WaveForgem

PDL Consulting · Blind RF Datalink Exposure

From an unknown IQ capture to readable bits — a 7-layer blind exposure pipeline for any RF datalink.

Sense → estimate → demodulate → frame → descramble → decode → recover. Operator-level capability to take a blind RF signal and walk it down to plaintext on weak or homebrew protocols. Honest about the ceiling: AES-GCM, ChaCha, TLS 1.3 require the key.

Pipeline

Stage-gated path from blind IQ to bits. L0–L1 shipped, L2–L7 queued in the QPU backlog as Q-21..Q-27.

L0 — Scanner

shipped

Welch PSD + CFAR + kurtosis + cyclostationary. l0_scanner.py

L1 — Estimator

shipped

CF centroid, BW, symbol rate, SNR, Swami–Sadler C20–C63, OFDM autocorr. l1_estimator.py

L2 — Demodulator

queued · Q-21

CMA equalizer + QAOA constellation decision handoff.

L3 — Framer

queued · Q-22

Preamble correlator + sync-word search + frame boundary discovery.

L4 — Descrambler

queued · Q-23

Shor-seeded Berlekamp–Massey LFSR recovery cascade.

L5 — FEC Decoder

queued · Q-24

Reed–Solomon, BCH, convolutional, turbo, LDPC trial decode.

L6 — Plaintext Recovery

queued · Q-26

Cipher fingerprinting, n-gram entropy, weak-key trial.

L7 — Semantic Decode

queued · Q-27

Protocol-zoo classifier, structured field extraction.

How to use

from waveforge_radar.expose import expose_pipeline

# any IQ capture, any sample rate
report = expose_pipeline.run(iq, fs=samp_rate)

# structured candidate + parameter report
print(report.summary())

Hooks into the wider PDL stack: S-04 MPS denoise, S-01 QSVM modclass, Q-12 Q-Born anomaly, Q-17 QCPD. Output feeds the OpenForge C2 SIGINT layer for operator display.