Your Mediatek Wi Fi Chip's Secrets Bypassing Firmware Encryption
summary
Complete defeat of MediaTek Wi‑Fi firmware: kernel reg_index/reg_val read/write primitives and radare2 support for NDS32 enable dumping and reverse engineering; MT7921 yields a simple XOR key and dumped 300 KB of ROM after bypassing a PDA CRC32 check via kernel-assisted CRC forgery and a ROM‑patch layout trick; MT7922 exposes a 65 KB executable window after brute‑forcing 43 PCI segments and allows recovered AES‑128 keys and live RAM patching via the set SPR callback; approach scales to later chips and produced working decryption/tools.
AI-written summary · about
chapters (17)
- 0:00Introduction and motivation
- 1:17MediaTek Wi-Fi overview
- 3:03Wi-Fi firmware and hardware basics
- 6:19MediaTek firmware structure
- 9:29Firmware loading protocol
- 12:17NDS32 instruction set architecture
- 16:52Reverse engineering challenges
- 17:35Debugging MediaTek hardware
- 20:03MediaTek 7921 chipset analysis
- 23:15Defeating firmware encryption
- 27:11User-space bypass for CRC checks
- 28:39MediaTek 7922 Wi-Fi 6E encryption
- 31:52Exploiting PCI bus mapping
- 33:39Dumping MediaTek 7922 ROM
- 35:05Wi-Fi 7 and future targets
- 37:35Future research directions
- 38:40Final considerations and Q&A
related talks
41mUnlock hidden Superpowers in MediaTek Wi-Fi Chips
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
33mBreaking Into Chips By Reading The Datasheet
45mExploiting Qualcomm WLAN and Modem Over The Air
34mPractical Side-Channel Attacks Against WPA-TKIP
24mLens Of Deceit: Unmasking And Altering Camera Sunglasses' Footage
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
40mIntroduction to IoT Reverse Engineering