Undocumented SDR Mode Discovered in ESP32 & LR2021 Chips

Table of Contents

Anyone who follows the world of Software-Defined Radio (SDR) remembers how the discovery of an undocumented raw I/Q streaming mode inside the humble RTL2832U DVB-T television tuner chip sparked a global RTL-SDR revolution. Today, a second RTL-SDR moment is unfolding across the embedded systems and radio frequency (RF) community: researchers and hardware hackers have uncovered hidden baseband I/Q SDR modes inside the ubiquitous Espressif ESP32 family and the Semtech LR2021 LoRa transceiver.

Crucially, this breakthrough is not limited to passive listening (RX). Within weeks of the initial announcement, bidirectional (RX/TX) transmission was successfully achieved across multiple ESP32 models (S3, C3, C5, C6, S31) as well as the LR2021. You can set up your base development toolchain using our ESP32 Setup Guide, and then use the open-source SDR projects reviewed in this article to transform your microcontrollers into spectrum analyzers and software-defined transceivers.

How the Undocumented I/Q Baseband Capture Mode Works on the ESP32

Almost all modern wireless microcontrollers convert analog signals arriving at the radio frequency (RF) front-end into digital I/Q (In-phase / Quadrature) baseband samples before routing them into internal hardware modems. Manufacturers typically hide these raw I/Q samples behind proprietary drivers, allowing firmware to interact only with decoded Wi-Fi frames or Bluetooth packets. However, hidden diagnostic and calibration registers used during factory wafer testing remain etched in silicon.

Independently uncovered by the ESPARGOS team (ESP-SDR) and researcher h0m3us3r (eSpDR), this undocumented mode taps the ESP32’s signal chain immediately before the Wi-Fi modem, streaming raw I/Q samples directly into SRAM and over USB/Ethernet to desktop SDR applications like SoapySDR, Gqrx, and SDR++.

Supported ESP32 Models: From original dual-core Xtensa chips to modern RISC-V variants (ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C5, ESP32-C6, and ESP32-S31). The dual-band Wi-Fi 6 ESP32-C5 supports I/Q capture in both 2.4 GHz and 5 GHz bands.
Excluded Models: The ESP32-P4 (which lacks an integrated radio) and the BLE/802.15.4-only ESP32-H2 do not contain this Wi-Fi baseband capture path.
Browser-Based Spectrum Analysis: ESPARGOS provides an in-browser Web Serial tool that allows flashing and monitoring 2.4 GHz Wi-Fi spectrum occupancy 24/7 with approximately 0.5 W total power consumption.

The I/Q Throughput Bottleneck and the ESP32-S31 40 MSa/s Solution

The ESP32’s internal modem ADC writes into SRAM at up to 80 million samples per second (80 MSa/s at 32 bits per complex sample = 2.56 Gbps). However, exporting this massive data stream off-chip represents the core engineering hurdle. Standard ESP32 peripherals provide limited egress bandwidth (SPI up to 80 Mbps, 4-bit SDIO at 50 MHz, and 8-bit PARLIO at 40 MHz):

SPI Transfer (80 Mbps): Delivers approximately 1.25 MHz of RF bandwidth at 32-bit I/Q resolution, 5 MHz at 8-bit resolution, or up to 40 MHz at 1-bit resolution for radio astronomy applications.
FPGA Bitbanging: Researcher h0m3us3r demonstrated bitbanging the wur.gpio_out register into an external FPGA to achieve 200 MB/s sustained USB 3.0 streaming to a host PC.
ESP32-S31 Native Streaming: Espressif’s high-performance ESP32-S31 solves this natively with integrated USB 2.0 High-Speed (480 Mbps) and Gigabit Ethernet (1 Gbps) interfaces, enabling continuous 20 MSa/s (8-bit) capture over USB and 40 MSa/s over Gigabit Ethernet via the SoapyESPSDR driver without external FPGA hardware.

Bidirectional Transmission: Transmitting RF Signals with ESP-SDR

Shortly after the initial receive discovery, developers marble, Jochen (DA2JH – esp32-sdr-trx), and z1000biker (esp32c3rxtx) proved that the ESP32 can also operate as a transmitter (TX). Testing confirmed that the chip’s internal Phase-Locked Loop (PLL) synthesizer can lock continuously between 1.8 GHz and 2.8 GHz.

This 1.8 GHz to 2.8 GHz range encompasses the entire 2.4 GHz ISM band, the 13 cm amateur radio band (2.3–2.45 GHz), and QO-100 (Es’hail-2) amateur satellite wideband uplink channels:

Hellschreiber and Custom Modulation: Point-to-point text and telemetry transmission between an ESP32-S3 and ESP32-C6 by directly modulating the RF carrier without standard Wi-Fi frames.
Narrowband FM & SSB Voice on 13 cm: The esp32-sdr-trx project transforms a single ESP32-S3 into an rtl_tcp receiver for SDR++ and an FM/SSB voice transmitter on the 13 cm amateur band fed from a microphone or sound card.
DVB-S2 Digital TV Transmission: The ESP32-DATV-SA project uses an ESP32-C3 to broadcast standalone DVB-S2 video and beacons directly to satellite receivers without a PC.

The Second Revelation: 16-Bit Sub-GHz and 2.4 GHz SDR on Semtech LR2021

Because the ESP32’s PLL cannot tune below 1.8 GHz, developers explored whether sub-GHz bands (433 MHz, 868 MHz, VHF, UHF) could be accessed similarly. Developer Samson1te answered this by uncovering hidden SDR capabilities in Semtech’s next-generation LR2021 LoRa transceiver (lr2021-sdr).

Unlike previous SX1262 modules that only export demodulated packets and RSSI, the LR2021 exposes raw 16-bit I/Q samples with both receive and transmit capabilities across dual RF paths:

Low-Frequency (LF Sub-GHz) Path: 150 MHz to 960 MHz, covering VHF, UHF, 433 MHz, 868 MHz, and 915 MHz ISM/LoRa frequencies.
High-Frequency (HF) Path: 1.5 GHz to 2.5 GHz, supporting L-band satellites and the 2.4 GHz ISM band.
Digital Voice & Pager Decoding: Demonstrated real-time decoding of P25 digital voice, analog FM, and POCSAG pager messages on 154.000 MHz with ultra-low battery consumption.

Feature / Parameter	RTL-SDR (RTL2832U)	ESP-SDR (ESP32 / S3 / C5 / S31)	LR2021 LoRa SDR
Frequency Range	24 MHz – 1.766 GHz	1.8 GHz – 2.8 GHz (C5 adds 5 GHz)	150 – 960 MHz & 1.5 – 2.5 GHz
Transmit (TX) Capability	No (Receive Only)	Yes (RX & TX supported)	Yes (RX & TX supported)
I/Q Resolution	8-bit ADC	Internal 32-bit (1-bit / 8-bit stream)	16-bit I/Q access
Maximum Bandwidth	2.4 MSa/s (Stable)	5 MHz (SPI); 20–40 MSa/s (S31 USB/Eth)	Narrowband / Medium-band protocol focused
Power Consumption	~1.5 W – 2.0 W (USB powered)	~0.4 W – 0.5 W	Ultra-low power (Battery friendly)
Hardware Cost	$25 – $40	$2 – $8	$5 – $12 (Per module)

Tuning ESP32 SDR to Lower Frequencies: DIY Downconverter Design

If you want to receive HF, VHF, or 400–500 MHz UHF signals using a 2.4 GHz ESP32, you can build a minimalist diode mixer frequency converter. Mixing two frequencies produces sum (f_RF + f_LO) and difference (|f_RF – f_LO|) products.

To tune 400–500 MHz into the ESP32’s 2.4–2.5 GHz window, you need a 2.0 GHz Local Oscillator (400 MHz + 2000 MHz = 2400 MHz). A minimalist circuit consists of four blocks:

Input Pi-Network Low-Pass Filter: Suppresses incoming signals above 500 MHz and prevents LO radiation into the antenna.
Second ESP32 as a 2 GHz Local Oscillator: Because ESP-SDR supports TX mode, a second $3 ESP32 can be programmed to emit a clean 2.0 GHz continuous wave (CW) carrier, eliminating expensive PLL synthesizer chips.
Schottky Diode Mixer: A fast, low-capacitance small-signal Schottky diode functions as the non-linear mixing element.
2.4 GHz Wi-Fi Bandpass Filter: A compact SMD ceramic filter passes the 2.4–2.5 GHz intermediate frequency to the receiving ESP32 while rejecting LO leakage.