ExpressLRS

  1. Home
  2. Wiki

ExpressLRS
Developer(s)ExpressLRS LLC and Community[1]
Initial release2018; 7 years ago (2018)
Stable release
3.6.0 / 5 September 2025; 28 days ago (2025-09-05)
Repositorygithub.com/ExpressLRS
Written inC++, Python
Operating systemCross-platform
LicenseGPLv3
Websiteexpresslrs.org

ExpressLRS is an open-source radio control link protocol for long range and low latency communication. It is used primarily in drones and aircraft. ExpressLRS uses LoRa, and FSK modulations on Semtech RF transceivers using an ESP32 or ESP8266 microcontroller. Since its release in 2018, ExpressLRS has been adopted in the FPV community for both hobbyist and commercial applications.[2] It supports packet rates up to 1000 Hz on the 2.4 GHz frequency band and up to 1000 Hz on the 915/868 MHz bands[3] while less frequent update rate settings enable ranges in excess of 100 km.[4]

Overview

[edit]

ExpressLRS is noted for its use of LoRa modulation combined with short packet sizes, allowing for very low latency and the ability to maintain link stability over long distances.

  • Packet rates: up to 1000 Hz on the 2.4 GHz band using FLRC, and up to 1000 Hz on the 915/868 MHz bands using FSK on LR1121 hardware[3]
  • Bandwidth: sufficient for RC channel data and telemetry, around 100bps-20kbps dependent on settings[5]
  • Telemetry support: MAVLink telemetry can be carried over ExpressLRS from Ardupilot or PX4 vehicles and displayed/controlled by ground stations such as Mission Planner and QGroundControl[6]
  • Range: >100km on both 2.4GHz and 900MHz[4]
  • Output protocols: CRSF, SBUS, MAVLink, SUMD, PWM, HoTT, SmartAudio, Tramp, and raw serial[7]
  • Supported bands: officially 2.4 GHz and 868/915 MHz ISM bands, limited support for 433MHz, and unofficial hardware/software available for other frequencies.[8]
  • Modulation schemes: LoRa for long range, FLRC and FSK for higher packet rates and lower latency.[9]
  • Frequency hopping: frequency-hopping spread spectrum (FHSS) to mitigate interference.
  • Antenna diversity: some transmitters/receivers support dual antennas with dual simultaneous transmission ("Gemini") for improved link reliability[10], including dual-band simultaneous operation in 2.4GHz and 900MHz ("GeminiX").
  • RC Channel count: Up to 16 full-resolution (10-bit) channels can be used with "Full" modes[11]

History

[edit]

ExpressLRS development began in 2018, created by hobbyists seeking to build a low-cost, low-latency control link using commodity hardware and open-source community-driven software.

Early versions of ExpressLRS focused on the 900 MHz ISM band and offered 200Hz packet rates, higher than commercially available competitors at the time. Commercial hardware was not yet available, so prospective users were required to build receivers themselves using plans from the ExpressLRS repositories[12]. By 2020, the introduction of the 2.4GHz band and readily-available low-cost commercial hardware[13] significantly increased adoption among first-person view (FPV) drone pilots, who valued the reduced retail cost and improved latency compared to proprietary systems such as TBS Crossfire and FrSky. Community contributions accelerated through 2021 and 2022, with regular firmware releases and the addition of features such as higher packet rates, full telemetry, and support for MAVLink telemetry. As of the mid-2020s, ExpressLRS has been adopted within the FPV drone community and is described by hobbyist sources as approaching a de facto standard[14].

Alleged vulnerabilities

[edit]

In 2022, a report claimed that a vulnerability in ExpressLRS could allow remote takeover of drones. Security experts dispute the description of the issue as technically inaccurate and misleading. The report claimed that the protocol used a binding phrase "encrypted" with the MD5 hashing algorithm[dubious – discuss]. It also alleged that synchronization packets exposed most of the identifier used for pairing, which attackers could reconstruct to hijack the communication link.[15]

Subject-matter experts responded that the report conflated cryptographic concepts and overstated the feasibility of a real-world attack. Security researchers note that, in real-world scenarios, simple electromagnetic jamming is a more practical and effective means of disrupting remote-control links than the protocol-level attack described, reducing the practical significance of the reported vulnerability.[16]

See also

[edit]

References

[edit]
  1. ^ "Contact Us - ExpressLRS". www.expresslrs.org. Retrieved 28 September 2025.
  2. ^ Conradie, Danie (19 January 2021). "ExpressLRS: Open Source, Low Latency, Long Range RC Protocol". Hackaday. Retrieved 26 April 2025.
  3. ^ a b "Signal Health - ExpressLRS". ExpressLRS. ExpressLRS Project. 18 September 2025. Retrieved 18 September 2025.
  4. ^ a b "Long Range Competition - ExpressLRS". ExpressLRS. Retrieved 28 September 2025.
  5. ^ "Telemetry Bandwidth - ExpressLRS". www.expresslrs.org. Retrieved 28 September 2025.
  6. ^ "Receiver Serial Protocols - ExpressLRS". www.expresslrs.org. Retrieved 28 September 2025.
  7. ^ "User Defines - ExpressLRS". www.expresslrs.org. Retrieved 28 September 2025.
  8. ^ "The ExpressLRS Lua Script - ExpressLRS". www.expresslrs.org. Retrieved 28 September 2025.
  9. ^ "Gemini - ExpressLRS". www.expresslrs.org. Retrieved 28 September 2025.
  10. ^ "Switch Configs - ExpressLRS". www.expresslrs.org. Retrieved 28 September 2025.
  11. ^ "ExpressLRS/ExpressLRS-Hardware". ExpressLRS. 27 September 2025.
  12. ^ "A Complete Guide to Flashing and Setting Up ExpressLRS". Oscar Liang. 6 March 2024.
  13. ^ "ExpressLRS vs Crossfire: Which Radio Link is Best?". Oscar Liang. 15 March 2021.
  14. ^ "Hack Allows Drone Takeover Via 'ExpressLRS' Protocol". threatpost.com. 7 July 2022. Retrieved 26 April 2025.
  15. ^ "A Review on Cybersecurity Vulnerabilities for Urban Air Mobility" (PDF). Retrieved 28 September 2025.