FlatSat

---

Welcome to FlatSat

FlatSat is a hardware-based training platform designed to be vulnerable on purpose. It is built for hackers, engineers, and space enthusiasts who want to dive deep into space-grade systems, learn cybersecurity concepts, and prototype their own payloads in a safe, controlled environment.

The project simulates critical real-world satellite subsystems, orbital telemetry, and authentic aerospace communication protocols, serving as a bridge between hardware hacking and aerospace security research.

---

What You Can Do With FlatSat

• Hands-on Learning: Use FlatSat as the hardware companion to your aerospace cybersecurity studies, featuring lessons on binary exploitation, secure communication, reverse engineering, and space protocols.
• Hack Real Vulnerabilities: Explore and exploit firmware designed to simulate historical or realistic software failures in orbiting infrastructure.
• Join Space CTFs: Participate in space-themed Capture The Flag challenges that simulate real satellite operation scenarios, turning your board into your own spacecraft.
• Prototype Your Payloads: Use the onboard components to develop and test your own payload logic, radio communication, or telemetry systems before deploying larger projects.

---

Hardware Overview

FlatSat's physical architecture layout is fully accessible and designed for open hardware auditing:

• On-Board Computer (OBC): Powered by the dual-core Raspberry Pi RP2040 microcontroller.
• Dual RF Link Subsystem: Equipped with two independent Semtech SX1262 sub-GHz LoRa modules dedicated to Uplink (receive) and Downlink (transmit) configurations.
• Onboard Sensors: Features a BME280 environmental sensor and a LIS2DH12 3-axis accelerometer to emulate real spatial telemetry.
• Exposed Auditing Interfaces: Physical header connector breakouts for direct bus monitoring via UART, I2C, and SWD debug lines.

RF Compliance Note: FlatSat operates exclusively within standard license-free ISM bands (typically 433 MHz or 915 MHz depending on your region). This ensures a legal, safe educational ecosystem that does not interfere with production space systems or critical ground infrastructure.

---

Firmware & Attacks

• Firmware/: The vulnerable-by-design firmware source, a pre-built .uf2 ready to flash (Firmware/build/), and platformio.ini to build it yourself. See Firmware/README.md for the full diff against the public baseline.
• Attacks/: Eight attack scripts (00–07) exploiting the vulnerabilities above, each in an RF variant (HackRF/RTL-SDR) and a USB variant. See Attacks/README.md for what's here, and the wiki (below) for the full step-by-step walkthrough of each one.

---

Technical Documentation and Guides (Wiki)

All deep technical documentation, source analysis, and setup guides have been centralized. If you want to start compiling, debugging, or exploiting the platform, please visit the FlatSat Wiki:

• 01. Quick Start Guide: Toolchain setup, compiling the firmware, flashing the RP2040, and verifying hardware operations.
• 02. Hardware Anatomy: Physical layout, schematics, pinouts, and hardware debugging ports.
• 03. Core Firmware Architecture: Deep dive into the Asymmetric Multiprocessing (AMP) architecture dividing tasks across Core 0 and Core 1.
• 04. Space Packet Protocol (CCSDS): Aerospace framing standards, packet encapsulation structure, and the active APID registry.
• 05. Offensive Attack Vectors: The security playground. Explaining packet fuzzing, telecommand spoofing, buffer overflows, and unauthorized subsystem manipulation.
• 06. Attack Walkthroughs (00–07): Step-by-step: prerequisites, the exact command, and how to confirm each of the 8 validated attacks worked against real hardware.

---

Collaboration and Community

This project is an open-source initiative maintained by PWNSAT and Electronic Cats. Contributions are highly welcome.

Disclaimer

This project was created for educational purposes, to teach and learn aerospace cybersecurity. Neither PWNSAT nor Electronic Cats are responsible for how the knowledge, code, or tools hosted in this repository are used. Use only against hardware, firmware, or signal sources you own or are explicitly authorized to test.

License

Electronic Cats invests time and resources providing this open source design, please support Electronic Cats and open-source hardware by purchasing products from Electronic Cats!

Designed by PWNSAT and Electronic Cats.

Hardware released under an CERN Open Hardware Licence v1.2. See the LICENSE_HARDWARE file for more information. Firmware and attack scripts are released under GPL-2.0-or-later — see LICENSE_FIRMWARE and Attacks/LICENSE.

PWNSAT and Electronic Cats are a registered trademark, please do not use if you sell these PCBs.

Special Thanks

A special thanks to Alex Lynd. His support made it possible to kick off the first version of the project, and his contribution remains a fundamental part of PWNSAT. His work will always be embedded in what this project has become.