reverse engineering News - CNX Software

July 15, 2026July 15, 2026 by Jean-Luc Aufranc (CNXSoft) - 7 Comments

Reverse-engineering brings RK3576 NPU support to open-source Rocket driver for mainline Linux

Back in 2024, we noted that the open-source driver for RK3588’s NPU by Tomeu Vizoso delivered decent performance for object detection. Since then, good progress has been made, and it’s now known as the Rocket driver in mainline Linux. However, the Rockchip RK3576 SoC is not supported by the Rocket driver in mainline yet, despite sharing a similar NPU. The good news is that Ga Hing Woo has been working on mainline Linux support for the Rockchip RK3576 NPU using the Rocket driver stack and has tested the updates on the Radxa ROCK 4D running Linux 7.1-rc5. This required some serious reverse-engineering work due to hidden registers not documented in the TRM. Ga Hing Woo (also written as Jiaxing Hu) sent us an email explaining some of the challenges: Single int8 convolution now comes out byte-exact against a CPU reference on the open stack. Getting there meant reverse-engineering the compute […]

May 26, 2026May 26, 2026 by Jean-Luc Aufranc (CNXSoft) - 1 Comment

WCH BLE Analyzer Pro USB Bluetooth LE sniffer gains Linux software with Wireshark (pcap) support

Last November, we wrote about the WCH BLE Analyzer Pro, an inexpensive (~$20) USB Bluetooth LE sniffer and analyzer, which looked useful and good value for reverse engineering and debugging. One downside is that the WCH BLE Analyzer software was only made for Windows 7 to 11, but Xecaz decided to look into it and reverse-engineered the USB protocol to write Linux software using libusb that outputs a standard pcap compatible with popular tools such as Wireshark, or as he puts it: “WinChipHead forgot to ship a Linux driver. We forgot to ask permission.” As a reminder, the BLE Analyzer Pro features three CH582F Bluetooth LE RISC-V microcontrollers and a CH334 USB hub, supports Bluetooth Low Energy (BLE) 4.0/4.2/5.0, and connects to the host through its USB-C port. The Linux “driver” for the BLE Analyzer Pro tool can be found on GitHub. Building and installing the software is quick and […]

March 10, 2025 by Jean-Luc Aufranc (CNXSoft) - 13 Comments

Hidden proprietary Bluetooth HCI commands in ESP32 microcontroller could pose a security risk

Security is hard. Just as Espressif Systems announced PSA Level 2 for the ESP32-C6 microcontroller, Spain-based cybersecurity company Tarlogic published their findings about a hidden Bluetooth functionality that can be used as a backdoor in the previous generation ESP32, and gave a presentation in Spanish at Rootedcon 2025. Specifically, they found hidden proprietary Bluetooth HCI (Host Controller Interface) commands used to read & write controller memory, and typically used for debugging. However, they could also facilitate supply chain attacks, the concealment of backdoors in the chipset, or the execution of more sophisticated attacks. Tarlogic initially called it a “backdoor”, but some disputed the claim (more on that later), and the company eventually issued an update downgrading it to a “hidden” feature: We would like to clarify that it is more appropriate to refer to the presence of proprietary HCI commands—which allow operations such as reading and modifying memory in the […]

January 7, 2025January 6, 2025 by Jean-Luc Aufranc (CNXSoft) - 4 Comments

FOSDEM 2025 schedule – Embedded, Open Hardware, RISC-V, Edge AI, and more

FOSDEM 2025 will take place on February 1-2 with over 8000 developers meeting in Brussels to discuss open-source software & hardware projects. The free-to-attend (and participate) “Free and Open Source Software Developers’ European Meeting” grows every year, and in 2025 there will be 968 speakers, 930 events, and 74 tracks. Like every year since FOSDEM 2015 which had (only) 551 events, I’ll create a virtual schedule with sessions most relevant to the topics covered on CNX Software from the “Embedded, Mobile and Automotive” and “Open Hardware and CAD/CAM” devrooms, but also other devrooms including “RISC-V”, “FOSS Mobile Devices”, “Low-level AI Engineering and Hacking”, among others. FOSDEM 2025 Day 1 – Saturday 1 10:30 – 11:10 – RISC-V Hardware – Where are we? by Emil Renner Berthing I’ll talk about the current landscape of available RISC-V hardware powerful enough to run Linux and hopefully give a better overview of what to […]

July 23, 2024November 24, 2025 by Jean-Luc Aufranc (CNXSoft) - 6 Comments

tinySniffer WiFi-connected USB sniffer is based on NanoPi NEO Air SBC

TinySniffer is a USB sniffer based on the Allwinner H3-powered NanoPi Neo Air SBC, designed to capture USB 1.x and 2.0 packets remotely, and whose captured data is compatible with the popular Wireshark packet analyzer tool. Wireshark can already be used to capture USB packets on its own, and I reverse-engineered a USB video capture solution that way in the past, but this method has some limitations; for instance, it does not capture some low-level USB packets, in which case a hardware USB sniffer like Total Phase Beagle USB, the PhyWhisperer USB, or the tinySniffer is required. The micro USB OTG port of the NanoPi NEO Air SBC is connected to the host computer, and the company added a USB 2.0 Type-A port connected to the USB interface on the GPIO header to connect a device under test, such as a USB keyboard, a USB Ethernet dongle, a USB printer, […]

April 21, 2024April 21, 2024 by Jean-Luc Aufranc (CNXSoft) - 16 Comments

Rockchip RK3588’s NPU open-source driver performs object detection at 30 FPS

Tomeu Vizoso has been working on an open-source driver for NPU (Neural Processing Unit) found in Rockchip RK3588 SoC in the last couple of months, and the project has nicely progressed with object detection working fine at 30 fps using the SSDLite MobileDet model and just one of the three cores from the AI accelerator. Many recent processors include AI accelerators that work with closed-source drivers, but we had already seen reverse-engineering works on the Allwinner V831’s NPU a few years ago, and earlier this year, we noted that Tomeu Vizoso released the Etvaniv open-source driver that works on Amlogic A311D’s Vivante NPU. Tomeu has now also started working on porting his Teflon TensorFlow Lite driver to the Rockchip RK3588 NPU which is closely based on NVIDIA’s NVDLA open-source IP. He started his work in March leveraging the reverse-engineering work already done by Pierre-Hugues Husson and Jasbir Matharu and was […]

March 28, 2024March 27, 2024 by Jean-Luc Aufranc (CNXSoft) - 2 Comments

LoLRa project – Transmitting LoRa packets without radio using CH32V003, ESP8266, or ESP32-S2 MCU

The LoLRa project is a firmware-only LoRa transmission open-source project that works without a Semtech radio and instead relies on an I2S or SPI interface (so not exactly bit-banging) to transmit data with microcontrollers such as WCH CH32V003, or Espressif Systems ESP8266 and ESP32-S2 microcontrollers. LoRa is a proprietary protocol by Semtech, but people have been trying to reverse-engineer the LoRa PHY for years, and this culminated with a LoRa GNU Radio SDR implementation last year. But CNLohr found out you don’t even need a radio to send LoRa packets and you can instead use SPI or I2S interfaces from general-purpose microcontrollers to send packets that can be decoded by commercial off-the-shelf LoRa gateways and other chips. The current implementation is designed for the ITU Region 2 (aka The Americas) targeting the 902-928MHz frequency band, but the code could be changed for Region 1 (EU, Russia, Africa) to target 863-870MHz […]

December 8, 2023December 7, 2023 by Jean-Luc Aufranc (CNXSoft) - 9 Comments

ESP32 may soon get an open-source WiFi MAC layer

Most, if not all, WiFi hardware relies on closed-source binary blobs including ESP32 wireless MCU, but there’s now work underway to reverse engineer a WiFi MAC layer for the ESP32 to make it a truly open-source platform. Espressif ESP32 wireless microcontrollers already have an open-source framework (ESP-IDF) and toolchain, people can customize the code to some extent, but this excludes the wireless bits (Wi-Fi, Bluetooth, low-level RF functions) that are distributed as closed-source precompiled libraries integrated into the firmware. There were some efforts to provide an open-source stack for the BL602 chip but it never went anywhere, and the ESP32 may become the first target with an open-source driver without any blobs, excluding FPGA-based projects such as OpenWiFi. The early-stage implementation currently supports the following features: Sending WiFi frames Receiving WiFi frames Send an ACK packet as a reply to packets that are sent to the ESP32 Connect to an […]