Comment by biosboiii

>Espressif's radio firmware blobs are closed source, and must run within ESP-IDF's FreeRTOS framework. It's near impossible to reverse-engineer them (not to mention legal risks.)

It's not nearly impossible, it has already been done :)

Slides: https://fahrplan.events.ccc.de/congress/2024/fahrplan/media/...

Video: https://www.youtube.com/watch?v=r8IqkUTGjlA