Fun with the ESP8266's BBPLL

[@zyxwvutsrqponmlkh]

FCC part 15 rules are what you need to be worried about, not 802.11 compliance. The latter is just a technical specification for interoperability, it is not legally mandated. As a hobbyist you are allowed to legally tinker in these unlicensed frequencies but it is up to you to know when you are violating fcc rules or not, generally they are concerned with you transmitting out of an allowable frequency band or at too high of power, using less of the band should be just fine. If you are selling devises (unfinished kits don't need this) you would need to get FCC certification and an FCC ID proving you are not transmitting outside the bounds stipulated by part 15 rules. You really should get a ham license, you get access to quite a bit more of the spectrum and at quite a bit higher power, given your knowledge set passing the test should be easy. This project looks to me to be 100% within regulatory requirements no matter if your in your home or not, licensed or not; but on that point your disclaimer on the intro propagates a falsehood, the FCC gives you no special consideration for doing stuff from in your home. I knew of a guy that got in quite a bit of hot water for monkeying with some firmware settings on (I think) 5.4 ghz gear and was stomping on some very sensitive weather radar from his home. If you break the rules in a disruptive way they can pinpoint you rather easily and will come knocking.

[@tohopes]

thanks, person with ... unpronounceable name!

[@DeminicusSCA]

They nearly never come for any one , just look up fcc inforcement is a joke for most things. Just like the boafang radio . To hear the hams tell it, the prisons should be full of people and their spurious transmission. But the aren't and data show this.

[@MichaelMantion]

Whatcha gunna do??? whatcha gunna do when they come for you? Rad boys

[@brasildocara]

hahahahha :')

[@Zildawolf]

I have literally never felt more lost. It’s like you’re speaking a different kind of English, and I can understand you for a minute before I fall out of pace, only to understand what you’re saying again like 2 seconds later

[@HachiMatt]

Seeing waffles gave me a startle.

[@Gameboygenius]

I may be wrong, but aren't you allowed to spit out whatever crap you want in the unlicensed bands, as long as you transmit below the legal power limit?

[@rasz]

2.4GHz IS an ISM band, you can shit all over it as long as you keep power within regulation limits.

[@miawgogo]

@@rasz if you couldn't microwaves would be in a dubious legal standing

[@ms2649]

@@rasz oh what about a amplifier that reaches 100m wifi

[@CNLohr]

@@ms2649 ?? The ESP does ~1km wifi without an amp.

[@ms2649]

@@CNLohr i never had an esp8266 with a range of ~1km without an amp and now I'm curious how did you get the range that far. and I'm talking about the amplifier extending the range of the wifi through concrete walls *EDIT* sorry i should have been more precise

[@berni8k]

So from the looks of it you are just changing the modulation symbol rate. This is not really illegal since 2.4GHz is an ISM band so there is no license needed as long as you stay inside and don't use too much transmit power. As far as the FCC is considered this is now a 2.4GHz keyfob with a custom modulation scheme. As for range you should be able to get a bit more range when clocking it slower since this exposes you to a narrower noise spectrum and yes this means you can now fit more wifi channels in the frequency band If you get access to the PLL that generates the carrier, that could let you shift it into other ISM license free bands such as 433MHz or 915MHz. But for that to work over a range >1m the ESP modules will need hardware modification to completely replace the impedance matching and antenna circuitry to get it to work well at the new bands.

[@bardenegri21]

Interesting for general security too I would imagine, would take a bit more work to figure out what's going on for an outsider.

[@CNLohr]

Yeah, I am hoping someone who has more RF prowess than me does something with this.

[@rasz]

I was somehow expecting different carrier frequency screwing with T/R filters, but this is quite usable.

[@CNLohr]

Yeah, there a separate PLL, the RFPLL, and if I mess with that it seems to keep crashing. I didn't mess with it until after I recorded the video.

[@leozendo3500]

Pwefkicit for slightly hidden slightly encrypted networks.

[@DroneMesh]

I might have couple ideas for this possible collaboration maybe?

[@Markfps]

Absolutely brilliant

[@JxH]

GitHub: "...from under it's [= it is] feet." Wrong "its". :-) Misusing the RF spectrum "in your own home" is no defense. On the other hand, the 2.4 GHz ISM band is unlicensed, so if you wish to change the waveform (as you've done) then you're perfectly free to do so. You don't need to follow any 802.11 industry standards.

[@CNLohr]

Fixed. (the it's)

[@guatagel2454]

Nice discovery. Thank you!

[@Wowthatsfail]

Rad1o sounds like a fallout universe device 😂

[@avejst]

Interesting observation Thanks for sharing :-)

[@rafaelcabelo6616]

It will be nice to have a way to program ESP8266 at Arduino IDE without the WiFi stuff. Just to use it as an general micro controller considering its high clock, saving the starting 200k of flash program memory used for the WiFi.

[@CNLohr]

You can check out nosdk8266 for that. It would be really cool if someone did an arduino thing with that.

[@Noubers]

The BBPLL is the base band clock. It's going to be a fixed bandwidth whatever you set the carrier frequency to since it is clocking the OFDM symbols into the mixer. The slower you clock it the longer the symbol duration (and this IC seems to handle that gracefully). Of course you'll need both sides to have the same symbol clock speeds for the Rx to be fed properly. Narrower bandwidth should get you a better bit error rate at the cost of transmission speed.

[@Noubers]

Also the IC is probably designed to do OFDM at a number of rates. 802.11 is pretty ambiguous at the physical layer depending on the revision. Some use OFDM, some are single carrier PSK. In OFDM the subcarrier modulation is also pretty carried from BPSK/QPSK to fairly high order QAM. The rest is just TDM for negotiating with clients and some crazy timing shit in N and AC for MIMO.

[@JasonDoege]

If you’ve reduced the bandwidth to 1/3, could you fit two more channels in, I wonder? Is it possible to adjust the center frequency on the esp8266?

[@CNLohr]

That might be possible. I spent a few minutes trying to change the RFPLL, but it turned out to be much more complex.

[@crazystuffproduction]

this is really neat.

[@commandroid9336]

Sending data at other frequency. Whats the fun part?

[@ms2649]

it's a glitch in the matrix

[@d00mfish]

Data transfer would be quite secure at the moment since there is no one out there who would expect this modification.

[@arzt99999]

Have you any further information about this hack? Where did you find the documentation for the registers? What happens, if you overclock the ESP? What exactly are the values you are setting to the registers? How they are related to the crystals frequency? Thanks :)

[@CNLohr]

I have not pursued this any further.

[@UncleRus]

Any news on software ESP32 USB-host?

[@brasildocara]

great Video Charles, Although I didn´t get so SO clear of what you did, and as I did undertood fine I am going to ask you this: if the NodeMCU is receiving in other frecuencies like 80 MHz, etcetera, How is the NodeMCU meant (designed) to don't receive those non standard frequencies? ---> setting the NodeMCU normally, it can receive those non standard frequencies?, What BBPLL stands for?, What the BBPLL is for?

[@CNLohr]

BBPLL = Baseband PLL, but it's also what drives the CPU and peripherals... So when you mess with that, it compresses or expands the baseband bandwidth -- it also changes the CPU + peripheral frequencies.

[@zyxwvutsrqponmlkh]

I think you have a fundamental misunderstanding. When he mentions 80 MHz that is not the frequincy it is transmitting on, that is the band width it is using for example from 2.400 to 2.480 GHz, this would be using 80 MHz of bandwidth (meaning how wide portion of the RF spectrum that is used, not to be confused with the more common meaning of data network throughput capacity).

[@jonshouse1]

meh ... narrower bandwidth for the same symbol rate just makes sig/noise at the receiver poorer. It will works because modern hardware has better performance than the hardware when the standard was developed, but that does not make it useful or desirable.

[@electronash]

Would a lower symbol rate not increase the range, though? I think that could prove very useful for some apps. The problem is, as Charles alluded to at the start of the vid, is that the non-spec modes would very likely upset the FCC (or the counterpart RF Gestapo in each Country). If the frequency could be lowered to one of the ISM bands, and the duty-cycle and maximum TX power adhered to, maybe it could be used for lower power / longer range LoRA style comms?

[@Gaget01Stuff]

@@electronash Not quite the way allocation of the frequency spectrum works. You can send anything of any shape on the 2.4ghz band without a license. There are plenty of products such as wireless landline phones and baby monitors that do this.

[@electronash]

@@Gaget01Stuff I'm not a HAM, but I thought there were still fairly strict guidelines still, on the bandwidth, power, and duration of the signal? AFAIK, you can even get in trouble for using the wrong WiFi channel in some Countries, but then I guess that would then be classed as an out-of-band issue.

[@tin2001]

@@electronash Some countries don't spread their 2.4 as wide as others, so channels 12, 13 and 14 are country dependant. I think Japan loses channel 1 too. And yes, some countries require specific modulation and channels depending on the device type or modulation. The fact microwave ovens spew out 2.4GHz leads some people to believe the band is open for little RF transmitters to do the same (and for safety, you really shouldn't).

[@electronash]

@@tin2001 True. It is weird how microwaves are allowed to leak RF across a wide swathe of the spectrum. I think it's still generally lower power than the average WiFi peaks, though, so I guess that's how it can cut through it?

[@erikslagter5686]

Can't this be used to make the ESP8266 faster? I know someone did, but there is very little information about how. I do know WiFi won't work (similar issue as described here), but how about setting it to "turbo boost" for short bursts when doing cpu intensive tasks and then reverting it to regain WiFi connectivity?

[@CNLohr]

It may be able to be used. Clone the repo and give it a shot.

[@erikslagter5686]

@@CNLohr I was hoping somebody would at least have some information about the pll('s). The source is not sufficient.

[@CM-Gram]

Hey man if you can please answer this question. I am trying to program the esp8266 using non sdk native c. i dont like programming in arduino /ide so i wanted to use eclipse. the tutorial you provide doesnt show how to write code for the esp using suitable IDE like eclipse or so. Recently espriff published something called IDF for esp32 which has full documentation on how to start programming the thing instantly unfortunately i have esp8266 not esp32 will you please make a video showing the process of writing code and how to embed the sdk and such in the Eclipse ide or whatever ide you use? i searched alot of forums and i cant do nothing. i dont know what to do with the sdk and all of that. thanks a bunch :)

[@CM-Gram]

to sum up, i read the API reference and i know how to write a code and i know how to burn the binaries onto the chip idk how the hell can i turn my code into a binary though or even where to write it :(

[@CNLohr]

I don't use an IDE, I strongly recommend a terminal and a text editor. But, for the rest of the environment, I primarily use esp82xx for all my ESP-related C stuff. Check out esp82xx on github!

[@CM-Gram]

@@CNLohr by that do you mean something like Gedit and then compile it using make in the terminal? can you give me a snippet on what an environment is or how it can help me?

[@CNLohr]

@@CM-Gram Please read the esp82xx github readme. It iwll answer a lot of questions and make additional questions easier to answer. I may make a video about doing a minimal project with it.

[@CM-Gram]

Thanks for replying to me :) i did download it and read it and actually used it. But i didnt truely understand what to do with it or didnt know how to use it properly And yes please do a video doing a mini project using it.

[@muh1h1]

i didn't even know wifi used OFDM ^^

[@Jonas_Meyer]

Can this be done with an ESP32?

[@CNLohr]

Not that I'm aware of. Maybe but I don't believe those registers are well documented

[@SinanAkkoyun]

Hacking with the esp is coming soon

[@aaron41]

Esp8266 sdr coming soon ;)

[@jamesmaxwell381]

What Linux distro are you using? Is that MATE? And what editor do you use for coding?

[@rishav4343]

looks lime mint

[@CNLohr]

@@rishav4343 Mint Mate and xed

[@NonExistChannel]

I have a love / hate relationship with the ESP8266. The documentation from Espressif is just so bad to the point that the latest SDK 3.0 is just not documented at all. I guess you are the only one who truly understands the ESP8266. Your "How to get started ESP8266" is pretty outdated btw. Would be nice if you could update.

[@r0_]

can you overclock to 5ghz?

[@bunnatang2081]

can this spectrum send signal to Mars?

[@SinanAkkoyun]

Can you jam 2.4GHz with an ESP8266? I mean really jam.

[@CNLohr]

Thankfully, no. the ESP honors CSMA which would prevent it from jamming up the spectrum.

[@RoterFruchtZwerg]

I once had an ESP8266 on a breadboard and wehenever I powered it, all devices in my home lost wifi. I even checked with airdump_ng... I stopped receiving packets from all SSIDs. I guess it was an issue with unreliable power on the breadboard. I suspect it just sent an unmodulated carrier and got somehow locked in that state.

[@Dlck.C.Normous]

@@RoterFruchtZwerg Same thing has happed to me several times before

[@metaorior]

spying

[@TheBodgybrothers]

I just incorporated a few lines of your code into an Arduino example sketch for ESP8266 WIFI AP and WIFIscan and it works as a hidden wifi AP. Detailed on your github issue section. github.com/cnlohr/esp8266oddclock/issues/3#issue-402717347 Thanks for sharing this. Sorry I used Arduino, just didn't want to set up a new compile environment. This can work for all WIFI examples in Arduino.