Kevin Liu's Blog || Technical || Travel

🌐 中文版：繁體中文 Seventh and final post in the series. Over the previous six posts the LoRa demodulator grew from single-frequency, fixed-parameter all the way to implicit header, different-SF-per-packet, and drift correction. Here the satellite does one last thing: it hops across multiple frequencies (FHSS), and the demodulator has to reassemble the symbols, scattered across different frequencies, back into time order before it can decode. Rest of the series: Channel Hop、True Color Is a Lie、Isod...

🌐 中文版：繁體中文 Sixth post in the series. In the previous post, Two Voices, the satellite was still using a standard SF9. Here the stranger has changed its downlink config into implicit header + a different SF per packet, and because high-SF symbols are long, Doppler/clock drift makes the decode start going wrong partway through. This is the post where the demodulator is finally forced to add drift correction. Rest of the series: Channel Hop、True Color Is a Lie、Isodata Seven、Subsidy Claim、H...

🌐 中文版：繁體中文 Fifth post in the series, and the storyline shifts to “the night shift”: GaianSpace Mission Control’s GAIAN-723 satellite has been hijacked. The first four posts (the farm arc) got the LoRa demodulator well-practiced; these three (this one, No Name on the Door, Hopscotch) throw increasingly nasty situations at that same demodulator. This post’s theme: within one recording, two LoRa transmitters with completely different parameters are talking to each other. Rest of the series: Ch...

🌐 中文版：繁體中文 Fourth post in the series, and the finale of the “farm arc” (Babb’s AgriLink world). The first three posts got the LoRa demodulator in shape; this one adds a layer of GIS and classifier reconstruction on top of the demodulation. In a way, it’s everything from the earlier posts applied together. Rest of the series: Channel Hop、True Color Is a Lie、Isodata Seven、Two Voices、No Name on the Door、Hopscotch What the challenge is about At the county agriculture office, the area-payment...

🌐 中文版：繁體中文 Third post in the series. After the demodulator got its skeleton in True Color Is a Lie, this one swaps in new parameters (implicit header) and upgrades the stego trick from subtracting two copies to clustering across multiple channels. Rest of the series: Channel Hop、Subsidy Claim、Two Voices、No Name on the Door、Hopscotch What the challenge is about Since dawn the tractor has stopped listening to the mast and started listening to a different, unknown transmitter. The Johnrippe...

🌐 中文版：繁體中文 Second post in the series, and the one where we actually start hand-building a LoRa demodulator. The previous challenge, Channel Hop, just read an already-decoded packet log. From here on we get raw IQ and have to do everything ourselves. This demodulator sticks with me all the way to the end of the series, so this post goes into more detail to lay out the skeleton of LoRa demodulation. The later posts only cover what’s different about each one. Rest of the series: Isodata Seven、...

🌐 中文版：繁體中文 This is the opening post of my favourite storyline in GaianSpace CTF 2026. The whole series is built around one idea: you hand-build a LoRa demodulator yourself, and then keep growing it: from a single fixed parameter set, to implicit headers, to Doppler drift, and finally to frequency hopping. This first post doesn’t touch IQ yet; it’s a warm-up at the packet layer. The real IQ work starts in the next post, True Color Is a Lie. Rest of the series: Isodata Seven、Subsidy Claim、Two...

The final post of the GaianSpace CTF 2026 “05-rad-hard-rampage” series. 🌐 中文版：繁體中文 This chapter has four radiation faults; the first three posts covered Single Event Upset (SEU), Single Event Latch-up (SEL), and Total Ionizing Dose (TID). This one wraps up with the fourth: Displacement Damage (DDD): not a single high-energy particle strike, nor burning out the circuit, but the lattice being knocked askew hit after hit, so the readings slowly creep and slowly drift. And this challenge has ...

Third post of the GaianSpace CTF 2026 “05-rad-hard-rampage” series. 🌐 中文版：繁體中文 The first two posts (SEU, SEL) were both single-event effects: one particle, one bit, one instant. This one is a cumulative effect: not a single hit, but months of radiation dose slowly wrecking the transistors. The failure model shifts from “data got changed” to “the logic itself is broken,” so the approach is completely different. Other post in the series: Sensor Drift / Degradift What the challenge i...

Second post of the GaianSpace CTF 2026 “05-rad-hard-rampage” series. 🌐 中文版：繁體中文 The previous post, Cosmic Bit Blunder, was about a Single Event Upset (SEU): one bit knocked over, either 0↔1. This one is similar, but the failure mechanism is a bit different: a Single Event Latch-up (SEL), where a bit gets forced high and stuck there. The distinction is subtle, yet it’s enough to cut the search space in half again. Other posts in the series: A Logic Gate Shorted by Radiation / Ionized ...