Reverse engineering ESP32 Wi-Fi driver: the road ahead

[jononor]

Very cool project. I think efforts like these are among the most promising to get a FOSS WiFi cards. Because these WiFi-capable MCUs are: designed to be generally programmable, have quite a lot of open documentation, are available for purchase in both small and large quantities, have s availability over long time-frames (10 years), can tap into the larger community knowledge-base. This is in contrast to the more specialized chips that dedicated WiFi cards use.

[robert_foss]

The ESP32 is 802.11n over 2.4ghz with no MIMO, so the bandwidth will always be bad.

[echoangle]

What would the performance be like though? Would you want to use a ESP32 for watching Videos? Would that be doable?

[DeathArrow]

What do you mean by FOSS Wi-Fi cards? Aren't there lots of open source drivers for Wi-Fi cards?

[fjfaase]

I wonder if they use any of the decompiler tools that are available. There is decompiler support for the Xtensa esp32 instruction in ghidra version 11.0. I also guess that rev.ng, which uses QEMU as its disassembler, could be used for decompiling as QEMU has support for the Xtensa esp32 instructions as well.

My experience with decompilers is that are not 100% perfect and that the output often still needs a lot of clean-up. I tried rev.ng on a binary written in assembler that used a register based calling convention (not stack based) and rev.ng produced a huge file many times the size you would expect from the assembler input. It seems that decompiler can only do the most trivial step of the reverse engineering process.

[linuxlizard]

Decompiling the microcode blob might run afoul of intellectual property laws. A clean room implementation needs to be done without reading any of the product's actual code.

[pabs3]

One of the posts mentioned they use Ghidra and Qemu forks for their work.

[pantalaimon]

All the newer ESP32 MCUs are RISC-V based if that may help

[ajb]

Interesting. 53286 accesses is a lot, I wonder if some of this is writing firmware to another processor, or writing a table. Some may also be busy waiting on status bits.

It would be interesting to see what the minimal subset of the 53286 is, which can be automated using the Delta Debugging algorithm, but it would first be necessary to figure out if there were any necessary waits during the writing process. Also blindly deleting stuff may produce a system that, even if it works, isn't a good citizen of the RF spectrum.

[K0balt]

It baffles me that a company like espressif wouldn’t publish complete API specs of their radio hardware . I could see why they may not want their proprietary source out there, as it might make it easier for competitors to make similar chips, but what is the downside to enabling someone to write software particular to your hardware?

It seems like they would have everything to gain and nothing to lose from this?

Anyone shed any light on the motivations here?

[ta988]

Really often that's because they license it from a third party and they are not allowed to.

[jesprenj]

Does a FOSS wifi driver for esp8266 already exist or is it in the making?

[pabs3]

They are working on it, the post is about what they still have to do.

[SillyUsername]

I need _Bluetooth_ OBEX support on ESP32 and Espressif's standard lib doesn't provide it. Is this project going to look at issues like these too?

[05]

The BT stack is based on Bluedroid, so that’s open source (up to the driver I’d guess); see here https://github.com/espressif/esp-idf/tree/master/components/...

[pabs3]

Some other examples of open WiFi firmware here:

https://wiki.debian.org/Firmware/Open

[opengears]

Does this mean we could get open source (hardware) WiFi cards for our Linux Notebooks based on ESP32 in the future?

[utensil4778]

No, and you don't want that in the first place. With an ESP32 you'd be pretty lucky to get more than 10 or 20mbps in ideal conditions. It's also 2.4GHz only.

[yjftsjthsd-h]

Depends on what you mean? The ESP32 isn't open hardware, so on that front, no. But could this potentially let you make an open source card that used the ESP32, absolutely. In fact, you can do that already, it'll just be using some closed source firmware. And replacing that firmware with FOSS is what this is about.

[pelorat]

So this appears to be a clean reversing effort, for what - legal reasons?

Espressif Systems is a Chinese company and probably stole half the code in the firmware anyways. No one will blame you if you stick the stick the firmware in Ghidra.

[tecleandor]

First paragraph:

"This will enable features that the current, closed source ESP32 Wi-Fi implementation does not have, for example 802.11s mesh networking. It will also improve the auditability of the code."

[DeathArrow]

>Espressif Systems is a Chinese company and probably stole half the code in the firmware anyways.

So if an entity is Chinese we are sure they are thiefs.

[ZiiS]

The people they copied it from would.

[mschuster91]

If you got enough (wo)manpower you can also do a cleanroom RE using a decompiler - one team decompiles and writes documentation about how the chip works, the second team writes a driver based on that doc.

[margorczynski]

Have you tried utilizing a strong LLM like ChatGPT or Claude to help you out? I've seen some really interesting examples of using it to decompile code to a very readable format.

[hildenae]

As other comments have mentioned - they do not want to decompile the source, they want a clean-room-implementation.