Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver
- ID
- 34737
- Status
- summarized
- Published
- 12 Oct 2026, 8:41 PM
- Fetched
- 13 Oct 2026, 2:21 PM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://github.com/h0m3us3r/w1700k-sdr
- Source URL
- https://hnrss.org/best
Summary
- Score
- 6.5
- Created
- 13 Oct 2026, 2:22 PM
- Tags
- Audience
- developers
What happened
The w1700k-sdr repo turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver by replacing MediaTek's firmware entirely with a ROM patch plus WM/WA built from the repo, which the author says was decoded register-by-register against a trace of MediaTek's own firmware. The MediaTek MT7996 radio captures raw 14-bit IQ at 40/80/160/320 Msps across 2.4, 5 and 6 GHz, DMA'd into a 1 GiB ring in the Airoha AN7581 SoC's DRAM and streamed zero-copy over 10 GbE in 8 KiB UDP datagrams, with a Linux host rendering a 262,144-point FFT and ~100 spectra/second waterfall in a browser. At 320 Msps, half the slices are packed to 28 bits per sample pair on the radio's own cores to fit the link; band 2 also offers a 640/2 mode that is flat to ±155 MHz but folds in signals 160–320 MHz away. The HN thread drew 313 points and 89 comments; the repo shows 446 stars, 44 forks and 9 commits.
Why it matters
If you work with RF, embedded Linux or high-throughput streaming, this is a concrete reference design for a ~$100-class consumer router acting as a 320 Msps receiver: the interesting engineering decisions are the zero-copy 8 KiB UDP datagram path, the lossless 28-bit packing needed to squeeze 320 Msps through one 10 GbE port, and the register-level bring-up from cold power-on with no MediaTek binary. The caveats matter before you buy hardware: the 640/2 mode aliases 160–320 MHz away into your passband, and retuning mid-stream costs about 1 ms, so it is not a drop-in for channelised or narrowband work. Nothing in the text gives a Malaysia or SEA angle - no local pricing, availability, distributor or regulator detail is stated, so treat any local type-approval or spectrum-licensing question as unaddressed by this source.
Discussion angle
The 10 GbE link is the real bottleneck, not the radio - at 320 Msps the project has to repack samples to 28 bits per pair on the SoC cores to fit. Ask the room what other cheap consumer hardware they own that is secretly a capable sensor or compute node, and what the register-trace reverse-engineering approach here implies for anyone trying to run their own firmware on commodity radios.