This same devloper also built an SDR out of an ESP32 Wi-Fi microcontroller [1], this is awesome!
This development makes me hope that we'd be seeing more of these on common Wi-Fi cards, so that every random laptop could be used as an SDR for many fun and useful applications on a budget.
Every wifi radio is an SDR under the hood. I'm not sure about this hack, but the ESP32 one was limited to just acting as an ADC + gain control. That leaves the guts of the radio still locked down, which limits a lot of use cases where you want wifi frames and time domain data. You either need to accept the latency and extract frames on PC, or add an FPGA, or use two cards fed from same antenna. Tx is also not possible.
The MT7996 chip is available with the banana pi R4 board, which has SFP+ (10 gigabit) so you'd have a near completely open ISM band SDR platform right there, feeding data to your server via fiber optics.
According to this TX is also possible on the ESP32-series chips, though they haven't published exactly how (I assume due they don't want to wake the FCC). But yeah the ESP32 is fairly limited in a lot of ways due to the limited processing power and IO bandwidth to stream data out of it
I know for sure that Qualcomm LTE/5G modems are also SDRs under the hood.
Like Wi-Fi chips, they don't use SDR mode during most of the normal operation. They have dedicated hardware units that do a lot of the decimation, conversion, modulation and demodulation efficiently. But the "SDR mode" is still there for things like factory calibration.
Makes me wonder how many other common MCUs and SoCs are just waiting for someone to unlock SDR in them.
TX is less "not possible" and more "this dev doesn't want to enable it" from what I gathered. Probably for "I don't want people using this to shit all over the spectrum" kinds of reasons. So you can get TX - it'll just require extra hacking.
Yes they are. And they have a much wider tuning range (I have one that tunes from 240 MHz to 7 GHz). Problem of standard hardware is that every path has dedicated SAW/BAW bandpass filters that yeet anything not in uplink/downlink. And you need an unfused chip for custom Hexagon DSP stuff (so no phones).
Their DSP/SoC silicon includes a wideband transceiver? But phone chips have external bandpass filters? Interesting. Mostly I've seen baseband processor + external transceiver (wideband or not) with its own filters.
I know the LTE modems had ADCs and DACs in SoC - ZIF with analog signal running straight between the tuner and the SoC. But 5G systems rolled ADC/DAC into the transceiver chip itself - with only the digital processing living in SoC.
Is the "QLink" setup they use in 5G systems now just a thin protocol running over LVDS and streaming I/Q between the transceiver and SoC DSP as digital signals?
Never actually went that far, but I did wonder if you could plug a QLink tuner chip into an FPGA to use it as a broadband SDR frontend.
There are also chips like NXP layerscape which do the sampling and hardware acceleration on a chip which streams to host (though still need another transceiver).
The motivation for this is of course beamforming, angle of arrival, spatial streaming, etc. You connect multiple antennas with different views back to the base station.
Yeah, I've worked on such chips where there is essentially a DSP with extra Wi-Fi specific hardware blocks on a shared memory bus. The DSP runs its standard assembly language and makes calls to the blocks, which are themselves configured with config registers or even a kind of microcode style assembly.
Those hardware blocks could be useful for certain applications but most importantly for triggering captures only when there are frames to process and giving you both the frame + the sample.
So for me the perfect hack would allow both normal Wi-Fi tx/rx and triggered or continuous rx sampling.
What are good, cheap, SDRs these days? Back when the first RTL-SDRs came out, I had an overview, but now there seems to be a gazillion variants, and every time I start researching I end up awfully close to buying a full HackRF that I'm drooling over but realistically don't have time to play with and which will just sit there gathering dust. Help! :P
Pick an RTL that does the ranges you are interested in and I doubt you can go wrong. The rtlblog v4 is recommended but hard to get ahold of now. They receive only but actually work quite well when paired with correct antenna.
HackRF is not as good at listening -- a bit deaf -- but does provide much larger bandwidth and obviously the low powered half duplex tx ability.
If you just want to grab random signals around and explore, get a cheap RTL.
If you really want to go back and fourth with a device, to modify data packets etc get a hackRF.
If you want to push beyond those limitations, you'll probably already know what you're shopping for next at that point.
Beware, you'll end up acquiring many different radio devices and then likely start building antennas out of scrap, buying a nanovna, and falling deeper and deeper into the magical rabbit hole!
> Pick an RTL that does the ranges you are interested in and I doubt you can go wrong.
Last time I was down this rabbit hole (when cheap RTL-SDRs were completely new), my favorite fun test was ADS-B, so let's say I wanna play around 1-1.1 GHz at first.
One day I also wanna sit down and do GPS from scratch, "by hand", so let's say I also wanna do 1.57 GHz (which I understand is becoming borderline difficult for the cheapest devices?).
Even though these devices are cheap, I'd rather avoid needlessly extra-shitty devices or my money going to copycat leeches.
Any recommendations in light of these requirements? Thanks a lot!
> HackRF is not as good at listening -- a bit deaf -- but does provide much larger bandwidth and obviously the low powered half duplex tx ability.
Yeah I know it's in a completely separate category, I just derail and start daydreaming ;-)
> Beware, you'll end up acquiring many different radio devices and then likely start building antennas out of scrap, buying a nanovna, and falling deeper and deeper into the magical rabbit hole!
RTL-SDR can do GPS L1CA signal processing easily, but you need to use the RTL-SDR Blog dongles not the blue no-name DVB-T dongles as:
- You need stable clock for the processing algorithms to be happy, RTL-SDR blog dongle have 0.5ppm TCXO while who knows what crystal they use on the no-name ones
- RTL-SDR blog dongles have bias-T, and a lot of GPS patch antennas are active antenna that need power from the coax to power the LNA
You are of course absolutely correct! Let me rephrase: "from scratch" once the signal has been captured and I've avoided all the ways that hardware will fuck me over due to my lack of skills :-)
Good and cheap is probably still RTL-SDR and HackRF. Both solid at what they do. If you want a similar thing from a different maker you can check out the sbitx-v3 [1] (official platform of HERMES[2]). For more money there are a bunch of options and I don't have any personal experiece with the platforms, but I see people recommend bladerf or kracken. Reddit's /r/sdr is a great place for info.
HackRF is the gold standard, but definitely not cheap. I have an SDR-Play duo that I'm pretty happy with, writing software for it is doable (even though the manufacturer is really coy about what's in there you can dig into the driver easily enough). It remains to be seen how long those will be for sale though, I'm not sure if they're still making the chips (long story short: the SDR-Play seller once upon a time made a chip for another market and they seem to have realized they could make more money selling those same chips packaged to the SDR market).
> so that every random laptop could be used as an SDR for many fun and useful applications
I guess the problem with these is they are more likely to be tied/tuned for specific (wifi) frequency ranges.
Although 2.4GHz gives bluetooth and zigbee in addition to wifi
The antennas usually included on ESP32 boards are for 2.4GHz, which is the range the ESP32 hardware is tuned for anyway. But if you do want a different antenna, just get a board with a modular antenna, like some of the Xiao boards from Seeed Studio
I think that applies too, laptops usually use the same connectors for the Wi-Fi antennas, so you shouldn't have an issue just using something off the shelf that matches the frequency you want
For an SDR? Me and my buddy Claude put the ceiling fans and a bunch of our light plugs onto a homebrew remote I built from a chip and an SDR. Would have gotten the tire pressures from the cars too, but they’re available via Bluetooth.
Not the point but the Airhona could here is really neat. AN7581 with typical quad Cortex-A53 but then 8x RISC-V network coprocessors. Good luck figuring out how to use that though, whew! (Go Astra go.)
https://www.airoha.com/products/p/NpfqGLnZiZuYUZ6N
I've been thinking how beautiful and awesome it is that SDR finally has a real jump. The QuadRF using the rpi's mipi connector was such a glorious hack! Custom ADC from parts. 80MSps. https://www.crowdsupply.com/scale-rf/quadrf
And man what a huge flying leap forward here. 320MSps! Much deeper 14b IQ precision vs 8b. The totally custom mediatek radio firmware is incredible. Such incredible possibility. Maybe someday the mimo can be useful for some of the same neat AoE / beam forming capabilities?
The "network coprocessors" are a bit lame imo. I initially tried to use them for packing, but they turned out to be very memory/cache bandwidth limited. They are also standard risk-v pretty much. I did run custom code on them though (and the Mediatek's "dsp" cores that are a bit more interesting extensions-wise, but are even more memory bw starved). There should be enough left in the tree to get one going pretty fast if one so wishes to play with those cores.
I can't keep up with the rapid, non stop cool stuff being discovered! Someone figured out how to get the ESP32 to transmit, at lower bandwidth (I think I read 200-250khz) I don't know which project it was but there are a bunch on this site:
Holy cow... I've got to limit my projects, so I don't repeat history where I kept finding radio shack bags full of parts for ideas. But you can get 3 of those, with external antennas for less than $60 through amazon. I put it in my wish list instead of buying them now. I've got a data diode to finish first.
Sideband on 13 CM sounds like an amazing thing to pull off.
Having done repairs on a ton of older service monitors, and having my hand in SDR, this is amazing! There's a huge amount of machining and hardware to make a service monitor, but with desktop CNC, cheap PCBS, and jelly bean components that go into the 10s of GHz, the sky's the limit.
I'd add a heat sunk 100 watt DC-5Ghz 20dB fixed attenuator, 0-110 dB switched attenuator, 5 ghz low pass filter, 7-12 Ghz local oscillator/mixer up/down converter, and it would make a small, very high performance service monitor good to 5 Ghz. 8)
A Communications service monitor is a tool for servicing radios. Until recently, most large organizations used VHF/UHF FM radio for communications on dedicated channels. A service monitor is a tool that can usually absorb the full output power of these radios while measuring power, frequency, distortion, etc. They can also generate a variety of signals for aligning receivers.
Most of the older, affordable models go from almost DC to 1 Ghz. I've got an IFR 2947a, which goes up to 1.05 Ghz.
I've edited it, but generally you don't want to have problems with mirror images getting through and creating spurious responses. Real world RF filters don't have infinitely steep edges, so initially I figured a 4 Ghz low pass filter would have enough loss by 5 Ghz to get the job done. I revised to to a 5 Ghz low filter, and a 7-12 Ghz Local Oscillator to give the filter an easier job. Also, the lower the swing in percentage terms for a VCO, the easier it is to work with.
So the signal path in receive mode would be:
N connector / 20 dB 100 watt pad / Switched attenuator / Low pass filter / Front End diodes / Mixer / Router board for DSP
Alternatively, there's usually a second path that skips the attenuator, with a lower maximum power level.
The reverse path would work for generating signals from DC (almost) to 5 Ghz.
Is this kind of thing why samsung asks you to sign a contract before letting third parties use the FM radios on their phones? Because many phone radios nowadays are software defined?
"BRINGUP, from a cold radio: what MediaTek's ROM patch does at download (XO, pin mux, the CONN AFE calibration pulse per band, the A-die TOP init by chip ID, pads and CONN switch, the A-dies' eFuse trims); the UMAC pool layout; the common and per-band PHY initialisation; on each A-die the RF init tables, the resistor calibration and the RC filter calibration; the FEM outputs and the crystal trim."
That's not even some other language poorly translated to English, that's just a bunch of words.
Between stuff like this and math "proofs" that aren't readable either I'm really challenged to see the benefit here.
What I get out of this is that one could, if you had the documentation, write a more generalized SDR application for this hardware than the Wifi7 application. That an LLM model can provoke this behavior seems as a good existence proof perhaps?
> That's not even some other language poorly translated to English, that's just a bunch of words.
The language makes sense if you've worked with radio chips or firmware.
Terms like XO (crystal oscillator) and pin mux (chip pin multiplexer, basically assigning pins to their role) are common for embedded work, not just radio work.
Usually in a project you get that language hidden in a separate implementation doc where casual readers won't get confused by it.
Yes there are radio terms in there. :-) That said, I've written combined firmware/gateware drivers for dedicated radio chips and that paragraph makes little sense to me. Even the RFSoC docs from AMD/Xilinx are better written and they are pretty damn dense.
> Even the RFSoC docs from AMD/Xilinx are better written
This project isn't meant to be vendor-quality documentation of the chipset. It's a reverse engineering project that succeeded and included enough documentation to build upon.
Comparing a freely shared reverse engineering proof of concept to vendor-provided 1st party documentation is a ridiculous high bar.
This is a cool project that was just shared hours ago. Criticizing it for not being 1st party vendor documentation quality is a really bad faith criticism.
Okay. So let's pretend it is simple a proof-of-concept (PoC) rather than a full blown project, it's opening paragraph in README.md is:
"Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it."
Does that read paragraph say "Hey check out this PoC!" to you?
So a human, used Claude code to reverse engineer a device. Fine, let THAT be the readme. If it had said, "This is something that was accomplished with Claude code reverse engineering this thing, I have no idea how it works, but that it does work is evidenced by the spectrum I can show."
For those of us who are "skilled in the art" as they say, this reads like "Hey check this out, I bypassed the paywall by putting in my Mom's credit card number!" The lede here is that Claude can reverse engineer things. That was most informatively shown with an article that showed up here titled "All the things I own, owned."
The comment I replied to simply said, "Thanks Claude." Which is droll, but accurate. And, for me, the criticism of showing off something you "did" with a tool you don't understand and whose outputs you don't understand, reminds me strongly of the script kiddies of the 90's and naughts who would boldly proclaim "Hey, check it out, I got root on <website>." when all they had done was run Metasploit and walked through a bunch of scripts until they hit an RCE vulnerability and then used it to gain root (with another script).
So at some point the vendor will go through and patch the holes which the model had exploited and they will have to rewrite their admin architecture, and maybe be liable to some fines with the chip companies if "Intellectual Property" was improperly disclosed by their failure to write good software. And are we any closer to using the products as a general purpose SDR? No, we are not.
Contrast that with the folks who reverse engineered the RealTek DVB-T tuner chip, and had an understanding of what they had done and how it worked, and it spawned a bunch of RTL-SDR dongles that introduced lots of people to SDRs.
It is a really cool project, and it is an interesting proof of concept which could be the starting point for reverse engineering these boxes. But the author chose to present it as a complete ready to go project with documentation of things like their "architecture."
I suspect it is also true that neither the author, and certainly not the large language model, has any idea about how this firmware even works.
It is interesting that the part you nitpicked is the one I made claude do just for fun. Cal and bringup worked just fine with a bundled vendor blob. But I wanted to understand at least some of the steps.
> So at some point the vendor will go through and patch the holes which the model had exploited and they will have to rewrite their admin architecture, and maybe be liable to some fines with the chip companies if "Intellectual Property" was improperly disclosed by their failure to write good software. And are we any closer to using the products as a general purpose SDR? No, we are not.
What? It tunes and it's streaming IQ over Ethernet. It is a general purpose SDR! You can use it as a general purpose SDR immediately.
I'd like a little more information from someone who actually knew what they were doing (or even just asked Claude to write it out in more detail) about the "real" nuts and bolts of the receiver, too (how's does IQ imbalance calibration work? How much dynamic range does it really have? How much can we configure the frontend, in detail?), but I don't think it's fair to claim this project is skiddie-level or not useful at this stage just because it was written by Claude.
Also, who's going to fine Mediatek for exposing Mediatek IP?
> write a more generalized SDR application for this hardware
Yeahhh, no. Sorry but the entry barrier is now extremely lowered, especially in effort.
~20 years ago this would have been literally sci-fi. Back then just getting an USRP to work with gnu-radio, then finding the proper hardware external clock, then doing lots of work on reading / trying stuff / writing scripts etc. took a ton of effort and time. Having the ability to throw tokens at it and have at least a starting point is amazing, IMO.
I'm doubtful about that. To be pedantic if you consider the set 'superhuman intelligence' to be a proper superset of 'human intelligence', then I would expect it to be able to structure its communications to the level the audience could understand. Does that make sense?
Is is more what it feels like talking to someone who doesn't really understand what it is they are talking about. A lot of keywords but no flow, no conceptual linkages from one part to another. Etc.
If someone wants to set up some hardware in a harness and then spend their tokens reverse engineering it, I'm thankful for the publication.
A year ago it was different. I looked at a lot of these vibe-RE projects and a lot of them wouldn't even do what they claimed. Now if someone points a frontier model at some code and lets it consume tokens for a few days, the output is often valuable as a starting point for other projects.
320MSPS at this frequencies for less than $100 that can be extracted over 10GBit/s.
This was worth upper 4- to 5-digit of dollars of equipment before.
I work in this industry and sold more than one kidney for this stuff.
Same for the ESP-SDR project. Most likely it can be used for transmitting on S-Band for satellite control in the future (with an amplifier, dish, maybe some filtering). The HF-Frontend is Wi-Fi certified and therefore quite clean. I've forwarded this project to a friend who's close to ESA staff.
Most people don't have an idea just how expensive high speed Analog to Digital Converters are, yet modern wifi radios often have 2 or 3 at a price under $30. Going to Digikey right now, an ADC capable of 14 bits at 350MSPS is over $200 (quantity 1), and that doesn't come with all the other supporting hardware needed to build a radio. The magic of volume production of hardware in quantities of millions is quite something.
The EEVblog teardown of the DH800 shows that the ADC is a custom Rigol part. Whether it's a rebadged ADC or not is unclear, but I have my doubts that the price point of the Rigol can be hit with off the shelf components from the North American supply chain.
If you could find an off-the-shelf ADC with those capabilities, I'd love to hear where. Last time I checked, I was unable to find anything that would financially make sense compared to just buying the entire oscilloscope, but I may not know where / how to look.
You're referencing a 5-figure rig like the ADRV9040 I suppose? I don't work in that industry but I do dabble in SDR hobbies and I guess due to my advancing age I view this as linear progress rather than breakthroughs. Two decades ago it was $1 million worth of junk.
Yes. That's a very modern design. Lots of MIMO.. so I assume you will find that beast in cellular base stations.
I'd more see it as a huge jump in the higher frequencies.
>2GHz basically became cheap now over night.
Thanks to Claude&co. it now only takes maybe a few hours to find (or brute force ) potential registers to spit out raw I/Q streams. The last huge breakthrough there was the now rather old Rtlsdr project around the Osmocom dudes.
Try using GPT to write software like this, I don't think just anyone could do it unless they know the problem domain well. Understanding something is not something any AI can replace (yet).
At the moment I have 5x RTL-SDR dongles streaming into a box on different bands (137, 433, 912, 978, and 1090 MHz). They pick up all kinds of things, from local weather stations to the water meter for my condo to ADS-B/UAT transmissions from local aircraft. I even see the tire pressure monitor signals from cars that drive by (some of you guys need to add air!).
Mostly it's just fun. I like peeking at all the ambient transmissions in the area.
A while back I was more deeply involved in the SDR space and even reverse-engineered some pager signals. At least a few years ago, pagers were still widely used in hospitals (totally in plaintext, by the way).
I am learning about radio and modulation using SDR (with professor Claude - incredible for learning! Especially if you know exactly what you want to learn and have a strong enough background in somewhat related fields - audio and image DSP for me - to make exercises it writes for me short, relatable, and yet illuminating) and our second lesson after cheap 433 remotes was FLEX and pagers - plenty of that stuff in the city, with about half messages from a hospital a few blocks away. Still very widely used in the US (I live in NYC).
Seeing what gets broadcasted there 100% unencrypted was quite a shock. Patient names, ages, and conditions; doctor names, rooms, departments, requests for medications and assistance... Insane amount of super private PII.
Learning the fundamentals behind radio really blew my mind at the time (years ago), and having Claude there to help visualize things must be an incredible boon.
Everything in SDR has an analog equivalent, from local oscillators to PLLs to filtering. In fact most of it simply is a direct implementation of decades-old analog concepts.
But the underlying math is what I found most incredible, where the "true" representation of a signal is complex, and that every real (both in the ordinary and mathematical sense) signal is actually the sum of a positive and negative frequency, such that the complex component cancels out. Phase becomes much more comprehensible as simply the angular component of the signal, and frequency is the derivative of phase. All of this had the indirect effect of improving my understanding of complex numbers as well.
off-topic, but "with professor Claude - incredible for learning! Especially if you know exactly what you want to learn "
This always strikes me in the "oh no look at all the cheating!" anti-ai takes.
Like, the cheating only blew up because there was/is the gap in teacher/professor/moderator understanding of the tools. Kids were copying wikipedia back in the day, and if the kid had a decent vocab, went completely undetected for a time. Then everyone thought they could do it and scorers got suspiscious enough to create a demand for an "is this wikipedia" software such that companies made them and scorers implemented them. We even saw reversions to written exams, and have had continuous use of written exams in 'critical' tests like SAT et al.
And of course, the only reason that the teacher's ensure that the students aren't cheating is because they know the students are heading for tests they can't cheat. So, there's new cheating, there will need to be new detection.
A motivated learner today has unprecedented capabilites compared to a motivated learner of even 10 years ago.
Assuming, of course, that the learner is practicing universally accepted study/research methods such as never implicitly trusting single sources, especially when they're third hand summaries of unverified sources.
I've had proffesors give me incorrect information with every bit of certainty an LLM offers, but it wouldn't be their fault if I just nodded along with either of them.
I’ve got one SDR reading air and VHF, one reading 1090 ADS-B, one on 433MHz reading weather stations, temp sensors, tire pressure modules, lots of stuff; finally a fourth one picking up local 70cm and 2m traffic. Oh and a GPS puck providing a stratum 1 time server. Lots of stuff to do and lots of exploring around your local bands.
Claude is surprisingly good at mapping out complex multi-repeater trunking systems, and identifying DMR vs P25 vs NXDN signals, so even if you know nothing about digital radio, you can be listening in minutes.
Claude is also very good at dashboards. I have my 5 radios all going through different decoders, streaming the data into a SQLite database, then visualized on a custom dashboard. Has tiles for the weather stations, a map for the ADS-B/UAT traffic, a status page for the radios themselves, and so on.
I didn’t think it would work either, but prompts like “Analyze the signal at 458.25MHz and determine the digital encoding” were all it took. Claude knew how to use the suite of rtl-sdr command line tools, and wrote throwaway Python scripts to analyze the captured data looking for modulation schemes, codec rates, estimating channel bandwidth, and so on. It was actually pretty impressive.
With some help, it downloaded the fcc licensor databases and ingested them into a SQLite database, which allowed it to identify voice frequencies that correspond to an identified control channel.
You can then use tools like dsd-fme to decode and playback digital voice channels and scan entire trunk systems. I’ve been having a blast lately and learning a lot.
It is cool to do. But there are professional uses for it, particularly like finding interference or noise. You can ask things like: "How crowded is my 2.4 GHz spectrum?"
The RTL SDR is the gateway drug into SDR's. The bandwidth is limited, so don't expect to be capturing HDTV Streams. But it's certainly possible to listen to AM/FM, Ham Bands, VHF/UHF signals, etc.
If you don't want to buy an RTL-SDR, you can search KiwiSDR which is a streaming SDR for frequencies under 30MHz. You can also connect to KiwiSDR's worldwide.
Then if you get the itch, you can go get your a HackRF, a ham license, or whatever else scratches it.
Many consumer temperature, humidity, rain, and wind sensors use simple radio protocols in the 433 MHz band to report their readings back to their indoor display unit.
Stick an RTL-SDR dongle on your computer and use the program rtl_433 to monitor that traffic. It comes with built-in decoders for the protocols for a very large number of those sensors.
I've got such a setup and I can see not only my one sensors (An AcuRite outdoor thermometer, and the two sensors from an AcuRite fridge/freeze thermometer) but also a few neighbor's temperature sensors, humidity sensors, soil moisture sensors, wind speed and direction sensors, rain gauges, and their tire pressure.
You can set up MQTT and have rtl_433 report the data that way, and you can have Home Assistant get that and display it. It knows how to handle a variety of sensor types.
I haven't done that yet. I just have rtl_433 log everything by appending JSON records to a file. A script reads that, finds the sensors I care about, and stores their data in an sqlite database.
I think it is cool to do, but only because first I worked through doing it. I never got around to cleaning the repo up for human consumption, but here’s the resulting code Claude and I assembled for running lights and fans in my living room. https://github.com/tclancy/radiofrequency/blob/main/firmware...
All via a tiny web server in an ESP32 with a radio attached. And the parts I bought for decoding the signals were cheap and let me replicate the process easily. Which reminds me I should push the Claude skill I created for doing this up into that repo. I even had Claude build me a Streamlit app to teach me how to read the signals. https://ook-signal-explorer.streamlit.app/
I've used it to identify transmissions in my neighborhood in the public (ISM) band, listen to various radio broadcasts outside the normal AM/FM, and best of all, track all the planes in my area (ADS-B).
It can be used in narrow bands, which makes it unusable for most of SDR use cases. Pretty cool that you can do this on wifi card, but somewhat expected nowadays.
wow, could this be turned into a 2.4ghz SAR? I always wondered if it’d be possible to use something like that to pick up wifi signals from much farther away. Of course a more sensible choice would just be to use a yagi antenna
Getting the testmode to run once is pretty easy to be honest. Getting it running continuously without gaps and then extrating the produced firehose of data is where most of the complexity was. At least for me. Also fuzzing for configurations that were not intended. For example, stock tables only allow for up to 40mhz @ 80msps on the 2.4ghz band.
The big advantage of the ESP32 discovery is its availability, while this device is a unique configuration that isn't available in most places.
Sipeed teased a similar hack using some (undisclosed) USB-wifi chip, though I don't take them seriously as none can get their hands on the chips they tend to use.
Many cheap USB 3 Wifi 5/6 dongles out there, based on RTL8852BU and such. Just one QFN IC and XO. Their "firmware" seems to be a binary blob loaded over USB. I'm skeptical that these "testmodes" can be figured out with just bruteforcing, wonder if they load custom firmware for compliance testing or just leave those routines hanging around in release firmware too.
2x 160 can be done pretty easily. Only on same band/LO though. So, only for things like multipath.
4x 80 might be possible, but needs a lot more effort. It is up to 2 ports per icap engine and only one icap engine got coerced into writing to pooled sram. The other 2 could only do their designated regions that are limited to 16KB if I remember right. So continuous reception gets more complicated/precise.
Everything above is from me experimenting with HW. There is no official reference for this stuff. So I may have missed something, and some mentioned limitations may be workaroundable.
Can you order them from amazon.com? I've ordered stuff from amazon.co.jp and amazon.de before and although it doesn't get there in two days, it does show up eventually.
Conventionally, a radio receiver is a pipeline of electronic components that decode a radio signal into some form you expect: audio, video, digital data, radar returns, whatever. This set of components is typically not "agile": it can decode only a limited set of signal types from some limited set of frequencies, so you need different receiver hardware for different type of radio signals.
Ideally, a software defined receiver replaces all of that with some high speed programmable component that can decode all types of signals across all frequencies, simultaneously. The ideal software defined receiver connects an antenna to a pin on a processor and software does everything digitally: demodulation, filtering, etc.
Physics and the limits of our semiconductor technology doesn't actually permit this ideal to exist. We can, however, achieve some degree of it, and improving components have expanded capabilities and made it cost effective.
This same devloper also built an SDR out of an ESP32 Wi-Fi microcontroller [1], this is awesome!
This development makes me hope that we'd be seeing more of these on common Wi-Fi cards, so that every random laptop could be used as an SDR for many fun and useful applications on a budget.
https://github.com/h0m3us3r/eSpDR
Every wifi radio is an SDR under the hood. I'm not sure about this hack, but the ESP32 one was limited to just acting as an ADC + gain control. That leaves the guts of the radio still locked down, which limits a lot of use cases where you want wifi frames and time domain data. You either need to accept the latency and extract frames on PC, or add an FPGA, or use two cards fed from same antenna. Tx is also not possible.
The MT7996 chip is available with the banana pi R4 board, which has SFP+ (10 gigabit) so you'd have a near completely open ISM band SDR platform right there, feeding data to your server via fiber optics.
https://espargos.net/espsdr/
According to this TX is also possible on the ESP32-series chips, though they haven't published exactly how (I assume due they don't want to wake the FCC). But yeah the ESP32 is fairly limited in a lot of ways due to the limited processing power and IO bandwidth to stream data out of it
This should have full TX: https://github.com/cyber-murmel/esp-sdr-zephyr
Wow, these are coming out faster than I can keep up with them
I know for sure that Qualcomm LTE/5G modems are also SDRs under the hood.
Like Wi-Fi chips, they don't use SDR mode during most of the normal operation. They have dedicated hardware units that do a lot of the decimation, conversion, modulation and demodulation efficiently. But the "SDR mode" is still there for things like factory calibration.
Makes me wonder how many other common MCUs and SoCs are just waiting for someone to unlock SDR in them.
TX is less "not possible" and more "this dev doesn't want to enable it" from what I gathered. Probably for "I don't want people using this to shit all over the spectrum" kinds of reasons. So you can get TX - it'll just require extra hacking.
Yes they are. And they have a much wider tuning range (I have one that tunes from 240 MHz to 7 GHz). Problem of standard hardware is that every path has dedicated SAW/BAW bandpass filters that yeet anything not in uplink/downlink. And you need an unfused chip for custom Hexagon DSP stuff (so no phones).
Base stations are also SDRs by the way xD
Their DSP/SoC silicon includes a wideband transceiver? But phone chips have external bandpass filters? Interesting. Mostly I've seen baseband processor + external transceiver (wideband or not) with its own filters.
External transceiver over QLink.
I know the LTE modems had ADCs and DACs in SoC - ZIF with analog signal running straight between the tuner and the SoC. But 5G systems rolled ADC/DAC into the transceiver chip itself - with only the digital processing living in SoC.
Is the "QLink" setup they use in 5G systems now just a thin protocol running over LVDS and streaming I/Q between the transceiver and SoC DSP as digital signals?
Never actually went that far, but I did wonder if you could plug a QLink tuner chip into an FPGA to use it as a broadband SDR frontend.
There are also chips like NXP layerscape which do the sampling and hardware acceleration on a chip which streams to host (though still need another transceiver).
The motivation for this is of course beamforming, angle of arrival, spatial streaming, etc. You connect multiple antennas with different views back to the base station.
Yeah, I've worked on such chips where there is essentially a DSP with extra Wi-Fi specific hardware blocks on a shared memory bus. The DSP runs its standard assembly language and makes calls to the blocks, which are themselves configured with config registers or even a kind of microcode style assembly.
Those hardware blocks could be useful for certain applications but most importantly for triggering captures only when there are frames to process and giving you both the frame + the sample.
So for me the perfect hack would allow both normal Wi-Fi tx/rx and triggered or continuous rx sampling.
You can buy an rtl-sdr for ~$40 and have a much more interesting frequency range, plus you can use wifi to google stuff while doing it.
Receive only SDRs have been cheap for a long time now.
What are good, cheap, SDRs these days? Back when the first RTL-SDRs came out, I had an overview, but now there seems to be a gazillion variants, and every time I start researching I end up awfully close to buying a full HackRF that I'm drooling over but realistically don't have time to play with and which will just sit there gathering dust. Help! :P
Pick an RTL that does the ranges you are interested in and I doubt you can go wrong. The rtlblog v4 is recommended but hard to get ahold of now. They receive only but actually work quite well when paired with correct antenna.
HackRF is not as good at listening -- a bit deaf -- but does provide much larger bandwidth and obviously the low powered half duplex tx ability.
If you just want to grab random signals around and explore, get a cheap RTL.
If you really want to go back and fourth with a device, to modify data packets etc get a hackRF.
If you want to push beyond those limitations, you'll probably already know what you're shopping for next at that point.
Beware, you'll end up acquiring many different radio devices and then likely start building antennas out of scrap, buying a nanovna, and falling deeper and deeper into the magical rabbit hole!
> Pick an RTL that does the ranges you are interested in and I doubt you can go wrong.
Last time I was down this rabbit hole (when cheap RTL-SDRs were completely new), my favorite fun test was ADS-B, so let's say I wanna play around 1-1.1 GHz at first.
One day I also wanna sit down and do GPS from scratch, "by hand", so let's say I also wanna do 1.57 GHz (which I understand is becoming borderline difficult for the cheapest devices?).
Even though these devices are cheap, I'd rather avoid needlessly extra-shitty devices or my money going to copycat leeches.
Any recommendations in light of these requirements? Thanks a lot!
> HackRF is not as good at listening -- a bit deaf -- but does provide much larger bandwidth and obviously the low powered half duplex tx ability.
Yeah I know it's in a completely separate category, I just derail and start daydreaming ;-)
> Beware, you'll end up acquiring many different radio devices and then likely start building antennas out of scrap, buying a nanovna, and falling deeper and deeper into the magical rabbit hole!
Lol! I can see that danger very clearly!
RTL-SDR can do GPS L1CA signal processing easily, but you need to use the RTL-SDR Blog dongles not the blue no-name DVB-T dongles as:
- You need stable clock for the processing algorithms to be happy, RTL-SDR blog dongle have 0.5ppm TCXO while who knows what crystal they use on the no-name ones
- RTL-SDR blog dongles have bias-T, and a lot of GPS patch antennas are active antenna that need power from the coax to power the LNA
Using an SDR is not "from scratch"
This is "from scratch": https://lea.hamradio.si/~s53mv/navsats/theory.html
:)
You are of course absolutely correct! Let me rephrase: "from scratch" once the signal has been captured and I've avoided all the ways that hardware will fuck me over due to my lack of skills :-)
Very, very cool link!
If go down that route: get yourself a Rubidium standard, they're $150 on ebay and it will give you a rock solid clock to start off from.
Good and cheap is probably still RTL-SDR and HackRF. Both solid at what they do. If you want a similar thing from a different maker you can check out the sbitx-v3 [1] (official platform of HERMES[2]). For more money there are a bunch of options and I don't have any personal experiece with the platforms, but I see people recommend bladerf or kracken. Reddit's /r/sdr is a great place for info.
[1] https://www.hfsignals.com/index.php/sbitx-v3/
[2] Recent discussion: https://news.ycombinator.com/item?id=49789228
HackRF is the gold standard, but definitely not cheap. I have an SDR-Play duo that I'm pretty happy with, writing software for it is doable (even though the manufacturer is really coy about what's in there you can dig into the driver easily enough). It remains to be seen how long those will be for sale though, I'm not sure if they're still making the chips (long story short: the SDR-Play seller once upon a time made a chip for another market and they seem to have realized they could make more money selling those same chips packaged to the SDR market).
"Damn, I forgot the garage code"
"oh, no problem"
>tippy tappy
>brrrrrrr
Is this your garage?
Does it matter? The door is open now.
Rest of the neighborhood too...
> so that every random laptop could be used as an SDR for many fun and useful applications
I guess the problem with these is they are more likely to be tied/tuned for specific (wifi) frequency ranges. Although 2.4GHz gives bluetooth and zigbee in addition to wifi
https://en.wikipedia.org/wiki/2.4_GHz_radio_use
It’d be neat to see this on ESP32-C5, which also has a 5GHz radio. S3 is 2.4 only.
https://espargos.net/espsdr/
ESP-SDR is based on this work, and supports the C5 and a bunch more
I think the lack of SIMD extensions on the C5/C6 holds it back, along with the bandwidth to get IQs out fast enough like you can on the S3/S31.
You'd still have to figure out how to replace the antenna.
The antennas usually included on ESP32 boards are for 2.4GHz, which is the range the ESP32 hardware is tuned for anyway. But if you do want a different antenna, just get a board with a modular antenna, like some of the Xiao boards from Seeed Studio
Yes, that was in the 'random laptop' context, sorry, I could have made that clearer.
I think that applies too, laptops usually use the same connectors for the Wi-Fi antennas, so you shouldn't have an issue just using something off the shelf that matches the frequency you want
I was really excited about this, but as an average home assistant user couldn't really see an application, lol.
For an SDR? Me and my buddy Claude put the ceiling fans and a bunch of our light plugs onto a homebrew remote I built from a chip and an SDR. Would have gotten the tire pressures from the cars too, but they’re available via Bluetooth.
Super awesome.
Not the point but the Airhona could here is really neat. AN7581 with typical quad Cortex-A53 but then 8x RISC-V network coprocessors. Good luck figuring out how to use that though, whew! (Go Astra go.) https://www.airoha.com/products/p/NpfqGLnZiZuYUZ6N
I've been thinking how beautiful and awesome it is that SDR finally has a real jump. The QuadRF using the rpi's mipi connector was such a glorious hack! Custom ADC from parts. 80MSps. https://www.crowdsupply.com/scale-rf/quadrf
And man what a huge flying leap forward here. 320MSps! Much deeper 14b IQ precision vs 8b. The totally custom mediatek radio firmware is incredible. Such incredible possibility. Maybe someday the mimo can be useful for some of the same neat AoE / beam forming capabilities?
The "network coprocessors" are a bit lame imo. I initially tried to use them for packing, but they turned out to be very memory/cache bandwidth limited. They are also standard risk-v pretty much. I did run custom code on them though (and the Mediatek's "dsp" cores that are a bit more interesting extensions-wise, but are even more memory bw starved). There should be enough left in the tree to get one going pretty fast if one so wishes to play with those cores.
FYI, since it's the same chipset I'm pretty certain this will work on the Banana Pi R4, which has built in PCIe for NVMe.
[flagged]
mt7996 is MTK
I can't keep up with the rapid, non stop cool stuff being discovered! Someone figured out how to get the ESP32 to transmit, at lower bandwidth (I think I read 200-250khz) I don't know which project it was but there are a bunch on this site:
https://www.rtl-sdr.com/esp32-sdr-turbo-mode-throughput-impr...
Holy cow... I've got to limit my projects, so I don't repeat history where I kept finding radio shack bags full of parts for ideas. But you can get 3 of those, with external antennas for less than $60 through amazon. I put it in my wish list instead of buying them now. I've got a data diode to finish first.
Sideband on 13 CM sounds like an amazing thing to pull off.
You can get 3 for way less than $60, eg. https://www.seeedstudio.com/XIAO-ESP32S3-p-5627.html
Having done repairs on a ton of older service monitors, and having my hand in SDR, this is amazing! There's a huge amount of machining and hardware to make a service monitor, but with desktop CNC, cheap PCBS, and jelly bean components that go into the 10s of GHz, the sky's the limit.
I'd add a heat sunk 100 watt DC-5Ghz 20dB fixed attenuator, 0-110 dB switched attenuator, 5 ghz low pass filter, 7-12 Ghz local oscillator/mixer up/down converter, and it would make a small, very high performance service monitor good to 5 Ghz. 8)
Service monitor?
A Communications service monitor is a tool for servicing radios. Until recently, most large organizations used VHF/UHF FM radio for communications on dedicated channels. A service monitor is a tool that can usually absorb the full output power of these radios while measuring power, frequency, distortion, etc. They can also generate a variety of signals for aligning receivers.
Most of the older, affordable models go from almost DC to 1 Ghz. I've got an IFR 2947a, which goes up to 1.05 Ghz.
Here's an example from ebay.
https://www.ebay.com/itm/168770412399
Here's a specification sheet for the one I have, a pdf
https://www.testmart.com/webdata/mfr_pdfs/aerofl/2947a.pdf
Heh, those are a lot shinier than the Cushman my father used when he serviced mobile/handheld police/fire transceivers 20-30 years ago :P
Why 4ghz?
I've edited it, but generally you don't want to have problems with mirror images getting through and creating spurious responses. Real world RF filters don't have infinitely steep edges, so initially I figured a 4 Ghz low pass filter would have enough loss by 5 Ghz to get the job done. I revised to to a 5 Ghz low filter, and a 7-12 Ghz Local Oscillator to give the filter an easier job. Also, the lower the swing in percentage terms for a VCO, the easier it is to work with.
So the signal path in receive mode would be:
N connector / 20 dB 100 watt pad / Switched attenuator / Low pass filter / Front End diodes / Mixer / Router board for DSP
Alternatively, there's usually a second path that skips the attenuator, with a lower maximum power level.
The reverse path would work for generating signals from DC (almost) to 5 Ghz.
Wow that's super cool! It's not DC to daylight but I sure don't know a cheaper way to get a 320 Msps receiver at 5 GHz.
Is this kind of thing why samsung asks you to sign a contract before letting third parties use the FM radios on their phones? Because many phone radios nowadays are software defined?
Which phones still have FM radios?
A lot of Samsung's low end phones sold worldwide still have them.
[dead]
Thanks claude
Yeah, reading stuff like:
"BRINGUP, from a cold radio: what MediaTek's ROM patch does at download (XO, pin mux, the CONN AFE calibration pulse per band, the A-die TOP init by chip ID, pads and CONN switch, the A-dies' eFuse trims); the UMAC pool layout; the common and per-band PHY initialisation; on each A-die the RF init tables, the resistor calibration and the RC filter calibration; the FEM outputs and the crystal trim."
That's not even some other language poorly translated to English, that's just a bunch of words.
Between stuff like this and math "proofs" that aren't readable either I'm really challenged to see the benefit here.
What I get out of this is that one could, if you had the documentation, write a more generalized SDR application for this hardware than the Wifi7 application. That an LLM model can provoke this behavior seems as a good existence proof perhaps?
> That's not even some other language poorly translated to English, that's just a bunch of words.
The language makes sense if you've worked with radio chips or firmware.
Terms like XO (crystal oscillator) and pin mux (chip pin multiplexer, basically assigning pins to their role) are common for embedded work, not just radio work.
Usually in a project you get that language hidden in a separate implementation doc where casual readers won't get confused by it.
Yes there are radio terms in there. :-) That said, I've written combined firmware/gateware drivers for dedicated radio chips and that paragraph makes little sense to me. Even the RFSoC docs from AMD/Xilinx are better written and they are pretty damn dense.
> Even the RFSoC docs from AMD/Xilinx are better written
This project isn't meant to be vendor-quality documentation of the chipset. It's a reverse engineering project that succeeded and included enough documentation to build upon.
Comparing a freely shared reverse engineering proof of concept to vendor-provided 1st party documentation is a ridiculous high bar.
This is a cool project that was just shared hours ago. Criticizing it for not being 1st party vendor documentation quality is a really bad faith criticism.
Okay. So let's pretend it is simple a proof-of-concept (PoC) rather than a full blown project, it's opening paragraph in README.md is:
"Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it."
Does that read paragraph say "Hey check out this PoC!" to you?
So a human, used Claude code to reverse engineer a device. Fine, let THAT be the readme. If it had said, "This is something that was accomplished with Claude code reverse engineering this thing, I have no idea how it works, but that it does work is evidenced by the spectrum I can show."
For those of us who are "skilled in the art" as they say, this reads like "Hey check this out, I bypassed the paywall by putting in my Mom's credit card number!" The lede here is that Claude can reverse engineer things. That was most informatively shown with an article that showed up here titled "All the things I own, owned."
The comment I replied to simply said, "Thanks Claude." Which is droll, but accurate. And, for me, the criticism of showing off something you "did" with a tool you don't understand and whose outputs you don't understand, reminds me strongly of the script kiddies of the 90's and naughts who would boldly proclaim "Hey, check it out, I got root on <website>." when all they had done was run Metasploit and walked through a bunch of scripts until they hit an RCE vulnerability and then used it to gain root (with another script).
So at some point the vendor will go through and patch the holes which the model had exploited and they will have to rewrite their admin architecture, and maybe be liable to some fines with the chip companies if "Intellectual Property" was improperly disclosed by their failure to write good software. And are we any closer to using the products as a general purpose SDR? No, we are not.
Contrast that with the folks who reverse engineered the RealTek DVB-T tuner chip, and had an understanding of what they had done and how it worked, and it spawned a bunch of RTL-SDR dongles that introduced lots of people to SDRs.
It is a really cool project, and it is an interesting proof of concept which could be the starting point for reverse engineering these boxes. But the author chose to present it as a complete ready to go project with documentation of things like their "architecture."
I suspect it is also true that neither the author, and certainly not the large language model, has any idea about how this firmware even works.
It is interesting that the part you nitpicked is the one I made claude do just for fun. Cal and bringup worked just fine with a bundled vendor blob. But I wanted to understand at least some of the steps.
> So at some point the vendor will go through and patch the holes which the model had exploited and they will have to rewrite their admin architecture, and maybe be liable to some fines with the chip companies if "Intellectual Property" was improperly disclosed by their failure to write good software. And are we any closer to using the products as a general purpose SDR? No, we are not.
What? It tunes and it's streaming IQ over Ethernet. It is a general purpose SDR! You can use it as a general purpose SDR immediately.
I'd like a little more information from someone who actually knew what they were doing (or even just asked Claude to write it out in more detail) about the "real" nuts and bolts of the receiver, too (how's does IQ imbalance calibration work? How much dynamic range does it really have? How much can we configure the frontend, in detail?), but I don't think it's fair to claim this project is skiddie-level or not useful at this stage just because it was written by Claude.
Also, who's going to fine Mediatek for exposing Mediatek IP?
> I'm really challenged to see the benefit here.
> write a more generalized SDR application for this hardware
Yeahhh, no. Sorry but the entry barrier is now extremely lowered, especially in effort.
~20 years ago this would have been literally sci-fi. Back then just getting an USRP to work with gnu-radio, then finding the proper hardware external clock, then doing lots of work on reading / trying stuff / writing scripts etc. took a ton of effort and time. Having the ability to throw tokens at it and have at least a starting point is amazing, IMO.
I gave up at this "on each A-die the RF init tables, the resistor calibration and the RC filter calibration"
I'm not new to embedded and electronic stuff, but what is this word-salad.
Is what it feels like to talk to a superhuman intelligence?
I'm doubtful about that. To be pedantic if you consider the set 'superhuman intelligence' to be a proper superset of 'human intelligence', then I would expect it to be able to structure its communications to the level the audience could understand. Does that make sense?
Is is more what it feels like talking to someone who doesn't really understand what it is they are talking about. A lot of keywords but no flow, no conceptual linkages from one part to another. Etc.
There is a test to see if you truly understand something, by explaining the concept to 5 Years old kid.
If someone wants to set up some hardware in a harness and then spend their tokens reverse engineering it, I'm thankful for the publication.
A year ago it was different. I looked at a lot of these vibe-RE projects and a lot of them wouldn't even do what they claimed. Now if someone points a frontier model at some code and lets it consume tokens for a few days, the output is often valuable as a starting point for other projects.
Claude or not: It's a huge breakthrough for ham radio and signal analysis.
We now can programm more manual tuned stuff to turn this into a full 13cm and 5cm radio as it was proven to work.
Before the esp-sdr hack and this one both bands were quite difficult and pricey to reach.
Why is this a breakthrough? Just because the platform costs under $100?
320MSPS at this frequencies for less than $100 that can be extracted over 10GBit/s.
This was worth upper 4- to 5-digit of dollars of equipment before.
I work in this industry and sold more than one kidney for this stuff.
Same for the ESP-SDR project. Most likely it can be used for transmitting on S-Band for satellite control in the future (with an amplifier, dish, maybe some filtering). The HF-Frontend is Wi-Fi certified and therefore quite clean. I've forwarded this project to a friend who's close to ESA staff.
Most people don't have an idea just how expensive high speed Analog to Digital Converters are, yet modern wifi radios often have 2 or 3 at a price under $30. Going to Digikey right now, an ADC capable of 14 bits at 350MSPS is over $200 (quantity 1), and that doesn't come with all the other supporting hardware needed to build a radio. The magic of volume production of hardware in quantities of millions is quite something.
Is it tho ?
The Rigol DHO800 has 1.25Gbps 12 bit ADC and cost less than $500, that is entire machine. I doubt the ADC parts cost more than 10% of machine.
The EEVblog teardown of the DH800 shows that the ADC is a custom Rigol part. Whether it's a rebadged ADC or not is unclear, but I have my doubts that the price point of the Rigol can be hit with off the shelf components from the North American supply chain.
If you could find an off-the-shelf ADC with those capabilities, I'd love to hear where. Last time I checked, I was unable to find anything that would financially make sense compared to just buying the entire oscilloscope, but I may not know where / how to look.
everythign covered by itar is super expensive
https://www.federalregister.gov/documents/2024/09/06/2024-19...
"A resolution of 12 bit or more, but less than 14 bit, with a “sample rate” greater than 400 MSPS;"
You're referencing a 5-figure rig like the ADRV9040 I suppose? I don't work in that industry but I do dabble in SDR hobbies and I guess due to my advancing age I view this as linear progress rather than breakthroughs. Two decades ago it was $1 million worth of junk.
> ADRV9040
Yes. That's a very modern design. Lots of MIMO.. so I assume you will find that beast in cellular base stations.
I'd more see it as a huge jump in the higher frequencies.
>2GHz basically became cheap now over night.
Thanks to Claude&co. it now only takes maybe a few hours to find (or brute force ) potential registers to spit out raw I/Q streams. The last huge breakthrough there was the now rather old Rtlsdr project around the Osmocom dudes.
> Claude&co
OpenAI seething that they didn’t pick a fucking name for their platform.
ChatGPT? Aka Chat-gippty, or chatty? At chat.com?
Try using GPT to write software like this, I don't think just anyone could do it unless they know the problem domain well. Understanding something is not something any AI can replace (yet).
An accurate description is "turn an SDR into an SDR".
More like "turn a locked-down single-purpose SDR into a general-purpose SDR"
What do normal people use SDRs for? I'm genuinely curious. Or is it just cool to do?
At the moment I have 5x RTL-SDR dongles streaming into a box on different bands (137, 433, 912, 978, and 1090 MHz). They pick up all kinds of things, from local weather stations to the water meter for my condo to ADS-B/UAT transmissions from local aircraft. I even see the tire pressure monitor signals from cars that drive by (some of you guys need to add air!).
Mostly it's just fun. I like peeking at all the ambient transmissions in the area.
A while back I was more deeply involved in the SDR space and even reverse-engineered some pager signals. At least a few years ago, pagers were still widely used in hospitals (totally in plaintext, by the way).
I am learning about radio and modulation using SDR (with professor Claude - incredible for learning! Especially if you know exactly what you want to learn and have a strong enough background in somewhat related fields - audio and image DSP for me - to make exercises it writes for me short, relatable, and yet illuminating) and our second lesson after cheap 433 remotes was FLEX and pagers - plenty of that stuff in the city, with about half messages from a hospital a few blocks away. Still very widely used in the US (I live in NYC). Seeing what gets broadcasted there 100% unencrypted was quite a shock. Patient names, ages, and conditions; doctor names, rooms, departments, requests for medications and assistance... Insane amount of super private PII.
Learning the fundamentals behind radio really blew my mind at the time (years ago), and having Claude there to help visualize things must be an incredible boon.
Everything in SDR has an analog equivalent, from local oscillators to PLLs to filtering. In fact most of it simply is a direct implementation of decades-old analog concepts.
But the underlying math is what I found most incredible, where the "true" representation of a signal is complex, and that every real (both in the ordinary and mathematical sense) signal is actually the sum of a positive and negative frequency, such that the complex component cancels out. Phase becomes much more comprehensible as simply the angular component of the signal, and frequency is the derivative of phase. All of this had the indirect effect of improving my understanding of complex numbers as well.
off-topic, but "with professor Claude - incredible for learning! Especially if you know exactly what you want to learn "
This always strikes me in the "oh no look at all the cheating!" anti-ai takes.
Like, the cheating only blew up because there was/is the gap in teacher/professor/moderator understanding of the tools. Kids were copying wikipedia back in the day, and if the kid had a decent vocab, went completely undetected for a time. Then everyone thought they could do it and scorers got suspiscious enough to create a demand for an "is this wikipedia" software such that companies made them and scorers implemented them. We even saw reversions to written exams, and have had continuous use of written exams in 'critical' tests like SAT et al.
And of course, the only reason that the teacher's ensure that the students aren't cheating is because they know the students are heading for tests they can't cheat. So, there's new cheating, there will need to be new detection.
A motivated learner today has unprecedented capabilites compared to a motivated learner of even 10 years ago.
Assuming, of course, that the learner is practicing universally accepted study/research methods such as never implicitly trusting single sources, especially when they're third hand summaries of unverified sources.
I've had proffesors give me incorrect information with every bit of certainty an LLM offers, but it wouldn't be their fault if I just nodded along with either of them.
I’ve got one SDR reading air and VHF, one reading 1090 ADS-B, one on 433MHz reading weather stations, temp sensors, tire pressure modules, lots of stuff; finally a fourth one picking up local 70cm and 2m traffic. Oh and a GPS puck providing a stratum 1 time server. Lots of stuff to do and lots of exploring around your local bands.
Claude is surprisingly good at mapping out complex multi-repeater trunking systems, and identifying DMR vs P25 vs NXDN signals, so even if you know nothing about digital radio, you can be listening in minutes.
Claude is also very good at dashboards. I have my 5 radios all going through different decoders, streaming the data into a SQLite database, then visualized on a custom dashboard. Has tiles for the weather stations, a map for the ADS-B/UAT traffic, a status page for the radios themselves, and so on.
How do you wire up Claude to listen in to your SDR?
I didn’t think it would work either, but prompts like “Analyze the signal at 458.25MHz and determine the digital encoding” were all it took. Claude knew how to use the suite of rtl-sdr command line tools, and wrote throwaway Python scripts to analyze the captured data looking for modulation schemes, codec rates, estimating channel bandwidth, and so on. It was actually pretty impressive.
With some help, it downloaded the fcc licensor databases and ingested them into a SQLite database, which allowed it to identify voice frequencies that correspond to an identified control channel.
You can then use tools like dsd-fme to decode and playback digital voice channels and scan entire trunk systems. I’ve been having a blast lately and learning a lot.
It is cool to do. But there are professional uses for it, particularly like finding interference or noise. You can ask things like: "How crowded is my 2.4 GHz spectrum?"
The RTL SDR is the gateway drug into SDR's. The bandwidth is limited, so don't expect to be capturing HDTV Streams. But it's certainly possible to listen to AM/FM, Ham Bands, VHF/UHF signals, etc.
If you don't want to buy an RTL-SDR, you can search KiwiSDR which is a streaming SDR for frequencies under 30MHz. You can also connect to KiwiSDR's worldwide.
Then if you get the itch, you can go get your a HackRF, a ham license, or whatever else scratches it.
Many consumer temperature, humidity, rain, and wind sensors use simple radio protocols in the 433 MHz band to report their readings back to their indoor display unit.
Stick an RTL-SDR dongle on your computer and use the program rtl_433 to monitor that traffic. It comes with built-in decoders for the protocols for a very large number of those sensors.
I've got such a setup and I can see not only my one sensors (An AcuRite outdoor thermometer, and the two sensors from an AcuRite fridge/freeze thermometer) but also a few neighbor's temperature sensors, humidity sensors, soil moisture sensors, wind speed and direction sensors, rain gauges, and their tire pressure.
You can set up MQTT and have rtl_433 report the data that way, and you can have Home Assistant get that and display it. It knows how to handle a variety of sensor types.
I haven't done that yet. I just have rtl_433 log everything by appending JSON records to a file. A script reads that, finds the sensors I care about, and stores their data in an sqlite database.
I think it is cool to do, but only because first I worked through doing it. I never got around to cleaning the repo up for human consumption, but here’s the resulting code Claude and I assembled for running lights and fans in my living room. https://github.com/tclancy/radiofrequency/blob/main/firmware...
All via a tiny web server in an ESP32 with a radio attached. And the parts I bought for decoding the signals were cheap and let me replicate the process easily. Which reminds me I should push the Claude skill I created for doing this up into that repo. I even had Claude build me a Streamlit app to teach me how to read the signals. https://ook-signal-explorer.streamlit.app/
I've used it to identify transmissions in my neighborhood in the public (ISM) band, listen to various radio broadcasts outside the normal AM/FM, and best of all, track all the planes in my area (ADS-B).
Satdump group uses them receiving all kind of weather satellites. They are mastering S-/X-Band stuff for ages already.
Ham radio operators looking forward using them for 13cm and 5cm band stuff.
It can be used in narrow bands, which makes it unusable for most of SDR use cases. Pretty cool that you can do this on wifi card, but somewhat expected nowadays.
What is the radio quality like SNR?
I'd assume top notch if it's Wi-Fi certified. And basically all Mediatek modems are.
You cannot sell them with the tag if it wasn't connected to standardized certification test system at least once.
Mediatek is the Linux-upstream, boutique kernel recompile, Queen of 802.11 Wi-Fi!
Dope,guys at espargos did the same thing in esp32, there is another 5ghz variant with same LAN port that can give broader sweep and more resolution.
https://espargos.net/espsdr/
wow, could this be turned into a 2.4ghz SAR? I always wondered if it’d be possible to use something like that to pick up wifi signals from much farther away. Of course a more sensible choice would just be to use a yagi antenna
It's RX-only.
Yet.
Ssshhh. Don't wake the FCC.
$80 here? https://www.amazon.com/dp/B0DR7KMNC4
That's quite a good deal...
Yeah, mine is arriving tomorrow, because I totally needed another unused SDR platform.
Am I understanding that this is doing something the chipset wasn’t designed to do?
I’m not seeing a synopsis of the significance of this, for the uninitiated
What is Msps? I’m not familiar with that scale
> Am I understanding that this is doing something the chipset wasn’t designed to do?
Every WiFi modem has a testmode. It's required to verify the TX/RX chain during manufacturing and for compliance testing.
Seemingly you can read out the entire spectrum at full rate.
Getting the testmode to run once is pretty easy to be honest. Getting it running continuously without gaps and then extrating the produced firehose of data is where most of the complexity was. At least for me. Also fuzzing for configurations that were not intended. For example, stock tables only allow for up to 40mhz @ 80msps on the 2.4ghz band.
The big advantage of the ESP32 discovery is its availability, while this device is a unique configuration that isn't available in most places.
Sipeed teased a similar hack using some (undisclosed) USB-wifi chip, though I don't take them seriously as none can get their hands on the chips they tend to use.
Many cheap USB 3 Wifi 5/6 dongles out there, based on RTL8852BU and such. Just one QFN IC and XO. Their "firmware" seems to be a binary blob loaded over USB. I'm skeptical that these "testmodes" can be figured out with just bruteforcing, wonder if they load custom firmware for compliance testing or just leave those routines hanging around in release firmware too.
I didn't see mention of multi-channel? Can you stream 4 x 20/40/80MS/s?
2x 160 can be done pretty easily. Only on same band/LO though. So, only for things like multipath. 4x 80 might be possible, but needs a lot more effort. It is up to 2 ports per icap engine and only one icap engine got coerced into writing to pooled sram. The other 2 could only do their designated regions that are limited to 16KB if I remember right. So continuous reception gets more complicated/precise. Everything above is from me experimenting with HW. There is no official reference for this stuff. So I may have missed something, and some mentioned limitations may be workaroundable.
Maybe have a look at the Zyxel WSM20. This beast costs ~20€ and has a Mediatek chipset.
I was able to get ~40MBit/s of low-rate I/Q out of it.. but didn't patch the Wifi modem firmware as you did.
I think I'm done with wi-fi routers. I believe I stirred the pot enough for others to take it further.
Msps = Mega samples per second
mega samples per second. IOW: sample rate.
The significance is that most off the shelf SDR platforms have much lower specs. Almost all of them use the same Analog Devices transceiver chip.
Anyone know how to get ahold of a device in Europe?
Can you order them from amazon.com? I've ordered stuff from amazon.co.jp and amazon.de before and although it doesn't get there in two days, it does show up eventually.
what is software defined radio receiver?
Conventionally, a radio receiver is a pipeline of electronic components that decode a radio signal into some form you expect: audio, video, digital data, radar returns, whatever. This set of components is typically not "agile": it can decode only a limited set of signal types from some limited set of frequencies, so you need different receiver hardware for different type of radio signals.
Ideally, a software defined receiver replaces all of that with some high speed programmable component that can decode all types of signals across all frequencies, simultaneously. The ideal software defined receiver connects an antenna to a pin on a processor and software does everything digitally: demodulation, filtering, etc.
Physics and the limits of our semiconductor technology doesn't actually permit this ideal to exist. We can, however, achieve some degree of it, and improving components have expanded capabilities and made it cost effective.
ChatGPT would know. I think some parts of a radio system are being done in software, which adds flexibility to its use.
Now if you could also make it transmit such samples a few of those could make a nice DIY phase array for some of the most fun bands to play with.
Can we stop normalising that interesting stuff nowadays is always slop?
[flagged]
Very interesting, thanks for sharing.