Tagged: ESP32

ESP32-SDR: Turbo Mode Throughput Improvement + Real I/Q Output

Thank you to Zoltan Doczi for writing in and sharing with us an article he's written explaining how he managed to speed up the ESP32-SDR's sampling time by 50x. The ESP32 has recently been discovered to have undocumented features that let it be used as an SDR. However, ESP32s have very limited USB bandwidth, so the full 80 MS/s I/Q sample rate cannot be sent to a PC, and hence only the spectrum data can be sent to a browser-based UI in bursts with gaps in between.

Previously, the gap was ~42 ms between bursts. However, Zoltan's investigation managed to yield a 50x speedup. The core idea was to implement a data buffer ring across three SRAM banks, so the dump engine never has to stop.

The result is a gapless spectrum output that can rival spectrum analyzers worth thousands of dollars. Zoltan's article explains how the implementation works and provides multiple characterization measurements made with a Signal Hound VSG60 signal generator. 

ESP32 Turbo Mode outputting 80 MS/s / 256 bins, filter wide open: 1295 spectra/s, gapless on chip.
ESP32 Turbo Mode outputting 80 MS/s / 256 bins, filter wide open: 1295 spectra/s, gapless on chip.

Zoltan's work on the SRAM buffer bank also enabled a real I/Q output, albeit limited to a maximum bandwidth of 250 ksps, which we are now starting to see in some ESP32-SDR projects.

To receive the 250ksps limited I/Q data stream on a PC with SDR++, Zoltan created sdrpp-esp-sdr-source, an SDR++ source module that lets an ESP32 act as a real SDR. And then by using a moRFeus signal generator as an upconverter with LO set at 2259.1 MHz, a 90.9 MHz broadcast FM station is mixed up to 2350 MHz. Zoltan was then able to receive the broadcast FM signal with the ESP32-SDR in SDR++.

The module can also stream the full 80 MHz spectrum to SDR++, but this is spectrum data only - no I/Q, so nothing can be demodulated.

The ESP32-S3 Wi-Fi radio is now listening to the FM broadcast band!

ESP32 Showing the Full BCFM Band Spectrum (Spectrum Only - No IQ Data, No Demod Possible)
ESP32 Showing the Full BCFM Band Spectrum (Spectrum Only - No IQ Data, No Demod Possible)

 

esp32-sdr-trx: Use an ESP32-S3 as a Receiver for SDR++ and as an FM/SSB Voice Transmitter on 13cm

Thank you to Jochen (DA2JH) for writing in and sharing with us his project, esp32-sdr-trx,  a software-defined transceiver built from a single ESP32-S3 dev board and two USB cables.

esp32-sdr-trx uses the same undocumented I/Q dump that we posted about previously, which was first discovered by h0m3us3r. To be able to get the data off the ESP32 and into the PC via the ESP32's limited USB streaming bandwidth, it is necessary to decimate the IQ data oln the chip down to 250 or 333 ksps. Then to keep things simple, the espdr-rx tool presents itself as an rtl_tcp server, allowing any RTL-SDR compatible software like SDR++ and GNU Radio to receive data within 1.84 to 2.79 GHz.

On the transmit side, the espdr-tx tool is used to transmit narrowband FM or SSB voice in the 13cm amateur band via a WAV file, audio pipe or sound card. Jochen notes that the ESP32 has no I/Q input so the PHY's test-tone carrier is steered in frequency and amplitude 40,000 times a second (polar modulation).

Jochem notes that there are several limitations to be aware of with this software and hardware "one board and one Linux host tested; the transmitter's power is not calibrated and its harmonics were not measured; transmitting needs an amateur radio licence (the tool asks for confirmation, and the firmware only sends in 2320 to 2450 MHz)".

The ESP32-S3 (Top) |  SDR++ receiving a PlutoSDR through the ESP32 (Left) | SDR++ receiving SSB voice transmitted by the ESP32 with a HackRF. (Right)
The ESP32-S3 (Top) | SDR++ receiving a PlutoSDR through the ESP32 (Left) | SDR++ receiving SSB voice transmitted by the ESP32 with a HackRF (Right)

AI Disclaimer: Jochen notes that much of the code and documentation for this project was written with Claude.

ESPsoup: Turn an ESP32-C5 into a 2.4 & 5 GHz Pocket Scanner with a Connected Phone or PC

Thank you to Peter Holzhauser for writing in and sharing with us his latest open-source project, 'ESPsoup'. Peter has written in previously to share his Android app, V2X2MAP, which detects and plots vehicle V2X (car-to-car) communications used by some modern cars. His new project, ESPsoup, combines an ESP32-C5 and a connected PC or phone into a fully featured scanner for the 2.4 GHz and 5 GHz bands.

ESPsoup has various features including a live spectrum view up to 80 MHz wide, a sweep mode to monitor larger bandwidths, a GPS-enabled heatmapping tool, Bluetooth analysis tools, an AirTag detector, WiFI analysis tools, a car-to-car V2X monitor, a smart home sensor reader, a drone remote ID detector, a microwave oven detector, and an analog FPV video demodulator and display.

The website notes that if you want to monitor multiple FPV drone video channels, up to eight ESP32-C5s have been tested to work together on a single USB hub connected to a PC.

Peter notes that he is planning to add RTL-SDR support to ESPsoup in approximately two weeks, so keep an eye out on their website for updates.

ESPsoup screenshots from a mobile device.
ESPsoup screenshots from a mobile device.

Various Projects Independently Find Hidden SDR Capabilities in ESP32 Microcontrollers

Back in 2025, we posted about ESPARGOS, a phased array of many patch antennas, each connected to an ESP32 WiFi microcontroller. ESPARGOS could be used to determine the direction of arrival for WiFi signals and create a live augmented reality heatmap.

Recently, the ESPARGOS team has made an exciting discovery. They found that several ESP32 chips have an undocumented feature that lets the firmware bypass the fixed WiFi and Bluetooth functionality and instead capture raw IQ baseband samples. As a result, several ESP32 models can now be used as an internal SDR covering 2.2–2.7 GHz, plus 4.8–6.0 GHz on the ESP32-C5, with up to 80 MS/s sample rate and roughly 13–54 MHz of analog bandwidth, depending on the chip.

However, for use as a general-purpose PC-connected SDR, the output bandwidth is insufficient, so only snapshots of data can be exported to a PC. This means that the SDR will only work as a spectrum analyzer, and demodulating or decoding continuous radio data is not possible with just an ESP32. The exception is the new ESP32-S31, which can stream continuously at up to 16 MS/s over its Gigabit Ethernet interface, with a SoapySDR driver for GNU Radio and gqrx coming soon. If you want to try it yourself, the ESP-WebSDR page lets you flash the firmware to most ESP32 dev boards directly from your browser and view a live spectrum and waterfall.

Furthermore, ESPARGOS notes that phase-coherent IQ sample capture is now possible with their hardware. This means ESPARGOS is no longer limited to WiFi and Bluetooth signals; it can now perform direction finding on any arbitrary signal in the 2.4 GHz band. The team also says phase-coherent transmissions would be possible, but they aren't implementing them right now because they could be misused.

It also seems that, independently, at least two other projects discovered the same or similar features around the same time, but to solve different problems.

Over on Reddit, user /u/h0m3us3r discovered the same feature and uploaded it to GitHub on Sept 26, and recorded a video showing an ESP32-S3 working as an SDR with an FPGA used as a USB3 front end. Unlike ESPARGOS, h0m3us3r's project streams the raw IQ data to a PC continuously via the FPGA rather than in snapshots, so full demodulation/decoding on PC should be possible. However, the current prototype uses the FPGA to clock the ESP32, which results in poor phase noise. So if the clocking issues can be resolved, an ESP32 combined with an FPGA could make a standard general-purpose SDR, like the RTL-SDR, but with a 2.2–2.8 GHz frequency range and up to 80 MHz of bandwidth.

Another project that seems to be using a somewhat similar finding is C5VRX, which was first uploaded to GitHub on August 13. C5VRX uses an ESP32-C5 as a 5.8 GHz real-time FPV video receiver. Although this project appears to use a different mechanism, the result is similar: it uses an undocumented IQ data stream on the ESP32 to sample FPV signals and demodulate them onboard, outputting analog composite video through a simple resistor DAC. The project is still a work in progress and doesn't yet work reliably at range.

eSpDR ESP32 80 MHz output to SDR++
eSpDR ESP32 80 MHz output to SDR++

ESP32 Bit Pirate Updates: New LoRa and Meshtastic Analysis Features

Back in September 2025, we posted about the "ESP32 Bus Pirate" firmware, which transforms an ESP32-S3 into a multi-protocol debugging and hacking tool. We later covered an update in March 2026 that added waterfall displays, cellular modem support, and an external radio expander.

Although the ESP32 does not have true SDR capabilities, it can leverage its numerous built-in radio hardware components to achieve a range of interesting SDR-like features. Recently, "Geo," the creator of the ESP32 Bus Pirate, wrote in to share some recent firmware updates with us.

Geo notes that the project is now called "ESP32 Bit Pirate" and now includes LoRa/SX1262 support and Meshtastic analysis features.

ESP32 Bit Pirate can now transmit and receive LoRa packets, monitor RSSI, scan frequency activity, display a simple waterfall view and perform Channel Activity Detection. Radio parameters including frequency, bandwidth, spreading factor, coding rate, transmit power, preamble and sync word can be configured directly from the interface.

Packets can also be recorded to the ESP32 filesystem and replayed later together with their original radio configuration.

A dedicated Meshtastic analysis shell has also been added, allowing users to send, receive and inspect Meshtastic packets. The goal is not to replace a Meshtastic node, but to provide a debugging and experimentation interface for understanding and interacting with LoRa/Meshtastic traffic.

The latest update has also added new LoRa hardware support for the Heltec Vision Master T190 and Heltec WiFi LoRa 32 V4, a browser-based debugging ecosystem, a Python scripting lab, and a BPIO2 USB adapter mode.

The project is entirely open source, and the code can be found on their GitHub page.

ESP32 Bit Pirate LoRa Support Added
ESP32 Bit Pirate LoRa Support Added

V2X2MAP: Visualize European 5.9 GHz V2X Vehicle and Traffic Signal Messages with an Android App and ESP32

Thank you to Peter for writing in and sharing news about his Android app called V2X2MAP, which makes Vehicle-to-Everything (V2X) radio traffic visible on a live map via an attached ESP32 board. The app is not free but costs only a small US$2.49 fee.

V2X is a cooperative wireless system in which vehicles and roadside infrastructure continuously broadcast small messages in the 5.9 GHz band. Equipped cars broadcast their position, speed, heading, and brake status about 10 times per second, while traffic signals broadcast their phase and timing, lane geometry, and event-driven hazard warnings. It can be thought of as something like ADS-B or AIS for cars, though at a much shorter range (typically a couple of hundred meters), with the added feature that roadside infrastructure also transmits.

V2X is designed to enhance vehicle safety, allowing vehicles to know about obstacles, traffic phases, and road geometry in advance. Currently, two incompatible standards are used: the older DSRC (Wi-Fi-based) and the newer C-V2X (cellular-based). Most markets are moving towards C-V2X because it provides short and long-range communications.

The V2X2MAP Android app works together with a $20 Waveshare ESP32-C5 board, which has an onboard 5.9 GHz WiFi 6 radio. The ESP32 receives the older Wi-Fi DSRC signals, particularly the ITS-G5 standard, which appears to be used only in Europe. Once running, V2X2MAP and the ESP32 decode the surrounding V2X broadcasts and plot live vehicles, hazard warnings, and traffic-light countdowns on a map of your immediate area.

V2X2MAP Screenshots
V2X2MAP Screenshots

ESP32 Bus Pirate: Update Brings Waterfall Displays, Cellular Modem Support and External Radio Expander

Back in September 2025, we posted about the "ESP32 Bus Pirate" firmware, which transforms an ESP32-S3 into a multi-protocol debugging and hacking tool. Although the ESP32 does not have true SDR capabilities, it can leverage its numerous built-in radio hardware components to achieve a range of interesting feats. Recently, "Geo," the creator of the ESP32 Bus Pirate, wrote in to share some recent firmware updates with us. He writes:

The ESP32-Bus-Pirate project is an open-source firmware that transforms inexpensive ESP32-S3 boards into versatile hardware hacking and debugging tools. Inspired by tools like the Bus Pirate and Flipper Zero, the firmware allows a single ESP32 device to interact with a wide range of digital buses, radios, and hardware interfaces.

Because ESP32 boards include integrated WiFi and Bluetooth radios and can interface with many external modules, the firmware makes it possible to experiment with both hardware protocols and RF systems using very low-cost hardware.

The firmware currently supports a wide range of protocols and devices including:

I²C, SPI, UART, CAN, 1-Wire, infrared, smartcards, Sub-GHz radios, RF24 modules, WiFi, Bluetooth and cellular modems.

Major New Features in v1.5

The latest release adds several major capabilities useful for hardware analysis and RF experimentation.

Waterfall Spectrum Displays

Multiple RF modules can now display real-time waterfall visualizations, showing signal peaks and activity across frequencies. This is available for:

• Sub-GHz radios
• RF24 modules
• FM radio modules
• WiFi channel activity

This makes it easier to visually monitor RF environments directly from the device.

Sub-GHz Improvements

The Sub-GHz subsystem has been completely reworked for improved reliability when recording, replaying and receiving RF frames. Raw payload transmission is also supported.

Cellular Modem Support

ESP32-Bus-Pirate can now interact with cellular modem modules, allowing users to inspect modem and network information and perform operations such as:

• Dumping SIM card data
• sending SMS
• dialing calls

External Radio Expander

The firmware now supports an **external UART radio expansion module** called the **ESP32 Bus Expander**, which allows adding additional RF hardware modules to the system, notably for the WiFi 5GHz.

Links

Project:
https://github.com/geo-tp/ESP32-Bus-Pirate

Web Flasher:
https://geo-tp.github.io/ESP32-Bus-Pirate/webflasher/

Documentation:
https://github.com/geo-tp/ESP32-Bus-Pirate/wiki

Scripts collection:
https://github.com/geo-tp/ESP32-Bus-Pirate-Scripts

ESP32 Bus Expander:
https://github.com/geo-tp/ESP32-Bus-Expander

ESP32 Bus Pirate. Left - Running on COTS ESP32-S3 based devices. Right - ESP32 Bus Pirate Interface
ESP32 Bus Pirate. Left - Running on COTS ESP32-S3 based devices. Right - ESP32 Bus Pirate Web Interface

ESP32 Bus Pirate: Turn your ESP32 into a Multi-Purpose Hacker Tool

Thank you to "Geo" for writing in and sharing with us his open source project called "ESP32-Bus-Pirate" which he thinks might be of interest to those in the RTL-SDR community. The ESP32 is a popular low-cost microcontroller due to the fact that it has WiFi and Bluetooth capabilities built in. Although the ESP32 does not have true SDR capabilities, it can leverage its numerous built-in hardware radio components to achieve various interesting feats. Geo writes:

This firmware turns an inexpensive ESP32-S3 board into a multi-protocol debugging and hacking tool, inspired by the original Bus Pirate and the Flipper Zero.

It currently supports a wide range of protocols and devices, including I²C, SPI, UART, 1-Wire, CAN, infrared, smartcards, and more. It also communicates with radio protocols as Subghz, RFID, RF24, WiFi, Bluetooth.

Compared to existing solutions, the focus is on:

Accessibility — runs on cheap ESP32-S3 hardware (around $7–$10).

Versatility — one device can probe, sniff, and interact with multiple buses.

Extensibility — open-source and modular, making it easy to add new protocol support.

I believe this could be useful for hardware hackers, security researchers, and hobbyists looking for a low-cost, flexible alternative to commercial tools.

With the firmware installed on a compatible ESP32 device, it is possible to create WiFi, Bluetooth, and RF24 sniffers, scanners, and spoofers, as well as perform general sub-GHz and RFID sniffing, scanning, and replay attacks. It also has a host of non-RF capabilities useful for hacking devices.