Show older
Lup Yuen Lee 李立源

txl_payload_handle handles Payloads by doing ... nothing! But txl_payload_handle_backup seems to be the right function that handles WiFi Payloads 🤔

github.com/lupyuen/bl602nutcra

1+
Lup Yuen Lee 李立源

Payload Handler calls rxu, txl and txu functions ... Fortunately these are defined in the AliOS / RivieraWaves Source Code we saw earlier

github.com/lupyuen/bl602nutcra

1
Lup Yuen Lee 李立源

Here's the Decompiled Supplicant that handles WiFi Authentication ... Decompiled code looks readable

github.com/lupyuen/bl602nutcra

1
Lup Yuen Lee 李立源

Thankfully Library libwifi was compiled with Assertions Enabled ... Makes Reverse Engineering simpler 👍

github.com/lupyuen/bl602nutcra

1
Lup Yuen Lee 李立源

Let's do Quantitative Analysis of the Decompiled Demo Firmware ... How many lines of code do we actually need to Reverse Engineer ... Now that we've found some matching source files?

github.com/lupyuen/bl602nutcra

1
Lup Yuen Lee 李立源

Load the Decompiled Functions into a spreadsheet ... For easier crunching

Google Sheets: docs.google.com/spreadsheets/d

1
Lup Yuen Lee 李立源

Matching the Decompiled Functions with AliOS / RivieraWave Source Code ... And identifying the differences

Google Sheets: docs.google.com/spreadsheets/d

1
Lup Yuen Lee 李立源

Work In Progress: What's inside the Demo Firmware ... And how many lines of code need to be Reverse Engineered

Google Sheets: docs.google.com/spreadsheets/d

1
Lup Yuen Lee 李立源

Decompiled Supplicant ... Looks similar to Rockchip RK3399 🤔

github.com/lupyuen/rk3399-kern

1
Lup Yuen Lee 李立源

2,500 lines of Decompiled Code in Supplicant seem to match Rockchip RK3399 ... Leaving 700 lines to be deciphered

Google Sheets: docs.google.com/spreadsheets/d

1
Lup Yuen Lee 李立源

GitHub Search shows something that partially matches Driver PHY Layer ... But the BL602 decompiled code seems to have more stuffing inside 🤔

github.com/lupyuen/bl602-604/b

1
Lup Yuen Lee 李立源

Firmware: 87,000 lines of Decompiled Code have been classified ... 24,000 more lines to go!

Google Sheets: docs.google.com/spreadsheets/d

1+
Lup Yuen Lee 李立源

Quantitative Analysis of Decompiled Firmware is nearly complete! Actual lines of WiFi code to be reverse engineered: 10,500

Google Sheets: docs.google.com/spreadsheets/d

1
Lup Yuen Lee 李立源

Reverse Engineering the Driver on ... All shall be explained here

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

Here's how we start the Driver in our Firmware

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

How we connect to a Access Point in our Firmware

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

How to send a HTTP Request in our Firmware

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

What happens when connects to a Network

lupyuen.github.io/articles/wif

1+
Lup Yuen Lee 李立源

What goes on inside the State Machine of the Manager

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

How talks to its Radio Hardware to transmit packets

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

How triggers a Lower MAC Interrupt in the Radio Hardware

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

Let's dive into the Driver ... Decompiled into C by BraveHeartFLOSSDev!

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

runs a Firmware Task ... To transmit and receive WiFi packets in the background

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

What happens inside the Firmware Task? 🤔 The decompiled code reveals all secrets! 🤫

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

Driver deciphered thanks to GitHub Search!

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

Kernel calls these Event Handlers to transmit and receive WiFi packets

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

packet transmission looks undecipherable... Bit there's hope!

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

How does transmit a Packet? Let's walk thru the decompiled code

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

Driver is based on CEVA RivieraWaves

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

What is RivieraWaves? How is it used for ?

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

Driver includes these modules from RivieraWaves Upper MAC

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

Here are the Lower MAC Interfaces exposed by Radio Hardware

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

's Supplicant ... And its Secret Origin 🤫

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

Physical Layer looks a little murky 🤿

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

How we do Quantitative Analysis of the Decompiled Firmware

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

How we classified 97,000 Lines of Code in our Decompiled Firmware

lupyuen.github.io/articles/wif

1+
Lup Yuen Lee 李立源

Matching the Decompiled Firmware ... With the source code we've discovered on GitHub Search

lupyuen.github.io/articles/wif

1
Lup Yuen Lee 李立源

Quantitative Analysis says: A huge chunk of the WiFi Source Code is already out there!

lupyuen.github.io/articles/wif

1+
░▒▓█►─═ 𐌔Ꝋ𐌂𐌊𐌔 𐌐𐌓Ꝋ𐋄𐌙 𓂀 ═─◄█▓▒░

@lupyuen

@AmpBenzScientist You may wanna pass a word to Prof, I find his revving work very very impressive. Wish I could contribute on lmac and other parts with no sourcecode to relate to, if I manage.

1
AmpBenzScientist
Follow

@PawelK @lupyuen Nearly all of the code is available as low level C from the RE work. I'm passively working on getting the rest to even disassemble. I'll pass along the gratz and the news.

· · Tusky · 1 · 0 · 1
░▒▓█►─═ 𐌔Ꝋ𐌂𐌊𐌔 𐌐𐌓Ꝋ𐋄𐌙 𓂀 ═─◄█▓▒░

@AmpBenzScientist
Ty.

@lupyuen

0
Sign in to participate in the conversation
CleverLibre Social

CleverLibre Social is an inclusive social instance for open discussion, learning, and community.
All cultures welcome.
Hate speech and harassment strictly forbidden.

Trending now

Resources

Developers

What is Mastodon?

social.cleverlibre.org

More…

v3.5.19-qoto · Privacy policy