Repository navigation
Home
A hardware-based CubeSat platform for aerospace cybersecurity research and training.
PWNCUBE is developed by PWNSAT in partnership with ElectronicCats. It is a deliberate port of FlatSat's protocol, architecture, and vulnerability catalog onto real, different flight-computer hardware — a dual-core Rockchip RV1106 (Cortex-A7 running Linux + a RISC-V coprocessor running RT-Thread) — to demonstrate that the same class of satellite command-and-control vulnerabilities is not an artifact of one specific board, but reproduces faithfully across genuinely different hardware.
Modern small satellites increasingly run on commercial-off-the-shelf (COTS) hardware and standardized protocols (CCSDS Space Packet Protocol) instead of bespoke, obscure flight software. That shift trades "security by obscurity" for a much larger, much more familiar attack surface — the same one embedded and IoT security researchers already know how to exploit. PWNCUBE (and its sibling project FlatSat) exist to make that attack surface concrete, physical, and safe to practice against.
| SoC | Rockchip RV1106 — Cortex-A7 (Linux) + RISC-V SCR1 (RT-Thread), dual-core AMP |
| Radios | 2x Semtech SX1262 (LoRa), SPI, owned by the RISC-V core |
| Sensors | BME280 (temp/pressure/humidity) + ICM-42670 (6-axis IMU), I2C0 |
| GPS | Real u-blox NEO-6M receiver, UART0 |
| Protocol | CCSDS Space Packet Protocol — identical framing to FlatSat |
| Uplink | 918 MHz, LoRa SF7/BW250/CR4:5 |
| Downlink | 916 MHz, LoRa SF7/BW250/CR4:5 |
| Encryption | None by default (plaintext telemetry) |
| Command link | USB gadget console (vendor-specific bulk, VID:PID 2207:0011) — no external UART/Ethernet |
- Getting Started — build the firmware from source and flash a board, from zero.
- Hardware Anatomy — physical layout, wiring, the dual-core architecture, USB topology.
- Firmware Architecture — how the two cores split responsibilities, boot sequence, IPC.
- CCSDS / Space Packet Protocol — the command protocol itself, packet format, APID map.
- Attack Vectors — PWNCUBE inherits FlatSat's documented vulnerability catalog (30+ findings); 8 of these are built into standalone, hardware-validated attack scripts covering every major exploitation class.
- Ground Station — PWNSAT-C3, the dual-platform ground station used to operate PWNCUBE (USB + RF). Full documentation coming soon.
This repository's code lives in two top-level folders:
| Folder | What's in it |
|---|---|
Firmware/ |
The complete RV1106 SDK — clone, build, flash. |
Case/ |
3D-printable enclosure files. |
The 8 hardware-validated attack scripts (USB and real RF, fully documented, no external dependencies) live in a companion Attacks/ repository, to be published separately.
| FlatSat | PWNCUBE | |
|---|---|---|
| MCU/SoC | RP2040, bare-metal | RV1106 — Cortex-A7 (Linux) + RISC-V (RT-Thread), dual-core |
| Radios | 2x SX1262, driven directly | 2x SX1262, owned by the RISC-V core, exposed to Linux over rpmsg |
| Protocol | CCSDS SPP | Identical — same header, same bit layout |
| Payload encryption | AES-128-ECB, static key, by default | None by default (plaintext) |
| RF parameters | 918/916 MHz, SF7/BW250/CR4:5 | Identical |
| Command transport | USB CDC (real serial port to an external host) | Internal rpmsg between two cores of the same chip, bridged to a USB gadget console for external access |
| GPS | Real NEO-6M | Real NEO-6M (added later in this project's timeline) + a deliberately unauthenticated debug-injection hook |
| Ground-station auth handshake | Yes (XOR against a static key) | Yes (same XOR scheme, same finding) |
Same protocol, same bug classes, different silicon — that pairing is the point.