Since the discovery of an undocumented I/Q sampling feature in ESP32 chips about two weeks ago, there has been a flood of similar features found in other wireless chips, including LoRa and Wi-Fi chipsets. The latest chip to join their ranks is the MediaTek MT7921AU, often used in Wi-Fi adapters, with two different projects developing independent SDR drivers for it in recent days.
The first was BirriaSDR, which discovered that the chip exposes raw I/Q samples for debugging and calibration; BirriaSDR instead streams these to the host at 40 Msps and 14-bit resolution, with the option to tune from 2156 to 2610 MHz. BirriaSDR uses libusb to communicate directly with the Wi-Fi adapter and access its registers; it does not make permanent firmware changes, so the Wi-Fi adapter returns to its original state after being used as an SDR. BirriaSDR implements an API similar to the RTL-SDR’s.
Mtk79ICAP, in contrast, exposes the MT7921AU’s sampling feature via a standard SoapySDR interface. Unlike BirriaSDR, it applies some firmware changes to the chip, and it requires a modified driver to work. However, it can reach a maximum bandwidth of 80 MHz and tune to the 5 GHz bands. The Wi-Fi adapter in use can also work in monitor mode and stream SDR data at the same time, although this only works if automatic gain control is enabled.
This is the second MediaTek chip we’ve seen repurposed for SDR work, after the previous MT7996. Conveniently, Wi-Fi adapters often have external antennas, which make it easier to connect a frequency mixer circuit. These adapters are not quite there yet, but some hackers have already used the ESP32 to transmit arbitrary signals.