ESP32 Microcontrollers Found to Have Undocumented SDR Capabilities

Undocumented SDR Functionality Discovered in ESP32

The ESPARGOS team, known for their work with ESP32-based phased arrays, has identified an undocumented feature in several ESP32 microcontrollers. This feature allows the firmware to bypass the standard WiFi and Bluetooth functions to capture raw IQ baseband samples directly. This effectively transforms certain ESP32 models into internal Software Defined Radios (SDRs).

SDR Capabilities and Limitations

The newly discovered SDR capability covers frequency ranges of 2.2–2.7 GHz and, on the ESP32-C5, 4.8–6.0 GHz. These chips can achieve sample rates up to 80 MS/s with analog bandwidths ranging from 13–54 MHz. However, for most ESP32 models, the output bandwidth is limited, restricting their use to spectrum analysis where only snapshots of data can be exported to a PC. Continuous demodulation or decoding of radio data is not feasible with these models alone.

ESP32-S31 and Continuous Streaming

An exception to the data streaming limitation is the new ESP32-S31. This model can continuously stream data at up to 16 MS/s over its Gigabit Ethernet interface. Support for this continuous streaming is expected to be integrated into GNU Radio and gqrx via a SoapySDR driver, enabling full SDR functionality for this specific chip. A web-based tool, ESP-WebSDR, allows users to flash firmware to most ESP32 dev boards directly from a browser to view live spectrum and waterfall displays.

Enhanced Direction Finding and Independent Discoveries

The ESPARGOS project can now perform phase-coherent IQ sample capture, extending its direction-finding capabilities beyond WiFi and Bluetooth to any arbitrary signal in the 2.4 GHz band. Separately, other projects have also independently discovered similar features. Reddit user /u/h0m3us3r demonstrated an ESP32-S3 working as an SDR with an FPGA for continuous streaming to a PC, addressing the data output bandwidth issue, though with current clocking challenges.