Unlock hidden Superpowers in MediaTek Wi-Fi Chips
summary
Reverse engineering of MediaTek Wi‑Fi firmware on NDS32 and RISC‑V chips yields working methods to dump ROMs despite CRC checks and XOR/ AES protections, a live ROM dumper and automatic descrambler recover full firmware, and a runtime patcher injects NDS32 code into RAM; enabling ICAP mode produces raw I/Q streams from a phone or dongle and CSI capture returns subcarrier CSI on routers, all demonstrated with open‑source tools like ROM dumper and MTK‑merge.
AI-written summary · about
chapters (21)
- 0:00Introduction and motivation
- 1:52Previous research on Wi-Fi firmware
- 3:19How Wi-Fi chips communicate
- 5:54Why explore MediaTek Wi-Fi firmware
- 6:59RISC-V ISA in MediaTek chips
- 8:44MediaTek Wi-Fi firmware types
- 11:35Firmware loading process
- 13:01Kernel and firmware communication
- 14:05Firmware debugging techniques
- 17:44Basics of Wi-Fi modulation
- 20:33Radio signal processing in Wi-Fi
- 23:02Discovering IAP mode
- 24:28Enabling IAP mode
- 26:33IAP mode demonstration
- 28:01Understanding CSI in Wi-Fi
- 30:30Enabling CSI mode
- 31:35CSI mode demonstration
- 33:21Tools for firmware reverse engineering
- 36:10Lessons learned from research
- 37:16Future research directions
- 38:16Q&A session
related talks
40mYour Mediatek Wi Fi Chip's Secrets Bypassing Firmware Encryption
40mIntroduction to IoT Reverse Engineering
45mExploiting Qualcomm WLAN and Modem Over The Air
30mCommSec D1 - How to Find and Exploit Bugs in IoT Devices
24mLens Of Deceit: Unmasking And Altering Camera Sunglasses' Footage
52mIoT Hacking 101: Reverse Engineering The Xiaomi Ecosystem
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
01h 46mTutorial: Introduction to Reverse Engineering