Moving away from LMAC Firmware (since we got no code) ... Let's study the mysterious #BL602 #WiFi Library "libwifi" ... Which has been decompiled into C by BraveHeartFLOSSDev

https://github.com/BraveHeartFLOSSDev/bl602nutcracker1

#BL602 Firmware starts the #WiFi Stack ... By creating a Background Task that runs wifi_main ... Let's hunt for wifi_main

https://github.com/lupyuen/bl_iot_sdk/blob/master/customer_app/bl602_demo_wifi/bl602_demo_wifi/main.c#L729-L747

"wifi_main" lives in the mysterious #BL602 #WiFi Library "libwifi" ... Let's study the decompiled C code (thanks to BraveHeartFLOSSDev and Ghidra)

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L32959-L33006

#BL602 "wifi_main" calls "ke_evt_schedule" to do #WiFi Tasks ... GitHub Search shows that "ke_evt_schedule" is also defined in ... AliOS! 😲

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L28721-L28737

But does "ke_evt_schedule" really come from AliOS? Not quite ... "ke_evt_schedule" actually comes from ... CEVA RivieraWaves! 😲

https://github.com/mclown/AliOS-Things/blob/master/platform/mcu/bk7231u/beken/ip/ke/ke_event.c#L203-L231

Now the #BL602 #WiFi Stack gets clearer ... We're actually reading the WiFi Driver Code by CEVA RivieraWaves! 💡

https://www.ceva-dsp.com/product/rivierawaves-wi-fi-platforms/

Lesson Learnt: GitHub Search is our very good friend for Reverse Engineering! 👍

https://github.com/search?l=C&o=asc&q=ke_evt_schedule&s=indexed&type=Code

The AliOS / RivieraWaves code we saw earlier was for Beken BK7231U WiFi + BLE SoC ... Is it related to #BL602? 🤔

http://www.bekencorp.com/en/goods/detail/cid/13.html

AliOS for Beken BK7231U WiFi SoC contains LMAC Firmware Code ... Is this the same LMAC Firmware that runs on #BL602's #WiFi Radio? 🤔 Super Exciting!

https://github.com/lupyuen/AliOS-Things/tree/master/platform/mcu/bk7231u/beken/ip/lmac/src

From Now On: We shall read and understand the AliOS / RivieraWaves Source Code ... While comparing it with the Decompiled Code for #BL602 libwifi ... Just to be sure that they are the same 🤝

https://github.com/lupyuen/AliOS-Things/tree/master/platform/mcu/bk7231u/beken/ip/ke

Back to ke_evt_schedule, the function in #BL602 #WiFi Driver Kernel that handles every WiFi Event ... Let's hunt for ke_evt_hdlr and discover the WiFi Events

https://github.com/lupyuen/AliOS-Things/blob/master/platform/mcu/bk7231u/beken/ip/ke/ke_event.c#L203-L231

Here are the #WiFi Event Handlers for #BL602 WiFi Kernel ... txl_payload_handle looks interesting ... Let's hunt for it

https://github.com/lupyuen/AliOS-Things/blob/master/platform/mcu/bk7231u/beken/ip/ke/ke_event.c#L78-L138

txl_payload_handle handles #BL602 #WiFi Payloads by doing ... nothing! But txl_payload_handle_backup seems to be the right function that handles WiFi Payloads 🤔

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L20203-L20398

#BL602 #WiFi Payload Handler calls rxu, txl and txu functions ... Fortunately these are defined in the AliOS / RivieraWaves Source Code we saw earlier

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L20220-L20398

Here's the Decompiled #BL602 #WiFi Supplicant that handles WiFi Authentication ... Decompiled code looks readable

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L29805-L29860

Thankfully #BL602 #WiFi Library libwifi was compiled with Assertions Enabled ... Makes Reverse Engineering simpler 👍

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.c#L38512-L38609

Let's do Quantitative Analysis of the Decompiled #BL602 #WiFi Demo Firmware ... How many lines of code do we actually need to Reverse Engineer ... Now that we've found some matching source files?

https://github.com/lupyuen/bl602nutcracker1/blob/main/bl602_demo_wifi.txt

Load the Decompiled #BL602 #WiFi Functions into a spreadsheet ... For easier crunching

Google Sheets: https://docs.google.com/spreadsheets/d/1C_XmkH-ZSXz9-V2HsYBv7K1KRx3RF3-zsoJRLh1GwxI/edit?usp=sharing

Matching the Decompiled #BL602 #WiFi Functions with AliOS / RivieraWave Source Code ... And identifying the differences

Google Sheets: https://docs.google.com/spreadsheets/d/1C_XmkH-ZSXz9-V2HsYBv7K1KRx3RF3-zsoJRLh1GwxI/edit?usp=sharing

Work In Progress: What's inside the #BL602 #WiFi Demo Firmware ... And how many lines of code need to be Reverse Engineered

Google Sheets: https://docs.google.com/spreadsheets/d/1C_XmkH-ZSXz9-V2HsYBv7K1KRx3RF3-zsoJRLh1GwxI/edit#gid=1323188614

Decompiled #BL602 #WiFi Supplicant ... Looks similar to Rockchip RK3399 🤔

https://github.com/lupyuen/rk3399-kernel/blob/main/drivers/net/wireless/rockchip_wlan/mvl88w8977/mlan/esa/keyMgmtSta.c#L572-L723

2,500 lines of Decompiled Code in #BL602 #WiFi Supplicant seem to match Rockchip RK3399 ... Leaving 700 lines to be deciphered

Google Sheets: https://docs.google.com/spreadsheets/d/1C_XmkH-ZSXz9-V2HsYBv7K1KRx3RF3-zsoJRLh1GwxI/edit#gid=1323188614

GitHub Search shows something that partially matches #BL602 #WiFi Driver PHY Layer ... But the BL602 decompiled code seems to have more stuffing inside 🤔

https://github.com/lupyuen/bl602-604/blob/master/components/bl602/bl602_wifi/plf/refip/src/driver/phy/bl602_phy_rf/phy_bl602.c#L474-L492

#BL602 #WiFi Firmware: 87,000 lines of Decompiled Code have been classified ... 24,000 more lines to go!

Google Sheets: https://docs.google.com/spreadsheets/d/1C_XmkH-ZSXz9-V2HsYBv7K1KRx3RF3-zsoJRLh1GwxI/edit#gid=1323188614

Quantitative Analysis of Decompiled #BL602 #WiFi Firmware is nearly complete! Actual lines of WiFi code to be reverse engineered: 10,500

Google Sheets: https://docs.google.com/spreadsheets/d/1C_XmkH-ZSXz9-V2HsYBv7K1KRx3RF3-zsoJRLh1GwxI/edit#gid=1323188614

Reverse Engineering the #WiFi Driver on #RISCV #BL602 ... All shall be explained here

https://lupyuen.github.io/articles/wifi?1

Here's how we start the #WiFi Driver in our #BL602 Firmware

https://lupyuen.github.io/articles/wifi?2#bl602-wifi-demo-firmware

How we connect to a #WiFi Access Point in our #BL602 Firmware

https://lupyuen.github.io/articles/wifi?3#connect-to-wifi-network

How to send a HTTP Request in our #BL602 #WiFi Firmware

https://lupyuen.github.io/articles/wifi?4#send-http-request

What happens when #BL602 connects to a #WiFi Network

https://lupyuen.github.io/articles/wifi?5#connect-to-wifi-access-point

What goes on inside the State Machine of the #BL602 #WiFi Manager

https://lupyuen.github.io/articles/wifi?6#wifi-manager-state-machine

How #BL602 talks to its #WiFi Radio Hardware to transmit packets

https://lupyuen.github.io/articles/wifi?7#send-request-to-lmac

How #BL602 triggers a Lower MAC Interrupt in the #WiFi Radio Hardware

https://lupyuen.github.io/articles/wifi?8#trigger-lmac-interrupt

Let's dive into the #BL602 #WiFi Driver ... Decompiled into C by BraveHeartFLOSSDev!

https://lupyuen.github.io/articles/wifi?9#decompiled-wifi-demo-firmware

#BL602 runs a #WiFi Firmware Task ... To transmit and receive WiFi packets in the background

https://lupyuen.github.io/articles/wifi?10#wifi-firmware-task

What happens inside the #BL602 #WiFi Firmware Task? 🤔 The decompiled code reveals all secrets! 🤫

https://lupyuen.github.io/articles/wifi?11#start-firmware-task

#BL602 #WiFi Driver deciphered thanks to GitHub Search!

https://lupyuen.github.io/articles/wifi?12#schedule-kernel-events

#BL602 #WiFi Kernel calls these Event Handlers to transmit and receive WiFi packets

https://lupyuen.github.io/articles/wifi?15#schedule-kernel-events