Category: ESP32

Etherbulb: An ESP32-C3 Smart Bulb That Changes Color Based on Nearby RF Signals

Thank you to Peter Holzhauser for writing in and sharing his latest open-source project, "Etherbulb," a technical-art project that builds on his ESPSoup project that we previously posted.

Etherbulb turns an ESP32-C3-based smart bulb into an ambient RF spectrum monitor.  Etherbulb uses the ESP-SDR discovery to capture IQ data at 80 MSps 25 times per second, then runs an FFT on the chip, covering 2.13 to 2.73 GHz. This range includes Wi-Fi, Bluetooth, Zigbee/Thread, analog FPV video, and LTE/5G Bands 1, 7, and 38. The signals are then mapped to visible colors, such as blue for Bluetooth and green for Wi-Fi, with brightness scaling with signal strength.

The bulb serves its own web dashboard with a live waterfall, spectrum and signal log, and it stays on your Wi-Fi network while listening. You can assign colors, brightness, and sensitivity per signal type, or drag a range on the waterfall to create custom rules. It includes 26 presets, from ExpressLRS to microwave ovens, plus 412 mobile network bands for 39 European countries. Supported hardware includes a 12W RGBCW E27 bulb, flashable over Wi-Fi, and the BTF SP530E LED strip controller, which needs a first UART flash and can drive five strips at once, one per signal type.

Etherbulb: Turning a ESP32 WiFi Bulb Into an ambient RF spectrum display
Etherbulb: Turning an ESP32 WiFi Bulb Into an ambient RF spectrum display

AI Disclaimer: This code lists Claude as a contributor.

BirriaSDR: 2.4 / 5 GHz SDR Discovery on a Mass-Produced USB3.0 Wi-Fi Dongle

With AI-in-the-loop reverse engineering, things are heating up, and we're starting to see a gold rush of reverse-engineered Wi-Fi radios turning into software-defined radios. Just yesterday, we posted about h0m3us3r's discovery of how a Gemtek W1700K Wi-Fi 7 router could be turned into a 320 Msps SDR. And the week before, we posted about the ESP32-SDR discovery.

Today, a new Wi-Fi dongle-turned-SDR has been discovered, and this time it is probably the most accessible one. Over on X @luigifcruz, author of the popular CyberEther tool, has announced that he has reverse engineered a commodity US$30 USB 3.0 Wi-Fi dongle with the help of GPT-6 Astra, and discovered a RAW I/Q stream which can be exported over USB3.0. This effectively turns the Wi-Fi dongle into a 2.4 GHz / 5 GHz SDR, capable of exporting 40 Msps at 14-bit ADC resolution. Luigi named the new SDR 'BirriaSDR' after the Birria Taco he was eating at a restaurant while using AI to reverse-engineer the WiFi dongle. The open-source repo is available on GitHub.

This is probably the most accessible of the newly discovered Wi-Fi SDRs because it is cheap, mass-produced, readily available, and has useful export bandwidth. The ESP32-SDR suffers from a lack of usable export bandwidth, meaning that getting usable amounts of IQ data onto a PC is impossible without hacking in an FPGA. The Gemtek W1700K Wi-Fi 7 router has an incredible 320Msps IQ bandwidth and an effective export via Ethernet, but it is expensive and not really available for purchase anywhere anymore. 

BirriaSDR supported dongles are any Wi-Fi dongle using the MT7921 chip. These are available in USB dongle format on Amazon, currently for US$26.99. There are also various MT7921 based M.2 and PCIe cards available for anywhere between US$16 and US$34. Many laptops may already have these Wi-Fi cards pre-installed.

Luigi has added support for the BirriaSDR in his CyberEther software through an input block and sample flowgraph.

It remains to be seen how popular these dongles will become, and if they'll become a new type of RTL-SDR like device. If there is a sudden influx of purchasers, sellers may put the pricing up. We also note that Wi-Fi dongles are limited to the 2.4/5 GHz bands, where there aren't that many interesting signals to play with. However, as Luigi suggests, modifying the dongle to add a front-end mixer is a possibility. The HackRF already uses a 2.4 GHz IF architecture, so a similar type of front end could be used.

BirrariaSDR Running in CyberEther
BirrariaSDR Running in CyberEther

ESP32-SDR: Turbo Mode Throughput Improvement + Real I/Q Output

Thank you to Zoltan Doczi for writing in and sharing with us an article he's written explaining how he managed to speed up the ESP32-SDR's sampling time by 50x. The ESP32 has recently been discovered to have undocumented features that let it be used as an SDR. However, ESP32s have very limited USB bandwidth, so the full 80 MS/s I/Q sample rate cannot be sent to a PC, and hence only the spectrum data can be sent to a browser-based UI in bursts with gaps in between.

Previously, the gap was ~42 ms between bursts. However, Zoltan's investigation managed to yield a 50x speedup. The core idea was to implement a data buffer ring across three SRAM banks, so the dump engine never has to stop.

The result is a gapless spectrum output that can rival spectrum analyzers worth thousands of dollars. Zoltan's article explains how the implementation works and provides multiple characterization measurements made with a Signal Hound VSG60 signal generator. 

ESP32 Turbo Mode outputting 80 MS/s / 256 bins, filter wide open: 1295 spectra/s, gapless on chip.
ESP32 Turbo Mode outputting 80 MS/s / 256 bins, filter wide open: 1295 spectra/s, gapless on chip.

Zoltan's work on the SRAM buffer bank also enabled a real I/Q output, albeit limited to a maximum bandwidth of 250 ksps, which we are now starting to see in some ESP32-SDR projects.

To receive the 250ksps limited I/Q data stream on a PC with SDR++, Zoltan created sdrpp-esp-sdr-source, an SDR++ source module that lets an ESP32 act as a real SDR. And then by using a moRFeus signal generator as an upconverter with LO set at 2259.1 MHz, a 90.9 MHz broadcast FM station is mixed up to 2350 MHz. Zoltan was then able to receive the broadcast FM signal with the ESP32-SDR in SDR++.

The module can also stream the full 80 MHz spectrum to SDR++, but this is spectrum data only - no I/Q, so nothing can be demodulated.

The ESP32-S3 Wi-Fi radio is now listening to the FM broadcast band!

ESP32 Showing the Full BCFM Band Spectrum (Spectrum Only - No IQ Data, No Demod Possible)
ESP32 Showing the Full BCFM Band Spectrum (Spectrum Only - No IQ Data, No Demod Possible)

 

esp32-sdr-trx: Use an ESP32-S3 as a Receiver for SDR++ and as an FM/SSB Voice Transmitter on 13cm

Thank you to Jochen (DA2JH) for writing in and sharing with us his project, esp32-sdr-trx,  a software-defined transceiver built from a single ESP32-S3 dev board and two USB cables.

esp32-sdr-trx uses the same undocumented I/Q dump that we posted about previously, which was first discovered by h0m3us3r. To be able to get the data off the ESP32 and into the PC via the ESP32's limited USB streaming bandwidth, it is necessary to decimate the IQ data oln the chip down to 250 or 333 ksps. Then to keep things simple, the espdr-rx tool presents itself as an rtl_tcp server, allowing any RTL-SDR compatible software like SDR++ and GNU Radio to receive data within 1.84 to 2.79 GHz.

On the transmit side, the espdr-tx tool is used to transmit narrowband FM or SSB voice in the 13cm amateur band via a WAV file, audio pipe or sound card. Jochen notes that the ESP32 has no I/Q input so the PHY's test-tone carrier is steered in frequency and amplitude 40,000 times a second (polar modulation).

Jochem notes that there are several limitations to be aware of with this software and hardware "one board and one Linux host tested; the transmitter's power is not calibrated and its harmonics were not measured; transmitting needs an amateur radio licence (the tool asks for confirmation, and the firmware only sends in 2320 to 2450 MHz)".

The ESP32-S3 (Top) | SDR++ receiving a PlutoSDR through the ESP32 (Left) | SDR++ receiving SSB voice transmitted by the ESP32 with a HackRF. (Right)
The ESP32-S3 (Top) | SDR++ receiving a PlutoSDR through the ESP32 (Left) | SDR++ receiving SSB voice transmitted by the ESP32 with a HackRF (Right)

AI Disclaimer: Jochen notes that much of the code and documentation for this project was written with Claude.

ESPsoup: Turn an ESP32-C5 into a 2.4 & 5 GHz Pocket Scanner with a Connected Phone or PC

Thank you to Peter Holzhauser for writing in and sharing with us his latest open-source project, 'ESPsoup'. Peter has written in previously to share his Android app, V2X2MAP, which detects and plots vehicle V2X (car-to-car) communications used by some modern cars. His new project, ESPsoup, combines an ESP32-C5 and a connected PC or phone into a fully featured scanner for the 2.4 GHz and 5 GHz bands.

ESPsoup has various features including a live spectrum view up to 80 MHz wide, a sweep mode to monitor larger bandwidths, a GPS-enabled heatmapping tool, Bluetooth analysis tools, an AirTag detector, WiFI analysis tools, a car-to-car V2X monitor, a smart home sensor reader, a drone remote ID detector, a microwave oven detector, and an analog FPV video demodulator and display.

The website notes that if you want to monitor multiple FPV drone video channels, up to eight ESP32-C5s have been tested to work together on a single USB hub connected to a PC.

Peter notes that he is planning to add RTL-SDR support to ESPsoup in approximately two weeks, so keep an eye out on their website for updates.

ESPsoup screenshots from a mobile device.
ESPsoup screenshots from a mobile device.