Zkitszo - The Real
October 14, 2026

BirriaSDR- Your Wi-Fi Dongle Is a Radio Now

A USB Wi-Fi dongle has a whole wideband radio receiver inside it. BirriaSDR grabs its samples raw- 14-bit I/Q at 40 million samples a second, tunable from 2156 to 2610 MHz, with no vendor firmware and nothing flashed. Pull the plug and it's a plain Wi-Fi adapter again.

Only one board opens: the COMFAST that shows up in lsusb as 3574:6211. The ALFA AWUS036AXML has the same MT7921AU chipset but enumerates as 0e8d:7961, an ID BirriaSDR marks "board not qualified" and refuses. Comfast's own CF-953AX is 0e8d:7961 too. Same chip, different board... check the USB ID before buying, not the chipset on the box.

How a Wi-Fi Chip Becomes a Receiver

Inside sit two dies: an MT7972 analog die doing the RF work (tuning, filtering, gain) and an MT7961 digital die. The chip also carries ICAP, a capture engine meant for calibration and debugging. BirriaSDR points it at receive chain 0 and lets it write into a circular buffer of on-chip SRAM- 65,536 complex samples at four bytes each.

A tiny original program- 1,120 bytes, loaded through the chip's boot ROM- hands that memory to USB DMA. Out it comes over USB 3.0 at about 161 MB/s (40 million samples × 4 bytes = 160 MB/s, napkin math holds). The host library checks every packet for gaps and corruption, then hands over cs16- signed 16-bit I and Q pairs. I/Q being two numbers per sample, in-phase and quadrature, which together keep the signal's strength and phase.

Antenna to app- the BirriaSDR path Top row lives on the chip, bottom row is what gets the samples out Antenna 2.4 GHz band in receive only MT7972 analog die tune, 40 MHz filter, LNA 0-3 / filter 0-8 MT7961 digital die digitizes, PHY chain 0 digital gain 0-12 ICAP debug capture engine tap 4, 40 MSps Host library checks every packet, cs16 to your app USB 3.0 bulk ~161 MB/s 40 M x 4 B = 160 MB/s Device DMA original 1,120-byte program, no vendor fw Circular SRAM 65,536 samples, 4 bytes each 14-bit I and Q, no CPU copy Nothing is flashed. Unplug it and the dongle is a plain Wi-Fi adapter again.

The API copies the librtlsdr pattern, so code built around an RTL-SDR has a familiar shape. CyberEther, from the same person, runs a rough no-build proof of concept. The firmware's boot magic, 0x41495242, read as little-endian bytes spells "BRIA".

40 MHz in One Look

The RTL-SDR, the TV tuner stick turned radio (the long story is in RTL-SDR-MANY-MUCH-ALL-MORE-EVERYTHING), does 2.56 MS/s at 8 bits before it drops samples. HackRF One tops out at 20 Msps, also 8 bits. BirriaSDR pulls 40 MSps at 14 bits off a Wi-Fi dongle. Two days before it went up, W1700K SDR did the same sort of thing to a Gemtek Wi-Fi 7 router- up to 320 Msps.

How much spectrum lands in one look Complex sample rate = span seen at once. Bars to scale. RTL-SDR (RTL2832U) 2.56 MHz, 8-bit HackRF One 20 MHz, 8-bit BirriaSDR (MT7921AU dongle) 40 MHz, 14-bit W1700K SDR (Wi-Fi 7 router) 320 MHz, 14-bit RTL-SDR: max rate without drops. HackRF: top of its 2-20 Msps range. W1700K: top of its 40-320 Msps range.

The fine print: experimental. Sensitivity, frequency accuracy and gain are uncalibrated- gain is raw codes, not dB. Receive only, chain 0 only, no 5 GHz yet. Strong signals just outside the 40 MHz span can alias in. A live retune takes about 87 ms and knocks the phase around. Only the Raspberry Pi 5 has been tested with hardware.

The Recipe

Ingredients

  • A COMFAST dongle that reads 3574:6211 in lsusb
  • A USB 3.0 port- a Raspberry Pi 5 is the tested host
  • A C compiler, CMake, pkg-config and the libusb development files

Cooking it

On Debian, Ubuntu or Pi OS:

sudo apt install build-essential cmake pkg-config libusb-1.0-0-dev

Keep the regular Linux driver, mt7921u, off the dongle- same blacklist trick as in 1 Pi, 2 WiFi:

echo "blacklist mt7921u" | sudo tee /etc/modprobe.d/birriasdr.conf

Then unplug it and plug it back in- a vendor ROM patch survives a software reset, only losing power clears it. Delete that file later to get normal Wi-Fi back.

git clone https://github.com/luigifcruz/BirriaSDR.git
cd BirriaSDR
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build -j
ctest --test-dir build --output-on-failure
./build/birria_rx --list
./build/birria_rx capture.cs16 8000000 manual

That records eight million complex samples at fixed manual gain into a little-endian cs16 file. No USB permissions? Put sudo in front. Check the exit status- an error means the capture is incomplete, even with samples in the file.

Overheard at the Party

This is very technical, high-level RF and Wi-Fi and device knowledge that 999.9999% * 0.333333333~ of humans have not the capacity to understand. This is what extraterrestrials conversate about at a casual meet at a party... I'd ask how's things goin'- how's the wife-an-kids- expecting nothing more or less back, while some smart people out there have turned our MT7921AU into a multi-planetary quantum teleportation device- sure.

Mention any word in this repo over 4 characters long at most parties and 1 of 2 things... you'd look around an empty house party wondering where everyone went- spotting the freshly put out chips and dips- now those are my kinda chips. Or, if they're at all mildly interested in YOU, not the subject- a person standing in front of you who'd just had their cerebral cortex scrambled- deer in headlights. I'd imagine alien races having such conversations- human to human?

SOL-3 closing 2437 MHz 40 MSps Tap FOUR. Divider three. 0x008c0400, I said! Chain ZERO?! A 1,120-byte program? Over USB?!

Driver Frustrations

I guess I'm waiting on my brain implant linking directly to the latest LLM- why does that not sound appealing? Account > Preferences? Security and Privacy > Actions > Allow full read/write from root- what would the AI slop look like then? The repo has its fair share of slippitty sloppity, but I forgive them- anyone delving so deep into the devices we cherish so.. driver frustrations... in the comments! Come on!

How many years younger would you be if it weren't for trying to get that Alfa adapter to function as it's supposed to- countless hours googling "chipset" & "driver", maybe adding a "linux distro". Hey, remember SssstaaackOvvvverflow? Ouch... imagine waking up and your Golden Goose Egg... so much traffic... the users... ad revenue.. poof. 100% of the traffic reviewed and it'd be Anthropic, ChatGPT, Meta... scraping any and all you've got till you got hip and blocked access. Ehem, ehem... someone got noticed (positive vocabulary... instead of "busted") scraping all they could to feed their AI juggernaut masters- "I promise to pay you for all this content.... just give me some time to come up with the cash".. crickets....

Now that's some type of language I understand- a rainy eve thriller- lies, deceit- technical jargon going deep into the matrix of our beloved Wi-Fi dongles. I try.. try until I snap out of it... who... am... I kidding? "hey [whatever latest bobby trending leading LLM] explain this to me like I am a five year old"... "hey [whatever latest bobby trending leading LLM] DO THIS for me".. ahh -what-a-relief- that is better.

Stack Overflow did sign an API deal with OpenAI, announced May 6, 2024. Questions kept sliding anyway- 3,862 in December 2025, down 78 percent on the year, from a peak of over 200,000 a month in early 2014.

Anyone got a 3574:6211 COMFAST running it yet- or an Alfa that got turned away at the door? What showed up at 40 MSps? Leave a comment... the driver war stories too.

Glossary

  • SDR — software-defined radio; hardware grabs raw radio samples and software does the demodulating
  • I/Q — in-phase and quadrature; the two numbers per sample that keep a signal's strength and phase
  • MSps — million samples per second; for complex I/Q it also sets how many MHz you see at once
  • 14-bit — each I and Q value runs from −8192 to 8191; more bits, more room between weak and strong signals
  • ICAP — the chip's internal I/Q capture engine, built for calibration and debugging
  • SRAM — fast on-chip memory; here a circular buffer the capture engine writes into
  • DMA — direct memory access; hardware moves data without the CPU copying it
  • Boot ROM — factory code burned into the chip that can load a small program into RAM
  • Receive chain 0 — the first of the chip's radio receive paths
  • LNA — low-noise amplifier, the first gain stage after the antenna
  • Aliasing — a strong signal outside the sampled span folding into the capture where it doesn't belong
  • cs16 — complex signed 16-bit; interleaved I, Q, I, Q values
  • Little-endian — lowest byte stored first
  • libusb — a library for talking to USB devices from a normal program, no kernel driver
  • librtlsdr — the RTL-SDR library whose API pattern BirriaSDR copies
  • USB ID (VID:PID) — USB vendor and product ID, the 3574:6211 that lsusb prints
  • Blacklist — a modprobe setting that stops Linux loading a driver automatically
  • MT7921AU — MediaTek's Wi-Fi 6E USB chipset family, built here from an MT7961 digital die and an MT7972 analog die

Sources

Comments

Post a Comment