{"slug": "d-link-dir-1750-hw-rev-a1-ssjrocks-dlink-experiments", "title": "D-Link DIR-1750 (HW rev A1): ssjrocks/dlink-experiments", "summary": "A researcher operating as ssjrocks reverse-engineered a D-Link DIR-1750 router (MediaTek MT7629B/MT7615), gaining root access, repacking firmware, and building a custom MediaTek RACFG/HQA client that extracts per-antenna RSSI over raw Ethernet to demonstrate amplitude-based direction finding on the device's 3x3 antenna array. The dlink-experiments project used Ghidra and Python with Claude, and its latest commit (a802ea1a) clarifies that the ICap raw-IQ capture engine is functional and that earlier zero-value readbacks were a readback issue rather than a firmware-gated feature. Phase-based Angle-of-Arrival remains unfinished because the proprietary fullmac driver lacks radiotap support, closing standard monitor mode, and independent confirmation of the results was not reported.", "body_md": "## Evidence at a glance\n\nBased on the linked sources. The author's reported result and independent confirmation are separate checks.\n\n- AI involvement\n- Reported models: Claude. Tools: Ghidra, Python, hqa.py. The writeup below describes the work attributed to AI.\n- Reported result\n- Partial. This is the directory's source-based outcome classification.\n- Independent confirmation\n- Not reported.\n- Human work and limitations\n- The project status evolved during the research period. While early commits suggested ICap was hardware-gated, the most recent commit in the provided source (a802ea1a) clarifies that the capture engine is functional and the previous failure was a readback issue.\n\n### Original sources\n\n## What was done\n\nA research project repurposing the D-Link DIR-1750 router. The author achieved root access, firmware modification, and demonstrated per-antenna RSSI direction finding. Advanced phase-based AoA remains a work in progress due to complex hardware-specific firmware limitations.\n\nThe [dlink-experiments](https://raw.githubusercontent.com/ssjrocks/dlink-experiments/HEAD/README.md) project documents the reverse engineering of a D-Link DIR-1750 router (MediaTek MT7629B/MT7615). The author utilized Ghidra for static analysis and live on-device testing to gain root access, repack firmware, and modify the stock web UI. A key achievement is the development of a custom MediaTek RACFG/HQA client that communicates over raw Ethernet to extract per-antenna RSSI data. This enabled demonstrated amplitude-based direction finding using the device's 3x3 antenna array. While initial investigations suggested the ICap raw-IQ capture path was gated out by firmware for the MT7629 variant, subsequent analysis indicated the capture engine is configured by firmware, with observed zero-value readbacks attributed to a readback issue rather than a compiled-out feature. The author notes that standard monitor mode is closed, as the proprietary fullmac driver lacks radiotap support. Phase-based Angle-of-Arrival (AoA) remains a research goal, requiring further work on calibration and sounding sequences.\n\n## Reproduce it\n\n```\nPrerequisites include root SSH access and a transmitting client. Use `tools/rssi_live.py` for live RSSI monitoring or `tools/hqa.py` for direct HQA protocol interaction over raw Ethernet.\n```\n\n", "url": "https://wpnews.pro/news/d-link-dir-1750-hw-rev-a1-ssjrocks-dlink-experiments", "canonical_source": "https://reversedwithai.com/p/d-link-dir-1750-hw-rev-a1-c1894139", "published_at": "2026-10-25 10:31:18+00:00", "updated_at": "2026-10-25 12:12:00.674086+00:00", "lang": "en", "topics": ["artificial-intelligence"], "entities": ["D-Link", "DIR-1750", "MediaTek", "MT7629B", "MT7615", "ssjrocks", "Ghidra", "Claude"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/d-link-dir-1750-hw-rev-a1-ssjrocks-dlink-experiments", "markdown": "https://wpnews.pro/news/d-link-dir-1750-hw-rev-a1-ssjrocks-dlink-experiments.md", "text": "https://wpnews.pro/news/d-link-dir-1750-hw-rev-a1-ssjrocks-dlink-experiments.txt", "jsonld": "https://wpnews.pro/news/d-link-dir-1750-hw-rev-a1-ssjrocks-dlink-experiments.jsonld"}}