# Announcement draft (v0.1.0) — do not post as-is

Venue plan: OpenWrt forum (Hardware / MediaTek section) first, link from
r/reverseengineering. Undersell: this is format tooling + docs + update
tracking; the deep RE comes later.

---

Subject: mtk-wifi-fw v0.1 — tooling, format docs, and a changelog for
MediaTek Connac2 WiFi firmware (mt7915/16/7981/86)

Body:

The WiFi firmware on Filogic routers ships in linux-firmware with its
version strings stripped (`fw_ver = "____000000"`) and no changelog. I've
been picking the containers apart; first release of the toolkit:

- **Extractor + ELF export** — carves `*_wm/wa/rom_patch.bin` into their
  load regions and emits EM_NDS32 ELF at true addresses, ready for Ghidra
  (official NDS32 module). Works across mt7915/7916/7981/7986.
- **Format spec + boot notes** — field-by-field container documentation
  cited to the mt76 loader source, plus how the four images (ROM patch,
  WM, WA, WED WO) load onto the three NDS32 cores.
- **Recovered version metadata** — the containers carry a second,
  kernel-unused trailer with the *full* build string (branch, MP tag, build
  timestamp). We've indexed every revision ever shipped to linux-firmware
  (54 so far, 2020→2026).
- **Version diffing** — region-aligned byte equality + string-set diffs.
  Example finding from the 2026 mt7981 build: near-total rework of the
  0xe003b000 code region, new rate-adaptation params (HT 20/40 coex), DPD
  calibration and thermal-power strings — details in the repo's reports.

No firmware bytes in the repo; tools run against your own linux-firmware
copy. Everything is tested (any blob you test must be a known upstream
revision) and CI tracks upstream weekly.

What's next: Ghidra annotation projects, the MCU command ABI map, and
eventually documentation of the WM/WA boundary. Feedback welcome,
especially from mt76 devs and anyone who's looked inside these blobs.

(link)