TLF: Rapid Characterization of RF Transceiver Parameters in Embedded Systems via Bus-Level Interception
We present TLF (Transceiver Lifter Framework), a tool for recovering RF transceiver configuration and runtime behavior from bus-level traces captured between a microcontroller and its transceiver IC. A stateful protocol decoder, built against the transceiver's register and data interface, reconstructs operating RF parameters and behavior from intercepted register writes and FIFO transfers. For bus-attached transceivers whose hardware-cryptography keys are loaded through the intercepted host interface, key material is also recoverable. Where the firmware drives frequency hopping -- either through a hardware-assisted engine or a custom schedule -- the decoder extracts the channel table, hop sequence, and timing. We evaluate the approach on two targets from different Semtech families: an SX1233-based UAV C2 modem employing firmware-level FHSS with per-packet sync word rotation, and an SX1276-based Meshtastic node exercising the LoRa register overlay. From a single bus capture, processed in seconds, TLF recovers the complete register-exposed RF configuration (modulation, band plan, phase behavior) without prior knowledge of the target firmware -- sufficient to configure a matched receiver or develop targeted countermeasures. Above the chip layer, a pluggable protocol decoder interprets recovered FIFO payloads as application PDUs, demonstrated end-to-end on Meshtastic. Firmware-level cryptographic state remains, as expected, opaque. The approach requires physical access or emulation of the target hardware, and its recovery depth is bounded by the transceiver's register interface: parameters implemented entirely in firmware (custom FEC, whitening, encryption) are observable only as opaque FIFO payloads.