Realtek WiFi Firmware and a Fully 8051-based Keylogger Using RealWOW Technology

submited by

Style Pass

2021-07-05 18:00:02

In the previous blog post, I looked at the EC firmware in my laptop. This time I will look into the WiFi firmware of the same laptop.

The wifi chip is located on a m.2 module that can be swapped out in my laptop. It has features like 2.4GHz and 5GHz wifi support and stuff. Communication with the wifi chip happens over PCIe.

Finding the firmware is easy: it is loaded at startup from /lib/firmware/rtlwifi on startup on Linux. There are actually two sets of firmware: one for normal usage (rtl8821aefw_29.bin) and one slightly smaller for Wake on Wlan (rtl8821aefw_wowlan.bin), a technology for waking devices over wifi. The ..._29.bin gets loaded on ip link set dev wlan0 up, the ..._wowlan.bin gets loaded on ip link set dev wlan0 down. They are not permanent firmwares but merely loaded into the RAM of the chip.

The chip also has an upstreamed wifi driver in the Linux kernel written by realtek. That does not say much about its quality, as it is still a driver written by realtek.