The Long Road Towards Reverse Engineering The ESP32 Wi-Fi Driver

Although much of the software that runs on the ESP32 microcontroller is open source, the Wi-Fi driver is not. Instead, it uses a proprietary binary blob. This was no problem for [Jasper Devreker]’s reverse-engineering of the ESP32’s Wi-Fi stack so far until he came face to face with reverse-engineering the initialization of the Wi-Fi peripheral. As it turns out, there is a lot of work involved after you call esp_phy_enable in the Espressif binary blob, with the team logging 53,286 peripheral accesses during the initialization phase. In comparison, sending a Wi-Fi packet takes about ten calls.

Currently, the way that the initialization step is handled is by having the initialization routine in the binary blob do its thing by configuring the radio and other elements before killing the FreeRTOS task and replacing it with their own version. The team is actively looking for a clean approach for moving forward that will avoid simply writing everything from scratch. For the Wi-Fi MAC, existing code (e.g., FreeBSD’s stack) could be used, but the radio code is much more of a headache. Clearly, there’s still a lot more work to be done in order to get a fully open-source Wi-Fi MAC and stack for the ESP32, but having the community (that’s you) pitch in might speed things up if there’s demand for an open-source driver.

[Jasper’s] been working on this for a while. He’s even built a Faraday cage to make the task easier.

16 thoughts on “The Long Road Towards Reverse Engineering The ESP32 Wi-Fi Driver

  1. Heads up that this may have ramifications for radio spectrum licensing. Often these blobs are proprietary because of vague certification reasons. Some channels should not be used in various geographies etc. The way I think it works is that the company which sells radio components sell them together with a radio blob and won’t make any guaranteess if you run the hardware with any other software than their own.

  2. I may be wrong but, I don’t believe people want to change the specs – there would be no point. They just want to know what’s in the code. And if the code is open to scrutiny : it’s verifiable.

    It’s an open standard so there’s no competitive advantage to having a proprietary blob.

    1. Author here: I don’t want to change the spec, but the ESP32 does not implement 802.11s standards-compliant mesh networking, and I would like to use that. If there is open-source code, that is possible.

      And indeed, security is also a major factor (but there could still be silicon vulnerabilities/backdoors)

      1. Jasper, you are my hero. Anxiously I refresh your blog for many months, hoping on an update.

        Your work will liberate so many devices, it will bring joy and happiness. Please keep up the good work!!

    2. “People” is a very broad brush. There will be “people” interested in doing and not doing any given detail. The opensource ability to be verifiable because its open is also vastly overstated. There are vanishingly small numbers of people that have any clue what their look at when it comes to code, hardware code, and then security related code, mentioned in decreasing prevalence.

      A large number of people just want to feel comforted that a hypothetical someone, though still probably not themselves, could change it if they really wanted to.

      1. What a depressing comment. Sadly it seems to be somewhat true. The number of open source developers appear to be dwindling. Next generation devs seem to be more interested in tiktok and gaming.

        No more itches to scratch, no desire for freedom… Sad.

        But then people like Jasper give us hope still!

  3. The public facing competitive advantage is by taking care of the expensive certification process in global markets costs are decreased for mid/low volume customers buying >5k parts a year.

    The internal reason is that no one wants to show you how the sausage gets made.

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.