Home

🛰️ Welcome to the FlatSat Wiki

FlatSat v1.0 is the world’s first open-source, hardware platform vulnerable-by-design, engineered specifically to learn space hacking and bridge the gap between hardware exploitation and aerospace security.

It is an open-source, hardware-in-the-loop educational platform designed to simulate satellite sub-systems, space communication protocols, and orbital telemetry. Developed specifically for satellite cybersecurity training, firmware prototyping, and aerospace CTFs (Capture The Flag), FlatSat provides a hands-on, community-driven environment for discovering, exploiting, and mitigating vulnerabilities in space systems.

---

Warning

RF Compliance & Safety FlatSat operates within standard license-free ISM bands (433 MHz / 915 MHz). Users must strictly adhere to local amateur radio and telecommunications regulations regarding transmission power, duty cycles, and frequency allocation.

---

System Architecture Overview

FlatSat emulates the modular and isolated nature of real sats. It breaks away from traditional linear micro-controller setups by introducing a dual-core infrastructure combined with independent uplink and downlink radio pipelines.

Dual-Core Asymmetric Multiprocessing (AMP)

The platform is powered by a Raspberry Pi RP2040 MCU utilizing both ARM Cortex-M0+ cores independently to simulate flight software task isolation:

Dual-Radio Communications

To simulate realistic satellite ground operations, FlatSat integrates two independent Semtech SX1262 LoRa modules:

1. Radio 0 (Uplink): Assigned to listen exclusively for incoming Telecommands (TC).
2. Radio 1 (Downlink): Assigned to broadcast continuous or requested Telemetry (TM) data frames.

---

Main Features & Vulnerabilities for Research

FlatSat is intentionally structured to teach developers and security researchers about edge cases and logic vectors in embedded space systems:

• CCSDS Space Packet Protocol: Telemetry and Telecommands are encapsulated using real aerospace standard headers. You will learn to parse Application Process Identifiers (APIDs), sequence flags, and payload lengths.
• Subsystem Logic Exploitation: Interact with and manipulate exposed onboard subsystems such as:
  • Mission Control (0x00)
  • Onboard Telemetry Loop (0x08)
  • Attitude Determination and Control System (ADCS) simulation via the accelerometer.
  • Thruster/Actuator (0x04) power and state machine logic.
• Non-Blocking Infrastructure: Implements an advanced timeout_worker_t mechanism, avoiding destructive delay() calls, allowing the system to handle tasks concurrently without an RTOS overhead.

---

Note

Navigation & Documentation

Use the sidebar on the right to navigate through the deep dive technical sections:

• 01. Getting Started: Firmware Compilation & Testing: Your entry point. How to set up the toolchain, compile the source code, flash the RP2040, and run the initial telemetry "sanity check" to verify the hardware is alive.
• 02. Hardware Anatomy & Specifications: Physical layout, pinouts, exposed debugging interfaces (UART, I2C, SWD), and hardware bill of materials.
• 03. Firmware & System Architecture: Deep dive into the Asymmetric Multiprocessing (AMP) distribution, Core 0 vs Core 1 task allocation, and the non-blocking execution loop.
• 04. Space Packet Protocol (CCSDS): Aerospace communication standards, packet encapsulation structure, and the live APID routing registry.
• 05. Satellite Hacking & Attack Vectors: [THE OFFENSIVE PLAYGROUND] How to exploit the platform. Fuzzing CCSDS packets, telecommand spoofing, buffer overflows in packet lengths, unauthorized thruster manipulation, and reverse engineering firmware vulnerabilities.