Zkitszo - The Real
October 14, 2026

BirriaSDR- Your Wi-Fi Dongle Is a Radio Now

That little USB Wi-Fi dongle- the one we plug in, wait on, unplug, plug back in... the one hanging off the side of the Pi- has a whole wideband radio receiver sitting inside it.

BirriaSDR taps into that. Raw I/Q- 14-bit, 40 million samples a second, tunable anywhere from 2156 to 2610 MHz- pulled straight off a COMFAST USB dongle through libusb, with no vendor firmware loaded and nothing flashed to the thing. All of it is volatile... unplug the dongle and it goes right back to being a plain old Wi-Fi adapter.

Before anyone runs off to order "an MT7921AU"... only one board opens: the COMFAST that shows up in lsusb as 3574:6211. The ALFA AWUS036AXML has the very same MT7921AU chipset, but it shows up as 0e8d:7961, an ID BirriaSDR lists as "board not qualified" and refuses before it even opens the device. Comfast's own CF-953AX shows up as 0e8d:7961 too. Check the USB ID in lsusb before buying, the chipset printed on the box won't tell you.

Inside the Dongle

Two dies in there: an MT7972 analog die doing the RF work- the tuning, the filtering, the gain- and an MT7961 digital die. Inside the chip is ICAP, an I/Q capture engine meant for calibration and debugging. BirriaSDR points it at receive chain 0 (the first of the chip's receive paths) and lets it write samples into a circular buffer in the chip's SRAM- room for 65,536 complex samples, four bytes each, written round and round.

Getting the samples off the chip falls on a tiny original program- 1,120 bytes, loaded through the chip's built-in boot ROM- that hands that memory over to the USB DMA engine (DMA being the hardware moving data on its own, no CPU copying it byte by byte). Out it goes over USB 3.0 at about 161 MB/s. Napkin math says 40 million samples × 4 bytes = 160 MB/s...

On the computer side, the library checks every packet for gaps, repeats, stale data and corruption before handing the samples over as cs16- signed 16-bit I and Q pairs. I/Q, for those new to this world- each sample comes as two numbers, in-phase and quadrature, which together keep both the strength and the phase of the signal.

Antenna to app- the BirriaSDR path Top row lives on the chip, bottom row is what gets the samples out Antenna 2.4 GHz band in receive only MT7972 analog die tune, 40 MHz filter, LNA 0-3 / filter 0-8 MT7961 digital die digitizes, PHY chain 0 digital gain 0-12 ICAP debug capture engine tap 4, 40 MSps Host library checks every packet, cs16 to your app USB 3.0 bulk ~161 MB/s 40 M x 4 B = 160 MB/s Device DMA original 1,120-byte program, no vendor fw Circular SRAM 65,536 samples, 4 bytes each 14-bit I and Q, no CPU copy Nothing is flashed. Unplug it and the dongle is a plain Wi-Fi adapter again.

The API follows the librtlsdr pattern- enumerate, open, configure, read, cancel, close. CyberEther, the GPU signal processing app from the same person, runs a rough no-build proof of concept flowgraph straight from the repo.

Oh.. the firmware's boot magic word, 0x41495242- read as little-endian bytes, it spells "BRIA".

40 MHz at Once

The RTL-SDR- the DVB-T TV tuner stick turned radio (the whole history is in RTL-SDR-MANY-MUCH-ALL-MORE-EVERYTHING)- does 2.56 MS/s at 8 bits before it starts dropping samples. HackRF One goes up to 20 Msps, also 8 bits. BirriaSDR pulls 40 MSps at 14 bits... double the HackRF's top rate- off a Wi-Fi dongle!

Two days before BirriaSDR went up, W1700K SDR showed up doing the same sort of thing to a Gemtek Wi-Fi 7 router- up to 320 Msps.

How much spectrum lands in one look Complex sample rate = span seen at once. Bars to scale. RTL-SDR (RTL2832U) 2.56 MHz, 8-bit HackRF One 20 MHz, 8-bit BirriaSDR (MT7921AU dongle) 40 MHz, 14-bit W1700K SDR (Wi-Fi 7 router) 320 MHz, 14-bit RTL-SDR: max rate without drops. HackRF: top of its 2-20 Msps range. W1700K: top of its 40-320 Msps range.

Other Considerations

Straight from the README:

Sensitivity across that range, frequency accuracy and gain are not calibrated.

Gain comes as raw codes rather than dB... LNA 0 to 3, filter stage 0 to 8, digital 0 to 12- working out what any of that means in real terms is on us. It's receive only, on chain 0 only, with no 5 GHz support yet. The filters don't fully block what sits just outside the 40 MHz span, so a strong signal next door can "alias"- fold into the capture where it doesn't belong. A live retune takes about 87 ms on the Pi and knocks the phase around. So far only the Raspberry Pi 5 has been tested with the hardware- the macOS code path is in there, untested.

The Recipe

Ingredients

  • A COMFAST dongle that reads 3574:6211 in lsusb- not "an MT7921AU", that exact ID
  • A USB 3.0 port... a Raspberry Pi 5 is the one that's been tested
  • A C compiler, CMake, pkg-config and the libusb development files

Cooking it

Debian, Ubuntu or Pi OS gets the build tools with:

sudo apt install build-essential cmake pkg-config libusb-1.0-0-dev

The regular Linux driver for this chip, mt7921u, needs to keep its hands off the dongle... same blacklist trick from 1 Pi, 2 WiFi:

echo "blacklist mt7921u" | sudo tee /etc/modprobe.d/birriasdr.conf

Then unplug the dongle and plug it back in. If the driver already loaded MediaTek's ROM patch onto it, a software reset won't clear it- only losing power does. To get regular Wi-Fi back later, delete that file and replug the dongle.

git clone https://github.com/luigifcruz/BirriaSDR.git
cd BirriaSDR
cmake -S . -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build -j
ctest --test-dir build --output-on-failure
./build/birria_rx --list
./build/birria_rx capture.cs16 8000000 manual

That last line records eight million complex samples at fixed manual gain (LNA 2, filter stage 8, digital 0) into a little-endian cs16 file. If USB permissions get in the way, putting sudo in front gets around it for now.

Mind the exit status, every time... an error means the capture is incomplete, even when the file has samples in it.

Overheard at the Party

This is very technical, high-level RF and Wi-Fi and device knowledge that 999.9999% * 0.333333333~ of humans have not the capacity to understand. This is what extraterrestrials conversate about at a casual meet at a party... I'd ask how's things goin'- how's the wife-an-kids- expecting nothing more or less back, while some smart people out there have turned our MT7921AU into a multi-planetary quantum teleportation device- sure.

Mention any word in this repo over 4 characters long at most parties and 1 of 2 things... you'd look around an empty house party wondering where everyone went- spotting the freshly put out chips and dips- now those are my kinda chips. Or, if they're at all mildly interested in YOU, not the subject- a person standing in front of you who'd just had their cerebral cortex scrambled- deer in headlights. I'd imagine alien races having such conversations- human to human?

SOL-3 closing 2437 MHz 40 MSps Tap FOUR. Divider three. 0x008c0400, I said! Chain ZERO?! A 1,120-byte program? Over USB?!

Driver Frustrations

I guess I'm waiting on my brain implant linking directly to the latest LLM- why does that not sound appealing? Account > Preferences? Security and Privacy > Actions > Allow full read/write from root- what would the AI slop look like then? The repo has its fair share of slippitty sloppity, but I forgive them- anyone delving so deep into the devices we cherish so.. driver frustrations... in the comments! Come on!

How many years younger would you be if it weren't for trying to get that Alfa adapter to function as it's supposed to- countless hours googling "chipset" & "driver", maybe adding a "linux distro". Hey, remember SssstaaackOvvvverflow? Ouch... imagine waking up and your Golden Goose Egg... so much traffic... the users... ad revenue.. poof. 100% of the traffic reviewed and it'd be Anthropic, ChatGPT, Meta... scraping any and all you've got till you got hip and blocked access. Ehem, ehem... someone got noticed (positive vocabulary... instead of "busted") scraping all they could to feed their AI juggernaut masters- "I promise to pay you for all this content.... just give me some time to come up with the cash".. crickets....

Now that's some type of language I understand- a rainy eve thriller- lies, deceit- technical jargon going deep into the matrix of our beloved Wi-Fi dongles. I try.. try until I snap out of it... who... am... I kidding? "hey [whatever latest bobby trending leading LLM] explain this to me like I am a five year old"... "hey [whatever latest bobby trending leading LLM] DO THIS for me".. ahh -what-a-relief- that is better.

Stack Overflow did end up signing a deal with OpenAI- OverflowAPI access, announced May 6, 2024. Questions kept falling anyway... 3,862 in December 2025, down 78 percent on the year before, from a peak of over 200,000 a month back in early 2014.

Anyone out there got a 3574:6211 COMFAST running this yet? Or an Alfa that got turned away at the door? What showed up at 40 MSps... leave a comment- driver war stories welcome too.

Glossary

  • SDR — software-defined radio; hardware grabs raw radio samples and software does the demodulating
  • I/Q — in-phase and quadrature; the two numbers per sample that keep a signal's strength and phase
  • MSps — million samples per second; for complex I/Q it also sets how many MHz you see at once
  • 14-bit — each I and Q value runs from −8192 to 8191; more bits, more room between weak and strong signals
  • ICAP — the chip's internal I/Q capture engine, built for calibration and debugging
  • SRAM — fast on-chip memory; here a circular buffer the capture engine writes into
  • DMA — direct memory access; hardware moves data without the CPU copying it
  • Boot ROM — factory code burned into the chip that can load a small program into RAM
  • Receive chain 0 — the first of the chip's radio receive paths
  • LNA — low-noise amplifier, the first gain stage after the antenna
  • Aliasing — a strong signal outside the sampled span folding into the capture where it doesn't belong
  • cs16 — complex signed 16-bit; interleaved I, Q, I, Q values
  • Little-endian — lowest byte stored first
  • libusb — a library for talking to USB devices from a normal program, no kernel driver
  • librtlsdr — the RTL-SDR library whose API pattern BirriaSDR copies
  • USB ID (VID:PID) — USB vendor and product ID, the 3574:6211 that lsusb prints
  • Blacklist — a modprobe setting that stops Linux loading a driver automatically
  • MT7921AU — MediaTek's Wi-Fi 6E USB chipset family, built here from an MT7961 digital die and an MT7972 analog die

Sources

Comments

Post a Comment