42 lines
1.9 KiB
Markdown
42 lines
1.9 KiB
Markdown
|
# Announcement draft (v0.1.0) — do not post as-is
|
||
|
|
|
||
|
|
Venue plan: OpenWrt forum (Hardware / MediaTek section) first, link from
|
||
|
|
r/reverseengineering. Undersell: this is format tooling + docs + update
|
||
|
|
tracking; the deep RE comes later.
|
||
|
|
|
||
|
|
---
|
||
|
|
|
||
|
|
Subject: mtk-wifi-fw v0.1 — tooling, format docs, and a changelog for
|
||
|
|
MediaTek Connac2 WiFi firmware (mt7915/16/7981/86)
|
||
|
|
|
||
|
|
Body:
|
||
|
|
|
||
|
|
The WiFi firmware on Filogic routers ships in linux-firmware with its
|
||
|
|
version strings stripped (`fw_ver = "____000000"`) and no changelog. I've
|
||
|
|
been picking the containers apart; first release of the toolkit:
|
||
|
|
|
||
|
|
- **Extractor + ELF export** — carves `*_wm/wa/rom_patch.bin` into their
|
||
|
|
load regions and emits EM_NDS32 ELF at true addresses, ready for Ghidra
|
||
|
|
(official NDS32 module). Works across mt7915/7916/7981/7986.
|
||
|
|
- **Format spec + boot notes** — field-by-field container documentation
|
||
|
|
cited to the mt76 loader source, plus how the four images (ROM patch,
|
||
|
|
WM, WA, WED WO) load onto the three NDS32 cores.
|
||
|
|
- **Recovered version metadata** — the containers carry a second,
|
||
|
|
kernel-unused trailer with the *full* build string (branch, MP tag, build
|
||
|
|
timestamp). We've indexed every revision ever shipped to linux-firmware
|
||
|
|
(54 so far, 2020→2026).
|
||
|
|
- **Version diffing** — region-aligned byte equality + string-set diffs.
|
||
|
|
Example finding from the 2026 mt7981 build: near-total rework of the
|
||
|
|
0xe003b000 code region, new rate-adaptation params (HT 20/40 coex), DPD
|
||
|
|
calibration and thermal-power strings — details in the repo's reports.
|
||
|
|
|
||
|
|
No firmware bytes in the repo; tools run against your own linux-firmware
|
||
|
|
copy. Everything is tested (any blob you test must be a known upstream
|
||
|
|
revision) and CI tracks upstream weekly.
|
||
|
|
|
||
|
|
What's next: Ghidra annotation projects, the MCU command ABI map, and
|
||
|
|
eventually documentation of the WM/WA boundary. Feedback welcome,
|
||
|
|
especially from mt76 devs and anyone who's looked inside these blobs.
|
||
|
|
|
||
|
|
(link)
|