ESP32 Hidden SDR: Your $5 Chip Can Receive 2.4 GHz Signals

Two independent teams discovered in late September 2026 that every ESP32 microcontroller with a built-in radio contains an undocumented debug path in its WiFi modem that exposes raw IQ baseband samples — the raw material of software defined radio. No extra hardware. No soldering. The chip already in your project drawer has been a low-cost SDR all along; Espressif just never said so.

How the Hidden Path Works

The ESP32 WiFi modem contains a debug mode Espressif left in for internal testing. When triggered via undocumented registers, the modem’s sample-dump engine writes raw in-phase and quadrature (IQ) samples directly into the chip’s SRAM, bypassing the normal WiFi processing stack. On the ESP32-S3, that IQ buffer sits at address 0x3fcd0000 (64 KiB). Firmware reads it out and ships the data over whatever interface is available.

The ESPARGOS team found this capability while building phased antenna arrays for WiFi direction finding. Reddit user h0m3us3r independently discovered the same path and reverse-engineered the register map — reportedly with LLM assistance — then published eSpDR on GitHub on September 26. A third project, C5VRX, used the same capability on the ESP32-C5’s 5 GHz radio to receive FPV drone video. Three independent discoveries in under a month signals this was ready to be found.

Which Chips, What Frequencies

ESP-SDR, the ESPARGOS firmware, currently supports eight ESP32 variants: the original ESP32, C3, C5, C6, C61, S2, S3, and S31. All cover 2.2–2.7 GHz. The ESP32-C5 adds 4.8–6.0 GHz, which includes the 5 GHz WiFi band and 5.8 GHz FPV range. Sample rates range from 4 MS/s on older chips to 80 MS/s on the S3. Analog bandwidth runs 13–54 MHz depending on the variant.

That frequency range is narrower than a 5 RTL-SDR dongle (500 kHz to 1.75 GHz), but it covers exactly where WiFi, Bluetooth, Zigbee, Thread, and BLE all live — the entire 2.4 GHz ISM band at once.

Try It in Two Minutes

The fastest path to a working demo is ESP-WebSDR. Connect any supported ESP32 dev board via USB, open the browser-based firmware flasher at espargos.net/espsdr, flash in about two minutes, and reconnect. The browser interface shows a live 2.4 GHz spectrum and waterfall display. No toolchain, no SDR software to install.

For desktop integration, SoapyESPSDR is an open-source SoapySDR driver that connects ESP-SDR to GNU Radio, Gqrx, and other SDR applications. The most compelling demo of the capability: h0m3us3r’s ESP32-S3 watching a phone’s Bluetooth Classic frequency hopping in real time as it streams LDAC audio to earbuds.

The Real Limit: Data Throughput

Honest coverage requires saying this plainly: most ESP32s cannot stream IQ data continuously. The modem generates samples internally at 2,560 Mbit/s (80 MS/s × 32 bits). Every output interface is far slower — SPI peaks at 13 Mbit/s, USB high-speed at 480 Mbit/s. The result is burst-capture snapshots, not continuous streams. That makes most ESP32s excellent low-cost spectrum analyzers but not standalone demodulators.

Two approaches fix this constraint. First: the ESP32-S31, which adds Gigabit Ethernet and high-speed USB. SoapyESPSDR’s streaming profile pushes 40 MS/s over Ethernet for continuous IQ reception — enough to receive a 2.63 GHz LTE signal without gaps. Second: h0m3us3r’s eSpDR project uses an FPGA as a USB3 front end on the ESP32-S3, achieving lossless 80 MS/s continuous streaming to Linux. More complex, but full demodulation capability.

What Developers Can Use This For

The most immediate value is in embedded diagnostics. An ESP32-based product can now run RF self-diagnostics without additional hardware: check whether its WiFi channel is congested, visualize BLE advertisement traffic, confirm a Zigbee mesh is on the right channels. That is normally a job for a separate spectrum analyzer dongle and a laptop. With ESP-SDR firmware, the device does it itself.

Beyond diagnostics: the community is building standalone spectrum monitors, phase-coherent direction-finding arrays, and drone video receivers. One Hacker News comment noted that S-band satellite downlinks fall within the tuning range — theoretically receivable with a dish and a $5 chip. The ESPARGOS team’s original application — simultaneous 8-channel phase-coherent capture — enables WiFi source localization that normally requires purpose-built hardware costing hundreds of dollars.

Will Espressif Patch It?

Espressif has issued no public statement on this discovery. Removing it at the firmware level is possible but hasn’t happened. Removing it at the hardware level requires new silicon. The capability is receive-only — no transmission, no regulatory concern — so there is little pressure on Espressif to act. When Espressif discovered undocumented Bluetooth HCI commands in 2025, they patched those and promised documentation, because those were command interfaces with potential misuse vectors. This is a debug data-dump path. The community expectation is that it stays.

Resources

• ESP-SDR project page and browser flasher — espargos.net
• ESP-SDR firmware on GitHub — ESPARGOS/esp-sdr (GPL-3.0)
• SoapyESPSDR driver — for GNU Radio and Gqrx integration
• RTL-SDR.com writeup — best technical summary with all three projects
• Hackaday article — Jenny List’s editorial coverage