"BRINGUP, from a cold radio: what MediaTek's ROM patch does at download (XO, pin mux, the CONN AFE calibration pulse per band, the A-die TOP init by chip ID, pads and CONN switch, the A-dies' eFuse trims); the UMAC pool layout; the common and per-band PHY initialisation; on each A-die the RF init tables, the resistor calibration and the RC filter calibration; the FEM outputs and the crystal trim."
That's not even some other language poorly translated to English, that's just a bunch of words.
Between stuff like this and math "proofs" that aren't readable either I'm really challenged to see the benefit here.
What I get out of this is that one could, if you had the documentation, write a more generalized SDR application for this hardware than the Wifi7 application. That an LLM model can provoke this behavior seems as a good existence proof perhaps?
> That's not even some other language poorly translated to English, that's just a bunch of words.
The language makes sense if you've worked with radio chips or firmware.
Terms like XO (crystal oscillator) and pin mux (chip pin multiplexer, basically assigning pins to their role) are common for embedded work, not just radio work.
Usually in a project you get that language hidden in a separate implementation doc where casual readers won't get confused by it.
Yes there are radio terms in there. :-) That said, I've written combined firmware/gateware drivers for dedicated radio chips and that paragraph makes little sense to me. Even the RFSoC docs from AMD/Xilinx are better written and they are pretty damn dense.
> Even the RFSoC docs from AMD/Xilinx are better written
This project isn't meant to be vendor-quality documentation of the chipset. It's a reverse engineering project that succeeded and included enough documentation to build upon.
Comparing a freely shared reverse engineering proof of concept to vendor-provided 1st party documentation is a ridiculous high bar.
This is a cool project that was just shared hours ago. Criticizing it for not being 1st party vendor documentation quality is a really bad faith criticism.
Okay. So let's pretend it is simple a proof-of-concept (PoC) rather than a full blown project, it's opening paragraph in README.md is:
"Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it."
Does that read paragraph say "Hey check out this PoC!" to you?
So a human, used Claude code to reverse engineer a device. Fine, let THAT be the readme. If it had said, "This is something that was accomplished with Claude code reverse engineering this thing, I have no idea how it works, but that it does work is evidenced by the spectrum I can show."
For those of us who are "skilled in the art" as they say, this reads like "Hey check this out, I bypassed the paywall by putting in my Mom's credit card number!" The lede here is that Claude can reverse engineer things. That was most informatively shown with an article that showed up here titled "All the things I own, owned."
The comment I replied to simply said, "Thanks Claude." Which is droll, but accurate. And, for me, the criticism of showing off something you "did" with a tool you don't understand and whose outputs you don't understand, reminds me strongly of the script kiddies of the 90's and naughts who would boldly proclaim "Hey, check it out, I got root on <website>." when all they had done was run Metasploit and walked through a bunch of scripts until they hit an RCE vulnerability and then used it to gain root (with another script).
So at some point the vendor will go through and patch the holes which the model had exploited and they will have to rewrite their admin architecture, and maybe be liable to some fines with the chip companies if "Intellectual Property" was improperly disclosed by their failure to write good software. And are we any closer to using the products as a general purpose SDR? No, we are not.
Contrast that with the folks who reverse engineered the RealTek DVB-T tuner chip, and had an understanding of what they had done and how it worked, and it spawned a bunch of RTL-SDR dongles that introduced lots of people to SDRs.
It is a really cool project, and it is an interesting proof of concept which could be the starting point for reverse engineering these boxes. But the author chose to present it as a complete ready to go project with documentation of things like their "architecture."
I suspect it is also true that neither the author, and certainly not the large language model, has any idea about how this firmware even works.
> So at some point the vendor will go through and patch the holes which the model had exploited and they will have to rewrite their admin architecture, and maybe be liable to some fines with the chip companies if "Intellectual Property" was improperly disclosed by their failure to write good software. And are we any closer to using the products as a general purpose SDR? No, we are not.
What? It tunes and it's streaming IQ over Ethernet. It is a general purpose SDR! You can use it as a general purpose SDR immediately.
I'd like a little more information from someone who actually knew what they were doing (or even just asked Claude to write it out in more detail) about the "real" nuts and bolts of the receiver, too (how's does IQ imbalance calibration work? How much dynamic range does it really have? How much can we configure the frontend, in detail?), but I don't think it's fair to claim this project is skiddie-level or not useful at this stage just because it was written by Claude.
Also, who's going to fine Mediatek for exposing Mediatek IP?
I'm doubtful about that. To be pedantic if you consider the set 'superhuman intelligence' to be a proper superset of 'human intelligence', then I would expect it to be able to structure its communications to the level the audience could understand. Does that make sense?
Is is more what it feels like talking to someone who doesn't really understand what it is they are talking about. A lot of keywords but no flow, no conceptual linkages from one part to another. Etc.
> write a more generalized SDR application for this hardware
Yeahhh, no. Sorry but the entry barrier is now extremely lowered, especially in effort.
~20 years ago this would have been literally sci-fi. Back then just getting an USRP to work with gnu-radio, then finding the proper hardware external clock, then doing lots of work on reading / trying stuff / writing scripts etc. took a ton of effort and time. Having the ability to throw tokens at it and have at least a starting point is amazing, IMO.
Try using GPT to write software like this, I don't think just anyone could do it unless they know the problem domain well. Understanding something is not something any AI can replace (yet).
If someone wants to set up some hardware in a harness and then spend their tokens reverse engineering it, I'm thankful for the publication.
A year ago it was different. I looked at a lot of these vibe-RE projects and a lot of them wouldn't even do what they claimed. Now if someone points a frontier model at some code and lets it consume tokens for a few days, the output is often valuable as a starting point for other projects.
320MSPS at this frequencies for less than $100 that can be extracted over 10GBit/s.
This was worth upper 4- to 5-digit of dollars of equipment before.
I work in this industry and sold more than one kidney for this stuff.
Same for the ESP-SDR project. Most likely it can be used for transmitting on S-Band for satellite control in the future (with an amplifier, dish, maybe some filtering). The HF-Frontend is Wi-Fi certified and therefore quite clean. I've forwarded this project to a friend who's close to ESA staff.
Most people don't have an idea just how expensive high speed Analog to Digital Converters are, yet modern wifi radios often have 2 or 3 at a price under $30. Going to Digikey right now, an ADC capable of 14 bits at 350MSPS is over $200 (quantity 1), and that doesn't come with all the other supporting hardware needed to build a radio. The magic of volume production of hardware in quantities of millions is quite something.
You're referencing a 5-figure rig like the ADRV9040 I suppose? I don't work in that industry but I do dabble in SDR hobbies and I guess due to my advancing age I view this as linear progress rather than breakthroughs. Two decades ago it was $1 million worth of junk.
Yes. That's a very modern design. Lots of MIMO.. so I assume you will find that beast in cellular base stations.
I'd more see it as a huge jump in the higher frequencies.
>2GHz basically became cheap now over night.
Thanks to Claude&co. it now only takes maybe a few hours to find (or brute force ) potential registers to spit out raw I/Q streams. The last huge breakthrough there was the now rather old Rtlsdr project around the Osmocom dudes.
Yeah, reading stuff like:
"BRINGUP, from a cold radio: what MediaTek's ROM patch does at download (XO, pin mux, the CONN AFE calibration pulse per band, the A-die TOP init by chip ID, pads and CONN switch, the A-dies' eFuse trims); the UMAC pool layout; the common and per-band PHY initialisation; on each A-die the RF init tables, the resistor calibration and the RC filter calibration; the FEM outputs and the crystal trim."
That's not even some other language poorly translated to English, that's just a bunch of words.
Between stuff like this and math "proofs" that aren't readable either I'm really challenged to see the benefit here.
What I get out of this is that one could, if you had the documentation, write a more generalized SDR application for this hardware than the Wifi7 application. That an LLM model can provoke this behavior seems as a good existence proof perhaps?
> That's not even some other language poorly translated to English, that's just a bunch of words.
The language makes sense if you've worked with radio chips or firmware.
Terms like XO (crystal oscillator) and pin mux (chip pin multiplexer, basically assigning pins to their role) are common for embedded work, not just radio work.
Usually in a project you get that language hidden in a separate implementation doc where casual readers won't get confused by it.
Yes there are radio terms in there. :-) That said, I've written combined firmware/gateware drivers for dedicated radio chips and that paragraph makes little sense to me. Even the RFSoC docs from AMD/Xilinx are better written and they are pretty damn dense.
> Even the RFSoC docs from AMD/Xilinx are better written
This project isn't meant to be vendor-quality documentation of the chipset. It's a reverse engineering project that succeeded and included enough documentation to build upon.
Comparing a freely shared reverse engineering proof of concept to vendor-provided 1st party documentation is a ridiculous high bar.
This is a cool project that was just shared hours ago. Criticizing it for not being 1st party vendor documentation quality is a really bad faith criticism.
Okay. So let's pretend it is simple a proof-of-concept (PoC) rather than a full blown project, it's opening paragraph in README.md is:
"Turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams it over 10 GbE, and a Linux host shows it as a live spectrum and waterfall in the browser, with the receiver's controls next to it."
Does that read paragraph say "Hey check out this PoC!" to you?
So a human, used Claude code to reverse engineer a device. Fine, let THAT be the readme. If it had said, "This is something that was accomplished with Claude code reverse engineering this thing, I have no idea how it works, but that it does work is evidenced by the spectrum I can show."
For those of us who are "skilled in the art" as they say, this reads like "Hey check this out, I bypassed the paywall by putting in my Mom's credit card number!" The lede here is that Claude can reverse engineer things. That was most informatively shown with an article that showed up here titled "All the things I own, owned."
The comment I replied to simply said, "Thanks Claude." Which is droll, but accurate. And, for me, the criticism of showing off something you "did" with a tool you don't understand and whose outputs you don't understand, reminds me strongly of the script kiddies of the 90's and naughts who would boldly proclaim "Hey, check it out, I got root on <website>." when all they had done was run Metasploit and walked through a bunch of scripts until they hit an RCE vulnerability and then used it to gain root (with another script).
So at some point the vendor will go through and patch the holes which the model had exploited and they will have to rewrite their admin architecture, and maybe be liable to some fines with the chip companies if "Intellectual Property" was improperly disclosed by their failure to write good software. And are we any closer to using the products as a general purpose SDR? No, we are not.
Contrast that with the folks who reverse engineered the RealTek DVB-T tuner chip, and had an understanding of what they had done and how it worked, and it spawned a bunch of RTL-SDR dongles that introduced lots of people to SDRs.
It is a really cool project, and it is an interesting proof of concept which could be the starting point for reverse engineering these boxes. But the author chose to present it as a complete ready to go project with documentation of things like their "architecture."
I suspect it is also true that neither the author, and certainly not the large language model, has any idea about how this firmware even works.
> So at some point the vendor will go through and patch the holes which the model had exploited and they will have to rewrite their admin architecture, and maybe be liable to some fines with the chip companies if "Intellectual Property" was improperly disclosed by their failure to write good software. And are we any closer to using the products as a general purpose SDR? No, we are not.
What? It tunes and it's streaming IQ over Ethernet. It is a general purpose SDR! You can use it as a general purpose SDR immediately.
I'd like a little more information from someone who actually knew what they were doing (or even just asked Claude to write it out in more detail) about the "real" nuts and bolts of the receiver, too (how's does IQ imbalance calibration work? How much dynamic range does it really have? How much can we configure the frontend, in detail?), but I don't think it's fair to claim this project is skiddie-level or not useful at this stage just because it was written by Claude.
Also, who's going to fine Mediatek for exposing Mediatek IP?
Is what it feels like to talk to a superhuman intelligence?
I'm doubtful about that. To be pedantic if you consider the set 'superhuman intelligence' to be a proper superset of 'human intelligence', then I would expect it to be able to structure its communications to the level the audience could understand. Does that make sense?
Is is more what it feels like talking to someone who doesn't really understand what it is they are talking about. A lot of keywords but no flow, no conceptual linkages from one part to another. Etc.
> I'm really challenged to see the benefit here.
> write a more generalized SDR application for this hardware
Yeahhh, no. Sorry but the entry barrier is now extremely lowered, especially in effort.
~20 years ago this would have been literally sci-fi. Back then just getting an USRP to work with gnu-radio, then finding the proper hardware external clock, then doing lots of work on reading / trying stuff / writing scripts etc. took a ton of effort and time. Having the ability to throw tokens at it and have at least a starting point is amazing, IMO.
Try using GPT to write software like this, I don't think just anyone could do it unless they know the problem domain well. Understanding something is not something any AI can replace (yet).
If someone wants to set up some hardware in a harness and then spend their tokens reverse engineering it, I'm thankful for the publication.
A year ago it was different. I looked at a lot of these vibe-RE projects and a lot of them wouldn't even do what they claimed. Now if someone points a frontier model at some code and lets it consume tokens for a few days, the output is often valuable as a starting point for other projects.
Claude or not: It's a huge breakthrough for ham radio and signal analysis.
We now can programm more manual tuned stuff to turn this into a full 13cm and 5cm radio as it was proven to work.
Before the esp-sdr hack and this one both bands were quite difficult and pricey to reach.
Why is this a breakthrough? Just because the platform costs under $100?
320MSPS at this frequencies for less than $100 that can be extracted over 10GBit/s.
This was worth upper 4- to 5-digit of dollars of equipment before.
I work in this industry and sold more than one kidney for this stuff.
Same for the ESP-SDR project. Most likely it can be used for transmitting on S-Band for satellite control in the future (with an amplifier, dish, maybe some filtering). The HF-Frontend is Wi-Fi certified and therefore quite clean. I've forwarded this project to a friend who's close to ESA staff.
Most people don't have an idea just how expensive high speed Analog to Digital Converters are, yet modern wifi radios often have 2 or 3 at a price under $30. Going to Digikey right now, an ADC capable of 14 bits at 350MSPS is over $200 (quantity 1), and that doesn't come with all the other supporting hardware needed to build a radio. The magic of volume production of hardware in quantities of millions is quite something.
You're referencing a 5-figure rig like the ADRV9040 I suppose? I don't work in that industry but I do dabble in SDR hobbies and I guess due to my advancing age I view this as linear progress rather than breakthroughs. Two decades ago it was $1 million worth of junk.
> ADRV9040
Yes. That's a very modern design. Lots of MIMO.. so I assume you will find that beast in cellular base stations.
I'd more see it as a huge jump in the higher frequencies.
>2GHz basically became cheap now over night.
Thanks to Claude&co. it now only takes maybe a few hours to find (or brute force ) potential registers to spit out raw I/Q streams. The last huge breakthrough there was the now rather old Rtlsdr project around the Osmocom dudes.
> Claude&co
OpenAI seething that they didn’t pick a fucking name for their platform.
ChatGPT? Aka Chat-gippty, or chatty? At chat.com?