D-Link DIR-1750 (HW rev A1): ssjrocks/dlink-experiments

A researcher operating as ssjrocks reverse-engineered a D-Link DIR-1750 router (MediaTek MT7629B/MT7615), gaining root access, repacking firmware, and building a custom MediaTek RACFG/HQA client that extracts per-antenna RSSI over raw Ethernet to demonstrate amplitude-based direction finding on the device's 3x3 antenna array. The dlink-experiments project used Ghidra and Python with Claude, and its latest commit (a802ea1a) clarifies that the ICap raw-IQ capture engine is functional and that earlier zero-value readbacks were a readback issue rather than a firmware-gated feature. Phase-based Angle-of-Arrival remains unfinished because the proprietary fullmac driver lacks radiotap support, closing standard monitor mode, and independent confirmation of the results was not reported.

Evidence at a glance Based on the linked sources. The author's reported result and independent confirmation are separate checks. - AI involvement - Reported models: Claude. Tools: Ghidra, Python, hqa.py. The writeup below describes the work attributed to AI. - Reported result - Partial. This is the directory's source-based outcome classification. - Independent confirmation - Not reported. - Human work and limitations - The project status evolved during the research period. While early commits suggested ICap was hardware-gated, the most recent commit in the provided source a802ea1a clarifies that the capture engine is functional and the previous failure was a readback issue. Original sources What was done A research project repurposing the D-Link DIR-1750 router. The author achieved root access, firmware modification, and demonstrated per-antenna RSSI direction finding. Advanced phase-based AoA remains a work in progress due to complex hardware-specific firmware limitations. The dlink-experiments https://raw.githubusercontent.com/ssjrocks/dlink-experiments/HEAD/README.md project documents the reverse engineering of a D-Link DIR-1750 router MediaTek MT7629B/MT7615 . The author utilized Ghidra for static analysis and live on-device testing to gain root access, repack firmware, and modify the stock web UI. A key achievement is the development of a custom MediaTek RACFG/HQA client that communicates over raw Ethernet to extract per-antenna RSSI data. This enabled demonstrated amplitude-based direction finding using the device's 3x3 antenna array. While initial investigations suggested the ICap raw-IQ capture path was gated out by firmware for the MT7629 variant, subsequent analysis indicated the capture engine is configured by firmware, with observed zero-value readbacks attributed to a readback issue rather than a compiled-out feature. The author notes that standard monitor mode is closed, as the proprietary fullmac driver lacks radiotap support. Phase-based Angle-of-Arrival AoA remains a research goal, requiring further work on calibration and sounding sequences. Reproduce it Prerequisites include root SSH access and a transmitting client. Use tools/rssi live.py for live RSSI monitoring or tools/hqa.py for direct HQA protocol interaction over raw Ethernet.