DJI DroneID location system

Reverse engineered the DJI DroneID protocol across OcuSync 2, 3 and 4 to build a drone location system driven entirely by an SDR.

Given nothing but raw spectrum, it recovers the aircraft and the operator's position straight out of the broadcast frames — no cooperation from the drone, and nothing to install on it.

DroneID spoofing device

A transmitter that emits modified DroneID data.

It exists to answer an uncomfortable question: how does a detection system behave when the identity broadcast it trusts is a lie? Ours included. You cannot harden what you have never attacked.

RemoteID detection module

Led both halves of this one: the team that designed the PCB and the team that wrote the firmware.

The module listens for the RemoteID broadcast that regulation now requires of every aircraft, and feeds it into the wider detection stack as just another sensor.

OcuSync 4 decryption server

Reverse engineered the communication protocol between the DJI Aeroscope and its Dongle, then rebuilt that exchange as an online OcuSync 4 decryption service.

The interesting part was never the cryptography on its own — it was working out which side of the conversation held what, from the outside.

OFDM RF detection device

Signal-level detection and reverse engineering of OFDM waveforms, turned into a standalone RF detection device.

Detection here happens below the protocol: you classify the shape of the transmission before anything has told you what it is.