7 ms·

Is it possible to use a laptop's built-in wifi antenna / wifi card as the hardware side of a gnu radio setup? That seems like it would be a nice cheap one-two

by geenew 5y ago

Is it possible to use a laptop's built-in wifi antenna / wifi card as the hardware side of a gnu radio setup? That seems like it would be a nice cheap one-two punch for getting started. AFAIR wifi uses the public (unregulated) bands so there should be lots of interesting stuff on those frequencies beyond wifi signals.

RF_Savage 5y ago
Due to it being a radio licenced by rule, the firmware in wifi devices is locked down tight. If it ware wide open FCC would revoke it's type acceptance. The only project that so far has managed to even partially use wifi hardware as a more generic SDR is nexmon[1] and even that is rather involved. Really cool project but not much heard since 2018. For just experimenting with modems across a noisy path one could just use the built in microphone and speakers. 1. https://github.com/seemoo-lab/mobisys2018_nexmon_software_defined_radio https://github.com/seemoo-lab/mobisys2018_nexmon_software_de...
- throway453sde 5y ago
  If i run linux can i modify the firmware? Also the regulations differ from country to country so this should be legal in some of the country.
  - Shared404 5y ago
    Firmware is typically loaded directly onto the hardware, so you would have to have a way to flash your custom firmware to the wifi antenna/card. In the US and other countries, it is to the best of my knowledge legal to modify firmware for hardware you own. The illegal part is broadcasting, most bandwidths are highly regulated. Listening on the other hand is mostly legal, or at the very least extremely likely to fly under the radar.
  - RF_Savage 5y ago
    You will not be able to modify the firmware blob just by running linux. Few years back there was danger of FCC de facto banning alternative router firmwares like openwrt to prevent tampering with the wifi cards firmware. This was the "only manufacturer signed firmware allowed" thing that thankfully was avoided. FCC's motivation in this is to prevent people from using too much power or certain frequencies. And as most manufacturers want to be able to sell in USA, it would have likely affected all versions. Kainda like how many wifi devices sold in Europe only go up to channel 11 on 2.4GHz, when the EU band goes up to channel 13. But ch12 and ch13 are not legal in usa, so they are blocked.
    - throway453sde 5y ago
      You mean there are binary blobs without source code in the linux repo?
      - bobthebuilders 5y ago
        Yup. One of the reasons GNU has a deblobbed Linux build.
  - Jenda_ 5y ago
    I would suggest not starting in the 2.4GHz band, the protocols used there (wifi, bluetooth) are very complicated to understand. Get a rtl-sdr and start with something simpler: FM broadcast (my blogpost: https://www.abclinuxu.cz/blog/jenda/2019/11/gnu-radio-first-steps-a-fm-receiver https://www.abclinuxu.cz/blog/jenda/2019/11/gnu-radio-first-..., there is even an example capture you can download and replay, so you can start without the physical radio), police radio (both analog and digital), radiosondes, weather satellites, ISM stuff - temperature sensors, garage and car remote controls, airplane multilateration (https://github.com/mutability/mlat-server https://github.com/mutability/mlat-server )… You can do lot of stuff even with the $10 rtl-sdr, for example I have used it for multilaterating TV and radio transmitters (thesis: https://jenda.hrach.eu/dipl.pdf https://jenda.hrach.eu/dipl.pdf, unfortunately "layman's explanation" is available only as a lecture in Czech). I know people are even building radioastronomy stuff and passive radars (https://www.rtl-sdr.com/passive-radar-dual-coherent-channel-rtl-sdr/ https://www.rtl-sdr.com/passive-radar-dual-coherent-channel-...) with rtl-sdr. Once you have basic understanding of the topic, you can get better hardware: AirSpy (the same features as rtl-sdr, but MUCH better signal-to-noise ratio and bandwidth) or bladeRF (costly, but probably the best radio you can get now). For example I'm now building a weather radar based on bladeRF. The bladeRF has a FPGA with open-source HDL, so you can mess even with absolutely lowlevel and bleeding edge stuff. Going back to your original question: Most cards load firmware from a file when they are initializing (check "dmesg|grep firmware", on my machine, for example, it says it has loaded /lib/firmware/rtl_nic/rtl8153b-2.fw), you are free to modify it. However, all (or maybe almost all) wifi cards have the format of the blob completely undocumented so it would be very hard to make a modification that would allow you to transmit/receive arbitrary signals. Something similar has been achieved with GSM phones (see OsmocomBB), but it requires very complicated reverse-engineering. Recently, there was a wifi stack released for a SDR, so the other way around: https://www.nuand.com/bladeRF-wiphy/ https://www.nuand.com/bladeRF-wiphy/.
  - pabs3 5y ago
    There are some devices with open source firmware, so yes for some devices: https://github.com/chunkeey/carl9170fw/ https://github.com/chunkeey/carl9170fw/ https://github.com/qca/open-ath9k-htc-firmware https://github.com/qca/open-ath9k-htc-firmware http://netweb.ing.unibs.it/~openfwwf/ http://netweb.ing.unibs.it/~openfwwf/
- geenew 5y ago
  For future reference, this[0] is a good get-started guide to getting a signal from the microphone, outputting a signal to the speaker, and some basic signal display / waveform generation. For my own use (on windows 10), I used the following device names for the microphone / speaker: Microphone: "Microphone Array (Realtek High Definition Audio)" Speaker: "Speaker/HP (Realtek High Definition Audio)" Specific names on windows can be found in the Control Panel > System > Sound (as of the date of writing) [0] https://www.youtube.com/watch?v=pTqaSCXTSqY https://www.youtube.com/watch?v=pTqaSCXTSqY
lsllc 5y ago
You can use a paperclip or a piece of wire if you have access to a GPIO port: https://www.rtl-sdr.com/receiving-ads-b-jetliner-traffic-with-a-simple-paper-clip/ https://www.rtl-sdr.com/receiving-ads-b-jetliner-traffic-wit... https://www.theverge.com/2019/11/26/20981630/raspberry-pi-pirate-radio-fm-station-35-dollars-diy https://www.theverge.com/2019/11/26/20981630/raspberry-pi-pi...
jcrawfordor 5y ago
WiFi adapters don't really expose this type of interface. WiFi adapters interact with the host computer by sending and receiving packets, the 802.11 framing and radio de/modulation is performed internally by the adapter. In other words, the host computer sees IP packets, not radio data. Some adapters (or really most adapters) provide some ability for the host to send and receive raw 802.11 frames but it's an infrequently used feature and tends to have a lot of caveats and limitations... you'll see a lot of discussion of this if you read into security/exploitation use-cases for WiFi that involve monitoring or generating 802.11 management traffic. This is somewhat related to the old difference between a "modem" and a "winmodem": proper telephone modems performed the de/modulation internally, winmodems did not and relied on the host processor to do so, resulting in generally lower performance but a much cheaper device. At modern network data rates it is not really feasible to do this and the general direction is towards offloading more and more of the work to the network adapter, outside of the host's control or view. For gnuradio you need raw radio samples, often referred to as IQ data due to the nomenclature for amplitude and phase. Few devices that aren't specifically designed for software-defined radio use expose this data because it requires extra complexity in the device and tends to be rather high-bandwidth. The "RTL SDR" TV tuner dongles are so well known precisely because they contain an undocumented feature that allows a host to request raw IQ data, although at a poor sample rate and bandwidth since these devices were not really intended for it.
- nousermane 5y ago
  Very few consumer wifi cards expose raw IQ to host software, but such cards do exist: https://wands.sg/research/wifi/AtherosCSI/ https://wands.sg/research/wifi/AtherosCSI/
noasaservice 5y ago
> Is it possible to use a laptop's built-in wifi antenna / wifi card as the hardware side of a gnu radio setup? No. There's a LOT of stuff the wifi chip does to convert EM to data, including despreading and other computationally expensive operations. Using an expensive SDR, you can follow this paper from 2013 to see the block diagram of what decoding wifi looks like: https://conferences.sigcomm.org/sigcomm/2013/papers/srif/p9.pdf https://conferences.sigcomm.org/sigcomm/2013/papers/srif/p9....
colechristensen 5y ago
It has been done because wifi/bluetooth chipsets are mostly software defined radios but the software is in proprietary pretty well locked down firmware environments. The hardware of the radios will also usually be specified for very specific bands and will have less general purpose uses. Also note that it’s easy to break FCC regulations and generally be disruptive if you mess around with this stuff and don’t know what you’re doing, and the FCC happily hands out five digit fines. https://github.com/seemoo-lab/mobisys2018_nexmon_software_defined_radio https://github.com/seemoo-lab/mobisys2018_nexmon_software_de...
pabs3 5y ago
There are some cards with open source firmware, you might be able to modify it to do something like that. https://github.com/chunkeey/carl9170fw/ https://github.com/chunkeey/carl9170fw/ https://github.com/qca/open-ath9k-htc-firmware https://github.com/qca/open-ath9k-htc-firmware http://netweb.ing.unibs.it/~openfwwf/ http://netweb.ing.unibs.it/~openfwwf/

by geenew 5y ago

RF_Savage 5y ago

Due to it being a radio licenced by rule, the firmware in wifi devices is locked down tight. If it ware wide open FCC would revoke it's type acceptance. The only project that so far has managed to even partially use wifi hardware as a more generic SDR is nexmon[1] and even that is rather involved. Really cool project but not much heard since 2018. For just experimenting with modems across a noisy path one could just use the built in microphone and speakers. 1. https://github.com/seemoo-lab/mobisys2018_nexmon_software_defined_radio https://github.com/seemoo-lab/mobisys2018_nexmon_software_de...

throway453sde 5y ago
If i run linux can i modify the firmware? Also the regulations differ from country to country so this should be legal in some of the country.
- Shared404 5y ago
  Firmware is typically loaded directly onto the hardware, so you would have to have a way to flash your custom firmware to the wifi antenna/card. In the US and other countries, it is to the best of my knowledge legal to modify firmware for hardware you own. The illegal part is broadcasting, most bandwidths are highly regulated. Listening on the other hand is mostly legal, or at the very least extremely likely to fly under the radar.
- RF_Savage 5y ago
  You will not be able to modify the firmware blob just by running linux. Few years back there was danger of FCC de facto banning alternative router firmwares like openwrt to prevent tampering with the wifi cards firmware. This was the "only manufacturer signed firmware allowed" thing that thankfully was avoided. FCC's motivation in this is to prevent people from using too much power or certain frequencies. And as most manufacturers want to be able to sell in USA, it would have likely affected all versions. Kainda like how many wifi devices sold in Europe only go up to channel 11 on 2.4GHz, when the EU band goes up to channel 13. But ch12 and ch13 are not legal in usa, so they are blocked.
  - throway453sde 5y ago
    You mean there are binary blobs without source code in the linux repo?
    - bobthebuilders 5y ago
      Yup. One of the reasons GNU has a deblobbed Linux build.
- Jenda_ 5y ago
  I would suggest not starting in the 2.4GHz band, the protocols used there (wifi, bluetooth) are very complicated to understand. Get a rtl-sdr and start with something simpler: FM broadcast (my blogpost: https://www.abclinuxu.cz/blog/jenda/2019/11/gnu-radio-first-steps-a-fm-receiver https://www.abclinuxu.cz/blog/jenda/2019/11/gnu-radio-first-..., there is even an example capture you can download and replay, so you can start without the physical radio), police radio (both analog and digital), radiosondes, weather satellites, ISM stuff - temperature sensors, garage and car remote controls, airplane multilateration (https://github.com/mutability/mlat-server https://github.com/mutability/mlat-server )… You can do lot of stuff even with the $10 rtl-sdr, for example I have used it for multilaterating TV and radio transmitters (thesis: https://jenda.hrach.eu/dipl.pdf https://jenda.hrach.eu/dipl.pdf, unfortunately "layman's explanation" is available only as a lecture in Czech). I know people are even building radioastronomy stuff and passive radars (https://www.rtl-sdr.com/passive-radar-dual-coherent-channel-rtl-sdr/ https://www.rtl-sdr.com/passive-radar-dual-coherent-channel-...) with rtl-sdr. Once you have basic understanding of the topic, you can get better hardware: AirSpy (the same features as rtl-sdr, but MUCH better signal-to-noise ratio and bandwidth) or bladeRF (costly, but probably the best radio you can get now). For example I'm now building a weather radar based on bladeRF. The bladeRF has a FPGA with open-source HDL, so you can mess even with absolutely lowlevel and bleeding edge stuff. Going back to your original question: Most cards load firmware from a file when they are initializing (check "dmesg|grep firmware", on my machine, for example, it says it has loaded /lib/firmware/rtl_nic/rtl8153b-2.fw), you are free to modify it. However, all (or maybe almost all) wifi cards have the format of the blob completely undocumented so it would be very hard to make a modification that would allow you to transmit/receive arbitrary signals. Something similar has been achieved with GSM phones (see OsmocomBB), but it requires very complicated reverse-engineering. Recently, there was a wifi stack released for a SDR, so the other way around: https://www.nuand.com/bladeRF-wiphy/ https://www.nuand.com/bladeRF-wiphy/.
- pabs3 5y ago
  There are some devices with open source firmware, so yes for some devices: https://github.com/chunkeey/carl9170fw/ https://github.com/chunkeey/carl9170fw/ https://github.com/qca/open-ath9k-htc-firmware https://github.com/qca/open-ath9k-htc-firmware http://netweb.ing.unibs.it/~openfwwf/ http://netweb.ing.unibs.it/~openfwwf/
geenew 5y ago
For future reference, this[0] is a good get-started guide to getting a signal from the microphone, outputting a signal to the speaker, and some basic signal display / waveform generation. For my own use (on windows 10), I used the following device names for the microphone / speaker: Microphone: "Microphone Array (Realtek High Definition Audio)" Speaker: "Speaker/HP (Realtek High Definition Audio)" Specific names on windows can be found in the Control Panel > System > Sound (as of the date of writing) [0] https://www.youtube.com/watch?v=pTqaSCXTSqY https://www.youtube.com/watch?v=pTqaSCXTSqY

lsllc 5y ago

You can use a paperclip or a piece of wire if you have access to a GPIO port: https://www.rtl-sdr.com/receiving-ads-b-jetliner-traffic-with-a-simple-paper-clip/ https://www.rtl-sdr.com/receiving-ads-b-jetliner-traffic-wit... https://www.theverge.com/2019/11/26/20981630/raspberry-pi-pirate-radio-fm-station-35-dollars-diy https://www.theverge.com/2019/11/26/20981630/raspberry-pi-pi...

jcrawfordor 5y ago

WiFi adapters don't really expose this type of interface. WiFi adapters interact with the host computer by sending and receiving packets, the 802.11 framing and radio de/modulation is performed internally by the adapter. In other words, the host computer sees IP packets, not radio data. Some adapters (or really most adapters) provide some ability for the host to send and receive raw 802.11 frames but it's an infrequently used feature and tends to have a lot of caveats and limitations... you'll see a lot of discussion of this if you read into security/exploitation use-cases for WiFi that involve monitoring or generating 802.11 management traffic. This is somewhat related to the old difference between a "modem" and a "winmodem": proper telephone modems performed the de/modulation internally, winmodems did not and relied on the host processor to do so, resulting in generally lower performance but a much cheaper device. At modern network data rates it is not really feasible to do this and the general direction is towards offloading more and more of the work to the network adapter, outside of the host's control or view. For gnuradio you need raw radio samples, often referred to as IQ data due to the nomenclature for amplitude and phase. Few devices that aren't specifically designed for software-defined radio use expose this data because it requires extra complexity in the device and tends to be rather high-bandwidth. The "RTL SDR" TV tuner dongles are so well known precisely because they contain an undocumented feature that allows a host to request raw IQ data, although at a poor sample rate and bandwidth since these devices were not really intended for it.

nousermane 5y ago
Very few consumer wifi cards expose raw IQ to host software, but such cards do exist: https://wands.sg/research/wifi/AtherosCSI/ https://wands.sg/research/wifi/AtherosCSI/

noasaservice 5y ago

> Is it possible to use a laptop's built-in wifi antenna / wifi card as the hardware side of a gnu radio setup? No. There's a LOT of stuff the wifi chip does to convert EM to data, including despreading and other computationally expensive operations. Using an expensive SDR, you can follow this paper from 2013 to see the block diagram of what decoding wifi looks like: https://conferences.sigcomm.org/sigcomm/2013/papers/srif/p9.pdf https://conferences.sigcomm.org/sigcomm/2013/papers/srif/p9....

colechristensen 5y ago

It has been done because wifi/bluetooth chipsets are mostly software defined radios but the software is in proprietary pretty well locked down firmware environments. The hardware of the radios will also usually be specified for very specific bands and will have less general purpose uses. Also note that it’s easy to break FCC regulations and generally be disruptive if you mess around with this stuff and don’t know what you’re doing, and the FCC happily hands out five digit fines. https://github.com/seemoo-lab/mobisys2018_nexmon_software_defined_radio https://github.com/seemoo-lab/mobisys2018_nexmon_software_de...

pabs3 5y ago

There are some cards with open source firmware, you might be able to modify it to do something like that. https://github.com/chunkeey/carl9170fw/ https://github.com/chunkeey/carl9170fw/ https://github.com/qca/open-ath9k-htc-firmware https://github.com/qca/open-ath9k-htc-firmware http://netweb.ing.unibs.it/~openfwwf/ http://netweb.ing.unibs.it/~openfwwf/