Perhaps the most exciting news of the past few weeks in the world of hardware hacking has been the unlocking of hidden SDR functionality in the Wi-Fi radios found on Espressif ESP32 microcontrollers. They can be used as both transmit and receive SDRs, and given that it’s early days for this hack we expect that great things are yet to come.
There’s one snag though, despite speculation that they might be dragged down to much lower frequencies, as far as we know they’re only proven to work around the Wi-Fi frequencies. Though the reality may be wider we’ll take that for a 2.4 GHz part as a 100 MHz slice from 2.4 GHz to 2.5 GHz. Plenty of possibilities there, and they might even work down to 1.8 GHz, but there would be so much more to do if it could work elsewhere in the spectrum. So it’s time to look at the converter, a tried and tested old way to make a radio work on a different frequency.
A Lesson From Analogue Receivers
![TV tuner front end block diagram. Derived from Chetvorno (Own work) [CC0], via Wikimedia Commons](https://hackaday.com/wp-content/uploads/2016/07/rf-front-end.jpg)
A converter uses exactly this principle. The antenna frequency range is mixed with the output of a fixed oscillator whose frequency is chosen so that their difference represents the frequency band of your radio. THus tuning your radio tunes across the output of your mixer, which is the same as tuning across the antenna frequency range. For a numerical example, if the ESP32 receives from 2.4 GHz to 2.5 GHz, a mixer on its input with a 2 GHz local oscillator would allow the ESP32’s receiver to pick up the 400 MHz to 500 MHz band. In practice the circuit requires filters for both input and output to keep out-of-band stuff from going where it shouldn’t, but it really is that simple. Best of all, with appropriate handling of power and amplification, it works for transmitters too, and such a device is called a transverter.
Towards An Achievable Receive Converter
To make a practical converter then, we need an input filter, a mixer, an output filter, and a local oscillator. The filters are often off-the-shelf parts and needn’t be too expensive, the mixer can be as simple as a fast Schottlky diode, and the local oscillator could even in this case be another ESP32, they’re that cheap. You can add amplifiers if you want and what I am about to describe is a somewhat janky receive converter, but it can be made to work.
The Filter
In most cases such a converter will be intended to receive signals lower than the ESSP32’s range, so let’s assume you’re looking somewhere from HF through to VHF. The input filter has to reject anything above your maximum input frequency and stop any stray local oscillator leakage to the antenna, which most of you will identify as a low-pass filter. These can be bought off the shelf for a price, but are easy enough to make for yourself.
The most common low pass filter is often referred to as a Pi network because its circuit superficially resembles a Greek letter Pi, and takes the form of an inductor in the signal path with a capacitor to ground either side of it. If you know your maths you can calculate the values for yourself, but if you don’t there are many online Pi network calculators to help you. Constructing a Pi network at these frequencies is straightforward enough.
For the output filter, you need something that rejects the local oscillator frequency as much as possible, and passes the ESP32 receive range. Here you’re in luck, because the Wi-Fi hardware industry needs exactly those filters, so they can be had from Mouser or Digi-Key for cheap. I’m not going to specify a particular part, but I’d like to point you at the TDK Wi-Fi filter range and invite you to pick one with the bandwidth you need.
The Local Oscillator
Your local oscillator for an ESP32 working at much lower frequencies is likely to be around or above 2 GHz. Back in the day you would have used a crystal oscillator and multiplier circuits, if you like you can buy an expensive PLL oscillator module, but your simplest and probably cheapest method is to use another ESP32, now that it can be used as an SDR transmitter. Program it to output a single carrier on your desired frequency, dial down the output level, and there you have it, a 2 GHz local oscillator for a dollar or two.
The Mixer
Yet again you can buy an off the shelf mixer as a module, though one for a 2.4 GHz output will be expensive. Happily there’s a simple circuit which can do the job, and it uses a diode as a non-linear element fed with both antenna and local oscillator signals. At these frequencies you are looking for a very fast small-signal Schottky diode with as low a capacitance as you can find, and happily such parts are available from multiple manufacturers at cent rather than dollar prices. The basic circuit is shown below, and as you can see it’s quite simple.
In the circuit above the diode is your Schottky device, the input low pass filter isn’t shown, and the output filter is an off-the-shelf Wi-Fi bandpass filter. The two thick lines represent a stripline coupler, and they are simply two parallel PCB traces side by side over a groundplane. Their size should ideally be calculated to present the right impedance, often 50 ohms which is also the value of R1, but in practice the jankiest solutions can work here. With an ESP32 as a local oscillator I would hazard a guess that laying the trace on the PCB under the module’s antenna with the power turned down would be enough. I may earn the scorn of some of my peers, but I have a long history of RF bodging and I think it might just work.
Making It Transmit
The same technique as above works for shifting the ESP32’s transmit output down to the desired frequency, but there’s a catch. Even the modest output from an ESP32 can be enough to damage or overload parts designed for receivers, so you have two choices. Pick transmit-appropriate parts, or dial back the power to a low level, and amplify it at the lower frequency.
By Now, You Should Be Able To Bodge A Converter
The information above isn’t a ready-to-go design for a receive converter to get your ESP32 listening to lower frequencies, but it should give you all the signposts you need to get there. People have built converters for the RTL-SDR for ages now, so you could pilfer ideas there too. If you build a downconverter, for transmit or receive or both, let us know!
At a superconference about a decade ago there was a talk about RF construction techniques which will save you a lot of pain, and with luck such a simple circuit should be within your grasp. Good luck.
Pretty cool timing, but I’ve been working on a project for a little over a year now and it may just solve this issue.
I discovered the repo where they got the ESP to work via undocumented ways and decided to rethink my approach. Which led to the discovery that Semtechs LR2021 has similar pathways. The difference being, these chips have low frequencies and high, which comes out to LF 150–960 MHz, and its high-frequency path covers 1.5–2.5 GHz. Which solves this issue but doesn’t cover 5ghz.
I’ve already configured it to work with P25, Analog FM, POCSAG, and plan on many more! Listening to my local police department at 154.000 MHz is pretty wild from this low power chip.
https://github.com/SAMS0N1TE/lr2021-sdr
Hey Sam, excellent research! Would you share how did you stumble upon this capability?
How many bits at what bandwidth is avialable?
Your PD still transmits analog without encryption? Wow.
That’s really cool work, I want to try it out someday.
Sounds like a good Hackaday post.
https://hackaday.com/2026/10/15/another-wireless-chip-has-a-hidden-sdr-revealed/
And the usual warning for everyone:
Please behave responsibly. When operating an RF transmitter, you’re responsible for following the local laws and regulations. This typically falls into 2 categories:
[1] – You’re not a licensed ham radio operator. In such case you’re allowed to operate only on the so-called unlicensed (ISM) bands, but you still need to follow the regulation limits – EIRP (which includes the antenna gain!), modulation type and duty cycle of the transmitter. Each country has local regulatory body, which has a website, where you can find documents describing all the RF operations parameters for you. Read this document BEFORE doing stupid stuff. I can assure you there are both civil and law-enforcement full-spectrum monitoring stations with phased-array antennas that can precisely triangulate even one-off signals.
[2] – You’re a licensed ham radio operator. This means you’re already trained into a specific class of operation and you know which frequencies, modes and power levels you’re allowed to operate, which is great.
Each time someone decides to perform a stupid stunt, we and our hobby suffers damage. Please be nice and smart.
Kind regards to ya all!
PS: As far as I know, there are cases when regulatory bodies provide on special requests temporary experimental licenses for organizations (not sure about individuals) but these are always parameter- and time-constrained, and I personally don’t have experience with it.
“I can assure you there are both civil and law-enforcement full-spectrum monitoring stations with phased-array antennas that can precisely triangulate even one-off signals.”
I mean, I agree regarding the care that people should take: but unless you put a serious amp at the transmit side, no, no one’s going to be able to triangulate anything from a significant distance from a one-off transmission. The power’s just not there.
The reason you don’t screw around with unlicensed transmission stuff is it makes it worse for everyone, not because of fear. Fear isn’t a good motivator because realistically, you’ll get away with a lot.
Anyone working on undocumented registers?
If you need this article you likely do not have the experience to work with the frequencies required for this.
Please don’t play with transmit until you’re sure you’ve done everything you need to properly. And by sure, that means you need to equipment to validate its right.
Quite. If you understand the nuances then you probably never needed the article in the first place. A bit of intellectual …. from the author.
I hope you noticed I described a receive converter and only briefly mentioned transmit.
I only loaded the gun with one round of ammo. It’s mostly safe, now spin that chamber…
A gun that can’t shoot doesn’t take even a single round of ammo. I guess you could tape the single round to the side, but then you’re still just pretending it will do something.
Come on, mate, you have to start from somewhere, and you could point out the valid paths to doing so rather than going straight to “how dare you even think about stepping on my turf”.
All of this is perfectly valid information for receive only.
Why do you think “playing with transmit” gas anything to do with the frequencies involved?
The vast majority of the spectrum is licensed. You can screw up 440 MHz just as easily as 4.4 GHz. Heck, it’s actually easier in a lot of ways.
Actually do it and make a proper write up?
https://github.com/JennyList/LanguageSpy/tree/master/Hardware/one-inch-HF-to-VHF-converter
Rude much?!
this could make x-band more accessible for folks. a cheap 5500-5900mhz vco + mixer would open up 7.5ghz to just short of 8.5ghz.
i’m going to play around with it a bit and see if the posted sample speed + bandwidth are as good as claimed – if so, it may be worth spending a bit more on a ADF5355 (covering 54mhz-13.6ghz) to have free reign of a wide swath of the spectrum.
suddenly we are starting to talk $50 mixers, $100 PLL, $$ filters, all for $4 module :)
True. But impedance mismatches in janky solutions can cause unintended, possibly broadband RF radiation which might run afoul of FCC limits. Sniffing the device for excess emissions is always a good idea, but it becomes more important when you’re not careful with impedance matches, shielding, etc.
Also, that mismatch can cause the behaviour to become erratic with small changes in layout, packaging, cable lengths, etc. It’s a fine approach for prototyping, but a poor one for a product – even if the product is a one-off.
https://github.com/Falconier/ESPtransceiver
I think we’re getting to the point where we need to start giving some serious thought to what all these “smart bulbs” etc. might be doing, and whether we want them in our homes.
I just wanted to point out that they also just determined that the common LORAWAN chipset can tune in from about 10 MHz to I believe around 2.5 GHz however the there’s a narrow band limit. I did some research on this because it would be very inexpensive to make a kraken type of PLL loop and time coherent set of these given their low price point but it extremely narrow 25hz I believe but don’t quote me on that….
However that does open up a lot of possibilities for using the spread spectrum frequency hopping at different frequencies to control for example a drone or other devices including sensors at extremely long ranges as you could use a frequency illegally I might add and so don’t do it except for educational purposes, as they would either be frequencies that could take advantage of ionosphere bouncing and or the ability to pass through solid objects.
It would also have the ability to frequency hub and to do spread spectrum digital error correcting so there’s a lot of potential capability there and at the same time there’s the built-in 128 AES encryption which opens up a lot of potential negative and black hat uses which a professor in the United States has already written a journal article on quite a while ago where he pointed to this communication standard as being extremely dangerous and could be easily used by nefarious individuals for nefarious purposes.
None of us on this platform are those kind of people but are quite a few of us work professionally on trying to make the electronics internet and communication sectors more secure and I would assume there’s quite a few of us here that take apart and bug bounties which many companies recently have started getting a little unethical with the way that they’re rejecting them or not patching them claiming that they’re as use and would not be scalable but all it takes is one really bad daily and it could take down a company and expose a lot of people’s data.
There are already making so much money on electronics and various other gadgets computers cell phones etc then it’s a little bit sick for them to not be very ethical and give credit where credit is due to those who put so much work into finding cve or should be CVS only to be rejected because they don’t want to pay out what amounts to change in their profit margins. This is one argument for taking it to the National internet and cyber security department of your government and to have them help you to recover your bug bouncy and to keep everything on the up and up because they will decide if something’s super important and I think that they would be much more open-minded about whether or not something needs to be patched.