LakeShark · Volume 10
LakeShark Volume 10 — Comparison, Ecosystem, Posture & Cheatsheet
Where it sits, who it builds on, what the law allows, and the one-page quick-reference
10.1 About this Volume
This volume places LakeShark against its alternatives, credits the open-source projects it is built from, states the legal envelope for a receive-focused scanner, flags the one practical hazard of tracking a near-daily-release project, and collects the cheatsheet material — a glossary and a laminate-ready quick reference. It is the volume to read first for a buy/no-buy decision and the one to print for field use.
The thesis to keep in mind throughout: LakeShark is “OP25 + dump1090 in your hand” — the same open DSP lineage that a PC-plus-RTL-SDR runs, ported onto an ESP32-P4 so it needs no PC, no Pi and no phone. Everything in this comparison turns on that one trade: portability and self-containment bought at the price of an MCU’s compute budget and a ~2 MSPS sampling ceiling.
Note. Reflects repo state v2.15.0 (2026-10-15). Because the project ships near-daily, treat every specific claim as dated; §8 explains how to read that churn.
10.2 vs a PC with an RTL-SDR
This is the most honest comparison, because it is the same radio on both sides. LakeShark hosts an RTL-SDR Blog V3/V4 (RTL2832U + R820T2) over USB — the identical dongle a laptop running OP25, dump1090 and DSD would use. What differs is the host.
Table 1 — 2. vs a PC with an RTL-SDR
| LakeShark | PC + RTL-SDR | |
|---|---|---|
| Radio front end | RTL2832U + R820T2 (same) | RTL2832U + R820T2 (same) |
| DSP lineage | librtlsdr / OP25 / dump1090 / DSD / mbelib | librtlsdr / OP25 / dump1090 / DSD / mbelib |
| Host | ESP32-P4, battery, in a pocket | Laptop/Pi, mains or big battery |
| Sample ceiling | ~2 MSPS (HS-USB) | 2.4–3.2 MSPS, CPU-limited |
| Band-scan width | Narrow (MCU budget) | Wide (full CPU) |
| P25 Phase II | Experimental | Mature (OP25) |
| Setup | Flash once, turn on | Install stack, configure |
| Spectrum muscle | Limited | A real workstation |
The DSP provenance is identical, which is the point — LakeShark is not a weaker reimplementation of the OP25/dump1090 algorithms, it ports the lineage. Where a PC wins is raw compute: wider simultaneous bandwidth, mature Phase II trunk-following, heavy waterfall and recording, and the ability to run several decoders at once. Where LakeShark wins is that it is a self-contained handheld that boots in seconds and fits in a jacket pocket, with a battery, GPS, compass and offline maps the PC rig does not carry.
The ~2 MSPS ceiling is a hard architectural fact: the P4’s USB OTG 2.0 High-Speed PHY (480 Mbps) is exactly what lets it host the dongle at 2 MSPS at all (Vol 3), and that is the top of its envelope. A PC pushes the same dongle a little harder and has orders of magnitude more compute behind it. For following one trunked system, one pager band, or 1090 MHz ADS-B on the move, the handheld is the better tool; for wideband survey and Phase II in a fixed location, the PC is.
10.3 vs HackRF One + PortaPack
Different niches that are easy to conflate because both are “handheld SDR.”
Table 2 — 3. vs HackRF One + PortaPack
| LakeShark | HackRF One + PortaPack (Mayhem) | |
|---|---|---|
| Role | RX scanner / decoder | TX+RX wideband Swiss-army |
| Frequency | Dongle-limited (~24–1766 MHz RTL) | 1 MHz – 6 GHz |
| Transmit | No (RX; LoRa/sub-GHz TX only) | Yes, wideband TX |
| Trunked digital voice | P25 trunk-following + DMR ID | Weak |
| POCSAG / ADS-B on-device | Yes | Limited / via apps |
| Offline map + GPS + compass | Yes | No |
| Open firmware | GPL-3.0 | Mayhem (also open) |
The HackRF/PortaPack is the generalist: it transmits and receives from 1 MHz to 6 GHz and runs the sprawling Mayhem firmware, which does a hundred things. What it is weak at is exactly LakeShark’s strength — following a trunked P25 system, pulling a DMR ID, decoding POCSAG and ADS-B on-device with a decent voice vocoder. LakeShark is the specialist scanner; the PortaPack is the wideband experimenter’s bench. They are complements, not competitors — see the HackRF One deep dive in this hub for the other half of that picture.
LakeShark can itself host a HackRF One as an experimental IQ source (Vol 3). That path is proven as transport at 2 MSPS (zero dropped bytes, POCSAG decoded) but live P25/ADS-B decode on the HackRF path is explicitly unobserved — the decimation from the HackRF’s 2 MSPS floor leaves the receive task near 90% busy with periodic ring overflows. Use the RTL-SDR for anything you need to rely on.
There is a neat symmetry worth naming: the HackRF/PortaPack is the tool a hacker reaches for to transmit and to explore unknown signals across six gigahertz, while LakeShark is the tool for following known digital-voice and data services in the field. A full bench carries both, and they barely overlap — the PortaPack’s Mayhem firmware would struggle to trunk-follow a P25 system, and LakeShark cannot transmit a wideband signal at all. Reading one as a substitute for the other is the most common mistake in placing LakeShark, and it is why this section exists. See the HackRF One and OpenSourceSDRLab PortaRF deep dives in this hub for the transmit-and-wideband side of the ledger.
10.4 vs other ESP32 / P4 SDR efforts
LakeShark is best understood as an application and integration layer, not a new RF front end. It does not invent a radio — it stands on two shoulders:
XTR1984/xtrsdr— the ESP32-optimized librtlsdr that makes USB-host RTL-SDR on an ESP32 possible at all (Vol 3). LakeShark is what you get when someone wraps that transport in a full decode stack, a UI, maps, GPS and a mesh.- jstockdale’s T-Display-P4 ADS-B reference — the CPR decode lineage for the 1090 MHz work (Vol 6).
Against a bare xtrsdr demo or a single-purpose ADS-B sketch, LakeShark’s value is
integration: it is the first project to put P25 trunk-following, DMR ID, POCSAG,
ADS-B, a waterfall, offline PMTiles maps, GPS, a 9-axis compass and MeshCore onto
one P4 handheld with a coherent UI and a two-slot OTA story. The silicon jump also
matters — this is ESP32-P4 (RISC-V dual-core, HS-USB), a real step up from every
ESP32-S3/CYD device in this hub, and the HS-USB PHY is the specific feature that
unlocks full-rate RTL-SDR hosting.
The contrast with the ESP32-S2-class USB-host SDR demos that preceded it is the
clearest way to see why the P4 matters. On an S2, xtrsdr streams an RTL-SDR only
over the slow path (Wi-Fi/Ethernet offload), capping throughput at roughly
240–300 kSPS — enough for a proof of concept, not enough for a usable scanner. The
P4’s High-Speed USB PHY carries the dongle’s full 2 MSPS natively, which is the
difference between “an ESP32 can technically talk to an RTL-SDR” and “an ESP32 can
be a scanner.” Everything LakeShark does on-device flows from that one
architectural fact, and it is why the project targets the P4 and not the cheaper,
more common S3.
Table 3 — 4. vs other ESP32 / P4 SDR efforts
| Project | What it is | LakeShark’s relation |
|---|---|---|
xtrsdr | ESP32 librtlsdr USB-host transport | LakeShark’s RTL-SDR foundation |
| jstockdale T-Display-P4 ADS-B | 1090 MHz CPR reference | LakeShark’s ADS-B lineage |
| OP25 / DSD / mbelib | PC P25/DMR decode + IMBE vocoder | Ported into the on-device pipeline |
| dump1090 / libmodes | PC ADS-B | Ported into the on-device ADS-B |
| LakeShark | Integrated handheld application | The layer over all of the above |
10.5 Where it sits in this hub
LakeShark fills a slot nothing else in the Hack Tools hub occupies: the standalone, host-free SDR handheld. The nearest neighbours each cover a different corner.
Table 4 — 5. Where it sits in this hub
| Need | Reach for | Why |
|---|---|---|
| Host-free handheld P25/ADS-B/POCSAG scanner | LakeShark | On-device decode, battery, maps |
| Cheap receive-only SDR tethered to a PC | the RTL-SDR deep dive | Same dongle, full-CPU host |
| Wideband TX+RX experimentation | the HackRF One deep dive | 1 MHz–6 GHz transmit |
| The other “HackRF as a handheld” answer | the OpenSourceSDRLab PortaRF deep dive | Integrated HackRF + display |
| Deep P25/DMR trunk-system domain knowledge | the Scanners project | Protocol + system reference |
| Antennas, matching, measurement | the Antennas project | The RF feed for any of these |
Flipper .sub + sub-GHz protocol depth | the Flipper Zero deep dive | Shared .sub format (Vol 8) |
The relationships are concrete: LakeShark reads and writes the same Flipper .sub
captures as the Flipper Zero deep dive covers, and can use a Flipper as its control
head (Vol 9 §9); its P25/DMR work is the applied counterpart to the Scanners
project’s protocol-and-system reference; and whatever antenna feeds it is the
Antennas project’s department. For a buyer already invested in this hub, LakeShark
is the piece that makes the RTL-SDR dongle a pocket scanner instead of a desk
peripheral.
What a working kit costs. LakeShark is firmware; the money is in the hardware it runs on. A realistic build-out:
Table 5 — it runs on. A realistic build-out
| Item | Needed? | Rough cost (USD) |
|---|---|---|
| LilyGO T-Display P4 (AMOLED, SX1262 or LR2021) | Yes | ~$145–160 |
| RTL-SDR Blog V3/V4 dongle | Yes for SX1262 board; no for LR2021 | ~$30–40 |
| MIX-RF keyboard add-on (CC1101 + nRF24 + NFC) | Optional | ~$74 |
| microSD card | Yes (bulk store, Vol 9 §5) | ~$10 |
| Antennas (LoRa + RTL-SDR band) | Yes | varies |
| USB-UART 3.3 V adapter (for the C6 reflash) | One-time, §7 | ~$5–10 |
| Typical kit | ~$245–255 |
The LR2021 board changes the arithmetic: it decodes P25 Phase 1/FM/ADS-B/pagers on its own radio (Vol 7 §2), so the RTL-SDR becomes optional rather than required — at the cost of a narrow capture bandwidth and no wide band-scan. The SX1262 board plus an RTL-SDR is the fuller scanner; the LR2021 board alone is the lighter, single-radio option.
10.6 The open-source credit map
LakeShark is GPL-3.0, and it is scrupulous about where it comes from —
third-party components keep their own licenses, catalogued in
docs/THIRD_PARTY_NOTICES.md. Crediting that lineage is part of understanding the
tool: almost nothing in the signal path is novel, and that is a strength — it is
battle-tested PC-SDR code brought to an MCU.
LakeShark (GPL-3.0, SAMS0N1TE)
│
├─ USB-host RTL-SDR ── XTR1984/xtrsdr (GPL-2.0, "ESP32 librtlsdr")
│ └─ Osmocom librtlsdr
├─ P25 / DMR decode ── OP25 lineage + DSD
│ └─ IMBE: OP25 fixed-point vocoder, mbelib fallback
├─ ADS-B ── libmodes / dump1090 + jstockdale T-Display-P4 ADS-B
├─ Offline maps ── PMTiles (CartoTUI / ZeroMesh rendering)
├─ Mesh ── MeshCore
└─ Companion ── LakeShark-Flipper (control head)Table 6 — 6. The open-source credit map
| Component | Upstream | License | Role |
|---|---|---|---|
| USB-host SDR transport | XTR1984/xtrsdr | GPL-2.0 | RTL-SDR over ESP-IDF USB host |
| librtlsdr | Osmocom | (via xtrsdr) | RTL2832U control |
| P25/DMR symbol + FEC | OP25 / DSD | open | C4FM decode, BCH, link control |
| IMBE vocoder | OP25 fixed-point / mbelib | open | Digital voice → audio |
| ADS-B | dump1090 / libmodes + jstockdale | open | 1090 MHz Mode S / CPR |
| Offline maps | PMTiles / CartoTUI / ZeroMesh | open | Vector tiles, no internet |
| Wireless offload | ESP-Hosted 2.12.9 | Espressif | C6 Wi-Fi/BT (Vol 9 §7) |
| Build | ESP-IDF 5.5.4 | Espressif | Toolchain |
The honest reading: LakeShark’s achievement is integration and porting, not new DSP. It took the de-facto-standard PC SDR decode stack and made it run, together, on a battery-powered RISC-V MCU with a touchscreen. That is a real feat of systems engineering, and the credit map shows exactly whose work it rests on.
Porting that stack to an MCU is not a recompile — it is where the engineering actually lives, and the HackRF bring-up notes (Vol 3) give a representative taste: USB DMA descriptors that must be 512-byte aligned and could not come from PSRAM (solved with reserved internal slots and an atomic bitmap, keeping the IQ ring in PSRAM); a receive task that runs near 90% busy once the decimator takes its quarter-core; a fixed-point IMBE vocoder used precisely because an MCU has no FPU budget to spare on voice. The PC versions of these algorithms assume a desktop’s memory bandwidth and float throughput; the port’s whole job is making them honest on 768 KB of SRAM, external PSRAM as cache, and two RISC-V cores clocked around 360 MHz. That constraint is why the credit map matters — the algorithms are upstream, but the fit is LakeShark’s.
10.7 Posture and the RF-listening legal envelope
LakeShark is a receive-focused scanner, which makes its posture milder than
the active-attack tools in this hub (the WiFi Pineapple and Ducky Script are the
posture-heavy end; LakeShark sits well below them). But “milder” is not “none” —
it transmits on LoRa/mesh and, through the MIX-RF add-on and sub-GHz replay, can
key other transmitters. The full rules are in ../_shared/legal_ethics.md; the
LakeShark-specific application:
Table 7 — LakeShark-specific application
| Activity | Posture | Rule of thumb |
|---|---|---|
| Listening to P25/FM/ADS-B/POCSAG | Receive | Monitoring is broadly permissible; using what you overhear may not be |
| Decoding digital voice | Receive | Same — jurisdiction-dependent; encrypted traffic is off-limits to decrypt |
| MeshCore / LoRa TX | Transmit | Region-correct band (868 vs 915), unlicensed-band rules apply |
| Sub-GHz OOK replay | Transmit | Only against gear you own; retransmitting others’ remotes can be a crime |
| MIX-RF CC1101 / nRF24 | Survey / TX | Passive sense is low-risk; keying a TX is governed as above |
| NFC reads | Read | Only cards you own or are authorized to read |
Three load-bearing principles:
- Receiving is far safer than transmitting, almost everywhere. The bulk of LakeShark’s value is receive, and receive is where the legal risk is lowest. Scanner-listening law varies by jurisdiction (some restrict monitoring certain services, or acting on what you hear), but passive RX is the mild end.
- Never decrypt, and never act on intercepts. Decoding P25 clear voice is one thing; attempting to defeat encryption, or using overheard information, is a different legal category entirely.
- Every transmit is against something real. LoRa, sub-GHz replay and the MIX-RF radios put you under the regional RF rules and potentially computer-misuse/access-control statutes. Own the hardware or hold written authorization.
Note. CELL WATCH (Vol 8 §8) is an RF survey, not an IMSI-catcher detector, and DETECTOR (Vol 8 §7) listens for beacons devices are required to broadcast — both are passive and defensive. Do not let their names inflate the device’s posture in a threat model.
10.8 The version-churn caveat
LakeShark ships near-daily releases. The repo was created 2026-06-18 and was on v2.15.0 by 2026-10-15 — a pace that is a genuine strength (bugs close fast, features land quickly) and a genuine documentation hazard.
The practical consequences:
- Press coverage is stale on arrival. Articles citing v2.2 or v2.5 are months behind; the feature set, the OTA scheme (two-slot since v2.9.0), and the C6 firmware version have all moved. Date every version claim, and when in doubt, the live repo wins over any article — including this dive.
- This dive is a snapshot. Everything here is the v2.15.0 state. Treat it as a dated reference, not a moving target; re-check the repo for anything you are about to rely on operationally.
- Features marked experimental may graduate — or vanish. P25 Phase II, HackRF live decode, and FSK replay are all flagged unverified at v2.15.0; a later release may confirm or drop any of them. The honesty ledger (§9) is itself dated.
Tip. For a fast-moving GPL project, the reliable sources are, in order: the repo’s own
docs/(dated commits), the release notes, and the author’s portal at terminalbay.com. Third-party write-ups, including this one, trail behind.
A concrete illustration of why dating matters: between the repo’s creation on 2026-06-18 and v2.15.0 on 2026-10-15 — under four months — the OTA scheme went from USB-only to signed two-slot (v2.9.0), the HackRF transport was proven, multiple decoders landed, and the feature menu reorganised. Any document that does not carry a version and date is describing a device that may no longer exist in that form. This dive states v2.15.0 at the top of every volume for exactly that reason, and the honesty ledger (§9) is explicitly a v2.15.0 snapshot — several of its “experimental” rows are the most likely things to change next.
10.9 The honesty ledger, collected
A recurring strength of this dive is that the author labels what is proven and what is not. Collected in one place, as of v2.15.0, for a quick pre-purchase expectation-set:
Table 8 — expectation-set
| Claim | Author’s honest status |
|---|---|
| Compass direction-finding | ”Not a validated direction-finding system” — fox-hunt aid only (Vol 7) |
| P25 Phase II | Experimental; live RF unverified; disabled after restart (Vol 5) |
| HackRF One path | Transport proven @2 MSPS; live P25/ADS-B decode unobserved (Vols 3, 10) |
| DMR decode | Symbol stack tested; never pointed at a real DMR TX (Vol 5) |
| Sub-GHz decoders | ~15 of 41 unseen captures; rolling-code/LiftMaster excluded by design (Vol 8) |
| OOK replay | Verified on air at 433 MHz (Vol 8) |
| FSK replay | Not yet verified over the air (Vol 8) |
| LR2021 I/Q transmit | Experimental (Vol 7) |
| CELL WATCH | RF band survey, NOT an IMSI-catcher detector (Vol 8) |
| RadioReference adapter | Live authentication not yet verified |
| CartoTUI integration | Not validated against recent firmware |
| Shared P4+RTL-SDR battery | Still in development (Vol 9) |
The correct way to read this table is as a reason to trust the project more, not less: a firmware that tells you its DMR path has never seen a real DMR transmitter and its compass is not a real DF system is setting honest expectations. Buy it for what is proven (RTL-SDR P25 Phase 1, FM, POCSAG, ADS-B, mesh, maps); treat everything in this table’s “experimental/unverified” rows as bonus-if-it-works.
Who should buy this, and who should not. The honesty ledger makes the buy/no-buy call unusually clean:
- Buy it if you want a pocketable, host-free scanner for P25 Phase 1, analog FM, POCSAG and ADS-B, with offline maps, GPS and a mesh — and you accept that it is a fast-moving open project you will update often. This is its home ground and it is proven here.
- Buy the LR2021 variant specifically if you want the smallest possible single radio (no dongle) and can live with narrow bandwidth and no Phase II.
- Do not buy it expecting mature P25 Phase II, reliable HackRF decode, a validated direction finder, or an IMSI-catcher detector — none of those are what it is, by the author’s own account.
- Prefer a PC + RTL-SDR if you need wideband survey, Phase II, or heavy recording in a fixed location; prefer a HackRF/PortaPack if you need transmit or 1 MHz–6 GHz coverage. Those are different tools for different jobs (§§2–3).
The device rewards a buyer who reads the ledger and matches expectations to the “proven” column. It punishes one who buys on the headline feature list and expects every experimental row to work.
Glossary
Table 9 — 10. Glossary
| Term | Meaning |
|---|---|
| ADS-B | Automatic Dependent Surveillance–Broadcast; 1090 MHz aircraft position beacons |
| AGC | Automatic Gain Control; keeps a weak carrier filling the output range |
| BCH(63,16) | The error-correcting code protecting the P25 Network ID |
| C4FM | Continuous 4-level FM; the P25 Phase 1 (and DMR) modulation, 4800 sym/s |
| CC1101 | TI sub-GHz transceiver on the MIX-RF add-on |
| CIC | Cascaded Integrator-Comb filter; the decimator on the HackRF path |
| CPR | Compact Position Reporting; ADS-B’s position encoding |
| DMR | Digital Mobile Radio; 4FSK @4800 sym/s — same symbol rate as P25 C4FM |
| DSD | Digital Speech Decoder; the open P25/DMR decode lineage |
| ESP-Hosted | Espressif firmware letting the P4 use the C6 as a Wi-Fi/BT radio (v2.12.9 required) |
| ESP32-C6 | The onboard Wi-Fi 6 + BLE co-processor (the P4 has no radio) |
| ESP32-P4 | The main SoC; RISC-V dual-core HP + LP, HS-USB, no built-in radio |
| FALLS | LakeShark’s waterfall display; tap-to-tune |
| HS-USB | USB OTG 2.0 High-Speed (480 Mbps); the feature enabling 2 MSPS RTL-SDR hosting |
| IMBE | Improved Multi-Band Excitation; the P25 voice vocoder |
| IQ | In-phase/Quadrature complex baseband samples |
| librtlsdr | Osmocom RTL-SDR driver; ported to ESP-IDF by xtrsdr |
| LR2021 | Newer LoRa transceiver variant giving onboard raw-IQ SDR RX (no dongle) |
| MeshCore | The LoRa mesh protocol LakeShark speaks (not Meshtastic) |
| MIX-RF | Optional keyboard add-on: CC1101 + nRF24 + ST25R3916 NFC |
| mbelib | Fallback IMBE vocoder library |
| NID | Network ID; the P25 frame’s addressing field |
| nRF24 | 2.4 GHz transceiver on the MIX-RF add-on |
| OP25 | Open P25 decoder project; the on-device pipeline’s lineage |
| OTA | Over-The-Air update; two-slot signed since v2.9.0 |
| P25 | Project 25; the digital land-mobile-radio standard (Phase 1 C4FM, Phase 2 TDMA) |
| PMTiles | Single-file vector map tiles; LakeShark’s offline maps |
| POCSAG | Common paging protocol |
| PSRAM | External pseudo-static RAM; holds the IQ ring and large buffers |
| RM69A10 / HI8561 | The AMOLED / TFT display controllers (two board variants) |
| RSSI | Received Signal Strength Indicator; the compass bearing input |
| RTL2832U + R820T2 | The RTL-SDR dongle’s demodulator + tuner chips |
| ST25R3916 | The MIX-RF add-on’s 13.56 MHz NFC reader |
.sub | Flipper Zero’s sub-GHz capture file format; interchangeable with LakeShark |
| SX1262 | Classic LoRa transceiver board variant (needs an RTL-SDR for SDR RX) |
| T-Display P4 | The LilyGO board LakeShark is built for |
| xtrsdr | XTR1984/xtrsdr, the ESP32 USB-host librtlsdr port |
10.10 Laminate quick-reference card
A one-page field reference. Print, laminate, keep with the kit.
┌─────────────────────────────────────────────────────────────────┐
│ LakeShark · quick reference (v2.15.0, 2026-10-15) │
├─────────────────────────────────────────────────────────────────┤
│ BOARD LilyGO T-Display P4 · ESP32-P4 (RISC-V) + C6 Wi-Fi/BT │
│ 4.1" AMOLED 568×1232 · 16MB flash · 32MB PSRAM │
│ 2× USB-C (R = P4U flash/serial; L = charge only) │
│ 1× USB-A host → RTL-SDR dongle │
│ RADIO SX1262 variant → LoRa+MeshCore+POCSAG; needs RTL-SDR │
│ LR2021 variant → + onboard P25 P1/FM/ADS-B (no dongle) │
│ DONGLE RTL-SDR Blog V3/V4 (reliable) · HackRF (experimental) │
├─────────────────────────────────────────────────────────────────┤
│ POWER Flash on RIGHT USB-C (P4U) only │
│ NEVER feed MIX-RF 5V back into the P4 (reboot loop) │
│ C6 UART: do NOT connect adapter 3.3V │
├─────────────────────────────────────────────────────────────────┤
│ FLASH (web) terminalbay.com/?m=lakeshark&board=tdp4 (Chrome) │
│ FLASH offsets (P4) bl 0x2000 · pt 0x8000 · app 0x10000 │
│ storage 0x910000 │
│ OTA HOME>SYSTEM>UPDATE (needs Wi-Fi/LINK); two-slot, reverts │
│ Pre-v2.9.0 → one USB install first │
│ C6 (ESP-Hosted 2.12.9, one-time, offsets DIFFER): │
│ 0x0 bl · 0x8000 pt · 0xd000 ota_data · 0x10000 network_adapter│
│ 1 flash coprocessor_download_mode on P4 → wait msg │
│ 2 USB-UART to C6 hdr, RX/TX crossed, 3.3V NOT connected │
│ 3 hold BOOT, tap RESET, release BOOT → esptool write_flash │
│ 4 reflash LakeShark on P4; look for "co-processor link: up(0)"│
├─────────────────────────────────────────────────────────────────┤
│ BUILD ESP-IDF 5.5.4 (+bench/patch-idf.ps1); ignore sdk 5.4.3 │
│ idf.py -B build_tdp4 -D SDKCONFIG=build_tdp4/sdkconfig \ │
│ -D SDKCONFIG_DEFAULTS="sdkconfig.defaults;\ │
│ boards/t_display_p4.defaults" build │
│ Targets: TDP4 AMOLED · TDP4 TFT · Waveshare headless · LCD4.3 │
├─────────────────────────────────────────────────────────────────┤
│ MENUS Radio: P25 FM ADS-B FALLS CELL-WATCH │
│ Mesh: MESH LORA-LABS │
│ RF: SUB-GHZ REC MIX-RF NFC DETECTOR EXPERIMENTS │
│ Nav: MAP COMPASS GPS NOTES │
│ Sys: MUSIC FILES UPDATE SET RADIOS LINK DIAG TERMINAL │
│ console radios ble off (persists in NVS) │
│ hackrf · hackrf ppm <n> · hackrf dump · hackrf snap │
├─────────────────────────────────────────────────────────────────┤
│ TRUST WHAT'S PROVEN: RTL-SDR P25 Phase1 · FM · POCSAG · ADS-B │
│ mesh · offline maps · OOK replay(433) │
│ TREAT AS BONUS: Phase II · HackRF decode · DMR · FSK │
│ replay · compass "DF" (NOT a DF system) │
│ CELL WATCH = RF survey, NOT an IMSI-catcher detector │
├─────────────────────────────────────────────────────────────────┤
│ LAW RX broadly OK; never decrypt, never act on intercepts. │
│ Every TX (LoRa/sub-GHz/MIX-RF) → own it or be authorized. │
│ Region band: 868 (EU) vs 915 (US) is a hardware fact. │
└─────────────────────────────────────────────────────────────────┘Tip. The two numbers worth memorising: flash on the right USB-C, and the P4 app lives at 0x10000 while the C6 app lives at 0x10000 too but with a 0x0 bootloader — it is the bootloader offset (0x2000 P4 vs 0x0 C6) that tells the two apart. Everything else can be looked up; getting the port and the bootloader offset right is what keeps a flashing session from going sideways.
This closes the LakeShark deep dive. The arc: a no-PC handheld scanner (Vol 1) built on an ESP32-P4 whose HS-USB is the enabling trick (Vols 2–3), running the ported OP25/dump1090/DSD DSP lineage on-device (Vols 4–6), with mesh, honest direction-finding and a candid RF toolbox (Vols 7–8), flashed and built through a web installer and the C6 dance (Vol 9), and placed here against its neighbours with its honesty ledger intact (this volume). It is, in the author’s own framing, OP25 and dump1090 in your hand — and it is refreshingly honest about where the “in your hand” part still has rough edges.
Comments (0)