Lup Yuen Lee 李立源 @lupyuen@qoto.org

The AliOS / RivieraWaves code we saw earlier was for Beken BK7231U WiFi + BLE SoC ... Is it related to #BL602? 🤔

http://www.bekencorp.com/en/goods/detail/cid/13.html

Lesson Learnt: GitHub Search is our very good friend for Reverse Engineering! 👍

https://github.com/search?l=C&o=asc&q=ke_evt_schedule&s=indexed&type=Code

Now the #BL602 #WiFi Stack gets clearer ... We're actually reading the WiFi Driver Code by CEVA RivieraWaves! 💡

https://www.ceva-dsp.com/product/rivierawaves-wi-fi-platforms/

But does "ke_evt_schedule" really come from AliOS? Not quite ... "ke_evt_schedule" actually comes from ... CEVA RivieraWaves! 😲

https://github.com/mclown/AliOS-Things/blob/master/platform/mcu/bk7231u/beken/ip/ke/ke_event.c#L203-L231

#BL602 "wifi_main" calls "ke_evt_schedule" to do #WiFi Tasks ... GitHub Search shows that "ke_evt_schedule" is also defined in ... AliOS! 😲

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L28721-L28737

@AmpBenzScientist Cool thanks! 👍

"wifi_main" lives in the mysterious #BL602 #WiFi Library "libwifi" ... Let's study the decompiled C code (thanks to BraveHeartFLOSSDev and Ghidra)

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L32959-L33006

#BL602 Firmware starts the #WiFi Stack ... By creating a Background Task that runs wifi_main ... Let's hunt for wifi_main

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_demo_wifi/bl602_demo_wifi/main.c#L729-L747

@AmpBenzScientist I'll probably make the same mistake in Spanish and Russian 😂

Moving away from LMAC Firmware (since we got no code) ... Let's study the mysterious #BL602 #WiFi Library "libwifi" ... Which has been decompiled into C by BraveHeartFLOSSDev

https://github.com/BraveHeartFLOSSDev/bl602nutcracker1

@AmpBenzScientist No worries I'm now looking at wifi_main that you have reverse-engineered ... The exciting stuff is in there 👍

@AmpBenzScientist Oops cancel last order ... I searched GitHub for coex_wifi_pta_forece_enable and found nothing interesting.

Which proves that wifi_main doesn't exist in GitHub.

https://github.com/search?l=C&q=coex_wifi_pta_forece_enable&type=Code

@AmpBenzScientist Wonder if I should comb thru GitHub Code Search for wifi_main and see whether I can find the source 🤔

https://github.com/search?l=C&o=desc&q=wifi_main&s=indexed&type=Code

@AmpBenzScientist wifi_main appears to be the entry point into the libwifi library ... Lemme trace it and see where it goes

@AmpBenzScientist Aha I found the link from BL602 Firmware to your RE code. Great job! 👍

@AmpBenzScientist Ah haha ... 人王 is probably not a good thing to say because it sounds like 人亡 which means... 😉

@AmpBenzScientist I'm also checking this pic for CEVA RivieraWaves...

https://www.ceva-dsp.com/product/rivierawaves-wi-fi-platforms/

Could we be looking at the "WiFi Driver" in the pic below? Which is the code from RivieraWaves?

@AmpBenzScientist Haha what's 人 王?

I can't find a match for this file though:

https://github.com/BraveHeartFLOSSDev/bl602nutcracker1/blob/main/libwifi1/bl.o.c

I searched for "bl_init" in the other repo. Why are some files missing from the other repo? 🤔

@AmpBenzScientist Another possible match: This file...

https://github.com/BraveHeartFLOSSDev/bl602nutcracker1/blob/main/libwifi1/bl602_calib_data.o.c

Looks similar to this...

https://github.com/jixinintelligence/bl602-604/blob/37f2d7b36b4c2ba6f073029d351551c33f9610f3/components/bl602/bl602_wifi/plf/refip/src/driver/phy/bl602_phy_rf/rf/Src/bl602_calib_data.c

@AmpBenzScientist Thanks! This file that you have reverse-engineered...

https://github.com/BraveHeartFLOSSDev/bl602nutcracker1/blob/main/libwifi2/phy_bl602.o.c

Looks similar to this source file?

https://github.com/jixinintelligence/bl602-604/blob/37f2d7b36b4c2ba6f073029d351551c33f9610f3/components/bl602/bl602_wifi/plf/refip/src/driver/phy/bl602_phy_rf/phy_bl602.c

Trying to figure out how this code is used by the BL602 WiFi Driver. Is this only used when BL602 is running as Host AP?

In my recent posts you can see that BL602 running as WiFi client will just call the LMAC Firmware directly.

And where is the LMAC Firmware code?

Puzzling 🤔