Having watched some fun videos on repurposed satellite dishes on YouTube, [Melan] wanted to get in on the action, managed to source an Intellian i4 — a dish built for marine use — and set about hacking it.
[Melan] first needed to convince the antenna that it was still on a boat by using an RP2040 microcontroller and an RS-422 module to send NMEA sentences. This was necessary to tell the i4 the “heading” of the “boat”, even though [Melan] was really using the rig stationary on land. From there, a simple email to the company itself sufficed to get the Intellian software running on the antenna.
But could it be controlled without the software?. Sniff the communications between the software and the Antenna Control Unit, and decompile the code. This done, it was relatively straightforward to put together a protocol description and figure out how to command the antenna where to point simply by issuing commands for azimuth and elevation.
Some of the first remote controls available to consumers used sound, visible light, or even just wires to communicate with their parent device. It was many years between these first rudimentary remotes before they standardized around infrared or RF signaling. Even then it was a while before remote controls were reliable enough to not have to think about anymore. They’ve gotten so good now that there are small modules available that let us quickly build these devices to perform all manner of tasks.
[Igor Brichkov] is demonstrating this project because his garage door remote control suddenly stopped working. The RF receiver and transmitter circuits are readily available and inexpensive, but they need some support circuitry to work properly. The transmitter is paired with an encoder which is provided a binary code by wiring various pins to power and ground. This “code” is sent to the receiver which has a decoder and listens for that specific code. When the codes match it changes the state of one of its pins, which is used in this case to short the garage door’s remote terminals and signal it to open the door.
Although the resulting handheld remote with its single button looks a bit like something from 1950s science-fiction, it’s an effective solution. Especially when compared to possibly trying to reprogram a proprietary remote, find one from a company that doesn’t exist anymore, or rebuild one that operates on a bizarre frequency. With access to the physical hardware, it turns out a lot of things are controlled by just shorting pins together, and anything can do that from wires to RF transmitters.
Most commercial pet trackers require a subscription or network connection to function. [Jon G Aguado] wanted a better way and designed LIA, a Meshtastic collar tracker.
LIA uses a custom PCB containing a ESP32-S3, LoRa radio, GPS/GNSS receiver, and a charge controller for the 18650 or 5023450 pouch Li-ion cell powering the device. Everything fits inside a 3D printed enclosure, and the device is charged via a magnetic 4-pin USB pogo connector to increase weather resistance.
One of the neat features of this particular tracker is that [Aguado] gave it two different power modes. High power gets a location fix every 30 seconds and has a pair of bright LEDs for visual assistance, low power only gets a fix every minute or so, and it can also be set to off, which is something we wish more device manufacturers remembered should be an option.
Bluetooth is a short-range protocol that’s great for peripherals and finding your keys, but it’s limited range is mainly a product of how it’s usually implemented. A recent video from [nktbuilds] demonstrates this by extending its range out to 12 kilometers, or around 7.5 miles.
The secret is twofold: one is the antenna, a parabolic unit that captures far more than the dinky dipole in your phone. The other is a very sensitive receiver with a much lower noise floor. What you won’t see here is any extra power than you get stock out of one of those generic coin-sized Bluetooth tracker tags. It’s kind of obvious, in retrospect: grab more signal, lower your noise floor, and get a better result. Still, it certainly wasn’t obvious it would work out to 1200 m, and it’s an impressive feat by [nktbuilds]. We’re going to have to keep it in mind next time we lose our keys.
Of course this doesn’t mean you should jump to Bluetooth for distance communications. You’re still better off sticking with something like LoRA for that, especially since it’s good to hundreds of miles if you can get line-of-sight — or even tens of thousands with the right setup.
With the ESP32 series of microcontrollers having had hidden software-defined radio (SDR) facility revealed, we’re now moving on from the announcement into projects making use of the finding. [Twotoz] has one using an ESP32-C5, to receive and demodulate analog FM video.
You might think that video is something which has largely gone away in 2026, with TV transmissions having made the switch more than a decade ago, and home entertainment appliances having used HDMI for longer. But it’s still very popular in the world of drones however, where it exists as 5 GHz FM transmission. There’s no digital cliff-edge to lose your picture if you fly into somewhere with bad propagation of radio waves, and perhaps more importantly, it has an extremely low latency. This receiver uses a Seeed Studio Xiao ESP32-C5 board with a simple resistor-ladder DAC to produce the video. It has a simple button channel interface, and a serial link for more in-depth options.
It’s good to see these projects appear, especially as this one’s 5 GHz and shows those chips work too with the hack. We’d be interested to know whether the latency of the SDR affects its usability though. You may be interested to know this isn’t the first time we’ve seen an SDR do video.
When most radio enthusiasts start trying to pick up signals from satellites, they might put together a quick-and-dirty Yagi antenna and try to catch a repeater as is passes overhead, or they might grab a small unused dish from a satellite TV service and point it up at a weather satellite by hand to try to decode some of the data coming down. But [Cranktown City] had a different approach. He found an eight-foot dish online and built a massive articulating base station out of it as his first exploration into the world of satellites.
The first problem that needs to be solved with a dish of this size is its mounting location. This installation uses a large post and concrete foundation with a custom-fabricated metal base at the bottom. The metal base houses all of the electronics not just for receiving signals from the dish, but also for orienting it properly. That includes a large metal gear driven by a wheelchair motor to control its azimuth and a linear actuator to take care of its elevation. Getting the large dish onto the frame was its own ordeal, complicated by the fact that it’s not uniform in its shape and has to be mounted in a specific orientation.
With everything assembled, the circularly-polarized antenna installed, and the computers up and running, the dish is able to track satellites across the sky and download data from things like GOES weather satellites. [Cranktown City] also built in a system that detects wind and points the dish vertically when it goes above a certain speed. This level of effort is impressive, and absolutely not required to listen in on plenty of sattelite activity out in the sky, but this installation will certainly give [Cranktown City] a lot of mileage and possibly even work for some radio astronomy.
Meshtastic has gained a lot of popularity over the last few years thanks to its low barrier of entry. No licenses are needed and the hardware is dirt cheap, at least when compared to a lot of ham radio gear. But while that physical barrier is low, there is a bit of a learning curve. Part of that comes from the fact that there are a lot of channels and modes that people could be communicating on, and unless the user knows that information up front it can be hard to find where the conversations are happening. [cemaxecuter] noticed this problem and built a Meshtastic sniffer into his radio-forward Linux distribution, DragonOS.
The sniffing software is built in C and comes as a complete standalone binary and does not rely on GNU Radio. With DragonOS up and running and the software loaded, it can look at the entire bandwidth that Meshtastic operates on and detect any traffic and decode it (as long as the key is known). [cemaxecuter] is using a HackRF as a software-defined radio for this project, which he notes doesn’t quite have enough bandwidth to cover every Meshtastic operating frequency, but it can get most of them. After firing up his own node, the software quickly detects it and shows its details in the terminal.
Software like this opens up a lot of opportunities for things that would be tedious, difficult, or impossible to do with with a standard Meshtastic node. Besides finding places where conversations are happening more easily, [cemaxecuter] also suggests that it could be used for wardriving and for locating or finding other networks much more easily. For those who still haven’t tried it out, take a look at this 2023 treatise on the protocol and hardware and then dive right in.
Since the discovery of an undocumented I/Q sampling feature in ESP32 chips about two weeks ago, there’s been a flood of similar features being found in other wireless chips, including LoRa and Wi-Fi chipsets. The latest chip to join their ranks is the MediaTek MT7921AU, often used in Wi-Fi adapters, with two different projects developing independent SDR drivers for it in the last few days.
The first was BirriaSDR, which discovered that the chip exposes raw I/Q samples for debugging and calibration; BirriaSDR instead streams these to the host at 40 Msps in 14-bit resolution, with the option to tune from 2156 to 2610 MHz. BirriaSDR uses libusb to directly communicate with the Wi-Fi adapter and access its registers; it doesn’t make any permanent firmware changes, so the Wi-Fi adapter goes back to its original state after being used as an SDR. BirriaSDR implements an API similar to the RTL-SDR’s.
Mtk79ICAP, by contrast, exposes the MT7921AU’s sampling features over a standard SoapySDR interface. Unlike BirriaSDR, it applies some firmware changes to the chip, and it requires a modified driver to work. However, it can reach a maximum bandwidth of 80 MHz and tune to the 5 GHz bands. The Wi-Fi adapter in use can also simultaneously work in monitor mode and stream SDR data, though this only works when automatic gain control is enabled.
This is the second MediaTek chip we’ve seen repurposed for SDR work, after the earlier MT7996. Conveniently, Wi-Fi adapters often have external antennas, which should make it easier to connect a frequency mixer circuit. These adapters aren’t quite there yet, but some hackers have already used the ESP32 to transmit arbitrary signals.
To quote commenter [douyarou], “It’s like our little version of a Precambrian explosion”. A bunch of hackers have discovered, independently and building on each other’s work, software-defined radio (SDR) capabilities in more places than you can shake a stick at.
It all started with [Espargos] and [h0m3us3r] apparently independently discovering that the ESP32 family of chips had a “secret” debug mode that allowed direct access to the radio that’s normally used for WiFi. While the 2.4 GHz radio signal is almost always immediately converted into data by the MAC hardware, here they found a way to listen in upstream, to the raw IQ data.
Seeing this, folks were immediately inspired to find out if they could transmit as well. [marble] not only got transmit functionality working, but integrated the part in with the standard osmosdr data flow, which meant that a whole bunch of existing tools were ready to go. We didn’t know about it at the time, but apparently [jochenhammes] and [z1000biker] concurrently had their TX-capable hacks up and running: here and here.
At this point, folks have already started to use the capabilities for broadcasting digital TV signals, voice signals, FM Hell, and other hijinks. This reminds us of the early days of the RTL-SDR project, when a competent, if receive-only, SDR functionality was found in a bunch of USB TV-tuner dongles. Once the hardware capabilities were sussed out, people started writing all sorts of useful software, and it gave rise to all manner of radio projects, from simply poking at domestic wireless devices to tracking all the airplanes in the world as they fly by.
[Tom] and I were discussing this on the podcast, and he remarked that of course there are SDRs hidden everywhere there is a radio unit these days, and the question is just whether or not we could hack them into usability. And before the podcast was even finally edited, [Samson1te] told us about his find in the LR2021 LoRa chip. This is a radio that’s designed to be a radio, with 16-bit resolution, and covering lower frequencies from 150 MHz to 960 MHz.
Compared to the RTL-SDR revolution, this is all happening at incredible speed. Each of these hacks will enable us to use different slices of radio spectrum with different degrees of ease, but it’s clear that the cost of entry into playing around with digital radio has just dropped precipitously. We will see hundreds of new signals hacks in the next few months – the floodgates have been opened.
This article is part of the Hackaday.com newsletter, delivered every seven days for each of the last 200+ weeks. It also includes our favorite articles from the last seven days that you can see on the web version of the newsletter.
Want this type of article to hit your inbox every Friday morning? You should sign up!
The news of the past couple of weeks has seen the ESP32 turned into an software-defined radio (SDR) thanks to a hidden baseband mode, an exciting development by anyone’s standards. It seems unexpected SDRs are like busses in that you wait for ages and two turn up at once, because hot on the heels of the ESP32 story is [Samson1te], revealing the SDR functionality hidden within the LR2021 LoRa chip. This one is especially interesting because as well as a 2.4 GHz radio, the chip sports a radio that works from 150 to 960 MHz.
We’re indebted to them for posting this in a comment on our receive converter post, as a complimentary project to the ESP32 one. It gives a 16-bit SDR with receive and transmit, however as with the ESP32 it’s early days and we hope great things lie ahead. There are comprehensive docs available, should you wish to enter the fray. Currently the main demo is P25 digital voice.
Perhaps the most exciting news of the past few weeks in the world of hardware hacking has been the unlocking of hidden SDR functionality in the Wi-Fi radios found on Espressif ESP32 microcontrollers. They can be used as both transmit and receive SDRs, and given that it’s early days for this hack we expect that great things are yet to come.
There’s one snag though, despite speculation that they might be dragged down to much lower frequencies, as far as we know they’re only proven to work around the Wi-Fi frequencies. Though the reality may be wider we’ll take that for a 2.4 GHz part as a 100 MHz slice from 2.4 GHz to 2.5 GHz. Plenty of possibilities there, and they might even work down to 1.8 GHz, but there would be so much more to do if it could work elsewhere in the spectrum. So it’s time to look at the converter, a tried and tested old way to make a radio work on a different frequency.
A Lesson From Analogue Receivers
TV tuner front end block diagram. Derived from Chetvorno (Own work) [CC0], via Wikimedia Commons.I hope most of you will be familiar with what happens when you mix two frequencies; the resulting spectrum contains both their sum, and their difference. This was the mechanism behind the tuning dial on your analogue radio or TV, the dial moved an oscillator, and a sensitive circuit tuned to a so-called intermediate frequency would filter out the difference frequency between the oscillator and the station you wanted. A few years ago we had a deep dive into the UHF hackers playground of an analogue TV tuner, where we examined this in depth.
A converter uses exactly this principle. The antenna frequency range is mixed with the output of a fixed oscillator whose frequency is chosen so that their difference represents the frequency band of your radio. THus tuning your radio tunes across the output of your mixer, which is the same as tuning across the antenna frequency range. For a numerical example, if the ESP32 receives from 2.4 GHz to 2.5 GHz, a mixer on its input with a 2 GHz local oscillator would allow the ESP32’s receiver to pick up the 400 MHz to 500 MHz band. In practice the circuit requires filters for both input and output to keep out-of-band stuff from going where it shouldn’t, but it really is that simple. Best of all, with appropriate handling of power and amplification, it works for transmitters too, and such a device is called a transverter.
Towards An Achievable Receive Converter
To make a practical converter then, we need an input filter, a mixer, an output filter, and a local oscillator. The filters are often off-the-shelf parts and needn’t be too expensive, the mixer can be as simple as a fast Schottlky diode, and the local oscillator could even in this case be another ESP32, they’re that cheap. You can add amplifiers if you want and what I am about to describe is a somewhat janky receive converter, but it can be made to work.
The Filter
A very simple Pi network low pass filter
In most cases such a converter will be intended to receive signals lower than the ESSP32’s range, so let’s assume you’re looking somewhere from HF through to VHF. The input filter has to reject anything above your maximum input frequency and stop any stray local oscillator leakage to the antenna, which most of you will identify as a low-pass filter. These can be bought off the shelf for a price, but are easy enough to make for yourself.
The most common low pass filter is often referred to as a Pi network because its circuit superficially resembles a Greek letter Pi, and takes the form of an inductor in the signal path with a capacitor to ground either side of it. If you know your maths you can calculate the values for yourself, but if you don’t there are many online Pi network calculators to help you. Constructing a Pi network at these frequencies is straightforward enough.
For the output filter, you need something that rejects the local oscillator frequency as much as possible, and passes the ESP32 receive range. Here you’re in luck, because the Wi-Fi hardware industry needs exactly those filters, so they can be had from Mouser or Digi-Key for cheap. I’m not going to specify a particular part, but I’d like to point you at the TDK Wi-Fi filter range and invite you to pick one with the bandwidth you need.
The Local Oscillator
Your local oscillator for an ESP32 working at much lower frequencies is likely to be around or above 2 GHz. Back in the day you would have used a crystal oscillator and multiplier circuits, if you like you can buy an expensive PLL oscillator module, but your simplest and probably cheapest method is to use another ESP32, now that it can be used as an SDR transmitter. Program it to output a single carrier on your desired frequency, dial down the output level, and there you have it, a 2 GHz local oscillator for a dollar or two.
The Mixer
Yet again you can buy an off the shelf mixer as a module, though one for a 2.4 GHz output will be expensive. Happily there’s a simple circuit which can do the job, and it uses a diode as a non-linear element fed with both antenna and local oscillator signals. At these frequencies you are looking for a very fast small-signal Schottky diode with as low a capacitance as you can find, and happily such parts are available from multiple manufacturers at cent rather than dollar prices. The basic circuit is shown below, and as you can see it’s quite simple.
The circuit of a simple unbalanced diode mixer with a bandpass filter on its output.
In the circuit above the diode is your Schottky device, the input low pass filter isn’t shown, and the output filter is an off-the-shelf Wi-Fi bandpass filter. The two thick lines represent a stripline coupler, and they are simply two parallel PCB traces side by side over a groundplane. Their size should ideally be calculated to present the right impedance, often 50 ohms which is also the value of R1, but in practice the jankiest solutions can work here. With an ESP32 as a local oscillator I would hazard a guess that laying the trace on the PCB under the module’s antenna with the power turned down would be enough. I may earn the scorn of some of my peers, but I have a long history of RF bodging and I think it might just work.
Making It Transmit
The same technique as above works for shifting the ESP32’s transmit output down to the desired frequency, but there’s a catch. Even the modest output from an ESP32 can be enough to damage or overload parts designed for receivers, so you have two choices. Pick transmit-appropriate parts, or dial back the power to a low level, and amplify it at the lower frequency.
By Now, You Should Be Able To Bodge A Converter
The information above isn’t a ready-to-go design for a receive converter to get your ESP32 listening to lower frequencies, but it should give you all the signposts you need to get there. People have built converters for the RTL-SDR for ages now, so you could pilfer ideas there too. If you build a downconverter, for transmit or receive or both, let us know!
At a superconference about a decade ago there was a talk about RF construction techniques which will save you a lot of pain, and with luck such a simple circuit should be within your grasp. Good luck.
Text messaging has been around on cellular networks en masse for around three decades now. It’s so common that it’s difficult to remember a time without it. Its two-way quick messaging is incredibly useful, but for even simpler communications there’s a one-way system that predates it. Pagers are able to receive simple messages, but outside of hospitals are rarely used nowadays. Eventually some added in two-way communications like this Motorola T900, but they’re still mostly obsolete. That’s why [zindustries87] converted it to operate on the Meshtastic network instead.
To get this pager working, a lot of reverse engineering was needed. There is essentially no documentation on the chips in these devices, so the screen and keyboard both were reverse-engineered to work with other hardware. In this case, [zindustries87] found space for a Heltec V4 with an ESP32-S3, a popular Meshtastic node with a small form factor. Some programming was needed to get everything communicating together, but from the looks of things it seems to have basic functionality.
[zindustries87] points out that this is a prototype, and didn’t know going in if the keyboard and screen could be brought back to life, or if the other hardware would fit in the case. But with it working on this level, they plan to add a number of other features in and possibly build a drop-in PCB replacement for these devices. They were once fairly popular so there are plenty around, and they’re a good form factor for a dedicated Meshtastic device that doesn’t need a smartphone to work. The only other ways of bringing pagers back to life involve bootstrapping an entire pager network, and Meshtastic is a bit more useful than that now.
Generally the DVB-S and -S2 standards require a satellite somewhere in Earth orbit to provide a signal to receive, but you can also transmit your own DVB-S2 stream with any RF transmitter if you’re so inclined. Courtesy of recent breakthroughs in using the RF hardware of the ESP32 on a raw level, [SP8ESA] has created the ESP32-DATV project using which you can broadcast a DVB-S2 signal using an ESP32-C3.
While a host PC side application handles the heavy lifting of turning the input video signal into a DVB-S(2) compliant signal, it is the ESP32-C3 that prepares the samples for transmission before sending them off to its RF block, with no external hardware needed.
If this brings to mind the idea of using an off-the-shelf DVB-S2 receiver to play back the signal, the frequency range for DVB-S2 is 10.7 – 12.7 GHz, while the ESP32-C3 is limited to roughly 2.4 GHz courtesy of it targeting only 2.4 GHz Wi-Fi and Bluetooth signals.
Well, that was fast! Last week, we reported on two apparently simultaneous hacks using the 2.4 GHz radio inside many ESP32 variants that enabled raw access to the radio samples, turning it into a listen-only software defined radio (SDR) platform. Listen only? That’s only half of the SDR story.
This is all in the roughly 2.4 GHz band, but [marble] suggests that it might be good down to 1.8 GHz. (Editor’s note: previously, we said 100 MHz, but that was incorrect.) So there is still some uncharted terrain, and it’s clear that the boundaries on the ESP-SDR are just starting to get pushed.
Perhaps the most famous of software-defined radios is the RTL-SDR, which is very cheap because it’s a digital TV receiver that’s been pressed into service delivering raw I and Q data streams. But the RTL-SDR is certainly not the only chipset that can do this, and today we have a new one.
The radio works on the 2.4, 5, and 6 GHz bands, depending upon which version of the device — and thus which radio chip — you have. These may not be entirely useful to many who use lower bands, and given that a similar hack has been found for ESP32 radios on 2.4 GHz it’s likely a demand will arise for a receive up-converter. Until then, you can look at WiFi packets in a waterfall view to your heart’s content.
Since more and more devices now incorporate a radio, we hope that more such undocumented raw streaming modes will be found, and that we’ll see some other new SDRs. Something to look forward to.
As the legacy AM broadcast bands fade away, what happens to the millions of devices built to receive them? Many of them will go into e-waste, but with a century of radios to choose from, some of them are collector’s items. Vintage tube radios like the ones [GarethDaviesLondon] has would go silent, so he’s made a small AM transmitter to keep them alive.
At its heart is an ESP32-S3, which takes an online radio stream and transmits it through RF generated with a pulse chain on a GPIO. Generating analogue signals from radio to video with a microcontroller is nothing new, but perhaps the more interesting part of this one comes in how he radiates enough from that pin. There’s a 3D printed box with stand-offs designed to take a widely spaced wire coil, which is enough for the vintage electronics to pick up. He makes the point that it may not be legal, but at that power we doubt anyone will notice.
The output on this one is 200kHz for the European long wave band, but we’re guessing a higher medium wave frequency could also be generated. Meanwhile if you are curious about AM, we’ve featured someone having a closer look at it.
Login
![TV tuner front end block diagram. Derived from Chetvorno (Own work) [CC0], via Wikimedia Commons](https://hackaday.com/wp-content/uploads/2016/07/rf-front-end.jpg)
