>Espressif's radio firmware blobs are closed source, and must run within ESP-IDF's FreeRTOS framework. It's near impossible to reverse-engineer them (not to men

>Espressif's radio firmware blobs are closed source, and must run within ESP-IDF's FreeRTOS framework. It's near impossible to reverse-engineer them (not to mention legal risks.) It's not nearly impossible, it has already been done :) Slides: https://fahrplan.events.ccc.de/congress/2024/fahrplan/media/38c3/submissions/C38ZK7/resources/38c3-final_vyLLS62.pdf https://fahrplan.events.ccc.de/congress/2024/fahrplan/media/... Video: https://www.youtube.com/watch?v=r8IqkUTGjlA https://www.youtube.com/watch?v=r8IqkUTGjlA