Three independent research projects have found undocumented features inside Espressif’s ESP32 microcontrollers that turn the common Wi-Fi chips into makeshift software-defined radio receivers, rtl-sdr.com reported on Thursday.

The ESPARGOS team, which last year built a phased antenna array of ESP32 boards that maps the direction of incoming Wi-Fi signals, said several ESP32 models have an undocumented mode in which the firmware bypasses the fixed Wi-Fi and Bluetooth functions and captures raw IQ baseband samples. The result is a receiver covering 2.2 to 2.7 GHz, plus 4.8 to 6.0 GHz on the newer ESP32-C5, at sample rates up to 80 MS/s with roughly 13 to 54 MHz of analog bandwidth, depending on the chip, the team said.

There is a catch. Output bandwidth to a computer is too small for general use, so most ESP32 boards can export only snapshots of data to a PC. That makes them spectrum analyzers, able to show what is on the air but unable to demodulate or decode a continuous signal. The new ESP32-S31 is an exception: it can stream samples continuously at up to 16 MS/s over its Gigabit Ethernet port, and the team says a SoapySDR driver for GNU Radio and gqrx is coming. A web tool, ESP-WebSDR, already lets owners flash the firmware from a browser and watch a live spectrum and waterfall.

ESPARGOS also said it can now capture phase-coherent IQ samples, so its array can do direction finding on any signal in the 2.4 GHz band rather than only Wi-Fi and Bluetooth traffic. Phase-coherent transmissions would also be possible, the team said, but it will not build them because they could be misused.

At least two other groups found the same or similar capabilities around the same time. On Reddit, a user known as h0m3us3r posted code to GitHub on Sept. 26, along with a video of an ESP32-S3 working as an SDR with an FPGA serving as a USB3 front end. That setup streams raw data to a PC continuously, fast enough for full demodulation and decoding. Its drawback is that the FPGA clocks the ESP32, which produces poor phase noise.

“Looks like this was solved five days ago,” one Hacker News commenter, xd1936, wrote, pointing to a recent commit in the project’s repository. If the clocking issues are fixed, rtl-sdr.com wrote, an ESP32 paired with an FPGA could work as a general-purpose SDR in the mold of the RTL-SDR, but covering 2.2 to 2.8 GHz with up to 80 MHz of bandwidth.

A third project, C5VRX, appeared on GitHub on Aug. 13. It uses an ESP32-C5 as a real-time 5.8 GHz receiver for first-person-view drone video, sampling the signals through what appears to be a similar undocumented data stream, demodulating them on the chip and emitting analog composite video through a simple resistor-based digital-to-analog converter. It is still a work in progress and does not yet work reliably at range.

On Hacker News, a commenter named mallets cautioned that Espressif might never document the capability. “So many $1 wireless ICs have a powerful ‘SDR’, but will never be documented due to certification/compiliance/export-control reasons,” the commenter wrote, adding that the projects rightly limited themselves to receiving and that Espressif could be pushed to patch the feature away if transmitting becomes possible. “Hope it doesn’t come to that, more cheap options for RF-to-bits is always welcome.”

A commenter using the name BlackRabbit1 estimated that the ESP32-S31’s gigabit interface could carry 20 to 40 million samples a second and wrote, “These hack will most likely will be a revolution for 13cm ham radio.” The commenter had already placed an order, it said: “I ordered a few and waiting for Ali to deliver them to my lab.”