Scenario - GPS Spoofing

This scenario was developed to prove that sensor level spoofing, without modifying flight software, was possible using NOS3.

This functionality allows the user to spoof GPS data on-demand and develops the layout and thought process that may be followed for spoofing other sensors. The goal of this scenario is to trick the spacecraft into entering science mode while it is not over CONUS, AK, or HI.

This scenario was last updated on 1/6/2026 and leverages the gps-sensor-spoofing branch [1bb73b1]. We currently have no plans of merging this into our production code.

Learning Goals

By the end of this scenario, you should be able to:

• Spoof data at the sensor level within the GPS hardware model.

• Understand why and how this spoofing works.

Prerequisites

• Getting Started

  • Installation

  • Running

• Scenario - Demonstration

• IMPORTANT: Checkout the gps-sensor-spoofing branch

  • May require running git submodule sync and git submodule update --init --recursive after

Walkthrough

In short, you will:

1. send MGR MGR_SET_MODE_CC with SPACECRAFT_MODE SCIENCE

2. send MGR MGR_SET_CONUS_CC with CONUS_STATUS ENABLE

3. send SIM_CMDBUS_BRIDGE NOVATEL_OEM615_SIM_TOGGLE_SPOOF with default parameters

This will enable a predefined data point to be read by the hardware model. That data point will propogate to the GPS SIM, and will be visible in telemetry (NOVATEL_OEM615 NOVATEL_OEM615_DATA_TLM).

This data point is located within the parameters for the spacecraft to enter science mode. While the spoofing is enabled, the spacecraft will continuously perform science mode operations no matter where it is in orbit, despite only being enabled for CONUS.

How to Replicate

First connect the GPS Sim to SIM_CMDBUS with the following in /cfg/sims/nos3-simulator.xml:

And then add a command_callback function and a global _spoof variable to the hardware model that can enable, disable, and spoof the GPS:

When the SIM_CMDBUS_BRIDGE NOVATEL_OEM615_SIM_TOGGLE_SPOOF command is sent, the _spoof variable is toggled. This instructs the hardware model to use the predefined data point in the Walkthrough section above.

When the GPS simulator requests data from the sensors, it will recieve the spoofed data point instead of real-time data. This method can be applied to virtually any hardware model in the NOS3 environment.

Try your own and let us know in the GitHub Discussions!