There is exciting news afoot in the world of the ESP32. This has long been microcontroller family of choice, but last month, someone found the internal test registers to receive raw spectrum data in the 2.4GHz range. And then built a spectrum analyzer around it. With WebUSB and firmware flashing right from the browser. Mindblowing, really.
That funny pattern showed up while I was playing around with it. Turns out, the microwave oven in the other room was running.
Coincidentally, that same weekend, I bought a $20 toy drone at a Canadian Costco on impulse. It’s called the “Mini Transporter” by M2 Brands, which seems to be a company that repackages all sorts of stuff for various department stores.
Interestingly, this is the first product I’ve ever seen that has an Industry Canada certification, and not an FCC ID. This seems to have landed in the stores this summer, not too long after the US banned all Chinese drones. Rough luck, they must have had to pivot to Canada market only, which is tiny.
Obligatory drone guts:
The drone itself is definitely a toy, but I got my $20 worth of entertainment out of it, crashing into my apartment walls.
So naturally, next I pulled out the SDR and had a look.
Whenever the transmitter was on and unlinked to the drone, there was a suspicious line of activity around 2475MHz.
Zoom in a little closer. Definitely something at 2475MHz:
As it links to the drone, the transmitter abandons 2475MHz and another pattern appears at 2458, 2462, 2666, and 2470. Clearly channel hopping.
Anyway, after this, the decoding was largely LLM-driven and blah blah blah no one cares about the details there. There were a couple days of recording captures with one device on, then the other, then stashing the transmitter behind a concrete wall so that the drone could juusst barely hear the transmitter, but the crummy ESP32 antenna couldn’t. Then the reverse scenario.
Oh, and that ESP32 discovery? It can also transmit!
Here’s a Python transmitter running on my laptop, talking to an ESP32, which is then talking to my drone.
The usual transmission disclaimer: I was transmitting at extremely low power in my apartment with foot-thick concrete that my Bluetooth headphones can’t get through. Don’t be dumb about transmitting on unlicensed bands!
You can see that I’ve added some scripting capabilities, but then you can ALSO see that drift on this toy is insane, so acrobatics definitely can’t be reliably done with an open-loop transmitter. I’ll have to get a webcam running some machine vision to do something more interesting, or something.
Both of these are with the same looping script running, with timed stick inputs attempting to fly the drone in a circle. It really is begging for a better sensor suite, or tracking its position with a webcam.
It strikes me that a decade ago, there were tons of research labs with rooms set up to do exactly this with many, very expensive drones. At $20 a pop now, it would be trivial to get a swarm of these acting in concert. That’s $20 including a transmitter we don’t need, packaging, and local store markups.
As all of the code-writing on this was done by the machine, I’m of the opinion that it is low value, and no one wants that slop. But here’s the specification, with which any other machine(or human!) can duplicate my work.
This also couldn’t have been done (easily) with DeviationTX, which as far as I understand it, was the group that figured out the scrambling protocol that this class of transmitter/receiver pair uses.