# What full firmware access buys: capability directions

Why this project exists, in plain terms. The radio's sound stays WiFi-shaped
(fixed silicon), but everything about how the radio *behaves* — measures,
steers, times, chooses — is firmware, and we're writing the manual for it.
These are the directions that manual unlocks, ordered by what they take
rather than what they politely yield.

## Sense — the router as an instrument

- **Motion through walls.** WiFi passes through drywall; people don't. The
  router hears the difference: presence, counting, tracking in rooms it
  can't see into.
- **Fine enough to see breathing.** Chest-scale motion measurably shifts the
  signal. Firmware-grade measurement = continuous presence at that scale —
  sleep monitoring, "is grandma moving today."
- **A camera made of radio.** Several boxes on different sides of a space,
  each reading signal fade through it; combined, a live occupancy map. No
  lens, no light, works through smoke and dark (radio tomography — nobody
  sells it).
- **Perimeter radar.** The AP illuminates; moving reflectors — drones,
  vehicles, people — return Doppler fingerprints. Private motion-sensing
  perimeter from commodity WiFi.
- **Indoor GPS.** Timing accurate enough to place devices (and reflecting
  people) within a room.

## Identify — physics as a lie detector

- **Evil-twin detection that works.** A rogue AP clones name and MAC, but
  not its transmitter's RF voiceprint (manufacturing imperfections no
  software fakes). Detect forgery by physics, not by trusting packets.
- **Countersurveillance.** Always-on full-spectrum ear: every nearby
  transmitter fingerprinted, logged, flagged when a new voice appears.
  Bug-sweeping as a background service.
- **Spectrum observatory.** Who transmits, when, how strong, from where,
  at what signal quality — the whole radio neighborhood, instrumented.

## Encrypt — physics as an uncopyable key

- **Keys from thin air.** Two radios that talked measured a channel
  slightly different from what any third radio sees; that difference is
  shared secret material. Two of our devices derive encryption keys from
  the fading of the air between them, in real time. The eavesdropper two
  meters away reads a different channel and gets different bits
  (information-theoretic key agreement — real research field, needs exactly
  the low-level channel control we're building).
- **Aim silence at the snooper.** Antenna steering puts full signal on our
  client and a deliberate null — a cone of near-silence — exactly where the
  eavesdropper sits.
- **Vanishing links.** Per-frame frequency hopping + power control: the
  link looks like background noise unless you know the dance. Hard to
  intercept, hard to jam.

## Reach — the far end of the menu

- **Farthest link this silicon can legally make.** Slowest mode, full
  calibrated power, narrowest channel, dish antennas — multi-km
  experimental links on commodity hardware. Same trade LoRa makes (speed
  for distance), less of it on offer.
- **Per-device brute optimization.** Stock firmware is conservative for a
  million strangers; ours knows its clients and pushes each to its true
  physical limit every transmission.

## Hard walls (unchanged)

Waveform is fixed (no arbitrary signals, no chirps); the receiver locks
only on WiFi preambles; power ceilings are regulatory; sensing items are
research-grade — but researchers are starving for exactly the measurement
control this platform can have.

## RE targeting consequence

Sensing, fingerprinting, channel-keys, and null-steering all consume the
same primitive: **rich per-packet channel measurement** (CSI/RX-vector
capture and control). That makes the RX measurement path — how the firmware
collects and reports channel state — the highest-value first reverse
engineering target beyond the dispatch layer already mapped.