The $10 SDR: Unlocking the ESP32’s Hidden Radio
Let’s have a look at the new ESP-SDR firmware.
With RAM and general hardware prices going through a solid spike, microcontrollers like the ESP32 start to become pretty attractive as candidates for cheap hardware projects.
These modern iterations are no slouch in comparison to the original board. While specifications vary according to model, the ability to have 2.4/5Ghz networking, BLE 5, and good flash and RAM support means these boards have become ever more capable while staying within the definition of “a cheap project”.
People are cooking all sorts of things with them, so when word got out that the onboard radio was capable of acting as a Software Defined Radio, naturally it was time to take a look.
Note: Today will be a quick getting-started guide that covers flashing the board and using the web interface. We’ll check out the actual performance of it as an SDR in a follow-up article.
The Find
The Bluetooth and WiFi capabilities of the ESP are pretty well known at this point. What is new, though, is an undocumented feature in the chipset that allows for the bypassing of this modem to capture raw baseband IQ samples. 
This isn’t a Software Defined Radio in the way that an RTL-SDR or HackRF is. It’s not going to operate in the same way that these units would. What it will do, though, is provide cheap capture capability and a baseline for future development.
At its most basic level, it operates snapshot FFT in spectrum mode, at 16, 40 or 80 MS/s over UART, with no continuous capture mode. It’s more like capturing activity rather than listening or looking at the radio.
In its current form, a fair bit of research has gone into this, meaning that some work has happened concurrently or privately before being released, and new features are evolving fast.
Two credits are worth dropping, though. Check out the README.md information below to find out more.
h0m3us3r on GitHub
ESPARGOS on GitHub
Lets Build
ESPARGOS has created a web flasher that can be used to make this project easy. Check it out via this link to get started quickly.
To flash your own, you’ll need:
A suitable ESP32. Select yours from the list if you aren’t sure about compatibility.
A computer or Android device to flash it with.
A data-capable USB cable.
Chrome or Edge Browser.
Once you’ve got your equipment, we can open the flasher and connect via WebSerial.
Depending on your system, things should go smoothly, and you should see your board available for flashing.
If you’re on Team Penguin, you may need to modify your udev rules if the board isn’t detected. It may also help to hold the BOOT button when you connect your board.
Once it’s recognised, you should have a firmware recommendation. We’re using the original ESP for the article, so 2.4GHz support only. The firmware should work at 5Ghz if your board supports it.
If everything looks good, simply hit flash. It shouldn’t take long for the firmware to download and be flashed to the device.
Once you’re seeing this message, you’re ready to check it out. 
The Results
ESPARGOS have included a ready-to-go web portal that makes it easy to test your new budget SDR. Let’s check it out and see if it’s working correctly. Open it via the link at the bottom of the firmware page. 
When you’re in, you’ll need to unplug the board for a few seconds, then reconnect the ESP to start your captures.
Once this is sorted, you should see the waterfall light up automatically and give you the radio version of “Hello World”.
If you’re near a router, you should also be able to spot some strong activity. 
The initial sample rate is 80MS/s while the waterfall shows us some clear activity.
It Works…To A Point
The web interface doesn’t work too badly all things considered, but a $10 SDR with little filtering that works as the result of a hack was probably always going to be somewhat questionable. We’ll explore how that theory holds up in more detail in future articles.
For now, let’s have a look at the waterfall and see if it reflects that.
The initial capture shows each row reflecting about 50 microseconds. It also makes it easy to identify the lab router. That’s the nice clear signal that we see in the middle of the waterfall.
It’s the correct 20 MHz in width; however, the channel frequency seems slightly off at around 5Mhz low. There’s also a pair of spikes and some horizontal noise in the waterfall as well.
It does confirm that the board is working, though.
The web interface gives us a bit of flexibility around gain control, frequency and LO offset. We’ll explore these and look at the waterfall in more detail in a future article.
For now, you can enjoy your receive-only, $10 SDR.
Investigator515 explores the RF spectrum, cybersecurity, and the hidden tech behind modern espionage.
Follow for new content weekly
Bluesky • X • Substack
You might also like,
- OSINT Investigators Guide to Self Care & Resilience
- Spies In The Mud: The RF-111 Aardvark
- What The Tech?! Space Shuttles
