Lup Yuen Lee 李立源

Come join me (the "monster" 😂) as we dive deep into the Code inside (the "wifi chip" 😂)

lupyuen.github.io/articles/pin

1+
Lup Yuen Lee 李立源

Many thanks to this hilarious (but truthful) comment on 😂

qoto.org/@lupyuen/106454770223

1+
Lup Yuen Lee 李立源

Here's the Firmware ... Let's find out how it connects to a WiFi Access Point

github.com/lupyuen/bl_iot_sdk/

1
Lup Yuen Lee 李立源

connects to Access Point ... By notifying the WiFi Manager

github.com/lupyuen/bl_iot_sdk/

1
Lup Yuen Lee 李立源

Manager runs as a Background Task ... Here's how we send requests to WiFi Manager

github.com/lupyuen/bl_iot_sdk/

1
Lup Yuen Lee 李立源

Manager runs a State Machine ... That connects to the WiFi Access Point in the Background Task

github.com/lupyuen/bl_iot_sdk/

1
Lup Yuen Lee 李立源

To connect to a Access Point, WiFi Manager sends a request to the Lower MAC Firmware

github.com/lupyuen/bl_iot_sdk/

1
Lup Yuen Lee 李立源

LMAC is the Lower MAC Firmware that runs on the Radio Hardware

ceva-dsp.com/product/rivierawa

1
Lup Yuen Lee 李立源

CEVA has an interesting list of customers

csimarket.com/stocks/markets_g

1
Lup Yuen Lee 李立源

Manager sends Connect Request to LMAC Firmware thru another Message Queue

github.com/lupyuen/bl_iot_sdk/

1
Lup Yuen Lee 李立源

Manager talks to LMAC Firmware via Message Queue ... Let's find out how it works

ceva-dsp.com/product/rivierawa

1
Lup Yuen Lee 李立源

Driver talks to LMAC Firmware ... By writing to a Message Buffer and triggering an Interrupt

github.com/lupyuen/bl_iot_sdk/

1
Lup Yuen Lee 李立源

Driver triggers LMAC Interrupt ... By writing to Address 0x4400 0000 ... Let's see what's at 0x4400 0000

github.com/lupyuen/bl_iot_sdk/

1
Lup Yuen Lee 李立源

But 0x4400 0000 is NOT documented in Reference Manual! 😲 Now we know a secret ... BL602 talks to LMAC Firmware at Address 0x4400 0000 🤫

github.com/bouffalolab/bl_docs

1+
Lup Yuen Lee 李立源

Moving away from LMAC Firmware (since we got no code) ... Let's study the mysterious Library "libwifi" ... Which has been decompiled into C by BraveHeartFLOSSDev

github.com/BraveHeartFLOSSDev/

1
Lup Yuen Lee 李立源

Firmware starts the Stack ... By creating a Background Task that runs wifi_main ... Let's hunt for wifi_main

github.com/lupyuen/bl_iot_sdk/

1
Lup Yuen Lee 李立源

"wifi_main" lives in the mysterious Library "libwifi" ... Let's study the decompiled C code (thanks to BraveHeartFLOSSDev and Ghidra)

github.com/lupyuen/bl602nutcra

1+
Lup Yuen Lee 李立源

"wifi_main" calls "ke_evt_schedule" to do Tasks ... GitHub Search shows that "ke_evt_schedule" is also defined in ... AliOS! 😲

github.com/lupyuen/bl602nutcra

1+
Lup Yuen Lee 李立源

But does "ke_evt_schedule" really come from AliOS? Not quite ... "ke_evt_schedule" actually comes from ... CEVA RivieraWaves! 😲

github.com/mclown/AliOS-Things

1
Lup Yuen Lee 李立源

Now the Stack gets clearer ... We're actually reading the WiFi Driver Code by CEVA RivieraWaves! 💡

ceva-dsp.com/product/rivierawa

1
Lup Yuen Lee 李立源

Lesson Learnt: GitHub Search is our very good friend for Reverse Engineering! 👍

github.com/search?l=C&o=asc&q=

1
Lup Yuen Lee 李立源

The AliOS / RivieraWaves code we saw earlier was for Beken BK7231U WiFi + BLE SoC ... Is it related to ? 🤔

bekencorp.com/en/goods/detail/

1
Lup Yuen Lee 李立源

AliOS for Beken BK7231U WiFi SoC contains LMAC Firmware Code ... Is this the same LMAC Firmware that runs on 's Radio? 🤔 Super Exciting!

github.com/lupyuen/AliOS-Thing

1+
Lup Yuen Lee 李立源

From Now On: We shall read and understand the AliOS / RivieraWaves Source Code ... While comparing it with the Decompiled Code for libwifi ... Just to be sure that they are the same 🤝

github.com/lupyuen/AliOS-Thing

1
Lup Yuen Lee 李立源

Back to ke_evt_schedule, the function in Driver Kernel that handles every WiFi Event ... Let's hunt for ke_evt_hdlr and discover the WiFi Events

github.com/lupyuen/AliOS-Thing

1
Lup Yuen Lee 李立源
Follow

Here are the Event Handlers for WiFi Kernel ... txl_payload_handle looks interesting ... Let's hunt for it

github.com/lupyuen/AliOS-Thing

· · Tusky · 1 · 1 · 0
Lup Yuen Lee 李立源

txl_payload_handle handles Payloads by doing ... nothing! But txl_payload_handle_backup seems to be the right function that handles WiFi Payloads 🤔

github.com/lupyuen/bl602nutcra

1+
Lup Yuen Lee 李立源

Payload Handler calls rxu, txl and txu functions ... Fortunately these are defined in the AliOS / RivieraWaves Source Code we saw earlier

github.com/lupyuen/bl602nutcra

1
Lup Yuen Lee 李立源

Here's the Decompiled Supplicant that handles WiFi Authentication ... Decompiled code looks readable

github.com/lupyuen/bl602nutcra

1
Lup Yuen Lee 李立源

Thankfully Library libwifi was compiled with Assertions Enabled ... Makes Reverse Engineering simpler 👍

github.com/lupyuen/bl602nutcra

1
Lup Yuen Lee 李立源

Let's do Quantitative Analysis of the Decompiled Demo Firmware ... How many lines of code do we actually need to Reverse Engineer ... Now that we've found some matching source files?

github.com/lupyuen/bl602nutcra

1
Lup Yuen Lee 李立源

Load the Decompiled Functions into a spreadsheet ... For easier crunching

Google Sheets: docs.google.com/spreadsheets/d

1
Lup Yuen Lee 李立源

Matching the Decompiled Functions with AliOS / RivieraWave Source Code ... And identifying the differences

Google Sheets: docs.google.com/spreadsheets/d

1
Lup Yuen Lee 李立源

Work In Progress: What's inside the Demo Firmware ... And how many lines of code need to be Reverse Engineered

Google Sheets: docs.google.com/spreadsheets/d

1
Lup Yuen Lee 李立源

Decompiled Supplicant ... Looks similar to Rockchip RK3399 🤔

github.com/lupyuen/rk3399-kern

1
Lup Yuen Lee 李立源

2,500 lines of Decompiled Code in Supplicant seem to match Rockchip RK3399 ... Leaving 700 lines to be deciphered

Google Sheets: docs.google.com/spreadsheets/d

1
Lup Yuen Lee 李立源

GitHub Search shows something that partially matches Driver PHY Layer ... But the BL602 decompiled code seems to have more stuffing inside 🤔

github.com/lupyuen/bl602-604/b

1
Lup Yuen Lee 李立源

Firmware: 87,000 lines of Decompiled Code have been classified ... 24,000 more lines to go!

Google Sheets: docs.google.com/spreadsheets/d

1+
Lup Yuen Lee 李立源

Quantitative Analysis of Decompiled Firmware is nearly complete! Actual lines of WiFi code to be reverse engineered: 10,500

Google Sheets: docs.google.com/spreadsheets/d

1
Lup Yuen Lee 李立源

Reverse Engineering the Driver on ... All shall be explained here

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

Here's how we start the Driver in our Firmware

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

How we connect to a Access Point in our Firmware

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

How to send a HTTP Request in our Firmware

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

What happens when connects to a Network

lupyuen.github.io/articles/wif

1+
Lup Yuen Lee 李立源

What goes on inside the State Machine of the Manager

lupyuen.github.io/articles/wif

1
Show newer
░▒▓█►─═ 𐌔Ꝋ𐌂𐌊𐌔 𐌐𐌓Ꝋ𐋄𐌙 𓂀 ═─◄█▓▒░

@lupyuen
It seems to set some hw reg though i suppose albeit not main workhorse.

0
Ignas Kiela

@lupyuen Huh, neat how much "closed source" code is out there if you only look for it.

1
Lup Yuen Lee 李立源

@ignaloidas So true 🙂

0
AmpBenzScientist

@lupyuen You've uncovered a lot of information about the BL602's code.
Good work Mr. Lee.

1
Show newer
Sign in to participate in the conversation
Qoto Mastodon

QOTO: Question Others to Teach Ourselves
An inclusive, Academic Freedom, instance
All cultures welcome.
Hate speech and harassment strictly forbidden.

Trending now

Resources

Developers

What is Mastodon?

qoto.org

More…

v3.5.19-qoto · Privacy policy