Evidence at a glance #
Based on the linked sources. The author's reported result and independent confirmation are separate checks.
- AI involvement
- Reported models: Claude. Tools: Ghidra, Python, hqa.py. The writeup below describes the work attributed to AI.
- Reported result
- Partial. This is the directory's source-based outcome classification.
- Independent confirmation
- Not reported.
- Human work and limitations
- The project status evolved during the research period. While early commits suggested ICap was hardware-gated, the most recent commit in the provided source (a802ea1a) clarifies that the capture engine is functional and the previous failure was a readback issue.
Original sources
What was done #
A research project repurposing the D-Link DIR-1750 router. The author achieved root access, firmware modification, and demonstrated per-antenna RSSI direction finding. Advanced phase-based AoA remains a work in progress due to complex hardware-specific firmware limitations.
The dlink-experiments project documents the reverse engineering of a D-Link DIR-1750 router (MediaTek MT7629B/MT7615). The author utilized Ghidra for static analysis and live on-device testing to gain root access, repack firmware, and modify the stock web UI. A key achievement is the development of a custom MediaTek RACFG/HQA client that communicates over raw Ethernet to extract per-antenna RSSI data. This enabled demonstrated amplitude-based direction finding using the device's 3x3 antenna array. While initial investigations suggested the ICap raw-IQ capture path was gated out by firmware for the MT7629 variant, subsequent analysis indicated the capture engine is configured by firmware, with observed zero-value readbacks attributed to a readback issue rather than a compiled-out feature. The author notes that standard monitor mode is closed, as the proprietary fullmac driver lacks radiotap support. Phase-based Angle-of-Arrival (AoA) remains a research goal, requiring further work on calibration and sounding sequences.
Reproduce it #
Prerequisites include root SSH access and a transmitting client. Use `tools/rssi_live.py` for live RSSI monitoring or `tools/hqa.py` for direct HQA protocol interaction over raw Ethernet.