A $30 USB Wi-Fi dongle turned into a 40 Msps dual-band radio receiver

Luigi Cruz@luigifcruz

The answer is an SDR that you already own!

Let me introduce you to the BirriaSDR! A dual-band 40 Msps SDR (2.4 GHz/5 GHz) based on a mass-produced USB 3.0 Wi-Fi dongle that can export RAW I/Q for under 30 USD.

Apologies, I finished the birria long ago... but only got around to writing this now.

The idea was to use a chip as cheap as the RTL-SDR (<50 USD), with transport already built in (USB 3.0). Not something that costs four times as much or needs to be paired with an FPGA to export any real amount of data.

Now, think for a bit: what kind of mass-produced device fits the bill? Yes, every single USB Wi-Fi dongle!!!

It has been clear for a while that a lot of models have internal firmware that can be modified to export RAW I/Q data via their DMA engines. Most units can even run ASM payloads to modify the data.

Historically, it would be a pain in the ass to reverse engineer the internal mechanisms of every single chipset in each Wi-Fi dongle (there are many!). But with AI, I can do that from my phone while eating birria at my local restaurant.

Before leaving, I connected my MT7921A Wi-Fi dongle to my Raspberry Pi 5 and gave GPT-6 Astra the goal of getting it to export RAW I/Q over USB. Don’t be fooled: this wasn’t a “turn this into an SDR, make no mistakes” prompt. I had to give it leads on how to do this properly. By the way, this is the same chipset that the notorious ALFA AWUS036AXML has.

At first, it created a burst exporter that could only record a short snapshot of RAW I/Q. This is an ancient feature that has been known for a long time and is even present in DD-WRT, but it was useless for our purposes.

Then, after a couple of hours, it improved it to use the internal packetizing engine to create a stream of four consecutive complex samples per 16-byte block, with I and Q each occupying a 16-bit slot and retaining 14-bit precision. These blocks can be moved out of the device via the DMA engine. The RF front end can tune to both the 2.4 GHz and 5 GHz bands. The tested 40 MHz, 80 MHz, and 160 MHz sample rates work, but with a very prominent filter shape, as expected.

The end result was a very capable SDR with dual-band 2.4 GHz/5 GHz reception, 14-bit I/Q resolution, and a nominal complex sample rate of 40 MSps over USB 3.0. Higher sample rates and wider bandwidths are still experimental.

That said, I think this is a good proof of concept that needs to be further refined. Using a Wi-Fi dongle as an SDR solves the data interconnect problem and makes it easy to connect an external antenna with RP-SMA.

I expect it won't take long for manufacturers to start mass-producing devices with the architecture I'm proposing, with a proper USB port, a tunable RF front end, and heat dissipation.

I also want to make the point that you don't need to write a whole new SDR client every time you reverse engineer a Wi-Fi device to be used as an SDR. All you need is a small library that exports the I/Q. To prove this, the whole driver is a single Python script inside a CyberEther flowgraph file.

Want to try it? First, buy an MT7921-based Wi-Fi dongle. They’re widely available and cost less than $30. Then, install CyberEther and download the flowgraph from the repository below. Connect the dongle and open the flowgraph in CyberEther to start streaming I/Q data, as shown in the video below.

This will be available as a built-in block in CyberEther after some refinement.

Download CyberEther: t.co/4bFosC4cj5
BirriaSDR Repo: t.co/idMu2ni3Qf

P.S. This is the same chipset many laptops come with!