From b97fa9ec05e2c463aa9b8db0b02c1b6af92c134e Mon Sep 17 00:00:00 2001 From: Zachery Aaron Shores-Chmielewski Date: Thu, 20 Aug 2026 21:27:14 +0400 Subject: [PATCH] v0.1.0: announcement draft, status log --- PLAN.md | 9 +++++++++ docs/announcement-draft.md | 41 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 50 insertions(+) create mode 100644 docs/announcement-draft.md diff --git a/PLAN.md b/PLAN.md index 5acbde7..5c7ce6f 100644 --- a/PLAN.md +++ b/PLAN.md @@ -99,6 +99,15 @@ router-dependent. router LAN / join `zach` WiFi from devuan-hpz (key + likely MAC-whitelisted, but changes this machine's network path mid-session). +- 2026-08-20 (later): MVP v0.1 complete. All 9 worklist steps: scaffold, + parser correctness (hidden trailer = recovered version metadata), + dataset-driven golden tests, ELF emitter (readelf-validated; Ghidra + open-check deferred to Ghidra bring-up — deviation noted), 54-revision + dataset, diff engine + 3 pilot reports (2026 build: 0xe003b000 region + ~95% changed, new RA/DPD/thermal strings), docs (format/boot), CI + (push + weekly track), v0.1.0 tagged. Announcement drafted, not posted — + hosting decision still open. + ## Open items - Repo name + hosting (GitHub reach vs Codeberg/self-hosted Forgejo; diff --git a/docs/announcement-draft.md b/docs/announcement-draft.md new file mode 100644 index 0000000..fd35b9c --- /dev/null +++ b/docs/announcement-draft.md @@ -0,0 +1,41 @@ +# Announcement draft (v0.1.0) — do not post as-is + +Venue plan: OpenWrt forum (Hardware / MediaTek section) first, link from +r/reverseengineering. Undersell: this is format tooling + docs + update +tracking; the deep RE comes later. + +--- + +Subject: mtk-wifi-fw v0.1 — tooling, format docs, and a changelog for +MediaTek Connac2 WiFi firmware (mt7915/16/7981/86) + +Body: + +The WiFi firmware on Filogic routers ships in linux-firmware with its +version strings stripped (`fw_ver = "____000000"`) and no changelog. I've +been picking the containers apart; first release of the toolkit: + +- **Extractor + ELF export** — carves `*_wm/wa/rom_patch.bin` into their + load regions and emits EM_NDS32 ELF at true addresses, ready for Ghidra + (official NDS32 module). Works across mt7915/7916/7981/7986. +- **Format spec + boot notes** — field-by-field container documentation + cited to the mt76 loader source, plus how the four images (ROM patch, + WM, WA, WED WO) load onto the three NDS32 cores. +- **Recovered version metadata** — the containers carry a second, + kernel-unused trailer with the *full* build string (branch, MP tag, build + timestamp). We've indexed every revision ever shipped to linux-firmware + (54 so far, 2020→2026). +- **Version diffing** — region-aligned byte equality + string-set diffs. + Example finding from the 2026 mt7981 build: near-total rework of the + 0xe003b000 code region, new rate-adaptation params (HT 20/40 coex), DPD + calibration and thermal-power strings — details in the repo's reports. + +No firmware bytes in the repo; tools run against your own linux-firmware +copy. Everything is tested (any blob you test must be a known upstream +revision) and CI tracks upstream weekly. + +What's next: Ghidra annotation projects, the MCU command ABI map, and +eventually documentation of the WM/WA boundary. Feedback welcome, +especially from mt76 devs and anyone who's looked inside these blobs. + +(link)