Various Projects Find Hidden SDR Capabilities in ESP32 Microcontrollers (rtl-sdr.com)

132 points by nkw 7 hours ago

21 comments:

by mallets 3 hours ago

So many $1 wireless ICs have a powerful "SDR", but will never be documented due to certification/compiliance/export-control reasons. The projects listed here rightly limited the scope to RX-only but Espressif might be forced to "patch" this away if arbitrary TX too is possible (or starts making headlines). Hope it doesn't come to that, more cheap options for RF-to-bits is always welcome.

On a technical note, not much I can find about the signal quality. Phase noise, images, DC Offset, etc. Have to get my hands on one, ESP32-S31 seems promising.

by BlackRabbit1 3 hours ago

I'm pretty sure that that WiFi-7 modems/routers have a similar modes up to 320MHz bandwidth.

The modems could be quite interesting as they are connected via PCIe which can eat a lot of bandwidth.

But they are very difficult (to almost impossible) to find if there isn't anything left in the firmware blob or device driver.

by ErroneousBosh 3 hours ago

> The projects listed here rightly limited the scope to RX-only but Espressif might be forced to "patch" this away if arbitrary TX too is possible

Why would they? It's perfectly legal to operate radio transmitters on any frequency you like, if you hold a suitable licence.

by ssl-3 2 hours ago

It is legal for a person with an appropriate license, yes. But laws (in the US) about RF transmission differ from how many other laws are structured: We're only allowed to transmit what we have permission to transmit -- and by default, we're forbidden.

But right now, I've got an ESP32 WROOM module on a dev board sitting in my windowsill reporting some sensor values over wifi.

The WROOM itself is registered with the FCC[1]. If I stick to using the documented operation, then I have permission to use it in those documented ways. As a practical concept, I don't need a unique license to use it in the way that I am; I'm granted the ability to use it by Part 15 of the FCC rules.

And that's pretty great: The hardware was inexpensive to buy and very easy to find. I was able to spin this sensor up very quickly and get moving on the software side that deals with those readings. It has been a very rewarding little project with a fantastic cost:benefit ratio.

The fear being expressed here (which I don't necessarily subscribe to) is that things like this WROOM module will become less-available when/if methods to use it in undocumented ways are published and start becoming used.

[1]: https://fccid.io/2AC7Z-ESPWROOM32

by wewewedxfgdf an hour ago

>>"We're only allowed to transmit what we have permission to transmit -- and by default, we're forbidden."

It is not true that by default you are forbidden to transmit. In fact there are quite open rules in some ways for transmissions. Whenever these discussions about transmission come up there's always people who, without really undrstanding, freak out about transmitting anything and declare that all tranmissions are illegal. Not so.

USA hobbyists can legally transmit without a licence under FCC Part 15, but the limits are pretty low and depend on the frequency. AM, up to 100 mW into the final RF stage, with the antenna, feedline and ground limited to a total of 3 metres. FM maximum field strength of 250 µV/m measured 3 metres away. There are special cases, such as 49.82–49.90 MHz, where home-built transmitters can go to 100 mW on a 1 metre antenna. One-off home-built transmitters don't need FCC certification if for personal use not being sold.

It's pretty interesting to read if you are a radio head: https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A...

https://www.ecfr.gov/current/title-47/section-15.209

"operation within these frequency bands is permitted under other sections of this part, e.g., §§ 15.231 and 15.241."

-->

0.009-0.490Mhz 0.490-1.705Mhz 1.705-30.0Mhz 30-88Mhz 88-216Mhz 216-960Mhz Above 960Mhz

by ssl-3 31 minutes ago

We're granted permission to make the transmissions you speak of; it is otherwise deny-by-default. This is described right there at the top of your first link, in the first three paragraphs.

It's broadly possible to sort any rule (or superset or subset of rules) into one of two different buckets:

One bucket contains the rules about the things things we're not allowed to do. Like a firewall with a blacklist, whereby we can do whatever we want that explicitly isn't blacklisted. It is allow-by-default.

The other bucket contains the rules about things that we are permitted to do. This is like a firewall with a whitelist, where we can do whatever the whitelist explicitly allows us to do and nothing more. It is deny-by-default.

Drug laws in the USA are in the first bucket (blacklisting). Radio transmission rules in the USA are in the second bucket (whitelisting).

(There is no third bucket.)

by ErroneousBosh an hour ago

The FCC is relevant in exactly one country in the world.

by TeMPOraL an hour ago

Other countries have equivalent organizations and they all tend to be in sync on this stuff.

by mallets 3 hours ago

Legal for end-user, sure. But Espressif might run into trouble with regulators like FCC.

by ErroneousBosh an hour ago

Then sell them in the UK, where the FCC is entirely irrelevant.

We treat RF like your lot treat Mexican fireworks.

by gamblor956 an hour ago

Our border control confiscates Mexican fireworks.

by BlackRabbit1 3 hours ago

As far as I follow the research process it's currently quite difficult to get all data (like the 80MSPS@10-Bit showcase on Reddit) to a computer without a FPGA+USB3.

With the new ESP32-S31 we most likely can extract the I/Q data over its new 1 GBit/s interface. Guessing something around 20-40MSPS should work.

These hack will most likely will be a revolution for 13cm ham radio. With the new 5GHz ESP32 modules most likely also for 5cm. As all Espressif components are WiFi-qualified we can expect a very very stable and robust radio.

I ordered a few and waiting for Ali to deliver them to my lab.

by drtz 3 hours ago

Since I'm a little slow and it took me a minute:

SDR in this context is software defined radio.

by xd1936 3 hours ago

Very exciting!

> However, the current prototype uses the FPGA to clock the ESP32, which results in poor phase noise.

Looks like this was solved five days ago:

https://github.com/h0m3us3r/eSpDR/commit/41a0ffe279119df942e...

by ErroneousBosh 3 hours ago

> undocumented feature that lets the firmware bypass the fixed WiFi and Bluetooth functionality and instead capture raw IQ baseband samples

So kind of like those TV USB sticks that you can adapt into proper SDRs?

by wiml an hour ago

The ones that the website hosting this article is named after?

by brcmthrowaway 3 hours ago

Yep, Matt Ettus converted that to hundreds of millions of dollars

by BlackRabbit1 3 hours ago

RTLSDRs only have a 8-Bit ADC that easily drown next to strong transmitters.

I remember the Ettus devices to be much much much more powerful.

by CamperBob2 an hour ago

Not with RTL-SDR specifically but by introducing one of the first open-architecture SDRs, the USRP.

RTL-SDR is the cheapest imaginable commodity implementation of SDR technology, while USRP was... well, pricy enough to bring in some solid revenue and get his company bought. More power to him, it was (and is) an incredibly useful platform.

by jcrawfordor 2 hours ago

the Ettus USRP SDRs predate RTL-SDR by almost (not quite) a decade.

by ErroneousBosh an hour ago

I was always into the soundcard HF SDRs, they were so simple and elegant. An oscillator, a ring counter, a 4052 MUX and one really fast dual opamp.

Data from: Hacker News, provided by Hacker News (unofficial) API