Raw IQ Capture with Espressif's ESP32 Chips

Espressif ESP32 chips contain an undocumented debug path that lets firmware bypass the built-in Wi‑Fi modem and dump raw complex baseband (IQ) samples from the internal ADC into SRAM. By configuring special modem registers and reserving SRAM as a ring buffer, firmware can capture 32-bit IQ words (signed 10‑bit I and Q with gain and AGC-state bits) at up to 80 MSa/s and roughly 13-54 MHz analog bandwidth. Supported chips include many ESP32 variants (original, C3, C5, C6, C61, S2, S3, S31), with tuning roughly 2.2-2.7 GHz and, on some parts, 4.8-6.0 GHz. The discovery relied on reverse engineering an adctrig test function and rebuilding a capture engine to move modem writes into CPU-visible memory.

Practical demos and tooling expose the feature: a browser-based ESP‑WebSDR shows spectrum/waterfall from typical dev boards at a low duty cycle, while ESPARGOS One implements phase‑coherent, eight‑channel capture with faster SPI/GigE links, signal triggers and local preprocessing. Throughput off-chip is the main constraint - UART/SPI are slow so continuous 80 MSa/s capture isn’t generally possible without reduced duty cycle or high‑speed links (ESP32-S31 over GigE/USB supports higher sustained rates). Use cases include low‑cost SDR reception, signal localization, array processing and specialized waveforms; transmission is technically possible but not provided due to misuse risks.