Liberating Wi-Fi on the ESP32: A Deep Dive into Reverse Engineering and Open Source Development

• 0:00:23 Introduction:

  • The talk introduces Yasper and Frosty, who are working on reverse engineering the ESP32's Wi-Fi capabilities.
  • They discuss their motivations, including enabling unsupported use cases (like standard-compliant mesh networking and Apple Wireless Direct Link), improving security auditability, and enabling Wi-Fi usage with alternative programming languages and real-time operating systems.

• 0:02:12 ESP32 Overview:

  • The ESP32 is a low-cost Wi-Fi microcontroller popular among makers and engineers due to its affordability, SDK quality, and open-source nature (except for Wi-Fi and Bluetooth components).
  • There are multiple variants of the ESP32, and this work focuses on the original ESP32 variant released in 2016.

• 0:03:18 Wi-Fi Basics:

  • Wi-Fi is a wireless networking technology (IEEE 802.11 standard) that operates on a shared medium using radio communications, similar to Ethernet but without wires.

• 0:04:08 Wi-Fi on the ESP32:

  • The ESP32 uses a closed-source Wi-Fi stack from Espressif, which licenses hardware from Riviera Waves (now CEVA).
  • The upper layers of the stack are based on FreeBSD and are licensed under Apache, allowing for legal reverse engineering.

• 0:06:15 Reverse Engineering Approach:

  • The team uses both static analysis (using Ghidra) and dynamic analysis (on real hardware and in an emulator) to understand the Wi-Fi hardware's interaction with the CPU.
  • 0:09:49 Faraday Cage: A custom-built Faraday cage is used for isolating the ESP32 during testing to avoid interference from other Wi-Fi devices.

• 0:11:18 Dynamic Analysis in Emulator:

  • An emulator based on QEMU with added ESP32 Wi-Fi support allows for detailed logging and tracing of hardware register accesses.

• 0:13:09 Hardware Capabilities:

  • The ESP32's Wi-Fi hardware handles many tasks, including packet transmission, acknowledgments, and reception with linked list buffering, reducing the load on the software.
  • 0:15:18 Cryptography Acceleration: Hardware acceleration for cryptography is used for encryption and decryption in protected networks (e.g., WPA).

• 0:16:54 Introducing "Ferris on Air": An open-source asynchronous 802.11 MAC stack written in Rust.

  • 0:18:35 OSI Model: Ferris on Air operates at layer 2.5, between the hardware driver (Layer 2) and the network stack (Layer 3).
  • 0:19:32 Architecture: The architecture is mirrored to handle two virtual interfaces, with a MAC task managing frame reception and routing. An "LMC" (Lower MAC) manages channel access between interfaces.
  • 0:23:04 Current Capabilities: Scanning for networks, connecting/disconnecting, and basic data transmission/reception.
  • 0:23:33 Limitations: Rate selection and some advanced features are not yet implemented.

• 0:24:21 Future Work:

  • Implement missing features, access point mode, AWDL support, mesh operation, and potentially fine timing measurement (FTM) for indoor navigation.
  • Explore reverse engineering other ESP32 chips.

• 0:26:11 Acknowledgments:

  • The team thanks various individuals, hacker spaces, and open-source projects (Embassy, esp-hal) for their support.
  • They also thank Espressif for their cooperation and confirmation of the project's legality.

• 0:27:51 Q&A Session:

  • Covers topics like antenna usage, RX filter programmability, comparison with running Linux on ESP32, potential source code release from Espressif, project timeline, hardware calibration, debugging capabilities, compatibility with OpenWiFi, applicability to other ESP32 chips, and usage of FreeRTOS.