zacheryasc/mtk-wifi-fw
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
mtk-wifi-fw/docs/announcement-draft.md
Zachery Aaron Shores-Chmielewski b97fa9ec05
Some checks failed
ci / test (push) Has been cancelled
Details
ci / track (push) Has been cancelled
Details
v0.1.0: announcement draft, status log
2026-08-20 21:27:14 +04:00

1.9 KiB
Raw Blame History

Announcement draft (v0.1.0) — do not post as-is

Venue plan: OpenWrt forum (Hardware / MediaTek section) first, link from r/reverseengineering. Undersell: this is format tooling + docs + update tracking; the deep RE comes later.

Subject: mtk-wifi-fw v0.1 — tooling, format docs, and a changelog for MediaTek Connac2 WiFi firmware (mt7915/16/7981/86)

Body:

The WiFi firmware on Filogic routers ships in linux-firmware with its version strings stripped (fw_ver = "____000000") and no changelog. I've been picking the containers apart; first release of the toolkit:

  • Extractor + ELF export — carves *_wm/wa/rom_patch.bin into their load regions and emits EM_NDS32 ELF at true addresses, ready for Ghidra (official NDS32 module). Works across mt7915/7916/7981/7986.
  • Format spec + boot notes — field-by-field container documentation cited to the mt76 loader source, plus how the four images (ROM patch, WM, WA, WED WO) load onto the three NDS32 cores.
  • Recovered version metadata — the containers carry a second, kernel-unused trailer with the full build string (branch, MP tag, build timestamp). We've indexed every revision ever shipped to linux-firmware (54 so far, 2020→2026).
  • Version diffing — region-aligned byte equality + string-set diffs. Example finding from the 2026 mt7981 build: near-total rework of the 0xe003b000 code region, new rate-adaptation params (HT 20/40 coex), DPD calibration and thermal-power strings — details in the repo's reports.

No firmware bytes in the repo; tools run against your own linux-firmware copy. Everything is tested (any blob you test must be a known upstream revision) and CI tracks upstream weekly.

What's next: Ghidra annotation projects, the MCU command ABI map, and eventually documentation of the WM/WA boundary. Feedback welcome, especially from mt76 devs and anyone who's looked inside these blobs.

(link)