Cheap Stuff To Hack: A Router With An SDR For $13

The history of consumer electronics is littered with devices that are relatively uninteresting at first, but become spectacular platforms for hardware exploitation once a few select people figure out how everything ticks. The Linksys WRT54G was just a router until someone figured out how to put a complete Linux system on them. Those RTL-SDR dongles were just for capturing over the air TV until someone realized they were actually a software-defined radio. The CueCat was just dot-com boom marketing garbage until… well, we picked up a lot of CueCats regardless.

Now there’s a new device sitting on the shelves at Walmart just waiting for some Linux hackers to have a go. It’s the Tzumi MagicTV, a device that allows you to watch over-the-air television on your phone. What’s inside? It’s a WiFi router, an RTL-SDR, and a battery pack in one tiny package. The best part? It costs $13, and apparently Walmart is just blowing them out.

Right now, there aren’t too many details on what’s going on inside the Tzumi MagicTV box, however, the discussion over on the RTLSDR subreddit has revealed enough to give us a good idea of what’s going on. The router inside the MagicTV is a TP-Link TL-WR703N, the exact same WiFi router that took the WRT54G’s place as the king of hackable routers a few years ago. The SDR chip is the same as the Astrometa DVB-T2, one of the common TV tuners on-a-stick. Other than that, there are TX and RX pins on the board, SSH is open, no one knows the password, but as of this writing, a few people are putting John the Ripper to work trying to break into this box.

What is the end goal of cracking this Linux box wide open? Well, it’s a WiFi router and an SDR, so if you want to make your own Flightaware ADS-B logger, that could be on the table. Of course, you could actually use it for its intended purpose and pull down over-the-air TV to your local network, but that seems so pedestrian after getting root on a $13 box from Walmart.

Thanks [Adam] for the tip!

41 thoughts on “Cheap Stuff To Hack: A Router With An SDR For $13

  1. How much useful DSP processing can you actually do with a 400MHz Atheros AR9330 MIPS CPU ?
    Like for simplicity sake how much DSP processing is currently carried out on a TL-WR703N with a RTL-SDR dongle connected to one of it’s USB ports.

    The things I see that this device has going for it is that it is cheap and it has a battery.

    1. I see a lot of potential. It immediately becomes a simple way to connect it to a smartphone and I cannot wait to get SDR on a smartphone with this. I barely use my SDR stick, but for the same price have one that can be networked, work on the go and on a smartphone? Yes please.
      The smartphone will have plenty of processing power, the AR9330 not so much.

      1. So you hope that someone modifies the existing firmware for the TL-WR703N, adds support for the MXL608 tuner to the rtl-sdr library which only has 6MHz, 7MHz or 8MHz bandpass filters in it, unlike the R820T2 – End of Life part, which have tracking bandpass filters for 1/2/3/4/5/6/7/8/9/10/11/12/13/14/15MHz. So even if that tuner can be got to work it will have some horrendous aliases at the sample rates that can be provided by the onboard RTL2832 in typical debug mode. 6 MHz of bandwidth aliased into 2.4MHz or less of bandwidth will look pretty dire for most of the spectrum. Unless the signal you are looking at has no other signals within 6MHz of it, then the performance will be fine.

        I don’t see anything great about it.What is new is a battery and cheap if you but it from Walmart’s clearance sale because the devices will do not support ATSC 3.0 at a guess.

        1. At this price it makes for a nice hacking platform, but for SDR use I’d rather put together a a rtl-sdr.com dongle ($21) plus a NanopPI Neo board ($13). Still a cheap solution that would bring a huge boost in performance.

        2. RTL2832U samples at 28.8MHz, so the Nyquist frequency is 14.4MHz, it then does internal DDC to get the 2.4MHz bandwidth.
          The 2.4MHz limit comes from the RTL2832U USB implementation and the fact that the SDR mode is more for debug than the exact use as it has an internal hardware demodulator and decoder for DVB-T.

    2. I suspect that it’s not much; but what it should be able to do is bundle up the RF samples and send them off to a punchier system for processing. I thing that rtl_tcp is ~50mb/s worst case; and dodgy little router SoCs can generally shovel packets pretty credibly for their size; that being the entire purpose.

    3. I would estimate enough for 5-20KHz bandwidth signals, maybe even up to 100KHz. You definitely wont be demodulating all FM stations at once, but one should be fine.

    4. I optimized an ADSB decoder to decode 12MSPS on a 500 MHz MCU (an i.MX RT1020 actually). I think a MIPS CPU at 400 MHz would give enough of power if one *really* cares.

  2. It isn’t a TP-Link TL-WR703N. Tuzmi or their ODM using the TL-WR703N config for OpenWRT as a base. It isn’t the same hardware so it is missing Ethernet etc… They may have kludged the TL-WR703N config instead of making a new one as that was the closest to this board so there may be some important changes we don’t know about.

    This isn’t capable of ADS-B reception. It has a MaxLinear MxL608 tuner chip which has a range of 52.5MHz to 866MHz. ADS-B is 1090MHz so too far out of range. The MxL608 isn’t currently supported by librtlsdr either. MaxLinear’s driver for it has been found so it should be possible to add support to librtlsdr.

  3. Pretty limited for a lot of applications but it would be perfect for the home automation crowd looking for a 433/900mhz ISM receiver for smart meters, wireless thermometers and cheap RF remotes.

      1. Mine had one left last weekend and I almost got it but grabbed the last 2 D-link wifi cams at $15, yeah these are the dcs936l that you dont want on the net but they will be fun to play with and at a $55 markdown I wont worry about breaking them. say what you want about walmart but I have found some good stuff to hack on in the clearance aisle there cheap.

  4. > The Linksys WRT54G was just a router until someone figured out how to put a complete Linux system on them.

    Err, that device was running “a complete Linux system” from the get-go. And what made that device so interesting is that Linksys decided (after a bit of nudging) to properly opensource everything rather than nothing or just the bare minimum as the competition did at that time and much later…

    NB: There were some experiments with special versions that didn’t use Linux as OS but some proprietary commercial OS with cut back resources but they were not exactly successful…

    1. They weren’t gently nudged, they were threatened with a lawsuit for violating GPL by not releasing the source code.

      WRT54G v5’s and later used WindRiver VXWorks instead of Linux, but Linksys continued to sell the WRT54G v4 as the WRT54GL (L for Linux)

  5. I can think of a lot of uses for this without even rooting. Why bother routing coax through a house when you can have the receiver physically close to the antenna!

    1. It’s when you use the rf out on an old vcr, feed it to a couple of signal boosters and back to n aerial.
      Set the channel on the vcr and tune a near by tv to that station. Have a stack of vcrs each set to their own channel.
      Now send encrypted data instead of audio and video and things get interesting. That’s a lot of bandwidth if you use all the channels.

      1. try to scan it at one of the self-scan things. mine was marked $25.00 was: $37.48. brickseek said it was $13. upon scanning it myself it showed $8. same thing at the self-checkout register.

  6. If you’re scouring Walmart for these, be sure to check both the clearance aisle (marked at $25, rang up at $13 for me) and the electronics department (different store, still on a secured peg that requires employee help, at the original $50 price, rang up at $13 for me).

  7. These sold out in all the Walmarts anywhere near hear, this past weekend. All except for ONE, which I bought today, though at a significant time investment. Scanning finds no channels, though manually entering frequencies from the FCC database works for most local channels. Pretty amazing for that price. I hope somebody finds the secret password on the firmware

  8. Picked one up today and managed to get into it through instructions on Reddit(compiled update programs and added new user to get ssh access).

    In my area I have zero channels(not surprising). In order to keep the router from turning off I started a ping on my tablet and it keeps the router running. With the external antenna switch set to on, the battery has dropped and the 3rd light is blinking after 45 minutes. This is while it is connected and charging.

    Not really sure how useful it will be, but I am hoping to test out the TV part when I get closer to a larger city and out of the mountains soon.

  9. Even if nobody gets rtl-sdr going it would be nice to see better firmware for using it to watch TV. I don’t see why it couldn’t connect to another router, for instance… An option to not turn off when plugged in would be nice…

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.