What full firmware access buys: capability directions

Why this project exists, in plain terms. The radio's sound stays WiFi-shaped (fixed silicon), but everything about how the radio behaves — measures, steers, times, chooses — is firmware, and we're writing the manual for it. These are the directions that manual unlocks, ordered by what they take rather than what they politely yield.

Sense — the router as an instrument

Motion through walls. WiFi passes through drywall; people don't. The router hears the difference: presence, counting, tracking in rooms it can't see into.
Fine enough to see breathing. Chest-scale motion measurably shifts the signal. Firmware-grade measurement = continuous presence at that scale — sleep monitoring, "is grandma moving today."
A camera made of radio. Several boxes on different sides of a space, each reading signal fade through it; combined, a live occupancy map. No lens, no light, works through smoke and dark (radio tomography — nobody sells it).
Perimeter radar. The AP illuminates; moving reflectors — drones, vehicles, people — return Doppler fingerprints. Private motion-sensing perimeter from commodity WiFi.
Indoor GPS. Timing accurate enough to place devices (and reflecting people) within a room.

Identify — physics as a lie detector

Evil-twin detection that works. A rogue AP clones name and MAC, but not its transmitter's RF voiceprint (manufacturing imperfections no software fakes). Detect forgery by physics, not by trusting packets.
Countersurveillance. Always-on full-spectrum ear: every nearby transmitter fingerprinted, logged, flagged when a new voice appears. Bug-sweeping as a background service.
Spectrum observatory. Who transmits, when, how strong, from where, at what signal quality — the whole radio neighborhood, instrumented.

Encrypt — physics as an uncopyable key

Keys from thin air. Two radios that talked measured a channel slightly different from what any third radio sees; that difference is shared secret material. Two of our devices derive encryption keys from the fading of the air between them, in real time. The eavesdropper two meters away reads a different channel and gets different bits (information-theoretic key agreement — real research field, needs exactly the low-level channel control we're building).
Aim silence at the snooper. Antenna steering puts full signal on our client and a deliberate null — a cone of near-silence — exactly where the eavesdropper sits.
Vanishing links. Per-frame frequency hopping + power control: the link looks like background noise unless you know the dance. Hard to intercept, hard to jam.

Farthest link this silicon can legally make. Slowest mode, full calibrated power, narrowest channel, dish antennas — multi-km experimental links on commodity hardware. Same trade LoRa makes (speed for distance), less of it on offer.
Per-device brute optimization. Stock firmware is conservative for a million strangers; ours knows its clients and pushes each to its true physical limit every transmission.

Hard walls (unchanged)

Waveform is fixed (no arbitrary signals, no chirps); the receiver locks only on WiFi preambles; power ceilings are regulatory; sensing items are research-grade — but researchers are starving for exactly the measurement control this platform can have.

RE targeting consequence

Sensing, fingerprinting, channel-keys, and null-steering all consume the same primitive: rich per-packet channel measurement (CSI/RX-vector capture and control). That makes the RX measurement path — how the firmware collects and reports channel state — the highest-value first reverse engineering target beyond the dispatch layer already mapped.

3.8 KiB Raw Blame History