Unlocking Hidden Powers in Xtensa-Based Qualcomm Wi-Fi Chips
Extends the Nexmon firmware modification framework to Xtensa-based Qualcomm Wi-Fi chipsets, enabling custom frame injection and security research.
Summary
Closed-Source Microcontrollers in Wireless Silicon
Modern Wi-Fi chipsets rely on high-performance embedded processor cores running proprietary, closed-source firmware that restricts low-level radio manipulation.
Architecture of Qualcomm Xtensa Wi-Fi Processors
Daniel Wegemer analyzes the Xtensa processor architecture and internal firmware structures deployed inside modern Qualcomm wireless system-on-chips.
Porting Nexmon to Xtensa Firmware
Extending the open-source Nexmon patching framework to Xtensa binaries provides automated hooks and compilation toolchains to inject C code directly into wireless firmware.
Enabling Advanced Wireless Research
Custom firmware patches allow security researchers to enable monitor mode, raw packet injection, and low-level 802.11 frame fuzzing on commodity hardware.
Related talks
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Main Stage·38 min
Joseph Gabay
Reverse engineers electronic shopping cart containment wheels, capturing ultra-low-frequency and 2.4 GHz RF signals to unlock wheel braking mechanisms.
Main Stage·40 min
Jiska Classen · Alexander Heinrich
SEEMOO researchers reverse engineer Apple's proprietary U1 Ultra-Wideband (UWB) chip, analyzing its operating system, cryptographic ranging protocols, and security.