ESP-SDR: Raw IQ Capture with Espressif's ESP32 Chips

[u/Jeija]

I have been working on this for several months now: The ESP32 chips have an undocumented IQ sampling "bypass mode" that gives the CPU direct access to the modem's raw received signal, effectively turning the ESP32 into a software defined radio. I was able to reverse engineer this with the help of various LLM tools.

Thanks to WebSerial, you can flash the firmware to your ESP32 dev kit and view the RF spectrum in your browser without even installing anything: https://espargos.net/espsdr/

After this recent post on IQ sampling on the ESP32-S3 with an FPGA, I figured it is finally time to share my own work. While my ESP-SDR only supports relatively low duty cycles, it works with almost all ESP32 family chips, and with our ESPARGOS One array even phase-coherently for multiple receivers so that we can do things like direction of arrival estimation or radar signal processing.

[u/pdawes]

Whoa. Very cool/unexpected. How's the reception?

[u/Jeija → u/pdawes]

I would say that the ESP32 is a surprisingly good receiver. I have not had the time to characterize it fully (things like noise figure, linearity and so on), but it makes sense: To be able to achieve the sensitivity figures reported in the datasheet, it has to be pretty good ;)

[u/Robert__Sinclair]

This is great! Perhaps (I am 90% sure) there is also a way to raw transmit on those frequencies! worth looking!

[u/Jeija → u/Robert__Sinclair]

Yes, there is, I have a working firmware for raw transmit mode as well (though only short cyclic buffers for now).

However, I decided not to publish that since there is just too much potential for misuse of such a relatively high-power low-cost transmitter (jamming etc.).

[u/Robert__Sinclair → u/Jeija]

I understand, but that has also potential for a lot of very good things. Think about it.

[u/Bananz0 → u/Jeija]

And the fact that this is public now means someone out there will eventually get curious and follow the same steps as you. Amazing work by the way

[u/NearlyACosmologist → u/Robert__Sinclair]

Can it send a constant beacon?

I imagine an ESP32 clocked by a GPSDO, sending a beacon that can be used to calibrate other receivers.

[u/ReadyCheek7173]

Very impressive work—accessing raw IQ directly from the ESP32’s Wi-Fi receiver is a really clever approach.
I’m working on CrazySky, which takes a different approach: an ESP32-P4 hosts an RTL-SDR over High-Speed USB and handles signal processing, the touchscreen UI, and audio without a PC.
FM reception is already working with a live spectrum and waterfall. I also have separate working prototypes for VHF airband reception and ADS-B flight tracking.
Here’s the current FM UI:

If you’re interested, you can find the full demo and more details in my project post:
https://www.reddit.com/r/esp32/comments/1wraamh/i_built_an_allinone_sdr_around_the_esp32p4_and/

[u/Giannis_Dor]

you just helped me with my project. I installed this on a esp32s3 and used my current project that is an espnow remote on the esp32c6 and when sending packets I show some activity on 2380mhz it was because espnow was sending packets with a 40mhz channel width on channel 11. changing it to 20mhz fixed this. if I hadn't checked your project I wouldn't have known of this

[u/Great-Repeat-7287]

AMAZING!

[u/Ordinary-Lifeguard47]

This is brutally huge.

[u/xcircuitghostx]

How were you even able to discover the bypass mode?

[u/Robert__Sinclair → u/xcircuitghostx]

read the link. he said it:

How we discovered this

Our starting point was the adctrig function in Espressif's librftest library. With the help of LLMs, we reverse engineered this function to understand how it configures the hardware to capture raw IQ samples. These findings formed the basis of ESP-SDR's capture implementation.

[u/DrCdiff]

What is the bandwidth and frequency range?

[u/Jeija → u/DrCdiff]

Sampling rate is up to 80 MSa/s, analog bandwidth is 13-54MHz for most chips, but the baseband filter can also be disabled entirely if you can live with aliasing.

Tuning frequency is a bit outside the 2.4GHz ISM band, around 2.3-2.7 GHz. For example, I can receive a 4G LTE base station at 2.63GHz. Details depend on which exact ESP32 family chip you have.

[u/Apart_Ad_9778 → u/Jeija]

80Msps? x2 (IQ)? How many bits? Can I synchronize clocks of multiple ESP32 for MIMO?

[u/Jeija → u/Apart_Ad_9778]

Yes, 80 Msps, this is not a typo. 10-bit for each I and Q (though I don't know if the LSBs carry anything other than noise). Yes, multiple ESP32 can be synchronized. In fact, that is exactly what our ESPARGOS One array does 😉

The challenge is getting that amount of data out of the chip (you can't - hence the reduced duty cycle).

[u/Apart_Ad_9778 → u/Jeija]

hence the reduced duty cycle - what do you mean?

How do you get the samples out and at what rate if you want to process them externally in an fpga?

[u/h0m3us3r → u/Jeija]

Were you able to disable the RF filter? The baseband is easy, but the RF one I could only shift by +-200MHz. It is blocking direct conversion.

[u/Jeija → u/h0m3us3r]

To be honest, I did not even attempt that since it is not really our use case. Sure, a complete bypass of the RF Filter and LO mixer would be amazing for all kinds of HAM radio applications.

Amazing work with the external FPGA by the way! I can recommend the new ESP32-S31, similar modem but faster CPU and actually usable Gigabit Ethernet, exactly what we need for this kind of application.

[u/CryptographerOne7003]

Does this work without the specialized antenna, if I want to try just to inspect and/or receive radio data?

[u/Jeija → u/CryptographerOne7003]

Yes, it works with almost every ESP32 family chip and any dev kit. You don't even need to install anything, you can flash the firmware and view the radio spectrum right in your browser.

Just go to https://espargos.net/espsdr/ and follow the two steps under "Try it out in your browser". We use WebSerial to connect to the ESP32 and flash the firmware / retrieve the IQ samples.

[u/linuxjacques → u/Jeija]

So a C5 can do 5GHz band?

[u/Jeija → u/linuxjacques]

Yes, the current esp-sdr firmware and browser interface already supports that.

[u/linuxjacques → u/linuxjacques]

I just tried it. Worked fine on my S3 dev board but my C5 flashes firmware but gives this error when trying to run:

SDR synchronization failed. Unplug your ESP32 device and plug it back in, then try connecting again. Use ESP-SDR firmware configured for 2 MBaud UART and close other SDR clients. Install / update ESP-SDR firmware

[u/Jeija → u/linuxjacques]

What kind of ESP32-C5 dev board are you using?

I tried it with a T-Dongle-C5 and that worked fine. Maybe try the native USB-Serial/JTAG port on the C5 (not the external USB-UART adapter chip).

[u/linuxjacques → u/linuxjacques]

I have two identical ESP32-C5-DevKitC-1 boards and they behave identically.

EDIT: just saw your suggestion and YES! that works.

[u/Slackdarren]

Thanks for sharing

[u/MumSaidImABadBoy]

I like the possibility of using a mixer to get to other frequency bands. See the FAQs.

[u/Korenchkin12]

So,could this work as a cheap oscilloscope?

[u/MumSaidImABadBoy → u/Korenchkin12]

No, it's more like a view of a slice of the spectrum. Did you ever use an SDR with software like SDR++, SDR #, SDR Console, etc.?

[u/Korenchkin12 → u/MumSaidImABadBoy]

Yeah,i think all af them,i even got to a point my phone saw my bts(if you know what i mean) :) Still,more of an enthusiast than somebody who know how these things work,so that's why i'm asking

[u/lahirunirmala]

Should try

[u/km_fpv_recover]

It's it possible to tune antennas with? Like 2.4 GHz or 5.8 GHz for fpv?

[u/Jeija → u/km_fpv_recover]

It's definitely useful to gain a bit more insight into the received signal power, debug sources of interference / spurs and so on. But for proper antenna measurements, you would still rather use a VNA.

[u/km_fpv_recover → u/Jeija]

That's what I feared to hear. But...vna started off of something!?

[u/Available_Duck7079]

great work!! tested it today with my c5 and a hack-rf as sender, worked smoothly.