多个项目发现 ESP32 微控制器隐藏的 SDR 功能
Various Projects Find Hidden SDR Capabilities in ESP32 Microcontrollers

原始链接: https://www.rtl-sdr.com/various-projects-independently-find-hidden-sdr-capabilities-in-esp32-microcontrollers/

ESPARGOS 团队发现了尚未公开的 ESP32 原始 IQ 信号采集功能,使受支持的开发板能够作为低成本 SDR 使用。其频率覆盖范围为 2.2–2.7 GHz,ESP32-C5 还支持 4.8–6.0 GHz;采样率最高可达 80 MS/s,模拟带宽约为 13–54 MHz。大多数型号只能导出信号快照,因此主要用于频谱分析。ESP32-S31 可通过千兆以太网以最高 16 MS/s 的速率连续传输数据,并计划支持 GNU Radio 和 gqrx。 相位相干采集如今使 ESPARGOS 能够对任意 2.4 GHz 信号进行测向,不再局限于 Wi-Fi 和蓝牙。其他项目也独立采用了类似技术:其中一个项目使用 ESP32-S3 加 FPGA,通过 USB 3 连续传输 IQ 数据,但与时钟相关的相位噪声问题仍未解决;C5VRX 则使用 ESP32-C5 在设备上直接解调 5.8 GHz FPV 视频。ESP-WebSDR 还支持在浏览器中刷写固件并实时查看频谱。

Hacker News 用户对一些项目感到兴奋,这些项目揭示了廉价 ESP32 芯片此前未公开的软件定义无线电能力。ESP32-S3 似乎可以将频率调谐到大约 2.2–2.8 GHz,从而接收 Wi-Fi、802.11p 车辆到基础设施通信,甚至可能接收卫星下行信号。较新的 ESP32-S31 可以通过 USB 传输每秒 2000 万采样的 8 位数据,以较低成本获取远超普通蓝牙和 Wi-Fi 使用范围的频谱。 爱好者认为,这为教育、业余无线电、传感器网络、交通监控和低成本实验带来了巨大机遇。不过,信号质量问题仍然存在,包括相位噪声、镜像和直流偏移。在一些地区,ESP32 开发板也已缺货。 随后展开了一场 lengthy 的监管讨论。参与者指出,各国的发射法规有所不同,而且经过 FCC 认证的硬件必须遵守严格的功率、频率和防篡改要求。尽管 ESP32 芯片已经可以通过 GPIO 技巧或调试接口生成射频信号,但故意滥用这些功能可能造成干扰,并引起监管部门的关注。总体而言,评论者认为,这些发现大幅降低了软件定义无线电实验的成本和复杂度。
相关文章

原文

Back in 2025, we posted about ESPARGOS, a phased array of many patch antennas, each connected to an ESP32 WiFi microcontroller. ESPARGOS could be used to determine the direction of arrival for WiFi signals and create a live augmented reality heatmap.

Recently, the ESPARGOS team has made an exciting discovery. They found that several ESP32 chips have an undocumented feature that lets the firmware bypass the fixed WiFi and Bluetooth functionality and instead capture raw IQ baseband samples. As a result, several ESP32 models can now be used as an internal SDR covering 2.2–2.7 GHz, plus 4.8–6.0 GHz on the ESP32-C5, with up to 80 MS/s sample rate and roughly 13–54 MHz of analog bandwidth, depending on the chip.

However, for use as a general-purpose PC-connected SDR, the output bandwidth is insufficient, so only snapshots of data can be exported to a PC. This means that the SDR will only work as a spectrum analyzer, and demodulating or decoding continuous radio data is not possible with just an ESP32. The exception is the new ESP32-S31, which can stream continuously at up to 16 MS/s over its Gigabit Ethernet interface, with a SoapySDR driver for GNU Radio and gqrx coming soon. If you want to try it yourself, the ESP-WebSDR page lets you flash the firmware to most ESP32 dev boards directly from your browser and view a live spectrum and waterfall.

Furthermore, ESPARGOS notes that phase-coherent IQ sample capture is now possible with their hardware. This means ESPARGOS is no longer limited to WiFi and Bluetooth signals; it can now perform direction finding on any arbitrary signal in the 2.4 GHz band. The team also says phase-coherent transmissions would be possible, but they aren't implementing them right now because they could be misused.

It also seems that, independently, at least two other projects discovered the same or similar features around the same time, but to solve different problems.

Over on Reddit, user /u/h0m3us3r discovered the same feature and uploaded it to GitHub on Sept 26, and recorded a video showing an ESP32-S3 working as an SDR with an FPGA used as a USB3 front end. Unlike ESPARGOS, h0m3us3r's project streams the raw IQ data to a PC continuously via the FPGA rather than in snapshots, so full demodulation/decoding on PC should be possible. However, the current prototype uses the FPGA to clock the ESP32, which results in poor phase noise. So if the clocking issues can be resolved, an ESP32 combined with an FPGA could make a standard general-purpose SDR, like the RTL-SDR, but with a 2.2–2.8 GHz frequency range and up to 80 MHz of bandwidth.

Another project that seems to be using a somewhat similar finding is C5VRX, which was first uploaded to GitHub on August 13. C5VRX uses an ESP32-C5 as a 5.8 GHz real-time FPV video receiver. Although this project appears to use a different mechanism, the result is similar: it uses an undocumented IQ data stream on the ESP32 to sample FPV signals and demodulate them onboard, outputting analog composite video through a simple resistor DAC. The project is still a work in progress and doesn't yet work reliably at range.

eSpDR ESP32 80 MHz output to SDR++
eSpDR ESP32 80 MHz output to SDR++
联系我们 contact @ memedata.com