Well, that was fast! Last week, we reported on two apparently simultaneous hacks using the 2.4 GHz radio inside many ESP32 variants that enabled raw access to the radio samples, turning it into a listen-only software defined radio (SDR) platform. Listen only? That’s only half of the SDR story.
Last weekend, [marble] got started fixing that, and released an early version of ESP32 firmware that can also transmit, and got receive working with gqrx. The demo communicates between an S3 and a C6 using a Hellschreiber mode, something that’s certainly out of the WiFi spec. And it didn’t stop there, either. [marble] is working on 802.15.4 modulation at the moment, which means that maybe soon your ESP32 will speak ZigBee.
This is all in the roughly 2.4 GHz band, but [marble] suggests that it might be good down to 1.8 GHz. (Editor’s note: previously, we said 100 MHz, but that was incorrect.) So there is still some uncharted terrain, and it’s clear that the boundaries on the ESP-SDR are just starting to get pushed.
If the early hacks on the RTL-SDR set off a wave of hacker SDR radio experimentation, and we can only hope that this is the beginning of the ESP-SDR era. Thanks then to [marble]– and the original hacks coming from the Espargos team for kicking this all off!
That’s “Hellschreiber,” as the Wikipedia link shows.
And a complete abuse of the bandwidth.
Sigh. This won’t end well.
Analog video transmitters that spam the whole 2.4GHz ISB band are around since a very long time, and you can still buy them. As are leaky microwave ovens, so nothing new.
If those leaky microwave is $2 a pop, it’s a big concern
Totally overblown. We’re talking about (theoretically) 100mW here. And even with an external high gain antenna, after going through tiny connectors and cheap lossy cables and adapters, you don’t get much out of it. We’re not talking about a broadband SDR with hundreds of watt output power.
You’re right, the good news is these devices have a maximum transmit power that is very low.
The bad news is that shoving that into an amplifier isn’t a challenge.
The problem I have isn’t the ability to use a wide bandwidth swath for inefficient data transfers (analog video as example), but the ease of abuse of spectrum. In this case we also know it won’t be particularly difficult for someone to use this to strategically jam wifi or Bluetooth.
Sometimes you don’t want to hand the sharp scissors to the toddler.
The high SNR in the waterfall is because the signal was wire bound over coax through a 30 dB attenuator ^^
While concerns about spectrum hygiene are understandable, we saw the exact same predictions of doom during the early days of RTL-SDRs and cheap TX hacks (like osmo-fl2k). Ultimately, they drove RF education and innovation rather than causing chaos.
Regarding the “abuse of bandwidth,” a single modern smartphone objectively consumes vastly more RF spectrum than multiple ESPs combined. To put the math into perspective: a standard 4G/5G smartphone occupies channel bandwidths anywhere from 20 MHz up to 100+ MHz (using carrier aggregation) to maintain its connection. In stark contrast, the Hellschreiber mode demonstrated here is an ultra-narrowband protocol that uses less than 300 Hz (0.0003 MHz) of spectrum.
Even if you account for some experimental harmonic splatter from an unfiltered ESP, the combined RF footprint of several ESPs running this mode is microscopic compared to the everyday devices in our pockets. 73 de DN9ZH
Spelling not withstanding, that’s still not Hellschreiber. Hellschreiber keys the transmitter on and off at a single frequency… encoding character “dot” placement by virtue of timing.
Question is, are ESP32’s RFC1149-compliant?
RFC1149, RFC1150, whatever it takes…
I don’t think so as it’s missing the whole avian part-though if you manage to add a transceiver then it probably is
If you throw it hard enough, sure.
Tuning down to 100MHz gives you Air Traffic Control (110-355M), older WESAT (137.5M), and the 2 metre ham band.
Great for listening, not so great for (unlicensed) transmit.
You might get away with using ham band. Interfering with ATC comms is a whole different ballgame.
Edit: 135M
I tried to tune 884 MHz, but it was unable to tune that frequency range, and the page says PLL cannot lock under 1.8GHz. So, I think it cannot be abused to screw up ATC comms nor ADS-B.
Sadly, this also means ESP32 cannot be used for power efficient portable ADS-B receiver by itself.
Sorry, that was my bad.
[marble] wrote in saying that the apparent 100 MHz limit was “more of a osmosdr / hackrf api artifact” and so I snuck in and edited the post.
CC1352R?
https://github.com/SP8ESA/ESP8266_2.4GHz_SSB_TRX
Try the PLL of ESP8266 ??? Downclocking ???
kaboom748 repository github have many info
https://github.com/kaboom748/ESPBoOm8266
An air band transmitter can be purchased everywhere. You can use a knife for eating meet or doing the wrong thing and knifes are not prohibited.
The Github page says the PLL will only lock around 1.8 to 2.8 GHz, so it will definitely not go down to 100 MHz. It still covers the entire 13 cm ham band, so I’m sure there will be lots of cool projects making use of it.
I was trying to do something simmilar but to generate SSB voice using the ESP as an USB soundcard and COM port for setting things up – this would be helpfull to use as a cheap transmitter for QO-100 ham raido satellite. I ran out of tokens :D but i hope that this will arrive soon in some project.
I feel dumb, but would this allow you to create a PWM signal to try and emulate much lower waveforms like a garage door opener, shopping cart lock/unlock, etc?
Probably not, because those all use much lower carrier frequencies, in the hundreds-MHz range rather than mid-GHz.
Cool, it covers the dect band
I am really happy that I can now get a cheap SDR for 2.4GHz. I have an RTL-SDR but it only goes up to 1.7GHz and its not useful for debugging Bluetooth boards that I have made for work. They always seem to have problems with then antenna tuning.
I could never justify buying a HackRF One or similar SDRs for just this since technically they work “well enough”, just not as well as one would expect
Could this effort perhaps be brought into esp-hosted (or more likely a fork thereof) to provide alternate communication protocols, ideally while still appearing to Linux host system as a standard WiFi device?
Same concept for ESP32 C3 RX/TX https://github.com/z1000biker/esp32c3rxtx
Zigbee radios are oddly brittle and incompatible. AliExpress zigbee devices transmit all kinds of gobbledygook and crash each other. I have a liveliness check for my hub to power cycle if it hasn’t seen any devices in a few minutes, and it fires pretty often.
I’m not sure if I’m scared that using an improvised zigbee radio will make this worse, or excited about having an option with open source firmware that could actually get bug fixes.
We really need some up/down converters now, what these be cheap enough to produce? Its like an LO and mixer basically? Not an expert
See also:
https://github.com/h0m3us3r/eSpDR
https://github.com/jochenhammes/esp32-sdr-trx
https://github.com/SP8ESA/ESP8266_2.4GHz_SSB_TRX ESP8266 also hacked !
for BLU (kaboom748)