Thank you to Logan Zarov for writing in and sharing D325f-SDR, a project that turns the cellular modem in an old LG D325 (L70 Dual) Android phone into a software-defined radio. This is another in a series of wireless devices being reverse-engineered into SDRs with the help of AI. Recently we've seen the ESP-SDR, W1700K-SDR, BirrariaSDR, and LR2021 LoRa-SDR projects. From now on, we're calling these newly discovered SDRs "Sleeper SDRs": commodity RF devices with hidden SDR capabilities that have been discovered and tapped.

To activate D325f-SDR mode, the phone needs to be rooted and running LineageOS 14.1 with TWRP and a custom kernel. A small patch is then applied to the Hexagon firmware on the phone's Qualcomm MSM8610 modem, which enables the ability to stream raw 8-bit IQ samples at 7.68 MS/s (about 5 MHz of bandwidth) into a shared memory buffer that the custom kernel sets up. An Android app based on Dennis Mantz's RF Analyzer then shows the spectrum and waterfall and demodulates AM, FM, SSB, and CW on the phone itself.

Tuning works by hooking into the modem's stock PLL calculation. Logan has confirmed PLL lock from 1.7 to 2.17 GHz and has received an 1875 MHz cellular base station downlink directly. To get below 800 MHz, the app uses an interesting trick. It keys the phone's own Bluetooth transmitter to produce a carrier in the 2.4 GHz ISM band, and uses that carrier as a mixer. In this mode, Logan has received FM broadcast stations, an analog TV carrier at 551.25 MHz, and shortwave AM stations between 8 and 15 MHz, including speech at 14.970 MHz.

For the hardware modification, the B8 and B1 RF bypass wires are brought out to the phone's 3.5 mm headphone jack, and an antenna plugs in through a homemade SMA-to-3.5 mm adapter.

Logan is upfront about the limitations. So far it has only been built and tested on one phone, and calibrated sensitivity figures haven't been published yet. The modem-side buffer is only about 8 ms long, so a busy CPU can stop the stream. The Bluetooth carrier coupling technique also hasn't been characterized. We also note that the phone actively transmits a Bluetooth carrier in the below-800 MHz mode, which probably violates the Bluetooth module's certification and could make this mode legally grey.

The code is open source under the GPL-3.0-or-later license and available on GitHub. Logan has also written up a detailed explanation of how it works, with IQ analysis, and shared raw IQ recordings. 

AI Disclaimer: The project's credits note that AI tools assisted with code development and documentation.