This is only a project you can accomplish if you are willing to dive into the code yourself, and only if you do that after investing time to understand the fundamental issues.
Really this is not a worthwhile idea.
If you wanted to do it, yes changing the IQ polarity configured into the baseband chip would be a requirement. Finding what in the code does that is the least of your problems.
You also have to consider the air settings used in a particular region. In some, downlinks use the same frequencies and bandwidths as uplinks. In others, dowlinks use distinct frequencies and bandwidth from uplinks.
If you invest time in understanding the capabilities of the Semtech baseband chip, you’ll learn about a few key limitations. For example, the chip can only receive in two tightly clustered regions of spectrum, traditionally these are set to be adjacent and cover the uplink frequencies utilized. Next, the chip can receive on multiple frequencies and spreading factors, but only at 125 KHz bandwidth; in some regional settings downlinks do often use 125 KHz bandwidth, but in others they are always 500 KHz. There’s also the ability to monitor a single frequency and single spreading factor at wider bandwidth - but only one, not the variety that a LoRaWAN network actually uses for downlink.
So if the gateway baseband chip can monitor most of the possible downlink modes, this might work. Otherwise the baseband chip (and possibly RF as well) would have to be dynamically reconfigured to catch each downlink. Nodes do this: but nodes know what to expect because of the rules mapping uplink settings to those of possible downlinks. A gateway trying to intercept other people’s traffic can’t know that. In a way, you’d be better off with a normal gateway to catch uplinks, and then you could steer a node radio or two to catch any potential downlinks corresponding to the uplinks you heard - but only those where you actually intercepted the uplink. And in a busy setting you could run out of radios to assign to possible downlinks.
Really, this is a complex project that would require a lot more effort and self sturdy on your part than you seem prepared to invest, and the results would generally be poor and useless. If you want to go ahead anyway, that’s up to you - but don’t expect anyone here to walk you through building it.
The one vaguely related thing that can actually make sense is sending gateway-to-gateway pings for test purposes. This however is fairly simple, because gateways already dynamically configure for each downlink, so all you really have to do is tell the sending gateway to transmit on one of the uplink, rather than downlink channels and IQ setting and it will be picked up by any gateway with ordinary configuration in range.