FlatSat Overview

FlatSat is a small board built as a satellite payload, not as a development board. It is designed to be mounted, powered, and operated the way a real spacecraft subsystem would be, with its antennas, its sensors, and its radio link exposed through a small connector set.

Features a dual-core ARM Raspberry Pi RP2040 microcontroller and a pair of SX1262 LoRa radios. Other components are two SMA antenna connectors, four tactile buttons, and a NeoPixel.

The board is laid out for "flat-sat" testing: components are exposed, labeled, and easy to audit, so the whole spacecraft bus is accessible for learning and security testing. FlatSat exposes a 6-pin header and a 4-pin SWD header for connecting external peripherals, a logic analyzer, or a debug probe.

FlatSat and its different modules

FlatSat features different modules that can take advantage of them to achieve environmental reads when flying high and send them back to the ground.

Along with the FlatSat Ground Station CLI, you can control and hack your own FlatSat via a web dashboard or the CLI.

RP2040

The RP2040 is the brain of the board, a dual-core ARM Cortex-M0+ microcontroller that runs the FlatSat firmware. The firmware splits its tasks between the two cores so that a fast data link never delays a time-critical radio operation.

The RP2040 drives both radios, both sensors, the status LED, and the buttons, and it is the only part of the board that talks to your computer.

It operates using an Asymmetric Multiprocessing (AMP) approach where tasks are split across two cores:

• Core 0: Manages the physical radio interfaces (uplink/downlink), sensor data acquisition, and the primary telemetry state machine.
• Core 1: Dedicated to the TinyUSB stack, handling the usbCDC interface to provide a high-speed command-and-control link for the On-Board Computer (OBC) or ground station simulation.

[!Note] The OBC Data Link on Core 1 is used in case you don't have access to a Software Defined Radio (SDR) device to collect and send packets.

SX1262

FlatSat carries two SX1262 transceivers, sub-GHz LoRa radio chips, so that one board can both send and receive on an experimental link; both are configured independently, and each one has its own SMA antenna connector.

• Radio 0 (Uplink): Assigned to NSS Pin 17. It processes incoming over-the-air packets.
• Radio 1 (Downlink): Assigned to NSS Pin 5. It handles outgoing over-the-air packet transmission.

The SX1262 sub-GHz radio transceivers are ideal for long-range wireless applications. The device is designed for long battery life with just 4.2 mA of active receive current consumption. The SX1262 can transmit up to +22 dBm with highly efficient integrated power amplifiers.

FlatSat uses ISM (Industrial, Scientific, and Medical) band frequencies for all RF communication—typically 433 MHz or 915 MHz, depending on your region. These frequencies are internationally reserved for unlicensed, experimental, and educational use.

To ensure that FlatSat does not interfere with any production space systems, licensed satellites, or critical ground infrastructure, the hardware does not use sensitive or restricted space communication bands such as:

• ❌ X-band
• ❌ Ka-band
• ❌ S-band

On-board sensors

The platform integrates physical sensors on a shared I2C bus using pins SDA 20 and SCL 21.

BME280

The BME280 is a combined digital humidity, pressure, and temperature sensor based on proven sensing principles. Its small dimensions and its low-power consumption allow the implementation in battery-driven devices such as handsets, GPS modules, or watches. The BME280 achieves high performance in all applications requiring humidity and pressure measurement.

Used for collecting telemetry data (temperature, barometric pressure, and relative humidity parameters).

LIS2DH12

The LIS2DH is a three-axis accelerometer. It measures acceleration, so it tells you how the board is tilted, whether it is moving, and, on a desk, mostly that it is sitting still. It is connected to the I2C bus, and its interrupt line is connected to the microcontroller.

The self-test capability allows the user to check the functionality of the sensor in the final application.

Exposed Interfaces

For hardware hacking foundations and educational auditing, the board layout leaves critical communication lines exposed. The following interfaces are directly accessible on the board:

• USB-C: the main command-and-control link. The firmware exposes a TinyUSB CDC stack with multiple endpoints, so the board appears as a set of serial ports on your computer.
• I2C: Connects the RP2040 to the LIS2DH12 and BME280 sensors (SDA 20, SCL 21).
• UART: Exposed serial interface for system data and logs.
• SWD: Serial Wire Debug interface connected directly to the RP2040 for hardware-level access.

Indicators and Controls

The hardware includes a WS2812B NeoPixel LED mapped to GPIO 15. It provides real-time feedback for field operations without requiring a serial monitor. The physical patterns and meanings are:

• White (Single Blink): Successful Downlink Transmission.
• Blue (Single Blink): Successful Uplink Reception.
• Yellow (8 Blinks): SPP Unpacking/Parsing Error.
• Red (8 Blinks): Hardware Interface / Radio Failure.
• Red/Yellow (Alternating): System Reboot Initiated (triggered by a software watchdog reboot via the reset telecommand or safety loops).

Along with the NeoPixel, the FlatSat comes with 4 tactile buttons:

• BOOT: Forces the RP2040 into USB bootloader (BOOTSEL) mode.
• REST: Hardware reset.
• Button1: User-controllable input.
• Button2: User-controllable input.

Power

FlatSat is powered only from the USB-C port. The 5 V coming from the USB connection passes through a 0.75 A fuse and a TLV75733 regulator, which provides the 3.3 V rail used by the microcontroller, both radios, the sensors, the status LED, and the headers. The RP2040 generates its own 1.2 V core voltage internally.

Background

What is the CCSDS Space Packet Protocol?

The CCSDS Space Packet Protocol is the packet format that real spacecraft use to move data between subsystems. Instead of addressing a device by a port number, each packet carries a header with an Application Process Identifier, an APID: a number that says which subsystem the packet belongs to, such as telemetry, power, or a diagnostic service.

Every packet also identifies the spacecraft that sent it with a spacecraft ID, carries a sequence counter so the receiver can detect gaps and reordering, and ends with a CRC-16-CCITT checksum so the receiver can detect corruption. FlatSat uses spacecraft ID 0x02 and telemetry APIDs that include a heartbeat, the environment sensor, the accelerometer, the power subsystem, and the idle packet.

What is Space Data Link Security?

Space Data Link Security is the layer that sits between the packet format and the radio, and it is what the training levels of FlatSat turn up and down. At level 1, payloads travel in cleartext. At level 2 they are protected with a simple XOR transformation. At level 3 they are encrypted with AES-128 in counter mode, using an initialization vector derived from the mission elapsed time. Each level also changes the session protection of the web dashboard, from a cleartext session to HMAC-SHA256 signatures.

Why the board has no authentication

The firmware deliberately has no cryptographic authentication layer, which makes it vulnerable to command spoofing: whoever can reach the radio can send a command that looks legitimate. Capturing one telemetry packet is enough to learn the spacecraft ID and the sequence counter that a valid command needs. The product documentation compares this risk to the ROSAT satellite, whose batteries were damaged in 1998 after its ground station was compromised.

[!IMPORTANT] The vulnerabilities are simulated for training, but the radio link is real and it transmits over the air. Work inside the ISM bands that your country reserves for unlicensed and experimental use, and only against equipment you own or are authorized to test.