At the 38c3 conference, a presentation was given about reverse engineering the firmware and command system of TI SimpleLink chips (CC13XX and CC26XX) with BLE (Bluetooth Low Energy) support, which allowed for the implementation of an FM receiver. An analog transmitter may not be feasible as the chips are purely digital.
The chips use DSP, while the main ARM Cortex core controls the RF Core Arm Cortex-M0, which provides the main core with a limited message-based interface. The memory of the RF core can be modified using patches that allow changes to the behavior of the radio subsystem. The chip manufacturer offers modules for supporting various wireless protocols, implemented using dynamic libraries and memory patches (similar to those used in Broadcom chips, currently owned by Cypress). In turn, the RF core manages a DSP with a specific architecture.
The researchers who presented the report recreated a proprietary RF patch format and demonstrated how to prepare custom patches to add support for new wireless protocols (for example, an FM receiver was implemented), manage the wireless subsystem, and replace the firmware. The toolkit for creating and uploading patches, as well as the assembler for the command set used in the DSP, has been published under the MIT license. Currently, the repository does not contain the source code for the firmware that implements the analog receiver.
Source: opennet.ru
