central claim, the single most consequential hardware decision a builder makes (which LoRa transceiver the board carries), a decision graph that routes a prospective builder to the right configuration, the full cost of a working kit, and a frank accounting of the gap between what the firmware claims and what its author has actually verified on real RF. That last item — the honesty ledger — appears here in Volume 1 deliberately, because it is the single most useful thing to internalize before spending money: LakeShark is a remarkably candid project, and the places where it says “experimental”, “bench-tested only”, or “not a validated system” are exactly the places where buyer expectations go wrong.

A note on dates and versions before anything else. LakeShark is developed at a near-daily cadence. The repository was created on 2026-06-18; at the time of writing the current release is v2.15.0, dated 2026-10-15. Press coverage from mid-2026 cites v2.2 and v2.5 — those numbers are stale by dozens of releases. Every version-specific claim in this series is dated; treat any undated capability claim found elsewhere with suspicion, and prefer the live repository (github.com/SAMS0N1TE/LakeShark) over any secondary article where the two disagree.

Note. Because the firmware moves fast, three things in this series are explicitly version-pinned and worth re-checking before a build: the ESP-IDF version (currently 5.5.4), the C6 co-processor’s ESP-Hosted firmware version (currently 2.12.9), and the two-slot OTA mechanism (present since v2.9.0). Volume 9 covers all three.

1.2 The one-sentence thesis: a scanner with no PC behind it

The repository description states the whole project in one breath: “Handheld T Display P4 & ESP32-P4 SDR scanners — RTL-SDR or LR2021 SDR, P25 Phase 1, FM/AM, ADS-B and POCSAG, plus onboard LoRa/MeshCore, GPS and Flipper.sub capture. No PC.”

Those last two words carry the weight. For twenty years the standard way to decode P25 trunked digital voice or 1090 MHz ADS-B with cheap hardware has been an RTL-SDR dongle feeding a laptop or a Raspberry Pi running OP25, DSD, or dump1090. The software is mature and open; the dependency that never went away was the host — a general-purpose computer that boots an operating system, runs a Python or C++ decode stack, and draws the waterfall. LakeShark removes the host. The decode stack runs on the microcontroller itself, and the dongle plugs into the board’s own USB-A port.

The reason this is newly possible is a single silicon feature on the ESP32-P4: a USB On-The-Go 2.0 controller with a High-Speed (480 Mbps) PHY. Earlier ESP32 parts could talk to an RTL-SDR, but only at Full-Speed USB or by tunnelling samples over Wi-Fi/Ethernet — both of which cap the achievable sample rate at a few hundred kilosamples per second, far below what P25 trunk-following or a usable waterfall needs. The P4’s High-Speed host PHY lets the chip pull the RTL-SDR’s full 2,000,000 samples per second directly, with no host in the loop. Volume 3 is devoted to exactly why this one feature is load-bearing; the short version is that LakeShark is the application layer that became buildable the moment an MCU could host an RTL-SDR at full rate.

Tip. If a single idea anchors the whole project, it is this: LakeShark is “OP25 + dump1090 + DSD in your hand.” It reuses the same open DSP lineage that the PC tools use (librtlsdr, OP25, dump1090/libmodes, DSD, mbelib) and ports it onto an MCU with a High-Speed USB host. It is an integration and application achievement, not a new RF front end.

1.3 What it actually decodes, on the device

Everything in the list below happens on the handheld, with audio out of its own speaker and graphics on its own screen. Nothing here requires a companion computer; the only external hardware for most of it is the RTL-SDR dongle (and on the LR2021 board, not even that — see §4).

Table 1 — 3. What it actually decodes, on the device

Domain	On-device capability	Notes / honesty flag
Digital voice	P25 Phase I conventional + trunked; AUTO/manual demod; call archive to SD	Phase II is experimental (bench-tested, live-RF unverified)
Digital-voice sideband	DMR activity view (talker IDs)	Read-only observer; never pointed at a real DMR TX — symbol stack tested only
Analog voice	FM / AM band scan, CTCSS/DCS tone decode	—
Paging	POCSAG	—
Data/beacon	APRS, AIS, SAME/EAS weather alerts	—
Aviation	ADS-B 1090 MHz Mode S — traffic list, offline mini-map, spoken callouts	dump1090/libmodes lineage
Spectrum	FALLS waterfall, tap-to-tune	—
Mapping	Offline PMTiles maps, trails, GPX, markers, range rings, FOLLOW / GO-TO	—
Direction-finding	Tilt-compensated compass; LoRa RSSI-by-heading bearing (FIND)	Author states explicitly: not a validated DF system — fox-hunting aid
Mesh	MeshCore messaging + telemetry over onboard LoRa	—
Sub-GHz	Scan / learn / capture; experimental OOK/FSK replay; Flipper .sub RAW; two integer decoders (subghz_pwm, subghz_nrz)	Decoders handle ~15 of 41 unseen captures by design
NFC (MIX-RF)	ST25R3916 — MIFARE Classic read	Requires MIX-RF keyboard add-on
2.4 GHz / sub-GHz (MIX-RF)	nRF24, CC1101	Requires MIX-RF keyboard add-on
Awareness	DETECTOR (drone Remote ID alerts, rules file); CELL WATCH (LTE/cellular baseline survey)	CELL WATCH is an RF baseline, explicitly not an IMSI-catcher detector
Wi-Fi / BT	Scan + WiGLE CSV export (via the C6 co-processor)	—
Utility	GPS/GPX logging, NOTES (Markdown to SD), terminal, RADIOS/DIAG	—

That breadth is the appeal, but it is also where a buyer can mislead themselves. The table’s right-hand column matters as much as the middle one. Read §8 before building a mental model of “a scanner that does all of this reliably” — several of these are proof-of-concept paths the author is honest about.

The right way to read the capability table is to sort it mentally into three tiers. Solid and routine: FM/AM scan, POCSAG, ADS-B, the waterfall, the offline map, GPS, MeshCore, and P25 Phase I conventional — these are the day-to-day scanner, built on mature decode lineages. Real but qualified: P25 trunk-following (works, but trunking is intrinsically fussier than conventional), the DMR activity view (an observer, not a decoder), and the sub-GHz .sub capture/replay (two honest integer decoders, not a universal one). Explicitly experimental or mislabel-prone: Phase II, HackRF decode, compass DF, and CELL WATCH — each covered in §8. A buyer who keeps those tiers straight will be satisfied; one who treats every row as finished will not. The tiers are not a knock on the project; they are how an honest scanner’s feature list should always be read.

1.4 The fork in the road: SX1262 vs LR2021

The single most consequential decision in a LakeShark build is which LoRa transceiver the board carries. LilyGO ships the T-Display P4 in two mutually-exclusive variants, and LakeShark auto-detects which one is present at boot. The choice changes whether the handheld needs an external RTL-SDR at all.

 ┌──────────────────────────────────────┐
 │ LilyGO T-Display P4 (ESP32-P4) │
 └──────────────────┬───────────────────┘
 │ LoRa transceiver (one of two)
 ┌───────────────────────┴───────────────────────┐
 ▼ ▼
 ┌─────────────────────┐ ┌────────────────────────────┐
 │ SX1262 (HPD16A) │ │ LR2021 │
 │ LoRa + MeshCore │ │ LoRa + MeshCore + raw-IQ │
 │ + POCSAG onboard │ │ SDR RX onboard │
 └──────────┬──────────┘ └─────────────┬──────────────┘
 │ needs an RTL-SDR for │ NO RTL-SDR needed for
 │ FM / P25 / ADS-B │ P25-P1 / FM / ADS-B / pagers
 ▼ ▼
 ┌─────────────────────┐ ┌────────────────────────────┐
 │ + RTL-SDR Blog │ │ Self-contained, but: │
 │ V3 / V4 (USB-A) │ │ • 125 kcomplex/s SPI IQ │
 │ = full scanner │ │ • no band-scan │
 │ │ │ • no Phase II on this path │
 └─────────────────────┘ └────────────────────────────┘

The SX1262 path (the HPD16A module) gives LoRa, MeshCore, and POCSAG directly on the board, but for FM, P25, and ADS-B it depends on an external RTL-SDR plugged into the USB-A host port. This is the cheaper, more flexible, and more capable configuration when an RTL-SDR is present, because the RTL-SDR can tune a wide span, scan bands, and feed the P4 the 2 MSPS the decode chains want.

The LR2021 path uses a newer transceiver that can deliver raw-IQ SDR reception on its own. On this board, P25 Phase I C4FM, FM, ADS-B, pagers, and MeshCore/LoRa all work with no RTL-SDR at all — the IQ comes over SPI at 125 kcomplex/s into the same DSP chain. The tradeoff is real and worth stating plainly: the SPI-IQ path is narrow. There is no wideband band-scan, and P25 Phase II is not supported on this path. It is a genuinely self-contained scanner for the modes it supports, at the cost of the flexibility an RTL-SDR brings.

Both boards can still take an RTL-SDR; the distinction is about what works without one. The full, canonical, row-per-variant breakdown — including the Waveshare headless boards, the TFT display variant, and where to buy each — is the “Where this firmware runs” supported-hardware table in Volume 2. Anyone choosing hardware should read that table before ordering; this section is the summary that routes the decision.

1.5 The decision graph

START ── Do you already own, or want, an RTL-SDR Blog V3/V4? ──┐
 │
 ┌──────────────── YES ──────────────┐ ┌──── NO ────┘
 ▼ │ ▼
 Want the widest capability │ Want a fully self-contained
 (band-scan, Phase II, HackRF │ handheld, fewest cables,
 experiments, best waterfall)? │ P25-P1 / FM / ADS-B / pagers?
 │ │ │
 YES │ YES
 ▼ │ ▼
 ┌───────────────────────────┐ │ ┌──────────────────────────────┐
 │ T-Display P4 + SX1262 │ │ │ T-Display P4 + LR2021 │
 │ + RTL-SDR Blog V3/V4 │◀──────────┘ │ (no RTL-SDR required) │
 │ = the reference "scanner" │ │ accept: no band-scan, no P-II │
 └───────────────────────────┘ └──────────────────────────────┘
 │ │
 ├── Want a physical keyboard + CC1101/nRF24/NFC? ── add MIX-RF keyboard
 │ (⚠ never let MIX-RF's 5 V USB-out feed the P4 — reboot loops)
 │
 ├── No screen needed; headless logger or remote? ── Waveshare ESP32-P4-NANO /
 │ -WIFI6 (serial console)
 │
 └── Want a Flipper Zero as the control head? ── LakeShark-Flipper app
 (BLE or GPIO; the Flipper drives a headless P4)

The graph resolves to three common builds. The reference scanner is the SX1262 board plus an RTL-SDR Blog V3/V4 — maximum capability, one extra dongle, one extra cable. The self-contained build is the LR2021 board on its own — fewest parts, accept the narrower RF path. And the headless/Flipper-driven build uses a Waveshare P4 (or a T-Display P4 with the screen unused) controlled over BLE or GPIO from a Flipper Zero running the companion LakeShark-Flipper app — the Flipper becomes the keyboard and screen for a P4 that lives in a pocket or a go-bag. That last option is one of the more interesting integration stories in the hub, because it stitches a device the hub already covers (the Flipper Zero) onto a P4-class SDR back end.

1.6 What it costs — the kit BOM

LakeShark’s hardware is inexpensive by SDR-scanner standards, but “inexpensive” still spans a factor of two depending on the add-ons.

Table 2 — 6. What it costs — the kit BOM

Item	Role	Approx. price (USD)
LilyGO T-Display P4 (SX1262 or LR2021)	The board — SoC, screen, GPS, IMU, battery, radio	$145 – $160
RTL-SDR Blog V3 or V4	External SDR for FM/P25/ADS-B (required on SX1262; optional on LR2021)	$30 – $40
MIX-RF keyboard add-on	Physical keyboard + CC1101 + nRF24 + ST25R3916 NFC	~$74
Minimum working scanner (SX1262 board + RTL-SDR)		~$175 – $200
Self-contained (LR2021 board only)		~$145 – $160
Full kit (board + RTL-SDR + MIX-RF)		~$245 – $255

Two cost notes. First, an antenna budget is not in the table because it varies wildly with intent — a stock telescopic whip ships with most RTL-SDR kits, but ADS-B at 1090 MHz and public-safety VHF/UHF each reward a purpose-cut antenna, which is where the hub’s Antennas project earns its keep. Second, a shared battery pack that powers both the P4 and the RTL-SDR off one source is noted in the repo as still in development; until then, power discipline matters (see the warning in §8 and the full treatment in Volume 9).

1.7 Where it sits: HackRF, PortaPack, the RTL-SDR dongle, the Scanners project

LakeShark is easiest to understand by what it is not.

Table 3 — 7. Where it sits: HackRF, PortaPack, the RTL-SDR dongle, the Scanners project

	LakeShark (SX1262 + RTL-SDR)	RTL-SDR on a PC/Pi	HackRF One + PortaPack	Dedicated trunk scanner (e.g. Uniden SDS)
Host required	None	Laptop / Pi	None (PortaPack)	None
Frequency span	~24 MHz – 1.7 GHz (R820T2)	Same	1 MHz – 6 GHz	Scanner-defined
Transmit	No (RX scanner)	No	Yes	No
P25 trunk-follow	Yes (Phase I)	Yes (OP25)	Weak	Yes
DMR ID view	Yes (observer)	Yes (DSD)	No	Model-dependent
ADS-B on-device	Yes	Yes (dump1090)	Limited	No
POCSAG	Yes	Yes	Limited	No
Offline map + GPS + DF	Yes	Via PC software	No	No
Open source	Yes (GPL-3.0)	Yes	Firmware (Mayhem)	No
Ballpark cost	~$175–200	$30 + a computer	~$320+	$500–750

Against a PC-hosted RTL-SDR, LakeShark is the same RTL2832U silicon and the same open DSP lineage (librtlsdr / OP25 / dump1090 / DSD / mbelib) with the host removed. It trades the PC’s effectively unlimited CPU for an MCU budget and a ~2 MSPS ceiling, and buys portability and instant-on operation. See the HackRF One and RTL-SDR deep dives in this hub for the tethered-SDR side of that comparison.

Against HackRF One + PortaPack (which the hub covers in depth), the niches barely overlap. PortaPack with the Mayhem firmware is a 1 MHz–6 GHz transmit-and-receive wideband Swiss-army knife; it is weak at trunked digital voice. LakeShark is a receive-only scanner whose whole reason to exist is P25-trunk-following, DMR-ID display, POCSAG, and ADS-B decoded on-device. A bench that has both uses the PortaPack for wideband TX/RX experiments and LakeShark for “what is that trunk talking about right now.”

Finally, the hub’s Scanners project is the conceptual neighbour, not a competitor. That project is the 25-volume reference on the radios, scanners, and DMR hotspots proper; it is the right place for the P25/DMR domain knowledge — trunking theory, control channels, system keys, talkgroup planning. LakeShark is a tool that operates in that domain on MCU silicon. Where this series needs P25 or DMR background beyond what the decode chain requires, it leans on the Scanners project rather than duplicating it, and the Antennas project for anything antenna-side.

1.7.1 The companion ecosystem

LakeShark is not a single repository; it is a small constellation, and knowing the pieces helps a buyer understand what is firmware, what is a helper app, and what is still aspirational.

Table 4 — The companion ecosystem

Repo / portal	Role	Maturity (as of v2.15.0)
SAMS0N1TE/LakeShark	The firmware itself	Active, near-daily releases
SAMS0N1TE/LakeShark-Flipper	Flipper Zero control-head app (BLE or GPIO)	The headless-control story
SAMS0N1TE/lr2021-sdr	The LR2021 raw-signal path	Supports the no-SDR variant
SAMS0N1TE/CartoTUI	Terminal/ASCII offline map rendering	Integration in development, not validated against recent firmware
SAMS0N1TE/ZeroMesh	Embedded PMTiles reader	Feeds the offline MAP app
terminalbay.com	Web flasher + project portal	The install path (Volume 9)

The two to weigh at buy time are LakeShark-Flipper (which turns a Flipper Zero into the control head for a headless P4 — a genuinely useful option if a Flipper is already on the bench) and the mapping pair CartoTUI/ZeroMesh (which back the offline PMTiles maps — ZeroMesh is in service; CartoTUI’s integration is still settling, so treat the terminal-map path as experimental). Volume 6 covers the mapping stack; Volume 9 covers the Flipper-control-head mode.

1.8 The honesty ledger, up front

The best single reason to trust this project is that its author documents its limits. The ledger below collects the places where the firmware’s README and docs say, in effect, “this works on the bench but has not been proven on real RF,” or “this is not the thing it sounds like.” Internalize it before buying; it prevents every common disappointment.

Table 5 — 8. The honesty ledger, up front

Feature	What it sounds like	What the author actually says (as of v2.15.0, 2026-10-15)
Compass DF	A direction-finder	”Not a validated DF system.” A tilt-compensated compass plus LoRa RSSI-by-heading — a fox-hunting aid, nothing more
P25 Phase II	Full P25 support	Experimental. Bench-tested against public recordings; live RF unverified
HackRF One support	A HackRF scanner	USB-IQ transport proven at 2 MSPS; live RF decode not observed. Pagers verified; live P25 unconfirmed
DMR activity view	A DMR decoder	A read-only observer on the P25 symbol stream. Never pointed at a real DMR TX — symbol stack tested only
Sub-GHz OOK/FSK replay	A replay attack tool	Experimental. The two integer decoders honestly decode ~15 of 41 unseen captures; rolling-code / LiftMaster excluded by design
CELL WATCH	An IMSI-catcher detector	An RF baseline survey of LTE/cellular activity. Explicitly NOT an IMSI-catcher detector
LR2021 IQ TX / replay	A transmitter	Experimental. OOK replay verified; FSK not yet verified over the air
RadioReference adapter	Live trunk-import	Present but live authentication not verified

Warning. Power the P4 only through its own USB-C input. The MIX-RF keyboard add-on has a 5 V USB output that must never feed back into the P4 — testing produced repeated reboot loops. A shared P4-plus-RTL-SDR battery pack is still in development. This is the one hardware mistake that will make a new build look broken when it is not. Volume 9 covers the power topology in full.

None of this is a knock on the project — it is why the project is credible. A firmware that shipped “IMSI-catcher detector” and “validated DF” with the same confidence as its P25 decode would be the one to distrust. The sub-GHz and MIX-RF features still carry a legal envelope regardless of maturity; see the hub’s shared legal/ethics note (../_shared/legal_ethics.md) and Volume 10.

1.9 Who it is for — and who should buy something else

A good fit is the engineer or hobbyist who wants a pocketable, instant-on receiver for public-safety and aviation monitoring, who values that the whole stack is open and inspectable, and who is comfortable flashing firmware, occasionally soldering, and living with a fast-moving codebase where some features are frank proofs of concept. It suits someone who already understands — or wants to learn by building — how an RTL-SDR, a decimating DSP chain, and a P25 framer fit together, and who finds “OP25 in my hand with a GPS and an offline map” a genuinely useful thing to carry.

A poor fit is the buyer who wants a sealed, warrantied, guaranteed-to-work trunk scanner for daily operational use — a Uniden SDS-series scanner is the right tool, and it is not a criticism of either device to say so. It is also a poor fit for anyone who reads “direction-finding”, “IMSI-catcher detector”, or “DMR decoder” in the feature list and expects those to be finished, validated systems; §8 exists precisely to prevent that purchase. And it is the wrong tool for transmit-side RF work — that is the HackRF/PortaPack’s job.

1.9.1 A note on version churn

One trait deserves its own flag because it shapes the whole ownership experience: LakeShark releases fast. From a 2026-06-18 creation to v2.15.0 on 2026-10-15 is roughly four months and well over a dozen point releases — a cadence closer to a nightly build than a shrink-wrapped product. For the owner this cuts both ways. New capabilities and fixes arrive constantly, and the two-slot signed OTA (since v2.9.0) makes updating low-risk because a bad flash reverts. But it also means any capability claim has a shelf life: a feature marked “experimental” in one release may be promoted — or quietly reworked — a week later, and documentation anywhere (including this series) should be read against a dated version. The practical discipline is simple: before relying on any specific behavior, check the current release notes. This series pins every version-specific claim to v2.15.0 (2026-10-15) for exactly that reason, and Volume 10 returns to the churn question as part of the ownership posture.

1.10 How this series is organized

Ten volumes, building from the hardware up to the ecosystem and the laminate card.

Table 6 — 10. How this series is organized

Vol	Title	What it covers
1	Overview & decision graph	This volume — thesis, the SX1262/LR2021 fork, cost, placement, the honesty ledger
2	The ESP32-P4 & the T-Display P4 board	SoC internals, the C6 offload, the board, MIX-RF, the full supported-hardware table
3	SDR theory & the USB-host miracle	xtrsdr/librtlsdr on ESP-IDF USB host, why HS-USB unlocks 2 MSPS, the RTL front end
4	On-device DSP & P25 voice	The full IQ→decimate→discriminator→C4FM→sync→BCH→IMBE→ES8311 pipeline, dual-core split, the LR2021 no-SDR path
5	Digital-voice & paging decode	P25 trunking vs conventional, Phase II, the DMR observer, POCSAG, SAME/EAS, APRS/AIS
6	ADS-B, waterfall & the mapping stack	1090 MHz Mode S, FALLS, PMTiles offline maps, GPS/GPX, spoken callouts
7	Mesh, LoRa & direction-finding	MeshCore, LoRa, the compass + RSSI-bearing fox-hunting (with the “not validated” caveat)
8	Sub-GHz, NFC & the MIX-RF tools	.sub capture/replay, the pwm/nrz decoders, CC1101/nRF24, NFC, DETECTOR, CELL WATCH
9	Flashing, building & the C6 dance	Web installer, flash offsets/OTA, SD roles, ESP-IDF source build, the C6 reflash, power pitfalls
10	Comparison, ecosystem, posture & cheatsheet	vs PC-RTL-SDR / PortaPack / other ESP32 SDRs, the credit map, legal envelope, glossary + quick-ref

A suggested reading order for a prospective builder: this volume to decide whether and which variant; Volume 2 for the hardware and the full supported-board table; Volume 3 to understand the one feature the whole thing rests on; then Volumes 4–8 for the decode chains in whatever order matches intent (digital voice, aviation, mesh/DF, or sub-GHz). Volume 9 is the build-and-flash reference to keep open during the first setup, and Volume 10 is the comparison and the laminate card. A returning reader after the first pass will mostly live in §8’s honesty ledger, Volume 9’s flash table, and Volume 10’s quick-ref.

The next volume opens the hood on the ESP32-P4 and the T-Display P4 board, and carries the mandatory supported-hardware table that §4 pointed to. Volume 3 then explains the one feature that makes the whole project possible: how an MCU came to host an RTL-SDR at two million samples a second with no computer behind it.

LakeShark is GPL-3.0 firmware by Samuel Reynolds (SAMS0N1TE). Facts in this volume are drawn from the live repository at github.com/SAMS0N1TE/LakeShark as of v2.15.0 (2026-10-15); version-specific claims are dated. Third-party components retain their own licenses (docs/THIRD_PARTY_NOTICES.md).