Uncovering Secret SDR Potential in ESP32 Microcontrollers

Recent independent discoveries have revealed that the popular ESP32 family of microcontrollers possesses undocumented capabilities that allow them to function as Software Defined Radios (SDRs). By bypassing the standard WiFi and Bluetooth stacks, developers can now access raw IQ baseband samples directly from the hardware.

🛠️ Technical Specifications

The ability to capture raw data varies across different models. The primary discovery is that the firmware can be manipulated to ignore fixed wireless protocols in favor of raw signal capture.

Hardware Capability Matrix

📡 The Data Bottleneck

For most models, the internal processing is powerful, but the output to a PC is the limiting factor. Continuous real-time streaming is possible for all models $\rightarrow$ Only snapshots of data can typically be exported due to insufficient output bandwidth.

Consequently, most ESP32-based SDRs are limited to acting as spectrum analyzers. However, there are two major workarounds:

1. The ESP32-S31: Utilizes a Gigabit Ethernet interface to stream at $16\text{ MS/s}$. (Drivers for gqrx and GNU Radio via SoapySDR are currently in development).
2. FPGA Integration: Using external hardware to handle the data throughput.

Signal Flow Architecture

---

🚀 Featured Projects

1. ESPARGOS

Originally designed as a phased array of patch antennas for WiFi direction finding and AR heatmapping, ESPARGOS has evolved.

• New Capability: Because they can now capture phase-coherent IQ samples, they are no longer restricted to WiFi/BT. They can perform direction finding on any signal within the $2.4\text{ GHz}$ band.
• Cautionary Note: The team noted that phase-coherent transmissions are technically possible, but they have chosen not to implement this to prevent potential misuse.

2. The /u/h0m3us3r Implementation

A Reddit user discovered these features independently and paired an ESP32-S3 with an FPGA acting as a USB3 front end.

"The current prototype uses the FPGA to clock the ESP32, which results in poor phase noise." — Initial report

Update: According to a follow-up comment, this has been resolved. The system now uses the ESP's standard crystal, forwarding a "copy" to the FPGA via the I2S master clock. This setup potentially rivals the RTL-SDR in utility but with a higher frequency range ($2.2 - 2.8\text{ GHz}$) and wider bandwidth.

3. C5VRX

This project utilizes the ESP32-C5 to create a real-time 5.8 GHz FPV video receiver.

• Mechanism: It uses the undocumented IQ stream to sample FPV signals.
• Output: Demodulation happens onboard, and the video is output as analog composite via a simple resistor DAC.
• Status: Still experimental; range reliability is currently low.

---

💻 Getting Started & Tools

If you have an ESP32 development board, you can test these capabilities using the ESP-WebSDR page, which allows for browser-based firmware flashing and live waterfall visualization.

Development Checklist

• Flash firmware via ESP-WebSDR
• Configure frequency range ($2.2\text{ GHz} - 2.7\text{ GHz}$)
• Set up SoapySDR (for S31 users)
• Implement FPGA clocking for low phase noise

Example Configuration Logic

// Conceptual representation of bypassing WiFi for IQ capture
void enable_sdr_mode() {
    set_rf_path(BYPASS_WIFI_STACK); 
    set_sample_rate(80_MSPS);
    start_iq_capture(RAW_BASEBAND);
}

📝 Final Thoughts

The discovery of these "hidden" features transforms a cheap microcontroller into a powerful RF tool. While the ESP32-S31 and FPGA-hybrid models offer the most promise for full SDR functionality, even the basic snapshot capability provides an accessible entry point for spectrum analysis.