Open-Source Firmware Turns a WiFi 7 Router Into a 320Msps SDR

An open-source project turns the Gemtek W1700K, a WiFi 7 router, into a wideband software-defined radio receiver. Its MediaTek MT7996 radio chip can capture raw 14-bit IQ samples at up to 320 million samples per second, while the router's AN7581 SoC streams that data over 10GbE to a Linux host that renders a live spectrum and waterfall display in the browser.

The notable part is that none of MediaTek's original firmware runs: the ROM patch, radio bring-up firmware (WM) and packer (WA) were written from scratch, with register-level behavior reverse engineered against traces of MediaTek's own firmware. The result supports tuning across the 2.4/5/6GHz bands with no fixed channels, locking the local oscillator to arbitrary frequencies with sub-15Hz steps, and retuning or switching bands mid-stream in about a millisecond.

The firmware is deliberately receive-only, disabling the MAC's transmit path and skipping MediaTek's transmit calibration routines entirely. It also avoids writing the eFuse bit that MediaTek's newer ROM patches permanently burn on first run. Installation backs up the original NAND before replacing the stock OS, and the full source, including a register reference for the MT7996, A-die and AN7581, is published openly.

For engineers working on hardware reverse engineering, RF front-end control or low-level SoC bring-up, this is a concrete, well-documented case of converting consumer networking silicon into a lab-grade SDR receiver.