
I just received a very exciting upgrade for my HackRF One. It is called the PortaPack H2. It essentially gives your HackRF a rechargeable battery, a display and many new capabilities that are a part of the Havoc firmware.
This setup will basically take my HackRF’s capabilities completely mobile opening it up to places and locations to explore that aren’t easy/possible without a setup like this.
Today I wanted to build the new PortaPack H2 and show all the steps I took. Let’s begin!
Hardware Used

The HackRF is a software defined radio (SDR) receiver and transmitter with a range of 1MHz all the way to 6GHz. With the use of software like CubicSDR, SDR# or GNU Radio you can decode and listen to / view almost any signal (including the International Space Station)!
Links: Amazon.com*, AliExpress.com*, Amazon.com.au*, Amazon.co.jp*, Amazon.co.uk*, Amazon.de*, Amazon.es*, Amazon.fr*, Amazon.it*, Amazon.nl*, Amazon.pl*, Amazon.se*, Amazon.sg*

The PortaPack H2 upgrade kit will take your HackRF completely mobile. With a rechargeable battery, a touchscreen and tons of new features from the Havoc firmware it’s a major upgrade to the HackRF!
Links: Amazon.com*, AliExpress.com*, Amazon.ca*, Amazon.com.au*, Amazon.co.jp*, Amazon.co.uk*, Amazon.de*, Amazon.es*, Amazon.fr*, Amazon.it*, Amazon.nl*, Amazon.pl*, Amazon.se*
Upgrade Kit
The upgrade kit came with the following:

And here is the back of the board:

Well that looks relatively straight forward to put together. Now we just need to open the HackRF One.
Opening HackRF One
To do this you will actually remove the gold rings around the ANTENNA, CLKIN and CLKOUT ports. You can screw these off with just your fingers.
This should leave you with a nice pile of nuts and washers like this:

Now we can open the case using a simple pry tool. Something like a plastic pick works great:

Now wedge the pick in and move toward each corner and they should pop and release:

Bingo! You can now lift the board out of the HackRF One’s shell (it’s not screwed in). The black connectors on the board are where the pins from the PortaPack H2 will plug into.
Adding New Components
Now that we’ve got to the loose HackRF board you can literally see how to assemble this kit. The pins from the PortaPack board are going to plug right into the HackRF.
You need to be careful when lining up the pins. It’s easy to end up one row too far over and have a whole row of pins not actually plugged into a socket.
Once you’ve got them lined up you can gently press the boards together. Don’t push too far on one side without the other sides going in or things can get awkward. It’s best to push them in a little bit at a time and then go push on the opposite end of the board to make sure the 3 sections of pins plugging into the board go in relatively evenly.
Here is the result:

Finally I tucked the battery between the boards like this:

The boards seem to easily hold the battery in place. Now add the knob and buttons to the board.
We have now completed the physical build!
Flashing Havoc Firmware
Go to the official GitHub releases page for the Havoc firmware here.
Grab the latest available release (1.5.4 at time of writing). There are two files (mayhem_v1.5.4_FIRMWARE.zip and mayhem_v1.5.4_COPY_TO_SDCARD.zip).
Get both files although for this step we will be using the firmware file. Unzip the archive.
The next step will depend on your platform. There are scripts in there to help on platforms other than Linux. Since you are of course using Linux we will proceed with that assumption (but if you aren’t check the GitHub page which will have the documentation for your platform).
You should already have the HackRF utilities installed on your computer. We are going to use the hackrf_spiflash utility to upload the Havoc firmware to the device like this:
hackrf_spiflash -w portapack-h1_h2-mayhem.bin
A successful flash would look like this:
james@jamesgigabyte-linux:~/Downloads/mayhem_v1.5.4_FIRMWARE$ hackrf_spiflash -w portapack-h1_h2-mayhem.bin File size 954744 bytes. Checking target device compatibility Erasing SPI flash. Writing 954744 bytes at 0x000000.
Preparing SD Card
The PortaPack H2 has enhanced features that can be enabled with the use of a SD card including a world map. First insert a micro SD card into your computer and format it to be blank with the format of FAT32.
Now extract the file we got in the previous section mayhem_v1.5.4_COPY_TO_SDCARD.zip
You are going to copy the contents of this archive directly into the root of the SD card. Once it is complete you can insert the SD card into the device.
Screen Troubleshooting Note
When I first got everything set up I had no display. It’s because you need to change the display driver your device is using.
This is very easy. The way you change it is by holding down one of the buttons (from the 5 button set) and power on the device. This may take up to 10 seconds to take effect.
For my display I had to hold the left button down and then power on the device. This immediately powered on my display.
If you aren’t getting any display this is almost certainly why and it’s not very likely your display is bad/damaged.
Conclusion
The upgrade is complete! Here is a look:

Here you can see the main menus. It’s very simple to navigate. You can easily do replay attacks from the menu here, perform captures, transmit signals and much more.
Here’s an active capture going:

It is very cool to see the handheld waterfall. I do need some better handheld antennas so I’ll definitely be getting some of those and covering them here on the site. I also have a metal body kit on the way (you can see it in the AliExpress link) but that will take a few weeks to get here.
Definitely stay tuned for more coverage of the PortaPack H2 features as I have just completed the build and will be diving into those in the near future!
Other Resources
My prerequisite guide HackRF Software Defined Radio Guide for Linux
To see using the HackRF for locking/unlocking a vehicle check out my Use HackRF SDR to Lock / Unlock Car article
I did a repair to a hackrf one with portapack. The Rx LNA and the TX amp were bad. Replaced both of them but not the skyworks switch and its sensitivity and power out has been restored. I obtained limiter diodes to put at the input(sma type) that limit at 10dbm. I expect to use a filter in front of it with the limiter and hope the front end will last a long time.
The input did not have a limiter just a large resistor on the antenna terminal. Any voltage excursion would be able to blow the input of the lna through the switch. I have 2 hackrf one’s with portapack, the second one has a bad lna but transmit power is ok so next change the LNA on it.
Hey chris451,
Wow, that’s an awesome repair and modification. Sounds like you’re well on your way to getting the second one fixed as well!