I wasnt aware of this wifi blob. This feeds a tiny paranoia I have at the back of my head when dealing with esp32/espressif. I have dozens of esp32s around and I love them, but Espressif is 100% Chinese.<p>Im uncomfortable with what I read that every company of significant size in China automatically requires CCP party members to be involved in the company at a high level.<p>So Im very happy to hear people such as these guys are looking deep at this.<p>Ofcourse since Espressif controls the hardware, so they can do anything eventually. My itch will always be there and Im going to switch once I find something made in preferably the EU when I find something comparable to esp32. Maybe Nordic Semiconductors will make some nice risk-v chips and dev-boards soon.
The article claims that the ESP32 costs $5. The reality is around half of that for the MCU, and around $3 for pre certified modules including crystal, PCB antenna or UF-L connector. So it's really affordable.<p>Espressif has also launched a new ESP32C3 based on RISC-V, with modules priced at around $2.
The section on trying to attenuate outside wifi signals interested me.<p>There is a bunch of hand wavy information on building faraday cages online, some people suggesting to utilize a microwave oven, since they operate at the same frequency.<p>There are even wifi faraday cages for sale on amazon.<p>However I can't really find much actual benchmark data online about how well these various approaches actually attenuate signals.
For someone unexperienced with ESP32 but wanting to dip your toes, I'd highly recommend M5Stack - <a href="https://m5stack.com/" rel="nofollow noreferrer">https://m5stack.com/</a> . No affiliation whatsoever, but I started playing with some basic boards last year for the first time and the the tiny devices they build have so many different sensors, transmitters, etc that you can start with a lot of early experiments just using a single device and a USB-C cable.
I can attest to the challenges of the section on Dynamic analysis on real hardware and the struggles of attenuating signal interference on the ESP.<p>Anyone have a recommendation on conducting fabric for RF isolation as briefly mentioned in the article or resources on the subject of rf isolation/Faraday cages for microcontrollers?
…I wonder if this could be used to implement AWDL (Apple Wireless Direct Link) for use with AirDrop… if I recall correctly, the blocker on normal WiFi chipsets is being unable to send the ACK frames, which this should enable?
What kind of programmer does one need to work with ESP32? I bought jlink for stm32 thinking that's the ultimate programmer for all my needs, however it does not claim compatibility with esp32.
I think Espressif have or at least used to have their own in-house developed MAC and PHY, which is not publicly documented.<p>For the Bouffalo Lab and Beken WiFi SoCs we already have SVD files[1] for the WiFi MAC (and likely the PHY too). Thus we have nearly complete documentation for all chip registers and their bitfields. Both SoCs are based on CEVA RivieraWaves WiFi IP.<p>Also you might be able to use it as a SDR for the 2.4GHz band, there appears to be registers to send ADC data to on-chip SRAM. And USB 2.0 High Speed device functionality on some of the Bouffalo chips.<p>I was thinking of hacking it to use as a cheap uplink to the QO-100 amateur radio satellite, which uplinks in the 2.4GHz band. I think 100mW of power might be just enough for CW or some very narrowband PSK mode.<p>By the way, on the Bouffalo devices, watch out for the eFuse registers, they're not fully lockable and write protectable, one wrong register write and the <i>whole chip itself</i> can be bricked and stuck permanently in secure boot mode. It happened to me, and I'm going to try and work around it by glitching the clock input on boot, just at the right time, to disrupt the eFuse reading, just for the fun of it.<p>1. <a href="https://github.com/bouffalolab/bl_iot_sdk/blob/master/components/platform/soc/bl602/bl602_std/bl602_std/Device/Bouffalo/BL602/Peripherals/soc602_reg.svd">https://github.com/bouffalolab/bl_iot_sdk/blob/master/compon...</a>
> 50000 peripheral memory accesses are needed [to initialize the hardware]<p>Wow, that's a lot. If OP could upload somewhere the list of accesses together with a stack trace for each, I think we could crowd source a rewrite of each function - I'd be willing to bet the vast majority of those are repetitive patterns - ie. 'run this transmission test 1000 times while increasing the power levels each time until the received power = some set value'.
I picked up an ESP32 devboard recently. I've always been intrigued by embedded but don't have a background in it at all.<p>I have no idea what my first project should be. Any ideas?
> 50000 peripheral memory accesses are needed<p>Have you tried just replaying those 50,000 accesses and seeing if things work? Obviously some things might not be correctly calibrated, but merely knowing that a simple replay works tells you that there are no complex hardware/software handshakes (ie. Take random token from here and write it to there). It also tells you that the process is probably fairly timing independent.
Wouldn't this invalidate the FCC certification on the prebuilt modules? You'd have to get certified with this firmware to ensure you aren't violating transmission power requirements.<p>Admittedly, this is a non-issue for hobby scale projects, but is potentially a blocker for commercial applications.<p>I wouldn't say it's necessarily a bad thing, but worth discussion.
He should just go with stm and its open source LwMesh library instead.<p>But the closed radio parts are indeed horrible. Qualcomm (US Intelligence) and Broadcom (Chinese intelligence) controlling the physical layer underneath is as disturbing as the various Intel, AMD, ARM backdoors in their pre-OS layers.
I think bl602 shares the wifi rf/mac layer with esp32. There is a monitor mode implementation here <a href="https://github.com/stschake/bl60x-wifimon/">https://github.com/stschake/bl60x-wifimon/</a>
Just a few months ago I was thinking "surely someone must have tried to RE the ESP32 Wi-Fi stack" and tried to find some research on it, but couldn't find anything. Great work!
the esp32 also has a mask ROM (which includes BASIC for some weird reason). Hence fully deblobbing it is a hopeless battle.<p><a href="https://docs.espressif.com/projects/esp-idf/en/v4.3/esp32/api-guides/romconsole.html" rel="nofollow noreferrer">https://docs.espressif.com/projects/esp-idf/en/v4.3/esp32/ap...</a>
This is very interesting. I'm keen to get involved but, while I'm very experienced with ESP32, I don't have experience with this type of reverse engineering.<p>How long did it take you to get the environment and tools set up, so you could start digging in?<p>Is time or money a more valuable investment at this stage? If it's not too forward, how much would be useful to your organisation? (I can email if preferred.)