Hacker News: h0m3us3r

New comment by h0m3us3r in "Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver"

h0m3us3r — Wed, 14 Oct 2026 01:19:57 +0000

External transceiver over QLink.

New comment by h0m3us3r in "Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver"

h0m3us3r — Wed, 14 Oct 2026 00:43:09 +0000

Yes they are. And they have a much wider tuning range (I have one that tunes from 240 MHz to 7 GHz). Problem of standard hardware is that every path has dedicated SAW/BAW bandpass filters that yeet anything not in uplink/downlink. And you need an unfused chip for custom Hexagon DSP stuff (so no phones).

Base stations are also SDRs by the way xD

New comment by h0m3us3r in "Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver"

h0m3us3r — Wed, 14 Oct 2026 00:27:34 +0000

I think I'm done with wi-fi routers. I believe I stirred the pot enough for others to take it further.

New comment by h0m3us3r in "Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver"

h0m3us3r — Wed, 14 Oct 2026 00:25:03 +0000

2x 160 can be done pretty easily. Only on same band/LO though. So, only for things like multipath. 4x 80 might be possible, but needs a lot more effort. It is up to 2 ports per icap engine and only one icap engine got coerced into writing to pooled sram. The other 2 could only do their designated regions that are limited to 16KB if I remember right. So continuous reception gets more complicated/precise. Everything above is from me experimenting with HW. There is no official reference for this stuff. So I may have missed something, and some mentioned limitations may be workaroundable.

New comment by h0m3us3r in "Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver"

h0m3us3r — Tue, 13 Oct 2026 01:27:30 +0000

Getting the testmode to run once is pretty easy to be honest. Getting it running continuously without gaps and then extrating the produced firehose of data is where most of the complexity was. At least for me. Also fuzzing for configurations that were not intended. For example, stock tables only allow for up to 40mhz @ 80msps on the 2.4ghz band.

New comment by h0m3us3r in "Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver"

h0m3us3r — Tue, 13 Oct 2026 01:21:05 +0000

The "network coprocessors" are a bit lame imo. I initially tried to use them for packing, but they turned out to be very memory/cache bandwidth limited. They are also standard risk-v pretty much. I did run custom code on them though (and the Mediatek's "dsp" cores that are a bit more interesting extensions-wise, but are even more memory bw starved). There should be enough left in the tree to get one going pretty fast if one so wishes to play with those cores.

New comment by h0m3us3r in "Turn a WiFi 7 Router into a 320Msps Software Defined Radio Receiver"

h0m3us3r — Tue, 13 Oct 2026 01:08:33 +0000

It is interesting that the part you nitpicked is the one I made claude do just for fun. Cal and bringup worked just fine with a bundled vendor blob. But I wanted to understand at least some of the steps.

New comment by h0m3us3r in "Plug’nPwn – Connect to Jailbreak"

h0m3us3r — Wed, 14 Oct 2020 05:17:12 +0000

Yes, sigchecks had to be patched out of the kernel. And yes, it does not persist T2 reboot, but T2 only reboots if you hold power button for 5 sec. MacOS "reboot" does _not_ reboot T2.