A developer publishing under the handle h0m3us3r on GitHub has released open-source firmware that turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined radio receiver. According to the project's GitHub repository, the router's built-in radio captures raw signal samples at up to 320 million samples per second, and a Linux computer on the same network displays the result as a live spectrum and waterfall in a web browser. The project matters because it suggests that consumer networking hardware, normally limited to carrying data, can be repurposed as a broad radio monitoring tool.
What the hardware chain does
The repository describes a chain of three components. The W1700K's MediaTek MT7996 radio captures raw 14-bit IQ data, the in-phase and quadrature components that describe a radio signal. Its Airoha AN7581 system-on-chip then streams that data over a 10 GbE link to a host computer. The host shows the incoming stream as a spectrum display, with the receiver's controls placed beside it.
Software-defined radio, or SDR, moves much of the signal processing from fixed circuits into software. Instead of tuning dedicated hardware to one frequency, an SDR digitises a wide slice of spectrum and lets software pick out what is of interest. That is why the approach appeals to hobbyists and researchers who want to watch many signals at once.
A wide view of the 2.4 GHz band
The most striking demonstration in the repository is the entire 2.4 GHz band, shown live at 320 million samples per second. The project applies a 262,144-point FFT to every sample and produces 100 spectra per second, although the recording included in the repository runs at 50 frames per second. The project's documentation also describes a 'flatten' mode, which corrects the roll-off introduced by decimation, the step that reduces the sample rate of a captured stream.
Roll-off matters because filters used during decimation tend to weaken signals near the edges of the captured band. Without correction, the noise floor sags toward the ends of the view and makes weak signals harder to compare. According to the repository's screenshots, the flattened view keeps the floor level from one edge of the band to the other, showing Wi-Fi frames and shorter hopping bursts clearly.
What the screenshots show
The project publishes three screenshots. The first shows the 2.4 GHz band at 320 million samples per second, with the Stream panel reporting a link carrying 9.75 Gbit/s. The description notes that half of the slices are packed and that every sample is transformed. The second shows two busy 80 MHz Wi-Fi channels between 5170 and 5330 MHz in a flattened 320 MHz view. The third zooms to 24 MHz around 5250 MHz, displaying the edges of the two channels and the guard gap between them at a resolution of 1.22 kHz per bin.
How the firmware is built
Many hobby projects repurpose a device's stock software. This one takes a different route. According to the repository, the radio runs only the project's own code: a ROM patch, along with WM and WA firmware built from the same repository, with no MediaTek code included. The project says the firmware brings the radio up from a cold power-on by itself. Its initialisation and calibration routines were decoded register by register by comparing them with a trace of MediaTek's own firmware.
After startup, the host controls the radio through a set of commands covering the local oscillator, which sets the centre frequency, along with sample rate, capture, streaming, gain and filtering. The repository points readers to its architecture and roadmap documents for more detail.
Getting started and what you need
Setup requires several pieces of equipment. The repository lists the following:
- a Gemtek W1700K router;
- a 3.3 V USB serial adapter connected to the router's console header;
- an Ethernet cable to the lan3 port for installation;
- a 10 GbE network card on the host, cabled to the router's wan port using 10GBASE-T. The repository notes that an X710 card with a copper SFP+ module works.
Once the hardware is connected, users open the interface at port 8073 on the host and press play. The repository says the first start loads the radio firmware and brings the radio up in about two seconds. Users who prefer not to use the browser can run the same operations from the command line with commands for load, start, band, tune, gain, filter, stop and status.
The build requires a C or C++ compiler, make, git, Python 3.10 or later, the usual Buildroot prerequisites, and clang with related LLVM tools for the RISC-V firmware. It also needs OpenSSL for firmware container encryption, and FFTW3 and zlib for the stream service and spectrum server. The repository states that no vendor firmware needs to be downloaded.
Warnings the project asks users to read
The repository's warnings deserve close attention. The firmware is receive-only. It runs none of MediaTek's transmit calibrations and keeps the transmit path of the MAC disabled. The project reports that a gapless watch at 5250 MHz during a load detected nothing, whereas MediaTek's own firmware transmits a full-power burst in the same situation. Even so, the project advises against connecting an antenna port directly to a sensitive instrument without an attenuator.
Other warnings are more serious. The project's ROM patch does not write to eFuses, but the repository says MediaTek's ROM patches since 2025 permanently program one eFuse gate bit on their first run. A unit that has ever run one of those patches will have that bit set. Installation also replaces the stock operating system. The installer first copies the entire NAND storage to the host, and users are told to keep that copy. Restoring stock firmware requires a raw NAND writer, which the repository does not provide. Finally, accessing undocumented MT7996 or AN7581 addresses can hang the SoC or wedge the radio until it is power-cycled.
Licensing and outlook
The project uses several licences. Most of the code is released under MIT. The Linux driver and kernel patches fall under GPL-2.0-only, the U-Boot patches under GPL-2.0+, the driver's user-space header under GPL-2.0 with the Linux syscall note, and files derived from MediaTek's mt76 driver under BSD-3-Clause-Clear. Readers planning to reuse code should consult the LICENSE file.
For hobbyists and researchers, the project shows how much spectrum monitoring capability can sit inside a commodity Wi-Fi router once its firmware is replaced. The warnings make clear that it is not a plug-and-play tool. Anyone attempting it should keep the installation backup, use attenuators, and read the repository's architecture and roadmap documents before going further.
Related: Open-Source n8n Bot Calculates Czech Tax on Broker Investments · Software License Renewal Tracker Sends Timely Reminders
Comments (0)