Source: ESPARGOS, ESP-SDR: Raw IQ Capture with Espressif’s ESP32 Chips
The ESPARGOS team found that the ESP32 can capture raw radio samples. An undocumented debug path, probably left in for factory testing, skips the Wi-Fi modem and writes IQ samples straight into the chip’s memory, which turns an ordinary dev board into a software-defined radio around 2.4 GHz. They found it by starting from one test function in Espressif’s library and reverse engineering it with help from LLMs. There’s a browser demo that works over Web Serial with most ESP32 boards.
TL;DR
- Undocumented ESP32 modem debug path, raw IQ into SRAM
- No extra hardware; probably left in for on-wafer testing
- Chips: ESP32, C3, C5, C6, C61, S2, S3, S31
- Tuning: 2.2-2.7 GHz; 4.8-6.0 GHz on C5 only
- Up to 80 MSa/s, ~13-54 MHz bandwidth, auto or manual gain
- Sample: 32-bit word, 10-bit I + 10-bit Q + gain index
- Bottleneck: 2,560 Mbit/s off-chip; browser demo works in bursts
- ESP32-S31: continuous 20 MSa/s (USB) or 40 MSa/s (Gigabit Ethernet)
- SoapyESPSDR driver for Gqrx and GNU Radio (experimental)
- ESPARGOS One: 8-channel phase-coherent SDR at 2.4 GHz