Glonce

w1700k-sdr turns a Gemtek W1700K Wi-Fi 7 router into an SDR receiver

toolsThe Glonce editorsHacker News🔥66Glonce rating66Impact40Novelty70Relevance70Surprise65Players10Credibility85
w1700k-sdr turns a Gemtek W1700K Wi-Fi 7 router into an SDR receiver

w1700k-sdr is a GitHub project that turns a Gemtek W1700K Wi-Fi 7 router into a wideband software-defined receiver. The router's MediaTek MT7996 radio captures raw 14-bit IQ at up to 320 Msps, its Airoha AN7581 SoC streams the samples over 10 GbE, and a Linux host shows them as a live spectrum and waterfall in the browser, with the receiver's controls next to the display.

The MT7996 runs only the project's own firmware: a ROM patch, WM and WA built from the repository, with no MediaTek code. It brings the radio up from a cold power-on by itself, using MediaTek's initialisation and calibration decoded register by register against a trace of MediaTek's own firmware. It takes its commands (LO, sample rate, capture, stream, gain, filter) from the host. No vendor firmware is downloaded or needed.

The page shows what this looks like in practice. The whole 2.4 GHz band is displayed live at 320 Msps, with the decimation's roll-off corrected in the stream (called 'flatten'), using a 262,144-point FFT of every sample and 100 spectra a second (the shown recording runs at 50 frames a second). In that demo Wi-Fi frames and shorter hopping bursts sit on a floor that stays level to the band's edges, and the Stream panel shows the 10 GbE link carrying 9.75 Gbit/s, with half of the slices packed and every sample transformed. A 5 GHz example shows two busy 80 MHz Wi-Fi channels at 5170 to 5330 MHz in a flattened 320 MHz view; zoomed to 24 MHz around 5250 MHz, it resolves the two channels' edges and the guard gap between them in 1.22 kHz bins.

To use it you need a W1700K (HW 1.x) or W1700K2 (HW 2.1), a 3.3 V USB serial adapter on the router's console header, an Ethernet cable to its lan3 port for installation, and a 10 GbE NIC on the host cabled to the router's wan port for the IQ stream (10GBASE-T; an X710 with a copper SFP+ module works). Both revisions run the same images. Most units carry a W25N04KV NAND; some W1700K2s carry a W25N04LV, which is supported but has never been run on a unit, so installation stops on it unless the user passes --i-dont-care-about-nand-corruption, and the maintainers ask for a raw dump of that chip.

The workflow is: build everything with make (about 10 minutes plus downloads), run the test suite with make check, bring up the link to lan3, run init/install (which backs up the NAND, installs, and saves the radio calibration), bring up the 10 GbE stream link, start the stream service and the spectrum server, then open the host's port 8073 in a browser and press play. The first start loads the radio firmware and brings the radio up in about 2 s. Without the browser, the same operations are available through host/bin/w1700k with load, start, band, tune, gain, filter, stop and status.

The README lists several cautions. The firmware is receive-only: it runs none of MediaTek's transmit calibrations and keeps the MAC's transmit path disabled, and a gapless watch at 5250 MHz saw nothing during a load, where MediaTek's firmware transmits a full-power burst. Even so, an antenna port should not be cabled straight into a sensitive instrument without an attenuator. The project's ROM patch writes no eFuse, whereas MediaTek's ROM patches since 2025 permanently program one eFuse gate bit on their first run. Installation replaces the stock operating system; init/install first copies the NAND's data to the host, and init/restore writes it back and returns the unit to its stock firmware. Accessing undocumented MT7996 or AN7581 addresses can hang the SoC or wedge the radio until a power cycle. The code is MIT-licensed, except the Linux driver and kernel patches (GPL-2.0-only), U-Boot patches (GPL-2.0+), the driver's user-space header (GPL-2.0 WITH Linux-syscall-note) and files derived from MediaTek's mt76 driver (BSD-3-Clause-Clear).

Key facts

  • Custom firmware makes the MediaTek MT7996 radio in a Gemtek W1700K Wi-Fi 7 router capture raw 14-bit IQ at up to 320 Msps; the Airoha AN7581 SoC streams it over 10 GbE to a Linux host with a browser spectrum and waterfall.
  • The firmware (ROM patch, WM and WA) is built from the repository with no MediaTek code, based on MediaTek's initialisation and calibration decoded register by register against a trace of MediaTek's own firmware.
  • The 2.4 GHz demo applies a 262,144-point FFT to every sample at 100 spectra a second, with the 10 GbE link carrying 9.75 Gbit/s.
  • It needs a W1700K (HW 1.x) or W1700K2 (HW 2.1), a 3.3 V USB serial adapter and a 10 GbE NIC on the host; installation replaces the stock OS, with init/restore to go back.
  • The firmware is receive-only and the ROM patch writes no eFuse; the code is MIT-licensed apart from GPL and BSD-3-Clause-Clear components.

Why it matters

A consumer Wi-Fi 7 router becomes a wideband receiver that delivers raw 14-bit IQ at up to 320 Msps and shows a live spectrum and waterfall in a browser. The project gets there by replacing MediaTek's radio firmware entirely with its own, built from public sources and based on the vendor's initialisation and calibration decoded register by register against a trace of MediaTek's own firmware. The demos show a whole 2.4 GHz band at once and the 5170 to 5330 MHz region with two busy 80 MHz Wi-Fi channels, zoomable down to 1.22 kHz bins.

Who it affects

Owners of a Gemtek W1700K (HW 1.x) or W1700K2 (HW 2.1), the two revisions the project supports with the same images. The setup also needs a Linux host with a 10 GbE NIC (10GBASE-T; an X710 with a copper SFP+ module works), a 3.3 V USB serial adapter for the console header, and a C/C++ toolchain with the Buildroot prerequisites, clang and the other build tools listed in the README.

How to use it

Build with make (about 10 minutes plus downloads) and run make check. Bring up the link to the router's lan3 port, run init/install to back up the NAND, install and save the radio calibration, then bring up the 10 GbE link on the wan port. Start the w1700k-stream service and the w1700k-spectrum server, open the host on port 8073 in a browser and press play. The first start loads the radio firmware in about 2 s. Without the browser, host/bin/w1700k offers load, start, band, tune, gain, filter, stop and status. Licence: MIT, with GPL-2.0-only, GPL-2.0+, GPL-2.0 WITH Linux-syscall-note and BSD-3-Clause-Clear exceptions for driver, kernel, U-Boot and mt76-derived files.

How solid is it

Every figure comes from the project's own README and demo recordings: up to 320 Msps, a 262,144-point FFT, 9.75 Gbit/s on the link. The page includes a test suite target (make check) and spectrum captures of real 2.4 GHz and 5 GHz Wi-Fi traffic. The source gives no sensitivity, noise figure, dynamic range or accuracy numbers, and no comparison with dedicated SDR hardware. It names no author or maintainer, and gives no date or version. The README itself marks one NAND chip, the W25N04LV found in some W1700K2 units, as supported but never run on a unit.

Risks and caveats

Installation replaces the stock operating system; init/install first copies the NAND's data to the host, and that copy should be kept, since init/restore uses it to return the unit to stock firmware. Accessing undocumented MT7996 or AN7581 addresses can hang the SoC or wedge the radio until a power cycle. The firmware is receive-only, but the README still advises against cabling an antenna port straight into a sensitive instrument without an attenuator. MediaTek's ROM patches since 2025 permanently program one eFuse gate bit on their first run (also with MediaTek's own driver), so a unit that ever ran one has that bit set; the project's patch writes no eFuse. Units with the W25N04LV NAND need an explicit override flag that acknowledges possible NAND corruption.

“Our firmware is receive-only. It runs none of MediaTek's transmit calibrations and keeps the MAC's transmit path disabled.”

— w1700k-sdr project README