TLF: Rapid Characterization of RF Transceiver Parameters in Embedded Systems via Bus-Level Interception

Abstract

We present TLF (Transceiver Lifter Framework), a tool for recovering RF transceiver configuration and runtime behavior from bus-level traces captured between a microcontroller and its transceiver IC. A stateful protocol decoder, built against the transceiver's register and data interface, reconstructs operating RF parameters and behavior from intercepted register writes and FIFO transfers. For bus-attached transceivers whose hardware-cryptography keys are loaded through the intercepted host interface, key material is also recoverable. Where the firmware drives frequency hopping -- either through a hardware-assisted engine or a custom schedule -- the decoder extracts the channel table, hop sequence, and timing. We evaluate the approach on two targets from different Semtech families: an SX1233-based UAV C2 modem employing firmware-level FHSS with per-packet sync word rotation, and an SX1276-based Meshtastic node exercising the LoRa register overlay. From a single bus capture, processed in seconds, TLF recovers the complete register-exposed RF configuration (modulation, band plan, phase behavior) without prior knowledge of the target firmware -- sufficient to configure a matched receiver or develop targeted countermeasures. Above the chip layer, a pluggable protocol decoder interprets recovered FIFO payloads as application PDUs, demonstrated end-to-end on Meshtastic. Firmware-level cryptographic state remains, as expected, opaque. The approach requires physical access or emulation of the target hardware, and its recovery depth is bounded by the transceiver's register interface: parameters implemented entirely in firmware (custom FEC, whitening, encryption) are observable only as opaque FIFO payloads.

Accepted for publication in the Proceedings of the 2026 IEEE Military Communications Conference (MILCOM 2026). This is the authors' accepted version; the final published version will appear in IEEE Xplore. 9 pages, 4 figures, 4 tables