W1700K SDR: a Wi-Fi 7 router as a 320 MHz receiver

Summary

The w1700k-sdr project turns the Gemtek W1700K Wi-Fi 7 router into a wideband SDR receiver that delivers up to 320 million complex samples per second from the 2.4, 5 and 6 GHz bands over 10 GbE to a Linux host. To do this, the MediaTek MT7996 radio runs nothing but home-made firmware, rebuilt register by register from traces of the original firmware. The host shows spectrum and waterfall in the browser, and frequency, gain and filter can be changed while the stream is running.

What is it?

The W1700K contains an Airoha AN7581 with four Cortex-A53 cores, 2 GiB of RAM and a 10 GbE port, plus the MediaTek MT7996 Wi-Fi chip with three radio front ends: an MT7976 for 2.4 GHz and two MT7977s for 5 and 6 GHz. A Wi-Fi chip normally only delivers decoded data frames. The MT7996, however, has a capture engine that MediaTek’s own firmware uses for a spectrum function, and this very engine delivers raw IQ data, the digitised radio signal itself.

The project uses it as a continuous stream: 14-bit IQ at 40, 80, 160 or 320 Msps on every band, freely tunable instead of tied to Wi-Fi channels. On the Linux host, w1700k-stream hands the data to every program, w1700k-spectrum computes 100 spectra per second with 262,144 points each, and sdr-recv records.

How it works

The MT7996’s ROM code verifies neither the jump table of the firmware patch nor, behind a bent CRC check, the programs loaded afterwards. From the patch onwards, only the project’s code runs. To start the radio without MediaTek code, the original firmware was traced on a cold-started unit over 69 loads, every register access logged individually and the necessary parts rewritten in C. Each module was checked access for access against this trace before it ran on the hardware.

The data path is built for throughput: the radio writes by DMA into a 1 GiB ring buffer, and the kernel sends every 8 KiB slice as its own UDP datagram without copying. 320 Msps at 32 bits per sample pair adds up to 1.28 GB/s, but a 10 GbE link only carries about 1.24 GB/s of payload. The radio’s own cores therefore pack half of the slices losslessly to 28 bits per pair, which puts the link at about 97 percent.

Why is it interesting?

An RTL-SDR stick shows about 2.4 MHz at once, a HackRF One 20 MHz. The W1700K captures 320 MHz and thus the entire 2.4 GHz band in one picture: Wi-Fi, Bluetooth and other radio systems in the same waterfall. For hunting interference, planning channels in your own network or recording short radio events, that is a bandwidth that otherwise requires expensive lab equipment.

The project also shows how much measurement technology is hidden in mass-market hardware. The capability was in the chip all along; nobody outside the manufacturer simply had access to it.

Limits and risks

Installation replaces the router’s operating system and needs a 3.3 V serial console and a 10 GbE network card for 10GBASE-T. The installer first backs up the entire 544 MiB NAND, but getting back to the original firmware requires a NAND programmer, which the project does not provide. According to its own checklist, the project has so far only been built on the development machine, and installation and recovery on a second unit are still pending.

The firmware does not transmit: transmit calibrations are missing and the transmit path stays disabled. It also writes no eFuse, whereas MediaTek’s patches since 2025 permanently set an eFuse bit on their first run. The first unit tunes from 2.081 to 2.748 GHz and from 4.647 to 7.576 GHz, and levels are not yet calibrated in dBm. The receiver is therefore not yet a measuring instrument in the strict sense.

Ideas

• A Wi-Fi chip’s capture engine delivers raw IQ data for a wideband SDR.
• Home-made firmware fully replaces MediaTek’s code and limits itself to receiving.
• Trace, understand and selectively rebuild the original firmware’s register accesses.
• Pack half of the data slices on the radio so that 320 Msps fit through 10 GbE.
• A 1 GiB ring buffer bridges about 0.8 seconds of congestion at full rate.
• Frequency, gain, filter and band can be switched while the stream is running.

Insights

• Mass-market hardware such as Wi-Fi routers contains radio technology that can do far more as a measuring tool than intended.
• A missing signature check in ROM opens the same door for tinkerers as for attackers.
• The approach only works on chips without programmed security eFuses; how long such units remain available is an open question.

Facts

• In the project, the MT7996 delivers 14-bit IQ at 40, 80, 160 or 320 Msps on every band.
• 320 Msps at 32 bits per sample pair adds up to 1.28 GB/s; 10 GbE carries about 1.24 GB/s of payload.
• Retuning the frequency takes about 1 ms within a running stream.
• With the project’s firmware, a cold radio is ready to receive in about 2 seconds.

References

• h0m3us3r: w1700k-sdr on GitHub
• w1700k-sdr: Architecture
• w1700k-sdr: Roadmap
• w1700k-sdr: Installing and updating a unit

Critique

• All performance figures come from the project itself and from a single unit; there are no independent measurements yet.

Remarks

• The project is published by the GitHub account h0m3us3r; no real name is given.
• The project was not installed or measured for this article.

Recommendations

• Store the complete NAND backup in two places before anything else.
• Use --expect-serial and --backup-only to back up first and only install afterwards.
• Always put an attenuator between the antenna port and sensitive test equipment.
• An RTL-SDR stick is enough to get started with SDR; the W1700K pays off for wideband analysis of Wi-Fi and the 2.4 GHz band.

View the project on GitHub →

Search the Web Archive

Links to the original source and the Web Archive open in a new tab.