Dolos Device

There are many ways which this device can be utilized besides its false emitter intent; including: retransmission, jammer, and DF kit. Utilizing a Raspberry Pi and some knowledge in coding, the possibilities are only limited by your imagination. In this configuration, the device and attached devices are unclassified and therefore pose a lower security risk if compromised. It is not recommended that this device hold any information that could be exploited if compromised. Full disk encryption could be used but it would only serve to protect the data at rest and would require the device be unlocked prior to any script execution (the device would not be fully functional when power is applied). Less complexity in design and program configuration allows anyone at the end user level to emplace the device.

The following is the parts list for the device.

Core

Cellular & timing

Radio & emitter

Power, enclosure & consumables

Estimated cost

Approximate 2026 prices in USD, before shipping and tax. The Sixfab line is the LTE-M Cellular IoT Kit (Base HAT, Telit modem, antenna, and SIM together).

• Soldering Iron and associated kit
• Wire strippers
• Precision screwdriver set (attaching boards together and wires to terminals)
• Shrink tubing
• 22 AWG wire (various colors)
• USB to micro USB cables (quantity will vary per components used)
• Multimeter

The BFoxCon ships assembled and pre-wired to the radio: the G/R/P/T pads are already wired to a 2-pin SP/MIC plug, and the +/− to a power lead for the BL-5L extended battery. You don't solder these. Mount the BFoxCon on the radio's back, plug the SP/MIC into the UV-5R, and plug the power lead into the BL-5L battery's charge jack.

Factory wiring (reference)

This is where the Pi takes control. The Pi connects to the BFoxCon's J2 serial header (the 1×4 header by RST) — nothing else. Wire the four J2 pins to the Pi's 40-pin GPIO header:

Two facts from the manual shape the control: configuration only works in the first three seconds after the BFoxCon powers up, and on a serial cable it will not run until it gets the first serial command. So the Pi powers the BFoxCon through J2 pin 3 — switched by a GPIO and a small MOSFET — and on each power-up sends the config and start command over UART inside that window. Power and serial, both through J2.

On the assembled build the BFoxCon is already wired, so the only soldering is the Pi's GPIO header — the Pi Zero 2 W ships with bare GPIO pads.

• Solder a 2×20 stacking header to the Pi: seat it square, tack two opposite corners, check it sits flat, then solder all 40 pins.
• Use a stacking (extended) header so the LTE Base HAT can seat and the UART pins (8 and 10) stay reachable for the J2 link.
• Solder to clean, tinned pads; keep the iron on each pin about a second.

Mount the Raspberry Pi, power module, radio interface, and associated plugs and accessories in the waterproof case you intend to use. Set it in a way that prides easy access to any power switches and ports for recharging the battery, also set it in a way to prevent the insides from shifting about during deployment and potentially breaking connections. Antennas should be mounted externally and oriented to allow efficient and correct wave propagation. It is advised to test connectivity and functionality of the device prior to mounting inside the case. It is also advised to utilize an onboard time retention module or GPS timing module if it is your intent to utilize the device for “on time” effects.

The finished device is triggered and controlled three ways. Each path can start, stop, and reconfigure the emitter; the two data paths also run commands on the Pi.

A fleet, and sensors

These deploy as a fleet. Build several, emplace them across an area, and a team hunts them like live SIGINT targets. Each Pi joins the mesh under its own hostname (dolos-1, dolos-2, …), so you command any node from one place.

The Pi has spare GPIO once the Base HAT and the J2 link are wired. Attach sensors — motion, door, vibration — and the dolos tool reads them and reports over the mesh. A sensor event can also trigger the emitter, so a node fires when something trips it.

Raspberry Pi OS Lite (64-bit), Bookworm, flashed with Raspberry Pi Imager 2.0. The wizard sets everything for a headless first boot.

1. Choose Device: Raspberry Pi Zero 2 W.
2. Choose OS: Raspberry Pi OS Lite (64-bit).
3. Choose Storage: the microSD.
4. OS customization: hostname dolos; username user; enable SSH with your public key; set Wi-Fi for first boot; set locale.
5. Write, boot, then ssh [email protected] and sudo apt update && sudo apt full-upgrade -y.

Bookworm uses NetworkManager. hostapd and dnsmasq are not used and will conflict if installed. One command stands up the AP on the onboard radio.

nmcli device wifi hotspot ifname wlan0 ssid dolos password CHANGEME
nmcli connection modify Hotspot connection.autoconnect yes ipv4.method shared

The Telit ME910C1 on the Base HAT connects to the Pi by USB. On Bookworm, ModemManager manages the modem and NetworkManager brings up the connection — no ttyS0, minicom, or PPP scripts.

1. Insert the SIM, connect the LTE/GNSS antenna, and seat the Base HAT; run the 90° micro-USB lead to the Pi's USB port.
2. Confirm the modem is seen: mmcli -L.
3. Create the connection: nmcli con add type gsm ifname '*' con-name dolos-lte apn YOUR_APN connection.autoconnect yes.
4. Verify: mmcli -m 0 and ip addr show wwan0.

rc.local is removed in Bookworm. NetworkManager autostarts the AP and the cellular link; run any orchestration script as a systemd service.

# /etc/systemd/system/dolos.service
[Unit]
Description=Dolos orchestration
After=network-online.target
Wants=network-online.target

[Service]
ExecStart=/home/user/dolos.sh
Restart=always

[Install]
WantedBy=multi-user.target

sudo systemctl enable --now dolos.service
journalctl -u dolos -f

The network services (access point, LTE-M, mesh) run from config and autostart. One thin Python tool, dolos, is the control surface; run it over SSH from the Wi-Fi AP or the mesh.

BFoxCon link

A Pi GPIO drives a MOSFET on the BFoxCon + line to power-cycle it; the Pi UART (GPIO14/15, reached through the stacking header — the Base HAT leaves UART disconnected) talks to J2 (pin 2 Serial-In, pin 4 Serial-Out, pin 1 GND). Config is accepted only in the first three seconds after power-up, so set power-cycles, then writes.

Skeleton

#!/usr/bin/env python3
# dolos — Dolos control tool. Run over SSH (Wi-Fi or the mesh).
import argparse, subprocess, time, serial
import RPi.GPIO as GPIO

FOX_PWR = 17                          # GPIO -> MOSFET on the BFoxCon + line
PORT, BAUD = "/dev/serial0", 115200   # baud/framing: confirm against the BFoxCon

def power(on):
    GPIO.setmode(GPIO.BCM); GPIO.setup(FOX_PWR, GPIO.OUT); GPIO.output(FOX_PWR, on)

def fox_set(callsign, loop_min):
    power(False); time.sleep(1); power(True)      # power-cycle for the 3 s config window
    with serial.Serial(PORT, BAUD, timeout=1) as s:
        s.write(b"***\r")                         # enter config (MicroFox family)
        s.write(f"C1 {callsign} #\r".encode())    # Morse ID  (encoding: confirm vs MFConfig)
        s.write(f"A3{loop_min:02d}00\r".encode()) # loop time mm:ss

def status():
    print(subprocess.getoutput("mmcli -m 0 | grep -i state"))   # LTE link
    print(subprocess.getoutput("tailscale status | head -1"))   # mesh
    # add: GNSS fix, PiSugar battery over I2C

p = argparse.ArgumentParser(prog="dolos")
sub = p.add_subparsers(dest="cmd")
sub.add_parser("status")
f = sub.add_parser("fox"); f.add_argument("action", choices=["start","stop","set"])
f.add_argument("--id"); f.add_argument("--loop", type=int, default=10)
a = p.parse_args()
if a.cmd == "status": status()
elif a.cmd == "fox":
    if a.action == "start": power(True)
    elif a.action == "stop": power(False)
    elif a.action == "set": fox_set(a.id, a.loop)

The three trigger paths converge on the Pi and the BFoxCon. The 2018 IFTTT and Dropbox callback is gone; the mesh VPN reaches the Pi directly.

Over the air (radio)

Send DTMF to the radio: 1 start, 2 toggle, 3 stop, D lock. The A/B/C codes reconfigure tones, timing, and the Morse ID. No Pi needed.

Over Wi-Fi or cellular (shell)

Join the Pi to your mesh, then SSH to it from anywhere — no public IP or port forwarding, which is what makes it work behind carrier NAT.

curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --login-server https://YOUR_HEADSCALE
# then from any node on the mesh:
ssh user@dolos

From the shell, run any command, swap audio and configs, or drive the BFoxCon over its J2 serial within the three-second post-power-up window.

Bring it up in layers and test each before adding the next, so a failure points at one layer.

1. Pi base — flash Bookworm Lite, boot headless, SSH in, update.
2. Networking — stand up the Wi-Fi AP and the LTE-M link, then join the mesh. Confirm you can SSH the Pi over Wi-Fi and over cellular.
3. Radio, standalone — power the BFoxCon off the BL-5L, set the UV-5R to a ham frequency, set your callsign as the Morse ID; confirm it transmits the loop and IDs, listening on another radio.
4. Serial protocol — with a USB-TTL adapter and the byonics.com/mfconfig tool, read and write the BFoxCon to capture its baud and command bytes.
5. Pi UART — set enable_uart=1, free the serial console, loopback-test /dev/serial0.
6. Wire J2 to the Pi (TX/RX/GND + the switched power line); confirm the Pi power-cycles the BFoxCon and reads its version back over serial.
7. End-to-end — from a node on the mesh, SSH to the Pi over cellular and run dolos to set the ID, then start and stop the emitter; confirm RF on another radio.

Power budget

Emplaced runtime is battery capacity divided by average draw. The Pi Zero 2 W idles near 0.4 W and the LTE-M link is low-power; the radio's transmit duty cycle is what drains the pack, so the BFoxCon's off-air delays and a low duty cycle buy runtime. Pick a target runtime, size one main battery, and for indefinite emplacement add a small solar panel and charge controller.

Permanent wiring

Solder the J2 link; a friction-fit plug works loose in an emplaced box. The BFoxCon's own config cable is the easy way: cut off the USB end (the converter), ohm out the four TTL leads, and solder them to the Pi — Serial-In to TX (pin 8), Serial-Out to RX (pin 10), GND to pin 6, +V to the Pi's switched 3.3 V line. Power the BFoxCon from the Pi only, not also the BL-5L.

Case

A custom 3D-printed enclosure holds the stack on M2.5 standoffs, mounts the antennas outside (LTE/GNSS and the radio's), and seals to weather with one access/charge port.

Fleet

Build several, give each a unique hostname, and join them all to the mesh. Spread them across the area for a realistic hunt, and command any node from one console.

47 CFR §97.119: the station must transmit its callsign at the end of each transmission and at least every ten minutes. An automatic CW identifier must not exceed 20 WPM.

• EW Dolos Device Build Guide, EW Community, September 26, 2018 (Light Fighter Library: Communicate / EW-SIGINT).
• 2026 hardware: Sixfab LTE-M Cellular IoT Kit — https://sixfab.com/product/raspberry-pi-cellular-iot-kit-lte-m/
• 2026 hardware: Sixfab 3G–4G/LTE Base HAT pinout — https://docs.sixfab.com/docs/raspberry-pi-3g-4g-lte-base-hat-technical-details
• 2026 hardware: PiSugar 3 (Raspberry Pi Zero UPS, pogo-pin, RTC) — https://docs.pisugar.com/docs/product-wiki/battery/pisugar3/pisugar-3-series
• 2G/3G sunset (justifies the LTE-M move): FCC 3G phase-out — https://www.fcc.gov/consumers/guides/plan-ahead-phase-out-3g-cellular-networks-and-service ; T-Mobile 2G retirement 2026-08-03 — https://www.t-mobile.com/support/coverage/t-mobile-network-evolution
• https://beebom.com/how-to-run-commands-on-raspberry-pi-by-email/
• https://raspberrypi.stackexchange.com/questions/42753/how-to-use-pi-to-remote-control-a-cell-phone-in-another-country
• https://www.rtl-sdr.com/building-your-own-cell-phone-network-with-a-raspberry-pi-and-bladerf/
• https://mbro95.github.io/PortableCellNetwork/
• https://hristoborisov.com/index.php/projects/turning-the-raspberry-pi-into-a-sms-center-using-python/
• https://pinout.xyz/
• http://www.raspberry-projects.com/pi/command-line/io-pins-command-line/io-pin-control-from-the-command-line
• https://www.raspberrypi.org/products/raspberry-pi-3-model-b-plus/
• https://www.raspberrypi.org/downloads/raspbian/
• https://www.raspberrypi.org/documentation/raspbian/
• https://sixfab.com/product/gsmgprs-shield/
• https://sixfab.com/product/mini-gsm-antenna-1-5dbi/
• https://sixfab.com/product/sma-to-u-fl-rf-adapter-cable-120mm/
• https://www.raspberrypi.org/documentation/configuration/wireless/access-point.md
• Raspberry Pi OS Bookworm Wi-Fi access point with NetworkManager — https://raspberrytips.com/access-point-setup-raspberry-pi/
• Sixfab Base HAT + Telit module setup — https://docs.sixfab.com/docs/getting-started-with-base-hat-and-telit-le910c1-module
• Run a program at boot on Bookworm (systemd) — https://raspberry.tips/en/raspberrypi-einsteiger/raspberry-pi-autostart-setup
• Raspberry Pi behind CG-NAT via Tailscale/Headscale — https://www.jeffgeerling.com/blog/2022/ssh-and-http-raspberry-pi-behind-cg-nat/
• Station identification, 47 CFR §97.119 — https://www.law.cornell.edu/cfr/text/47/97.119
• Byonics BFoxCon Manual v0.4 — https://byonics.com/downloads/BFoxCon_Manual_v0.4.pdf