thomasbuilds/Spectre

What it is

Spectre is an open-source Android app (minimum Android 12 / API 31) for observing and interacting with nearby wireless signals — Bluetooth LE, Wi-Fi, cellular, GNSS — with pentesting tools (GATT inspector, iBeacon broadcast, local-network host discovery). The summary already lists the features; what it can't carry is the set of hard platform limits that determine whether the readings mean what you think, plus an install-time verification step.

How it works (the measurement caveats that matter)

The single "RF exposure" dBm figure is a reconstruction, not a raw reading. Modems report a per-reference-element power (RSRP on 4G/5G, RSCP on 3G), not whole-channel power, so Spectre rebuilds a wideband estimate per network type: LTE uses the modem's RSSI or a bandwidth-derived offset; NR (5G) uses a fixed offset because Android exposes no NR channel bandwidth; WCDMA derives from Ec/No; GSM is already total power. It then converts each emitter to linear milliwatts, sums, and converts back — so the total is dominated by the strongest emitter, which is physically correct. Result is "usually within a few dB."

Preconditions / limits that break assumptions

• 5G NSA is invisible. On non-standalone 5G the phone rides a 4G anchor cell; Android exposes only the anchor. A "5G NSA" strength reading is the anchor's, not the 5G carrier. Only standalone 5G (SA) returns a real 5G reading. Cannot be worked around.
• Only your carrier's cells appear. The modem decodes only your SIM's network and roaming partners; other carriers never show. Dual-SIM phones need both SIMs active — Spectre monitors every active subscription because Android's telephony API defaults to one.
• Wi-Fi scan throttling. Android caps an app to ~4 scans per 2 minutes. Spectre paces to ~1 scan / 30s while throttled, faster once throttling is disabled in Developer options, and also consumes system-initiated scan results.
• Distance is estimated. True ranging only where hardware supports it (Wi-Fi 802.11mc FTM, cellular timing advance); otherwise a path-loss model calibrated from iBeacon measured-power. Every estimate is labeled with its confidence.

What to do

Before installing, verify the APK's signing certificate against the CERT.sha256 fingerprint. The app has no ads, trackers, or analytics; granted permissions drive the scanners only. To lift Wi-Fi scan throttling for faster refresh, disable it in Developer options.

Caveats

All figures are approximations the app discloses in-app: the "few dB" accuracy claim, the fixed-offset NR estimate, and the confidence-labeled distances are the author's own stated limits, not independently verified here.