Overview
This research examines whether the physical and logical state of an ExpressLRS frequency-hopping command-and-control link can be reconstructed from non-cooperative RF observations.
The experimental work covers passive radio-profile identification, operational identity reconstruction, FHSS tracking, and controlled transmitter substitution on a stock receiver in a controlled RF test environment.
Research scope
The work combines cross-version source analysis with hardware experiments on ExpressLRS, including an integrated ELRS 4.1 campaign from passive profile selection through reconstruction, full FHSS tracking, controlled source substitution, and receiver recovery.
Reproducibility
The public research artifact provides sanitized experimental evidence, offline reconstruction and verification code, replay scripts, traceability manifests, and cryptographic hashes.