Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver
github.com
github.com
This development makes me hope that we'd be seeing more of these on common Wi-Fi cards, so that every random laptop could be used as an SDR for many fun and useful applications on a budget.
ESP-SDR is based on this work, and supports the C5 and a bunch more
"oh, no problem"
>tippy tappy
>brrrrrrr
The MT7996 chip is available with the banana pi R4 board, which has SFP+ (10 gigabit) so you'd have a near completely open ISM band SDR platform right there, feeding data to your server via fiber optics.
According to this TX is also possible on the ESP32-series chips, though they haven't published exactly how (I assume due they don't want to wake the FCC). But yeah the ESP32 is fairly limited in a lot of ways due to the limited processing power and IO bandwidth to stream data out of it
Like Wi-Fi chips, they don't use SDR mode during most of the normal operation. They have dedicated hardware units that do a lot of the decimation, conversion, modulation and demodulation efficiently. But the "SDR mode" is still there for things like factory calibration.
Makes me wonder how many other common MCUs and SoCs are just waiting for someone to unlock SDR in them.
TX is less "not possible" and more "this dev doesn't want to enable it" from what I gathered. Probably for "I don't want people using this to shit all over the spectrum" kinds of reasons. So you can get TX - it'll just require extra hacking.
Those hardware blocks could be useful for certain applications but most importantly for triggering captures only when there are frames to process and giving you both the frame + the sample.
So for me the perfect hack would allow both normal Wi-Fi tx/rx and triggered or continuous rx sampling.
Base stations are also SDRs by the way xD
Is the "QLink" setup they use in 5G systems now just a thin protocol running over LVDS and streaming I/Q between the transceiver and SoC DSP as digital signals?
Never actually went that far, but I did wonder if you could plug a QLink tuner chip into an FPGA to use it as a broadband SDR frontend.
The motivation for this is of course beamforming, angle of arrival, spatial streaming, etc. You connect multiple antennas with different views back to the base station.
Receive only SDRs have been cheap for a long time now.
HackRF is not as good at listening -- a bit deaf -- but does provide much larger bandwidth and obviously the low powered half duplex tx ability.
If you just want to grab random signals around and explore, get a cheap RTL.
If you really want to go back and fourth with a device, to modify data packets etc get a hackRF.
If you want to push beyond those limitations, you'll probably already know what you're shopping for next at that point.
Beware, you'll end up acquiring many different radio devices and then likely start building antennas out of scrap, buying a nanovna, and falling deeper and deeper into the magical rabbit hole!
Last time I was down this rabbit hole (when cheap RTL-SDRs were completely new), my favorite fun test was ADS-B, so let's say I wanna play around 1-1.1 GHz at first.
One day I also wanna sit down and do GPS from scratch, "by hand", so let's say I also wanna do 1.57 GHz (which I understand is becoming borderline difficult for the cheapest devices?).
Even though these devices are cheap, I'd rather avoid needlessly extra-shitty devices or my money going to copycat leeches.
Any recommendations in light of these requirements? Thanks a lot!
> HackRF is not as good at listening -- a bit deaf -- but does provide much larger bandwidth and obviously the low powered half duplex tx ability.
Yeah I know it's in a completely separate category, I just derail and start daydreaming ;-)
> Beware, you'll end up acquiring many different radio devices and then likely start building antennas out of scrap, buying a nanovna, and falling deeper and deeper into the magical rabbit hole!
Lol! I can see that danger very clearly!
This is "from scratch": https://lea.hamradio.si/~s53mv/navsats/theory.html
:)
Very, very cool link!
- You need stable clock for the processing algorithms to be happy, RTL-SDR blog dongle have 0.5ppm TCXO while who knows what crystal they use on the no-name ones
- RTL-SDR blog dongles have bias-T, and a lot of GPS patch antennas are active antenna that need power from the coax to power the LNA
[1] https://www.hfsignals.com/index.php/sbitx-v3/
[2] Recent discussion: https://news.ycombinator.com/item?id=49789228
I guess the problem with these is they are more likely to be tied/tuned for specific (wifi) frequency ranges. Although 2.4GHz gives bluetooth and zigbee in addition to wifi
Not the point but the Airhona could here is really neat. AN7581 with typical quad Cortex-A53 but then 8x RISC-V network coprocessors. Good luck figuring out how to use that though, whew! (Go Astra go.) https://www.airoha.com/products/p/NpfqGLnZiZuYUZ6N
I've been thinking how beautiful and awesome it is that SDR finally has a real jump. The QuadRF using the rpi's mipi connector was such a glorious hack! Custom ADC from parts. 80MSps. https://www.crowdsupply.com/scale-rf/quadrf
And man what a huge flying leap forward here. 320MSps! Much deeper 14b IQ precision vs 8b. The totally custom mediatek radio firmware is incredible. Such incredible possibility. Maybe someday the mimo can be useful for some of the same neat AoE / beam forming capabilities?
https://www.rtl-sdr.com/esp32-sdr-turbo-mode-throughput-impr...
Sideband on 13 CM sounds like an amazing thing to pull off.
I'd add a heat sunk 100 watt DC-5Ghz 20dB fixed attenuator, 0-110 dB switched attenuator, 5 ghz low pass filter, 7-12 Ghz local oscillator/mixer up/down converter, and it would make a small, very high performance service monitor good to 5 Ghz. 8)
So the signal path in receive mode would be:
N connector / 20 dB 100 watt pad / Switched attenuator / Low pass filter / Front End diodes / Mixer / Router board for DSP
Alternatively, there's usually a second path that skips the attenuator, with a lower maximum power level.
The reverse path would work for generating signals from DC (almost) to 5 Ghz.
Most of the older, affordable models go from almost DC to 1 Ghz. I've got an IFR 2947a, which goes up to 1.05 Ghz.
Here's an example from ebay.
https://www.ebay.com/itm/168770412399
Here's a specification sheet for the one I have, a pdf
"BRINGUP, from a cold radio: what MediaTek's ROM patch does at download (XO, pin mux, the CONN AFE calibration pulse per band, the A-die TOP init by chip ID, pads and CONN switch, the A-dies' eFuse trims); the UMAC pool layout; the common and per-band PHY initialisation; on each A-die the RF init tables, the resistor calibration and the RC filter calibration; the FEM outputs and the crystal trim."
That's not even some other language poorly translated to English, that's just a bunch of words.
Between stuff like this and math "proofs" that aren't readable either I'm really challenged to see the benefit here.
What I get out of this is that one could, if you had the documentation, write a more generalized SDR application for this hardware than the Wifi7 application. That an LLM model can provoke this behavior seems as a good existence proof perhaps?
The language makes sense if you've worked with radio chips or firmware.
Terms like XO (crystal oscillator) and pin mux (chip pin multiplexer, basically assigning pins to their role) are common for embedded work, not just radio work.
Usually in a project you get that language hidden in a separate implementation doc where casual readers won't get confused by it.
This project isn't meant to be vendor-quality documentation of the chipset. It's a reverse engineering project that succeeded and included enough documentation to build upon.
Comparing a freely shared reverse engineering proof of concept to vendor-provided 1st party documentation is a ridiculous high bar.
This is a cool project that was just shared hours ago. Criticizing it for not being 1st party vendor documentation quality is a really bad faith criticism.
"Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it."
Does that read paragraph say "Hey check out this PoC!" to you?
So a human, used Claude code to reverse engineer a device. Fine, let THAT be the readme. If it had said, "This is something that was accomplished with Claude code reverse engineering this thing, I have no idea how it works, but that it does work is evidenced by the spectrum I can show."
For those of us who are "skilled in the art" as they say, this reads like "Hey check this out, I bypassed the paywall by putting in my Mom's credit card number!" The lede here is that Claude can reverse engineer things. That was most informatively shown with an article that showed up here titled "All the things I own, owned."
The comment I replied to simply said, "Thanks Claude." Which is droll, but accurate. And, for me, the criticism of showing off something you "did" with a tool you don't understand and whose outputs you don't understand, reminds me strongly of the script kiddies of the 90's and naughts who would boldly proclaim "Hey, check it out, I got root on <website>." when all they had done was run Metasploit and walked through a bunch of scripts until they hit an RCE vulnerability and then used it to gain root (with another script).
So at some point the vendor will go through and patch the holes which the model had exploited and they will have to rewrite their admin architecture, and maybe be liable to some fines with the chip companies if "Intellectual Property" was improperly disclosed by their failure to write good software. And are we any closer to using the products as a general purpose SDR? No, we are not.
Contrast that with the folks who reverse engineered the RealTek DVB-T tuner chip, and had an understanding of what they had done and how it worked, and it spawned a bunch of RTL-SDR dongles that introduced lots of people to SDRs.
It is a really cool project, and it is an interesting proof of concept which could be the starting point for reverse engineering these boxes. But the author chose to present it as a complete ready to go project with documentation of things like their "architecture."
I suspect it is also true that neither the author, and certainly not the large language model, has any idea about how this firmware even works.
What? It tunes and it's streaming IQ over Ethernet. It is a general purpose SDR! You can use it as a general purpose SDR immediately.
I'd like a little more information from someone who actually knew what they were doing (or even just asked Claude to write it out in more detail) about the "real" nuts and bolts of the receiver, too (how's does IQ imbalance calibration work? How much dynamic range does it really have? How much can we configure the frontend, in detail?), but I don't think it's fair to claim this project is skiddie-level or not useful at this stage just because it was written by Claude.
Also, who's going to fine Mediatek for exposing Mediatek IP?
> write a more generalized SDR application for this hardware
Yeahhh, no. Sorry but the entry barrier is now extremely lowered, especially in effort.
~20 years ago this would have been literally sci-fi. Back then just getting an USRP to work with gnu-radio, then finding the proper hardware external clock, then doing lots of work on reading / trying stuff / writing scripts etc. took a ton of effort and time. Having the ability to throw tokens at it and have at least a starting point is amazing, IMO.
Is is more what it feels like talking to someone who doesn't really understand what it is they are talking about. A lot of keywords but no flow, no conceptual linkages from one part to another. Etc.
I'm not new to embedded and electronic stuff, but what is this word-salad.
We now can programm more manual tuned stuff to turn this into a full 13cm and 5cm radio as it was proven to work.
Before the esp-sdr hack and this one both bands were quite difficult and pricey to reach.
This was worth upper 4- to 5-digit of dollars of equipment before.
I work in this industry and sold more than one kidney for this stuff.
Same for the ESP-SDR project. Most likely it can be used for transmitting on S-Band for satellite control in the future (with an amplifier, dish, maybe some filtering). The HF-Frontend is Wi-Fi certified and therefore quite clean. I've forwarded this project to a friend who's close to ESA staff.
Yes. That's a very modern design. Lots of MIMO.. so I assume you will find that beast in cellular base stations.
I'd more see it as a huge jump in the higher frequencies.
>2GHz basically became cheap now over night.
Thanks to Claude&co. it now only takes maybe a few hours to find (or brute force ) potential registers to spit out raw I/Q streams. The last huge breakthrough there was the now rather old Rtlsdr project around the Osmocom dudes.
OpenAI seething that they didn’t pick a fucking name for their platform.
The Rigol DHO800 has 1.25Gbps 12 bit ADC and cost less than $500, that is entire machine. I doubt the ADC parts cost more than 10% of machine.
https://www.federalregister.gov/documents/2024/09/06/2024-19...
"A resolution of 12 bit or more, but less than 14 bit, with a “sample rate” greater than 400 MSPS;"
A year ago it was different. I looked at a lot of these vibe-RE projects and a lot of them wouldn't even do what they claimed. Now if someone points a frontier model at some code and lets it consume tokens for a few days, the output is often valuable as a starting point for other projects.
Ham radio operators looking forward using them for 13cm and 5cm band stuff.
The RTL SDR is the gateway drug into SDR's. The bandwidth is limited, so don't expect to be capturing HDTV Streams. But it's certainly possible to listen to AM/FM, Ham Bands, VHF/UHF signals, etc.
If you don't want to buy an RTL-SDR, you can search KiwiSDR which is a streaming SDR for frequencies under 30MHz. You can also connect to KiwiSDR's worldwide.
Then if you get the itch, you can go get your a HackRF, a ham license, or whatever else scratches it.
Mostly it's just fun. I like peeking at all the ambient transmissions in the area.
A while back I was more deeply involved in the SDR space and even reverse-engineered some pager signals. At least a few years ago, pagers were still widely used in hospitals (totally in plaintext, by the way).
This always strikes me in the "oh no look at all the cheating!" anti-ai takes.
Like, the cheating only blew up because there was/is the gap in teacher/professor/moderator understanding of the tools. Kids were copying wikipedia back in the day, and if the kid had a decent vocab, went completely undetected for a time. Then everyone thought they could do it and scorers got suspiscious enough to create a demand for an "is this wikipedia" software such that companies made them and scorers implemented them. We even saw reversions to written exams, and have had continuous use of written exams in 'critical' tests like SAT et al.
And of course, the only reason that the teacher's ensure that the students aren't cheating is because they know the students are heading for tests they can't cheat. So, there's new cheating, there will need to be new detection.
A motivated learner today has unprecedented capabilites compared to a motivated learner of even 10 years ago.
Assuming, of course, that the learner is practicing universally accepted study/research methods such as never implicitly trusting single sources, especially when they're third hand summaries of unverified sources.
I've had proffesors give me incorrect information with every bit of certainty an LLM offers, but it wouldn't be their fault if I just nodded along with either of them.
Everything in SDR has an analog equivalent, from local oscillators to PLLs to filtering. In fact most of it simply is a direct implementation of decades-old analog concepts.
But the underlying math is what I found most incredible, where the "true" representation of a signal is complex, and that every real (both in the ordinary and mathematical sense) signal is actually the sum of a positive and negative frequency, such that the complex component cancels out. Phase becomes much more comprehensible as simply the angular component of the signal, and frequency is the derivative of phase. All of this had the indirect effect of improving my understanding of complex numbers as well.
Claude is surprisingly good at mapping out complex multi-repeater trunking systems, and identifying DMR vs P25 vs NXDN signals, so even if you know nothing about digital radio, you can be listening in minutes.
With some help, it downloaded the fcc licensor databases and ingested them into a SQLite database, which allowed it to identify voice frequencies that correspond to an identified control channel.
You can then use tools like dsd-fme to decode and playback digital voice channels and scan entire trunk systems. I’ve been having a blast lately and learning a lot.
Stick an RTL-SDR dongle on your computer and use the program rtl_433 to monitor that traffic. It comes with built-in decoders for the protocols for a very large number of those sensors.
I've got such a setup and I can see not only my one sensors (An AcuRite outdoor thermometer, and the two sensors from an AcuRite fridge/freeze thermometer) but also a few neighbor's temperature sensors, humidity sensors, soil moisture sensors, wind speed and direction sensors, rain gauges, and their tire pressure.
You can set up MQTT and have rtl_433 report the data that way, and you can have Home Assistant get that and display it. It knows how to handle a variety of sensor types.
I haven't done that yet. I just have rtl_433 log everything by appending JSON records to a file. A script reads that, finds the sensors I care about, and stores their data in an sqlite database.
All via a tiny web server in an ESP32 with a radio attached. And the parts I bought for decoding the signals were cheap and let me replicate the process easily. Which reminds me I should push the Claude skill I created for doing this up into that repo. I even had Claude build me a Streamlit app to teach me how to read the signals. https://ook-signal-explorer.streamlit.app/
You cannot sell them with the tag if it wasn't connected to standardized certification test system at least once.
I’m not seeing a synopsis of the significance of this, for the uninitiated
What is Msps? I’m not familiar with that scale
The significance is that most off the shelf SDR platforms have much lower specs. Almost all of them use the same Analog Devices transceiver chip.
Every WiFi modem has a testmode. It's required to verify the TX/RX chain during manufacturing and for compliance testing.
Seemingly you can read out the entire spectrum at full rate.
Sipeed teased a similar hack using some (undisclosed) USB-wifi chip, though I don't take them seriously as none can get their hands on the chips they tend to use.
Many cheap USB 3 Wifi 5/6 dongles out there, based on RTL8852BU and such. Just one QFN IC and XO. Their "firmware" seems to be a binary blob loaded over USB. I'm skeptical that these "testmodes" can be figured out with just bruteforcing, wonder if they load custom firmware for compliance testing or just leave those routines hanging around in release firmware too.
I was able to get ~40MBit/s of low-rate I/Q out of it.. but didn't patch the Wifi modem firmware as you did.
That's quite a good deal...
Ideally, a software defined receiver replaces all of that with some high speed programmable component that can decode all types of signals across all frequencies, simultaneously. The ideal software defined receiver connects an antenna to a pin on a processor and software does everything digitally: demodulation, filtering, etc.
Physics and the limits of our semiconductor technology doesn't actually permit this ideal to exist. We can, however, achieve some degree of it, and improving components have expanded capabilities and made it cost effective.