HN
Today

Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver

This GitHub project transforms a consumer WiFi 7 router into a high-performance software-defined radio receiver. By replacing proprietary firmware with custom code and leveraging the router's powerful MediaTek chips and 10 GbE, it achieves 320 Msps of 14-bit IQ data across multiple GHz bands. It's popular on HN for its impressive hardware hacking, detailed reverse engineering, and the sheer coolness of turning a networking device into a versatile radio analysis tool.

10
Score
0
Comments
#5
Highest Rank
6h
on Front Page
First Seen
Oct 12, 4:00 PM
Last Seen
Oct 12, 9:00 PM
Rank Over Time
2258978

The Lowdown

The h0m3us3r/w1700k-sdr project showcases a remarkable feat of hardware reverse engineering and custom firmware development, repurposing a Gemtek W1700K WiFi 7 router into a sophisticated wideband software-defined radio (SDR) receiver. This ambitious endeavor bypasses manufacturer firmware entirely, leveraging the router's MediaTek MT7996 radio and Airoha AN7581 SoC to capture and stream raw radio frequency data at extremely high rates.

  • Hardware Transformation: The project replaces the router's stock firmware with custom code built from scratch, allowing direct control over the MediaTek MT7996 radio. This involves reverse-engineering MediaTek's initialization and calibration routines register by register.
  • High Performance: The modified router can capture 14-bit complex IQ data at speeds up to 320 Msps (Mega-samples per second), with an experimental 640/2 Msps mode.
  • Wide Frequency Coverage: It operates across 2.4 GHz, 5 GHz, and 6 GHz bands, supporting precise tuning to any frequency the synthesizer locks at, not just predefined channels.
  • Data Transport: Raw IQ data is streamed over the router's 10 Gigabit Ethernet port using zero-copy UDP datagrams, with on-radio compression (packing) to optimize bandwidth usage.
  • Host Software: A suite of host-side tools provides functionality including receiving and processing the IQ stream (w1700k-stream), real-time spectrum and waterfall display via a web UI (w1700k-spectrum), and stream recording (sdr-recv).
  • Custom Firmware Details: The project includes custom U-Boot, Linux kernel patches, and firmware for the MT7996 radio (ROM patch, WM for radio control, WA for packing), all developed without any MediaTek proprietary code.
  • Safety and Installation: The firmware is receive-only, ensuring no accidental transmissions. Installation involves replacing the stock OS but includes NAND backup. Users are warned about potential hardware hangs from accessing undocumented addresses.
  • Open Source: The entire project is open-source under various licenses (MIT, GPL-2.0, BSD-3-Clause-Clear).

This project exemplifies the power of open-source development and hardware hacking, transforming a consumer networking device into a powerful and flexible tool for radio spectrum analysis, all built on a foundation of painstaking reverse engineering and custom software.