0
$0.00
0

Cart

Zoom
FlatSat board with its two antennas upright at 90 degrees
FlatSat V1.0 board, top view: RP2040, USB-C port, two SMA antenna connectors and the BOOT and RST buttons
FlatSat V1.0 board at an angle, showing the USB-C port, the pin header and both SMA connectors
FlatSat V1.0 board from above: the RP2040 microcontroller flanked by its two LoRa radio chips
Back of the FlatSat V1.0 board with the Electronic Cats, PwnSat and Open Source Hardware marks
FlatSat board with its two antennas mounted, seen at an angle
FlatSat board with both antennas open in a V shape
FlatSat board with its two antennas extended flat at 180 degrees
FlatSat board with its two antennas upright at 90 degrees
FlatSat V1.0 board, top view: RP2040, USB-C port, two SMA antenna connectors and the BOOT and RST buttons
FlatSat V1.0 board at an angle, showing the USB-C port, the pin header and both SMA connectors
FlatSat V1.0 board from above: the RP2040 microcontroller flanked by its two LoRa radio chips
Back of the FlatSat V1.0 board with the Electronic Cats, PwnSat and Open Source Hardware marks
FlatSat board with its two antennas mounted, seen at an angle
FlatSat board with both antennas open in a V shape
FlatSat board with its two antennas extended flat at 180 degrees

FlatSat 1

A satellite testbed for learning space cybersecurity: a 3-level CTF on your own board, safe by design, solo or in a workshop.

$100.00

Out of stock

Email when stock available

  • CatSniffer, our LoRa sniffer (single-radio overlay)
  • RTL-SDR dongle + SDR++ for passive RF verification
  • Preloaded vulnerable firmware that mimics spacecraft
  • Ground Station on Linux, macOS and Windows

In the box

FlatSat kit
FlatSat patch (standard edition)

Not included

An SDR. The RTL-SDR dongle and sub-GHz antenna used to verify FlatSat’s LoRa telemetry over the air are sold separately.

You also need

RTL-SDR USB dongle + sub-GHz antenna, for passively verifying FlatSat’s over-the-air LoRa telemetry (not included in the kit)
SDR++ software (free, sdrpp.org), to visualize the RF spectrum and confirm the downlink signal
A second FlatSat unit + a laptop running the FlatSat Ground Station webapp, for the full CTF curriculum’s Base hardware tier and Attack/Defend workshop mode
SWD probe (e.g. a second Raspberry Pi Pico as debugger) + soldering 3 wires to the board’s SWD pads, needed only for the Advanced firmware-hacking tier
Arduino IDE + arduino-pico board package, needed only if compiling or flashing custom firmware instead of the pre-compiled UF2
  • 570 GitHub Stars
  • Presented at DEF CON 34.
  • Designed and built in Aguascalientes, Mexico
  • Hardware CERN-OHL v1.2 · firmware GPL-2.0

What is FlatSat?

FlatSat is a satellite testbed for the classroom, made by Electronic Cats in collaboration with PwnSat: a flat training board that simulates a small spacecraft, with an RP2040, two LoRa radios and sensors, so you can learn satellite and space-systems cybersecurity hands-on. It is built to be vulnerable on purpose and ships preloaded with intentionally vulnerable firmware that mimics real spacecraft systems, so you can practice binary exploitation and reverse engineering safely on hardware you own. Setup is simple: connect over USB, enter bootloader mode and drag a precompiled firmware file onto the board, with no coding or soldering required. FlatSat then guides you through a 3-level CTF (web and RF, systems and the CCSDS protocol, then firmware and crypto), with an onboard NeoPixel LED confirming each stage. It uses only license-free ISM radio bands and never touches real satellites, so training stays self-contained on your own board.

Work through a 3-level satellite CTF

Progress through three levels of challenges: Level 1 covers web interfaces and cleartext RF, Level 2 covers onboard systems and the CCSDS protocol, and Level 3 tackles firmware and cryptography. A NeoPixel LED changes color to confirm every milestone, so you always know where you stand without a serial monitor.

Confirm the downlink without touching the board

Confirm FlatSat’s simulated satellite is actually transmitting by capturing its LoRa downlink with an RTL-SDR dongle and SDR++ — no cable, no connection to the board required. It’s a genuine over-the-air signal, captured entirely within license-free ISM bands.

Run a workshop or classroom CTF lab

Teaching space-systems security to a class or a workshop group? Give each learner a FlatSat and the FlatSat Ground Station, run the three CTF levels as a self-paced Home Lab or a condensed instructor-led Workshop, and let the NeoPixel LED confirm every level cleared, so you can check progress around the room without a serial monitor.

Start in 10 minutes

  1. Connect the FlatSat board to your computer via USB.
  2. Enter bootloader mode: hold BOOT, tap RST, then release BOOT — the board mounts as a USB mass-storage drive.
  3. Download the latest flatsat-firmware.uf2 file from the FlatSat GitHub releases.
  4. Drag and drop flatsat-firmware.uf2 onto the board’s mass-storage folder; it unmounts automatically once flashing succeeds.
  5. Head to the FlatSat wiki to pick your starting CTF level and curriculum format (Home Lab or Workshop).
MCU

RP2040 (dual-core ARM Cortex-M0+)

Radio

2x SX1262 LoRa transceivers (uplink + downlink)

Environmental sensor

BME280 (pressure, humidity, temperature)

Accelerometer

LIS2DH12, 3-axis (I2C)

Status LED

WS2812B NeoPixel (GPIO 15)

Exposed interfaces

I2C, UART, SWD

Operating voltage

3.3V I/O

Dimensions

41 mm x 78 mm

Flash memory

4 MB (no filesystem partition)

RF band

433 MHz / 915 MHz (license-free ISM)

Open hardware

CERN Open Hardware Licence v1.2

What is FlatSat?
FlatSat is a hardware-based training platform for satellite and space-systems cybersecurity, built to be vulnerable on purpose for hackers, engineers and space enthusiasts. It ships preloaded with firmware that mimics real spacecraft systems, so you can practice binary exploitation and reverse engineering safely on hardware you own. You work through it via the FlatSat Ground Station, a web dashboard and CLI that runs on Linux, macOS or Windows and talks to the board over USB.
By drag and drop, no tools needed. Connect the board over USB, enter bootloader mode (hold BOOT, tap RST, release BOOT) so it mounts as a USB drive, download the latest flatsat-firmware.uf2 from the FlatSat releases on GitHub and drop it onto that drive; it unmounts by itself when flashing succeeds. If you prefer to build your own firmware, use the Arduino IDE with the arduino-pico core.
Install the FlatSat Ground Station (Python; Docker or native) and connect the board over USB: you get a web dashboard at localhost:5000 and a `flatsat` command-line tool. Then follow the wiki page ‘First time using FlatSat’. Your first mission is CTF Level 1, web and cleartext RF, and each level you clear is confirmed by the NeoPixel LED changing colour.
FlatSat is a satellite simulator built to be vulnerable on purpose, for hackers, engineers and space enthusiasts. You can work through three CTF levels (web and cleartext RF, systems and the CCSDS protocol, firmware and crypto), capture its LoRa downlink with an RTL-SDR and SDR++ without touching the board, practise RF command-and-control techniques such as spoofing, fuzzing and replay against your own unit, and prototype your own payloads.
Free shipping to the US on orders +$250 USD · to Mexico on orders +$100 USD