RESEARCHERS FIND AN UNDOCUMENTED RAW IQ CAPTURE MODE IN ESP32 CHIPS, TURNING $5 BOARDS INTO SOFTWARE-DEFINED RADIOS

Summary from the TLDR Hardware newsletter

The ESPARGOS team found a hidden debug feature in Espressif's ESP32 modem that bypasses the fixed Wi-Fi modem and dumps raw baseband IQ samples straight into internal SRAM, using the chip's own ADC chain with no extra hardware. They reverse-engineered it, with help from LLMs, and it works across the original ESP32 plus the C3, C5, C6, C61, S2, S3, and S31, capturing up to 80 MSa/s across 2.2-2.7 GHz (and 4.8-6.0 GHz on the C5), which even reaches some LTE and 5G NR bands near 2.6 GHz.