WiFi 7 Router Reborn as a High-Performance SDR Receiver: An Open-Source 320Msps Solution

From Router to Software-Defined Radio: An Unexpected Hardware Rebirth

A project that sparked discussion on Hacker News showcases an exciting hardware hacking idea: transforming a consumer-grade WiFi 7 router into a 320Msps software-defined radio (SDR) receiver. Built on the MT7981 chipset, this project opens up new possibilities for low-cost SDR applications.

Why a WiFi 7 Router?

WiFi 7 routers have dropped significantly in price, and their built-in RF front-ends and high-speed ADC/DAC were originally designed to handle wide-bandwidth signals. As MediaTek's mainstream WiFi 7 solution, the MT7981 chipset offers sufficient processing power and flexible RF interfaces, making it an ideal candidate for SDR modification.

Compared to dedicated SDR hardware (such as USRP or HackRF), the cost advantage of routers is extremely obvious. An entry-level WiFi 7 router might cost only a few hundred RMB, while professional SDR equipment capable of similar sampling rates often costs thousands or even tens of thousands of RMB.

MT7981 is a wireless communication SoC from MediaTek designed for WiFi 6/7 routers, featuring a dual-core ARM Cortex-A53 architecture with integrated 2.4GHz and 5GHz dual-band RF front-ends and a dedicated network acceleration engine. Despite being positioned as a consumer-grade routing chip, it internally contains high-speed ADC/DAC, a programmable baseband processing chain, and several debug interfaces (such as JTAG, serial port, and potentially exposed RF sampling ports). These interfaces were originally intended for production line calibration and manufacturer debugging, but they provide an entry point for reverse engineering. By modifying firmware or directly accessing these low-level interfaces, researchers can bypass the WiFi protocol stack and directly obtain raw IQ data streams. The high integration of the MT7981 also means that the RF front-end, clock management, and data movement can all be completed within a single chip, reducing external components—which is crucial for low-cost SDR modification.

What Does 320Msps Mean?

A sampling rate of 320Msps (320 million samples per second) is considered mid-to-high-end in the SDR field. According to the Nyquist sampling theorem, it can theoretically process signals with up to 160MHz bandwidth. This means the modified router can receive:

• Wideband FM broadcast and Digital Audio Broadcasting (DAB)
• Some radar and weather signals
• Certain 5G NR bands
• Most amateur radio bands
• Analysis of WiFi 6/7 signals themselves

The Nyquist sampling theorem states that to reconstruct a signal with bandwidth B without aliasing, the sampling rate must be at least 2B. Therefore, a 320Msps sampling rate corresponds to a theoretical maximum instantaneous bandwidth of 160MHz. However, in practical SDR systems, due to the non-ideality of anti-aliasing filters and the analog bandwidth limitations of the ADC front-end, the usable instantaneous bandwidth is typically slightly less than the theoretical value—approximately 120-140MHz. Furthermore, a 160MHz instantaneous bandwidth means extremely high IQ data stream rates: with 16-bit quantization, for example, 320Msps × 2 (I/Q) × 2 bytes ≈ 1.28GB/s, which places demanding requirements on data transmission interfaces and host processing capability. This is why router modification solutions must rely on 2.5G/10G Ethernet or USB 3.0+ high-speed interfaces to move data, otherwise sample loss will occur.

Technical Implementation Challenges

Turning a router into an SDR is not simply a firmware modification. The core challenges are:

Data Path Modification: The router's original RF chain is optimized for WiFi communication, so obtaining raw IQ samples requires bypassing or modifying the baseband processing flow. This typically involves reverse engineering the firmware or utilizing debug interfaces provided by the chipset.

Data Transmission: A 320Msps IQ data stream requires extremely high transmission bandwidth. The project may have adopted USB 3.0 or PCIe interfaces, or leveraged the router's own Ethernet ports (2.5G or 10G) for data backhaul.

Clock Synchronization: SDR applications have high demands on sampling clock stability, and the router's built-in clock source may not satisfy all application scenarios—external reference clock input may be necessary.

IQ samples are the fundamental data form in software-defined radio, representing complex baseband signals. The I (in-phase) and Q (quadrature) signals differ by 90 degrees in phase, together preserving the amplitude and phase information of the signal. Unlike real signals, IQ sampling allows the spectrum to be represented symmetrically around zero frequency after frequency shifting, thereby covering the same bandwidth at a lower sampling rate. To obtain raw IQ samples, one must bypass the router's original WiFi baseband processing chip—which typically performs OFDM demodulation, filtering, and protocol parsing, outputting only decoded data packets rather than raw waveforms. Common approaches include: modifying firmware to disable baseband processing, using test modes reserved by the chipset to directly export ADC data, or intercepting data on the high-speed bus between the ADC and baseband chip via hardware probes. Each step requires in-depth chip documentation or extensive reverse engineering work.

The Value of the Open-Source Community

The significance of this project lies not only in its technical feasibility but also in showcasing the creativity of the open-source hardware community. According to feedback from the Hacker News discussion thread, community members are already exploring various improvement directions for this approach, including adding transmit functionality, extending frequency coverage, and optimizing host software.

For RF engineers, amateur radio enthusiasts, and signal processing researchers, this low-cost, high-sampling-rate SDR solution could significantly lower the barrier to experimentation. It also provides a new hardware platform for converged applications of edge computing and wireless sensing.

Potential Application Scenarios

1. Spectrum Monitoring: Low-cost deployment of wide-area spectrum sensing networks
2. IoT Security Research: Analyzing the security characteristics of various wireless protocols
3. Educational Experiments: Providing students with a real high-speed SDR experimentation platform
4. Radio Astronomy: Serving as low-cost nodes for distributed radio telescopes

Limitations and Outlook

It should be noted that router-based SDR modification may not match professional equipment in RF performance (such as noise figure, dynamic range, and image rejection). However, for many non-critical applications, cost-effectiveness is the decisive factor.

This project is currently mainly circulating in technical communities and has not yet formed a complete open-source project. Interested readers can follow the discussion on Hacker News, as well as documentation and community resources for MediaTek's MT7981 chipset.

Noise Figure measures the additional noise a receiver introduces when amplifying signals. Professional SDR equipment typically achieves 3-6dB, while router RF front-ends—optimized for cost and power consumption—may have noise figures of 8-12dB or even higher. Dynamic Range refers to the receiver's ability to simultaneously handle strong and weak signals; limited by ADC bit width and automatic gain control range, router solutions tend to lose weak signals when strong signals are present. Image Rejection measures the receiver's ability to suppress image frequency interference; professional equipment achieves over 60dB through precision quadrature mixers and calibration, while router modification solutions may only achieve 30-40dB due to I/Q imbalance. These limitations mean it is better suited for non-coherent applications such as signal presence detection and spectrum monitoring, rather than communication links requiring high-fidelity demodulation.

One-line Summary

Transforming a WiFi 7 router into a 320Msps software-defined radio receiver, unlocking new SDR possibilities at extremely low cost.

Paragraph Summary

This project demonstrates an innovative hardware hacking approach: based on a consumer-grade WiFi 7 router with MediaTek's MT7981 chipset, it achieves a 320Msps sampling rate software-defined radio receiver by bypassing baseband processing and modifying the data path. Its theoretical bandwidth reaches 160MHz, covering wideband FM, DAB, some radar, 5G NR, and amateur radio bands. Compared to professional SDR equipment, the router solution is extremely low-cost, but compromises on RF performance such as noise figure, dynamic range, and image rejection. The open-source community is exploring directions such as adding transmit functionality, extending frequency coverage, and optimizing host software. This solution has broad application prospects in spectrum monitoring, IoT security research, educational experiments, and radio astronomy.