URH-NG: Universal Radio Hacker - Next Generation

Beta -- URH-NG is currently in beta and under active testing. It will be available in the RF Swift image starting with v0.1.6.

URH-NG is a next-generation fork of Universal Radio Hacker, maintained by PentHertz. It extends URH with automatic protocol identification against 327 protocols, an automotive RF crypto toolkit with 23 ciphers, and support for new SDR hardware including HydraSDR, Harogic spectrum analyzers, and Signal Hound BB60.

URH-NG is a complete suite for wireless protocol investigation with native support for many common Software Defined Radios. It allows easy demodulation of signals combined with automatic detection of modulation parameters making it a breeze to identify the bits and bytes that fly over the air. As data often gets encoded before transmission, URH-NG offers customizable decodings to crack even sophisticated encodings like CC1101 data whitening. When it comes to protocol reverse-engineering, URH-NG is helpful in two ways. You can either manually assign protocol fields and message types or let URH-NG automatically infer protocol fields with a rule-based intelligence. Finally, URH-NG entails a fuzzing component aimed at stateless protocols and a simulation environment for stateful attacks.

What's New in URH-NG

Auto Protocol Identification (PHZ DB)

A database of 327 protocol signatures sourced from rtl_433, Flipper-ARF, and ProtoPirate. URH-NG matches captured signals against all 327 protocols using a modulation-aware scoring engine that detects encoding type (PWM, Manchester, NRZ, Miller), preamble patterns (6 types), gap structures (4 types), and field layouts (17 types).

See SUPPORTED_PROTOCOLS.md for the full list.

Automotive RF Crypto Toolkit (23 Ciphers)

15 protocols auto-decode without any user input -- just capture, demodulate, and identify:

8 guided-decode protocols with built-in key management and brute-force:

See CRYPTO_TOOLKIT.md for full details.

New SDR Hardware Support

Enhanced Signal Processing

• PWM encoding support -- proper short/long pulse width demodulation
• Miller encoding support -- mid-bit transition detection (RFID ISO 14443, EPC Gen2)
• FrameAnalyzer -- detects 6 preamble types, 4 gap types, 3 encoding types automatically
• Modulation-aware scoring -- protocol matching considers PWM vs NRZ vs Manchester
• Field coverage scoring -- penalizes unlabeled trailing data for better protocol fits

Additional Improvements

• Sample rate combobox for fixed-rate devices
• Multi-device support for HydraSDR and Harogic
• Flipper Zero SubGHz plugin
• CI/CD workflows for multi-arch builds (.deb packages)
• Contributing guide for adding protocols, crypto, and decoders (CONTRIBUTING_DECODERS.md)

Getting Started

• View the installation instructions below
• Download the original userguide (PDF) (URH basics still apply)
• Watch the demonstration videos (YouTube)
• Check out the wiki for device info and SDR setup

Quick Start: Auto Protocol Identification

1. Capture or load a signal in URH-NG
2. Demodulate the signal (auto-interpretation handles most parameters)
3. Analyze -> Auto-identify protocol (PHZ DB) -- matches against 327 protocols
4. If a crypto cipher is mapped, the result dialog shows decoded fields (SN, button, counter)
5. For user-key ciphers: Analyze -> Crypto Toolkit opens pre-filled with guidance

Installation

URH-NG runs on Windows, Linux, and macOS. Python 3.9+ is required.

Linux (recommended)

From source

git clone https://github.com/PentHertz/urh-ng.git
cd urh-ng
pip install -e .

Using .deb package

Pre-built .deb packages are available from GitHub Releases.

In order to access your SDR as non-root user, install the according udev rules. You can find them in the wiki.

Windows

pip install urh-ng

If you get an error about missing api-ms-win-crt-runtime-l1-1-0.dll, run Windows Update or install KB2999226.

macOS

pip install urh-ng

Running from source (all platforms)

git clone https://github.com/PentHertz/urh-ng.git
cd urh-ng/src/urh
PYTHONPATH=.. ./main.py

Note: C++ extensions will be built before first usage.

Native SDR Backends

Install the -dev package for your SDR before installing URH-NG for native support:

Citing URH

We encourage researchers working with URH to cite the WOOT'18 paper:

@inproceedings {220562,
author = {Johannes Pohl and Andreas Noack},
title = {Universal Radio Hacker: A Suite for Analyzing and Attacking Stateful Wireless Protocols},
booktitle = {12th {USENIX} Workshop on Offensive Technologies ({WOOT} 18)},
year = {2018},
address = {Baltimore, MD},
url = {https://www.usenix.org/conference/woot18/presentation/pohl},
publisher = {{USENIX} Association},
}

Credits

URH was originally created by Johannes Pohl (@jopohl).

URH-NG is maintained by Sebastien Dudek at PentHertz (@FlUxIuS).

See CONTRIBUTORS.md for the full list of contributions.

Articles

Hacking stuff with URH

• Hacking Burger Pagers
• Reverse-engineer and Clone a Remote Control
• Reverse-engineering Weather Station RF Signals
• Reverse-engineering Wireless Blinds
• Attacking Logitech Wireless Presenters (German Article)
• Attacking Wireless Keyboards
• Reverse-engineering a 433MHz Remote-controlled Power Socket for use with Arduino

General presentations and tutorials on URH

• Hackaday Article
• RTL-SDR.com Article
• Short Tutorial on URH with LimeSDR Mini
• Brute-forcing a RF Device: a Step-by-step Guide
• Hacking wireless sockets like a NOOB

External Decodings

See wiki for community-provided decodings.

Screenshots

Get the data out of raw signals

Keep an overview even on complex protocols

Record and send signals

License

GNU General Public License (GPL)