# D-Link DIR-1750 (HW rev A1): ssjrocks/dlink-experiments

> Source: <https://reversedwithai.com/p/d-link-dir-1750-hw-rev-a1-c1894139>
> Published: 2026-10-25 10:31:18+00:00

## Evidence at a glance

Based on the linked sources. The author's reported result and independent confirmation are separate checks.

- AI involvement
- Reported models: Claude. Tools: Ghidra, Python, hqa.py. The writeup below describes the work attributed to AI.
- Reported result
- Partial. This is the directory's source-based outcome classification.
- Independent confirmation
- Not reported.
- Human work and limitations
- The project status evolved during the research period. While early commits suggested ICap was hardware-gated, the most recent commit in the provided source (a802ea1a) clarifies that the capture engine is functional and the previous failure was a readback issue.

### Original sources

## What was done

A research project repurposing the D-Link DIR-1750 router. The author achieved root access, firmware modification, and demonstrated per-antenna RSSI direction finding. Advanced phase-based AoA remains a work in progress due to complex hardware-specific firmware limitations.

The [dlink-experiments](https://raw.githubusercontent.com/ssjrocks/dlink-experiments/HEAD/README.md) project documents the reverse engineering of a D-Link DIR-1750 router (MediaTek MT7629B/MT7615). The author utilized Ghidra for static analysis and live on-device testing to gain root access, repack firmware, and modify the stock web UI. A key achievement is the development of a custom MediaTek RACFG/HQA client that communicates over raw Ethernet to extract per-antenna RSSI data. This enabled demonstrated amplitude-based direction finding using the device's 3x3 antenna array. While initial investigations suggested the ICap raw-IQ capture path was gated out by firmware for the MT7629 variant, subsequent analysis indicated the capture engine is configured by firmware, with observed zero-value readbacks attributed to a readback issue rather than a compiled-out feature. The author notes that standard monitor mode is closed, as the proprietary fullmac driver lacks radiotap support. Phase-based Angle-of-Arrival (AoA) remains a research goal, requiring further work on calibration and sounding sequences.

## Reproduce it

```
Prerequisites include root SSH access and a transmitting client. Use `tools/rssi_live.py` for live RSSI monitoring or `tools/hqa.py` for direct HQA protocol interaction over raw Ethernet.
```