Hacking ▍

Rayhunter · Deep Dive · 10 volumes

Rayhunter

10 volumes: the IMSI-catcher threat and what is detectable from the handset, the Orbic platform, the analyzer model, install and field use, reading the recordings, and where it sits among cellular detectors.

The EFF's open-source IMSI-catcher / Stingray detector firmware (Rust) for cheap Qualcomm-modem hotspots — it passively watches the cellular control plane its own modem is on for the signatures of a fake base station. Defensive situational awareness; runs on the Orbic RC400L and a dozen other hotspots.

Search every volume:

?

How to search

sten gun
pages with both words
"sten gun"
the words together, as a phrase
sten OR sterling
either one (| works too)
sten -replica
leave out pages that mention “replica”

Without quotes, the last word also matches longer words that start with it (sten finds Stenophylla), and close word forms count (rifle finds rifles). Tick Exact words to match whole words only.

Whole deep dives are listed first, then the pages inside them.

    Volumes

    1. Vol 1 Rayhunter Volume 1 — Overview & Decision Tree The EFF's passive IMSI-catcher detector in one page, the defensive-only posture, who it is for, when to reach for it over SnoopSnitch / Crocodile Hunter / an SDR, and where it sits beside the GL-iNet travel kit, HackRF One and Flipper Zero
    2. Vol 2 Rayhunter Volume 2 — Cellular & IMSI-Catcher Primer How a device registers (IMSI / TMSI / GUTI), the 2G→5G control plane, what a cell-site simulator actually does, and the exact boundary of what is detectable from the handset side
    3. Vol 3 Rayhunter Volume 3 — Where This Firmware Runs: Supported Hardware The mandatory board-by-board table — recommended vs functional tiers, modems, regions, the Wi-Fi-AP and rootability quirks, and how to buy a verified-rootable unit
    4. Vol 4 Rayhunter Volume 4 — The Orbic RC400L Platform The reference device in depth: the Qualcomm MDM9207 modem, the DIAG/QMI interface Rayhunter rides, storage and display, power, and how root is obtained at a high level
    5. Vol 5 Rayhunter Volume 5 — How Rayhunter Works The Rust daemon, the DIAG→QMDL capture pipeline, the analyzer/heuristic model category by category, the warning UX, the sources of false positives, and the 'detection not prevention, signal not proof' framing
    6. Vol 6 Rayhunter Volume 6 — Installing & First Run From a verified-rootable hotspot to a flashed, running detector: the EFF installer workflow, first boot, reaching the web UI, enabling flash/SD logging, and the configuration file — all at a user and workflow level
    7. Vol 7 Rayhunter Volume 7 — Using It in the Field Power-on order, establishing a known-clean baseline, reading the warning line, what to do on a warning, the Wi-Fi-AP sleep quirk, and clearing recordings between trips
    8. Vol 8 Rayhunter Volume 8 — Reading the Recordings Pulling QMDL/PCAP off the device, reviewing the recorded control plane in Wireshark, cross-referencing serving cells against public tower databases, and a host-side summary workflow
    9. Vol 9 Rayhunter Volume 9 — Comparison & Ecosystem Rayhunter next to SnoopSnitch, CellGuard, SeaGlass and Crocodile Hunter; where a general SDR like the HackRF One sits; and an honest account of the limits of this class of detector
    10. Vol 10 Rayhunter Volume 10 — Legal, Ethics, OPSEC, Cheatsheet & Glossary The benign legal footing of passively recording your own connection, the ethics of carrying and reporting, OPSEC of the detector itself, a laminate-ready field card, and an A–Z glossary