Various Projects Independently Find Hidden SDR Capabilities in ESP32 Microcontrollers

Back in 2025, we posted about ESPARGOS, a phased array of many patch antennas, each connected to an ESP32 WiFi microcontroller. ESPARGOS could be used to determine the direction of arrival for WiFi signals and create a live augmented reality heatmap.

Recently, the ESPARGOS team has made an exciting discovery. They found that several ESP32 chips have an undocumented feature that lets the firmware bypass the fixed WiFi and Bluetooth functionality and instead capture raw IQ baseband samples. As a result, several ESP32 models can now be used as an internal SDR covering 2.2–2.7 GHz, plus 4.8–6.0 GHz on the ESP32-C5, with up to 80 MS/s sample rate and roughly 13–54 MHz of analog bandwidth, depending on the chip.

However, for use as a general-purpose PC-connected SDR, the output bandwidth is insufficient, so only snapshots of data can be exported to a PC. This means that the SDR will only work as a spectrum analyzer, and demodulating or decoding continuous radio data is not possible with just an ESP32. The exception is the new ESP32-S31, which can stream continuously at up to 16 MS/s over its Gigabit Ethernet interface, with a SoapySDR driver for GNU Radio and gqrx coming soon. If you want to try it yourself, the ESP-WebSDR page lets you flash the firmware to most ESP32 dev boards directly from your browser and view a live spectrum and waterfall.

Furthermore, ESPARGOS notes that phase-coherent IQ sample capture is now possible with their hardware. This means ESPARGOS is no longer limited to WiFi and Bluetooth signals; it can now perform direction finding on any arbitrary signal in the 2.4 GHz band. The team also says phase-coherent transmissions would be possible, but they aren't implementing them right now because they could be misused.

It also seems that, independently, at least two other projects discovered the same or similar features around the same time, but to solve different problems.

Over on Reddit, user /u/h0m3us3r discovered the same feature and uploaded it to GitHub on Sept 26, and recorded a video showing an ESP32-S3 working as an SDR with an FPGA used as a USB3 front end. Unlike ESPARGOS, h0m3us3r's project streams the raw IQ data to a PC continuously via the FPGA rather than in snapshots, so full demodulation/decoding on PC should be possible. However, the current prototype uses the FPGA to clock the ESP32, which results in poor phase noise. So if the clocking issues can be resolved, an ESP32 combined with an FPGA could make a standard general-purpose SDR, like the RTL-SDR, but with a 2.2–2.8 GHz frequency range and up to 80 MHz of bandwidth.

Another project that seems to be using a somewhat similar finding is C5VRX, which was first uploaded to GitHub on August 13. C5VRX uses an ESP32-C5 as a 5.8 GHz real-time FPV video receiver. Although this project appears to use a different mechanism, the result is similar: it uses an undocumented IQ data stream on the ESP32 to sample FPV signals and demodulate them onboard, outputting analog composite video through a simple resistor DAC. The project is still a work in progress and doesn't yet work reliably at range.

eSpDR ESP32 80 MHz output to SDR++
eSpDR ESP32 80 MHz output to SDR++

Using an Affordable Optical Encoder as an SDR Tuning Wheel

Thank you to Gerrit (PA3BYA) for writing in and sharing a hardware project he completed that combines an affordable optical encoder and a microcontroller with custom firmware to create a high-resolution USB mouse wheel for SDR tuning. Many people prefer using a knob to tune through the bands rather than a keyboard and mouse. Gerrit writes:

Although I initially developed it for use with the RTL-SDR, it is actually a general-purpose tuning solution that can be used with virtually any SDR software. Many SDR projects use a cheap mechanical rotary encoder with, for example, 24 pulses per revolution.

But why settle for a 24-pulse mechanical encoder when an affordable optical encoder can provide 600 pulses per revolution? For this quick SDR experiment, I combined a high-resolution optical encoder with a tiny Digispark ATtiny85 and turned it into a standard USB mouse wheel for tuning.

The result is a surprisingly simple and platform-independent tuning control that works with SDR software on macOS, Windows, Linux, and even a Raspberry Pi.

The encoder he used is a cheap Chinese part, costing around 17 Euros. However, one interesting issue that Gerrit encountered was that the cheap encoder would not reliably operate when powered from 5V, even though the operating voltage was specified as 5V to 24V. To fix this, he suspected that the input LDO was dropping too much voltage at the low 5V end, so he modified the encoder by shorting the input and output of the 78M05 regulator, to allow direct 5V power without any dropout.

His firmware for the ATtiny85 is open source and can be found on GitHub.

The Optical Encoder and ATTiny85 Microcontroller
The Optical Encoder and ATTiny85 Microcontroller

FoxSDR Updates: Node Canvas, Single Map Display, Linux+Android Builds, Locating Air Traffic Radar Positions

Thank you to wonderingStars for writing in and sharing updates to his FoxSDR software program. FoxSDR is a new AI-coded software that supports all common protocols and SDRs.

The first update that wonderingStars notes is the addition of a node canvas where you can wire radios, decoders, speakers, and displays together. It can run up to five SDRs at the same time, each with its own decoders. This is now FoxSDR's main screen.

The second update is a map that can accept multiple inputs from multiple decoders, allowing users to plot various data streams such as ADS-B, AIS, amateur high-altitude balloons, and more on a single map.

The third update is that Linux x64 builds are now published, although they are noted to still be in development. An Android arm64 build has also been released in alpha form. To access this, users will need to sign up to test.

The final update adds a new radar sweep feature, which locates the positions of air-traffic radars around you by listening to 1090 MHz. The author explains:

Secondary surveillance radars rotate and interrogate aircraft transponders as their beam passes. Aircraft that broadcast ADS-B also report their own position, so every reply they give reveals where a radar was pointing at that moment. Radar Sweep collects these replies over hours and works out each radar's location, rotation speed and direction on its own. It then draws bearing lines towards aircraft that answer the radar but broadcast no position, and marks a position where two radars' lines cross.

It is the same idea as PlanePlotter's Beamfinder, except that Radar Sweep finds the radar sites itself instead of being given them. It is not affiliated with PlanePlotter or its authors.

In testing on a 12.8-hour recording, it confirmed two radars, each within about 5 km of a published airfield position. Bearings to held-out aircraft had a median error of 0.3°.

You need a 1090 MHz antenna, an SDR running at 2 MS/s or more, and a few hours of traffic. Radar Sweep remembers the radars it finds and never reveals your location.

It is available free to FoxSDR users in the United States.

The author also wanted to share an upcoming feature, which is the GUI builder, which will allow you to customize your own GUI.

FoxSDR: New Node Canvas + Radar Sweep
FoxSDR: New Node Canvas + Radar Sweep

AI Disclaimer: wonderingStars describes their company as a human-gated AI company, and FoxSDR is AI coded.

NNJ-SDR++: Improved Firmware and Software for Kintex-7 AD9361 B210 Clones

USRP B210 Chinese clones can now be commonly found on marketplace sites for less than USD$300. This is a bargain, considering that an original USRP B210 (board only) costs US$2,387. The disadvantage is, of course, janky ported firmware that doesn't support all the available features and doesn't maximize the available performance.

Recently, Fabrizio Francione wrote in and wanted to share his new firmware and software project, called "NNJ-SDR++ UHD Edition V1.0". This project consists of improved firmware that unlocks the full sample rate, fixes various problems, and enables the onboard GNSS receiver. It also includes a modified SDR++ frontend that exposes more controls. Fabrizio writes:

The work involved substantial FPGA and software development rather than simply customizing the SDR++ interface. Starting from the original B210-compatible architecture, I progressively redesigned and extended several areas of the firmware, including improved CIC numerical handling, RX/TX fixed-point processing, BRAM-based asynchronous transport FIFOs, CIC passband compensation, a wideband FIR receive path, ADC clipping/overload telemetry, runtime FPGA control and diagnostics, and a dedicated wideband profile for operation at up to 56 MS/s.

I also finally integrated the board's onboard u-blox MAX-M10S GNSS receiver directly with the FPGA, including GPS UART data, internal PPS capture and timing telemetry, while preserving external 10 MHz reference and PPS support.

On the host side, I developed a customized UHD 4.10 environment and SDR++ frontend for both Windows and Linux. The application exposes RF filter bandwidth, LO offset, reference lock, PPS status, GNSS information, firmware telemetry and other board-specific controls directly from the SDR++ source panel.

One particularly interesting part of the project was making sustained 56 MS/s operation practical across both operating systems while retaining B210/UHD compatibility.

The Firmware is not open source or free, and Fabrizio is selling it for US$19.90.

The inside of a B210 Clone
The inside of a B210 Clone
Kintex-7 FPGA & custom SDR++ : 56 MHz Wideband Waterfall

RF-Traffic-Monitor: Track Aircraft, Ships, Drones and Radiosondes in One Program

Thank you to Stefanos (Steeod) for sharing a new program he created, "RF-traffic-monitor." Stefanos created this program because he initially wanted to install adsb.im (an ADS-B feeder image that also tracks ships, radiosondes, and ACARS/VDL2/HFDL) on Windows 10, but was unsuccessful in doing so, as adsb.im is written for Linux machines.

So, to get around this, Stefanos decided to fire up ChatGPT to write his own similar Windows program. The end result was RF-traffic-monitor, which is capable of tracking aircraft, ships, and radiosondes using an RTL-SDR or HackRF. It can also use the SDR to decode ACARS, VDL2, and HFDL. With a compatible WiFi adatper the software is also capable of tracking drones via Wi-Fi Remote ID.

RF-Traffic-Monitor Screenshot
RF-Traffic-Monitor Screenshot

AI Disclaimer: The author notes that this program was written by ChatGPT.

Echo Pro: KiwiSDR, OpenWebRX, WebSDR and FM-DX iOS Browser App now with Live Transcription and Translation

Back in April we posted about the release of Echo, a free iOS app designed for browsing global web-based KiwiSDR, OpenWebRX, WebSDR, and FM-DX software-defined radios. Mark, the developer of Echo, has written in to us again and wanted to share news about the release of the Pro (paid) version of Echo.

Echo Pro adds several features such as recording, on-device transcription and translation, iCloud sync, and the ability to access recordings across Apple devices. The transcription and translation service may be quite interesting, as it allows you to record an entire foreign radio program to text, and translate it to your language for later reading.

Echo Pro costs either US$4.99/month or US$39.99/year. More information about the app is available at echosdr.com.

Promo images from Echo
Promo images from Echo

RTL-SDR Pager: Android App for Receiving and Decoding POCSAG and FLEX Pager Messages

Thank you to Christian from ebcTech.eu for writing in and sharing with us the release of his new Android app called "RTL-SDR Pager" (Google Play Store link). The app is designed to work with an RTL-SDR dongle connected to the Android device. It is capable of decoding POCSAG and FLEX messages. However, Christian notes that he hasn't been able to test FLEX decoding so far because there are no FLEX channels in his area, so he would be interested in any feedback on this.

The app also provides push alerts, allowing you to monitor for a specific RIC or keyword and allows you to save channel lists.

The app offers a free demo that allows up to 50 messages. Upgrading to unlimited messages costs $3.99.

Screenshots of the ebcTech RTL-SDR Pager App
Screenshots of the ebcTech RTL-SDR Pager App

KhanfarRX: Mayhem External App for the PortaPack H4M with Band Plan Tuning, Band Lock, EIBI “On Air Now” and FT8 Geo Map

Thank you to M Khanfar for writing in and sharing his new app for the HackRF PortaPack H4M, KhanfarRX. The program aims to make listening to HF on the PortaPack a much better experience. Khanfar writes:

KhanfarRX: Never get lost in the HF bands! A free external app for the HackRF PortaPack H4M (Mayhem firmware).

In this video I show KhanfarRX, an app that makes HF listening on the PortaPack H4M much easier.

It has an easy band plan, a band lock that keeps you inside the band you choose, and a live EIBI browser that shows which shortwave stations are on the air right now.

WHAT KHANFARRX GIVES YOU

  • Easy band plan: HAM HF/VHF, broadcast, airband and marine bands in one clean menu
  • Stay in the band: tuning wraps around inside the band edges, so you can't drift out. One tap on DisableHF returns to free tuning
  • EIBI "On Air Now": see which shortwave stations are broadcasting at this moment and tune in with one touch
  • Correct mode automatically: AM/LSB/USB for HF, NFM for marine, AM for airband, WFM for FM broadcast
  • Full receiver: live waterfall, RSSI, recorder, gain and squelch, like the stock Mayhem Audio app

Not mentioned in Khanfar's notes is that KhanfarRX also comes with an FT8 Geo map. This plots every received FT8 message on a map displayed by the PortaPack's screen.

PortaPack H4M · Mayhem External KhanfarRX App