Last week we posted about BirriaSDR, which turns cheap MT7921-based USB 3.0 Wi-Fi dongles into a 2.4 / 5 GHz SDR. Now Daniel has written in about his project Mtk79ICAP, a similar project that uses a forked Linux mt76 driver and a patched MediaTek firmware to stream 14-bit I/Q from the chip’s internal capture engine.
The key difference is that Mtk79ICAP includes a SoapySDR module, so the dongle works directly in GQRX, SDR++, and GNU Radio Companion. It supports 20, 40, and 80 MHz bandwidths on both bands, including 80 MHz on 2.4 GHz, and Wi-Fi monitor mode can keep running in parallel while I/Q is streamed.
The project is still experimental and Linux-only, with uncalibrated levels and some variability at 80 MHz on 2.4 GHz. Still, with multiple teams now working on these dongles, the MT7921 is quickly maturing into a usable, low-cost wideband SDR.
With AI-in-the-loop reverse engineering, things are heating up, and we're starting to see a gold rush of reverse-engineered Wi-Fi radios turning into software-defined radios. Just yesterday, we posted about h0m3us3r's discovery of how a Gemtek W1700K Wi-Fi 7 router could be turned into a 320 Msps SDR. And the week before, we posted about the ESP32-SDR discovery.
Today, a new Wi-Fi dongle-turned-SDR has been discovered, and this time it is probably the most accessible one. Over on X @luigifcruz, author of the popular CyberEther tool, has announced that he has reverse engineered a commodity US$30 USB 3.0 Wi-Fi dongle with the help of GPT-6 Astra, and discovered a RAW I/Q stream which can be exported over USB3.0. This effectively turns the Wi-Fi dongle into a 2.4 GHz / 5 GHz SDR, capable of exporting 40 Msps at 14-bit ADC resolution. Luigi named the new SDR 'BirriaSDR' after the Birria Taco he was eating at a restaurant while using AI to reverse-engineer the WiFi dongle. The open-source repo is available on GitHub.
This is probably the most accessible of the newly discovered Wi-Fi SDRs because it is cheap, mass-produced, readily available, and has useful export bandwidth. The ESP32-SDR suffers from a lack of usable export bandwidth, meaning that getting usable amounts of IQ data onto a PC is impossible without hacking in an FPGA. The Gemtek W1700K Wi-Fi 7 router has an incredible 320Msps IQ bandwidth and an effective export via Ethernet, but it is expensive and not really available for purchase anywhere anymore.
Luigi has added support for the BirriaSDR in his CyberEther software through an input block and sample flowgraph.
It remains to be seen how popular these dongles will become, and if they'll become a new type of RTL-SDR like device. If there is a sudden influx of purchasers, sellers may put the pricing up. We also note that Wi-Fi dongles are limited to the 2.4/5 GHz bands, where there aren't that many interesting signals to play with. However, as Luigi suggests, modifying the dongle to add a front-end mixer is a possibility. The HackRF already uses a 2.4 GHz IF architecture, so a similar type of front end could be used.
Just last week we posted about ESP32-SDR, which is custom firmware for ESP32's indpendently discovered by two experimenters that transforms them into a full software defined radio.
Now, h0m3us3r, one of the discoverers of the ESP32-SDR hack, has discovered a way to turn a Gemtek W1700K Wi-Fi 7 router, which uses a MediaTek MT7996 chip, into a wideband software-defined receiver. Compared to the ESP32's maximum 80 Msps sample rate, this newly discovered Wi-Fi chip captures a massive 320 MSps. And most importantly, unlike the ESP32, the router has a built-in 10 GbE Ethernet SoC, which lets you stream full-bandwidth data out and ingest it on a PC.
As a result, you can capture the entire 2.4 GHz band and a wide portion of the 5 GHz band live and stream the spectrum to a Linux host running a live spectrum and waterfall display.
Other devices that run the MediaTek MT7996 Wi-Fi chip include the Banana Pi BPI-R4, GL.iNet Flint 4, and Gemtek XR1710G, however it is unclear if this firmware will run on those devices.
The entire 2.4 GHz Wi-Fi Spectrum at the max 320 Msps sample rate.
AI Disclaimer: Claude is listed as a contributor to the repo.
