The ESPARGOS team, known for their WiFi signal direction-finding phased array project, recently discovered that several ESP32 microcontroller chips contain an undocumented feature allowing firmware to bypass standard WiFi and Bluetooth functionality. Instead, these chips can capture raw IQ (in-phase and quadrature) baseband samples directly from the radio frontend. This capability enables the ESP32 to operate as an internal software-defined radio without requiring external RF hardware, effectively turning a common $2 WiFi module into a rudimentary spectrum analyzer.
According to their findings, different ESP32 models support varying frequency ranges: most cover 2.2–2.7 GHz, while the ESP32-C5 extends to 4.8–6.0 GHz. The chips can sample at rates up to 80 million samples per second (MS/s) with analog bandwidth ranging from roughly 13 to 54 MHz depending on the specific model. However, for use as a general-purpose PC-connected SDR, the output bandwidth proves insufficient for continuous data transfer, limiting most ESP32-based systems to exporting only data snapshots. This restriction means they function primarily as spectrum analyzers rather than enabling real-time demodulation or decoding of continuous radio signals when connected to a computer; the notable exception is the newer ESP32-S31 model, which features a Gigabit Ethernet interface capable of streaming IQ data continuously at up to 16 MS/s, with development underway for SoapySDR drivers to support GNU Radio and gqrx integration.
This image illustrates the ESP32-S31 model's capability to stream IQ data continuously to a PC for use with SDR applications such as SDR++.
Independent projects have demonstrated complementary approaches: Reddit user h0m3us3r's design uses an FPGA as a USB3 frontend to stream raw IQ data continuously to a PC, enabling full demodulation/decoding, though early versions suffered from phase noise due to FPGA clocking issues that were later resolved by using the ESP32's crystal as a reference clock. Another project, C5VRX, repurposes the ESP32-C5 as a 5.8 GHz real‑time FPV video receiver by leveraging the undocumented IQ stream for onboard signal sampling and demodulation to analog composite video. While these discoveries open exciting possibilities for ultra‑low‑cost SDR applications, significant technical hurdles remain, including the undocumented nature of the feature (which could be changed or removed in future firmware), challenges with phase noise, DC offset, and image rejection that are typically managed in purpose‑built SDR hardware, and the need for further software development to achieve stable, wide‑band reception.