Tagged: esp32-sdr

Etherbulb: An ESP32-C3 Smart Bulb That Changes Color Based on Nearby RF Signals

Thank you to Peter Holzhauser for writing in and sharing his latest open-source project, "Etherbulb," a technical-art project that builds on his ESPSoup project that we previously posted.

Etherbulb turns an ESP32-C3-based smart bulb into an ambient RF spectrum monitor.  Etherbulb uses the ESP-SDR discovery to capture IQ data at 80 MSps 25 times per second, then runs an FFT on the chip, covering 2.13 to 2.73 GHz. This range includes Wi-Fi, Bluetooth, Zigbee/Thread, analog FPV video, and LTE/5G Bands 1, 7, and 38. The signals are then mapped to visible colors, such as blue for Bluetooth and green for Wi-Fi, with brightness scaling with signal strength.

The bulb serves its own web dashboard with a live waterfall, spectrum and signal log, and it stays on your Wi-Fi network while listening. You can assign colors, brightness, and sensitivity per signal type, or drag a range on the waterfall to create custom rules. It includes 26 presets, from ExpressLRS to microwave ovens, plus 412 mobile network bands for 39 European countries. Supported hardware includes a 12W RGBCW E27 bulb, flashable over Wi-Fi, and the BTF SP530E LED strip controller, which needs a first UART flash and can drive five strips at once, one per signal type.

Etherbulb: Turning a ESP32 WiFi Bulb Into an ambient RF spectrum display
Etherbulb: Turning an ESP32 WiFi Bulb Into an ambient RF spectrum display

AI Disclaimer: This code lists Claude as a contributor.

BirriaSDR: 2.4 / 5 GHz SDR Discovery on a Mass-Produced USB3.0 Wi-Fi Dongle

With AI-in-the-loop reverse engineering, things are heating up, and we're starting to see a gold rush of reverse-engineered Wi-Fi radios turning into software-defined radios. Just yesterday, we posted about h0m3us3r's discovery of how a Gemtek W1700K Wi-Fi 7 router could be turned into a 320 Msps SDR. And the week before, we posted about the ESP32-SDR discovery.

Today, a new Wi-Fi dongle-turned-SDR has been discovered, and this time it is probably the most accessible one. Over on X @luigifcruz, author of the popular CyberEther tool, has announced that he has reverse engineered a commodity US$30 USB 3.0 Wi-Fi dongle with the help of GPT-6 Astra, and discovered a RAW I/Q stream which can be exported over USB3.0. This effectively turns the Wi-Fi dongle into a 2.4 GHz / 5 GHz SDR, capable of exporting 40 Msps at 14-bit ADC resolution. Luigi named the new SDR 'BirriaSDR' after the Birria Taco he was eating at a restaurant while using AI to reverse-engineer the WiFi dongle. The open-source repo is available on GitHub.

This is probably the most accessible of the newly discovered Wi-Fi SDRs because it is cheap, mass-produced, readily available, and has useful export bandwidth. The ESP32-SDR suffers from a lack of usable export bandwidth, meaning that getting usable amounts of IQ data onto a PC is impossible without hacking in an FPGA. The Gemtek W1700K Wi-Fi 7 router has an incredible 320Msps IQ bandwidth and an effective export via Ethernet, but it is expensive and not really available for purchase anywhere anymore. 

BirriaSDR supported dongles are any Wi-Fi dongle using the MT7921 chip. These are available in USB dongle format on Amazon, currently for US$26.99. There are also various MT7921 based M.2 and PCIe cards available for anywhere between US$16 and US$34. Many laptops may already have these Wi-Fi cards pre-installed.

Luigi has added support for the BirriaSDR in his CyberEther software through an input block and sample flowgraph.

It remains to be seen how popular these dongles will become, and if they'll become a new type of RTL-SDR like device. If there is a sudden influx of purchasers, sellers may put the pricing up. We also note that Wi-Fi dongles are limited to the 2.4/5 GHz bands, where there aren't that many interesting signals to play with. However, as Luigi suggests, modifying the dongle to add a front-end mixer is a possibility. The HackRF already uses a 2.4 GHz IF architecture, so a similar type of front end could be used.

BirrariaSDR Running in CyberEther
BirrariaSDR Running in CyberEther

Turning a Wi-Fi 7 Router into a 320 Msps SDR

Just last week we posted about ESP32-SDR, which is custom firmware for ESP32's indpendently discovered by two experimenters that transforms them into a full software defined radio.

Now, h0m3us3r, one of the discoverers of the ESP32-SDR hack, has discovered a way to turn a Gemtek W1700K Wi-Fi 7 router, which uses a MediaTek MT7996 chip, into a wideband software-defined receiver. Compared to the ESP32's maximum 80 Msps sample rate, this newly discovered Wi-Fi chip captures a massive 320 MSps. And most importantly, unlike the ESP32, the router has a built-in 10 GbE Ethernet SoC, which lets you stream full-bandwidth data out and ingest it on a PC.

As a result, you can capture the entire 2.4 GHz band and a wide portion of the 5 GHz band live and stream the spectrum to a Linux host running a live spectrum and waterfall display.  

Other devices that run the MediaTek MT7996 Wi-Fi chip include the Banana Pi BPI-R4, GL.iNet Flint 4, and Gemtek XR1710G, however it is unclear if this firmware will run on those devices.

The entire 2.4 GHz Wi-Fi Spectrum at the max 320 Msps sample rate.
The entire 2.4 GHz Wi-Fi Spectrum at the max 320 Msps sample rate.

AI Disclaimer: Claude is listed as a contributor to the repo.

ESP32-SDR: Turbo Mode Throughput Improvement + Real I/Q Output

Thank you to Zoltan Doczi for writing in and sharing with us an article he's written explaining how he managed to speed up the ESP32-SDR's sampling time by 50x. The ESP32 has recently been discovered to have undocumented features that let it be used as an SDR. However, ESP32s have very limited USB bandwidth, so the full 80 MS/s I/Q sample rate cannot be sent to a PC, and hence only the spectrum data can be sent to a browser-based UI in bursts with gaps in between.

Previously, the gap was ~42 ms between bursts. However, Zoltan's investigation managed to yield a 50x speedup. The core idea was to implement a data buffer ring across three SRAM banks, so the dump engine never has to stop.

The result is a gapless spectrum output that can rival spectrum analyzers worth thousands of dollars. Zoltan's article explains how the implementation works and provides multiple characterization measurements made with a Signal Hound VSG60 signal generator. 

ESP32 Turbo Mode outputting 80 MS/s / 256 bins, filter wide open: 1295 spectra/s, gapless on chip.
ESP32 Turbo Mode outputting 80 MS/s / 256 bins, filter wide open: 1295 spectra/s, gapless on chip.

Zoltan's work on the SRAM buffer bank also enabled a real I/Q output, albeit limited to a maximum bandwidth of 250 ksps, which we are now starting to see in some ESP32-SDR projects.

To receive the 250ksps limited I/Q data stream on a PC with SDR++, Zoltan created sdrpp-esp-sdr-source, an SDR++ source module that lets an ESP32 act as a real SDR. And then by using a moRFeus signal generator as an upconverter with LO set at 2259.1 MHz, a 90.9 MHz broadcast FM station is mixed up to 2350 MHz. Zoltan was then able to receive the broadcast FM signal with the ESP32-SDR in SDR++.

The module can also stream the full 80 MHz spectrum to SDR++, but this is spectrum data only - no I/Q, so nothing can be demodulated.

The ESP32-S3 Wi-Fi radio is now listening to the FM broadcast band!

ESP32 Showing the Full BCFM Band Spectrum (Spectrum Only - No IQ Data, No Demod Possible)
ESP32 Showing the Full BCFM Band Spectrum (Spectrum Only - No IQ Data, No Demod Possible)