nawrhehe/QualcommWireless
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
23 Commits 2 Branches 0 Tags
0809b01856a1aa426f6f8f0605c9ffe06aead54d
Commit Graph
3 Commits
Author SHA1 Message Date
Erwan d152d81d79 docs: dump comprehensive research, kernel reverse-engineering and post-mortems 
- Breakthroughs & Rétro-ingénierie :
  * Création de docs/RESEARCH_AND_REVERSE_ENGINEERING.md : synthèse exhaustive
    de toutes les recherches théoriques, des contraintes matérielles du WCN7850
    (MMIO BAR0 windowing 0x310c, DMA 36-bit page mask, désactivation ASPM L0s/L1),
    de la machine d'état du protocole MHI/BHIe (bootloader 2-étapes FBC, anneaux
    CR/ER/TR, environnement d'exécution AMSS/WFW), ainsi que du reverse-engineering
    complet de l'ABI et de la vtable IO80211Controller (3728 octets, 466 entrées,
    graphe d'appels de start(), slots purs et ivars dans BootKernelExtensions.kc).
  * Création de docs/ISSUES_AND_POSTMORTEMS.md : historique détaillé et
    chronologique de l'ensemble des 9 incidents, bugs et panics rencontrés
    depuis le début du projet (erreurs de link KPI, padslot mismatch OpenCore,
    panique explicite Apple _panic("No ivars->_faultReporter"), échec RNGAgent,
    cycle Kext OSBundleRequired Network-Root, et reboots intempestifs), avec
    symptômes, analyses de cause racine, et résolutions techniques validées.
  * Mise à jour de docs/ARCHITECTURE.md : référencement croisé des nouveaux
    documents d'ingénierie et de post-mortems.

- Validation :
  * Arborescence documentaire consolidée et intègre.
  * Validation syntaxique et liens Markdown vérifiés.
 2026-10-17 20:00:22 +02:00
Erwan a10e097a7e feat(tahoe): port QualcommWireless & QualcommWifi to macOS Tahoe 26.x (Darwin 25) 
Breakthroughs & Reverse Engineering (macOS Tahoe 26.7.1 / Darwin 25.6.0):
- Reconstructed the complete 463-slot Skywalk vtable and class layout (0x128 / 296 bytes) of IO80211Controller (__ZTV17IO80211Controller at 0xffffff8002461148) and AppleBCMWLANCore from BootKernelExtensions.kc (IO80211Family 1200.13.1, source 1566.5).
- Verified IOUSBHostDevice::deviceRequest vtable slot in Tahoe's BootKernelExtensions.kc (__ZTV15IOUSBHostDevice at 0xffffff8002e72720): confirmed exact match at slot 374 (0x176, byte offset 0xbb0).
- Disassembled Tahoe's /usr/sbin/bluetoothd (FindTransportType at 0x10014c700, Found_USB_Dongle at 0x1000e9559, GetProductAndVendorID at 0x1000edf2a) confirming USB transport matching on 'Bluetooth USB Host Controller' and CSR 0x0a12 descriptor spoofing.

Code & Build Modifications (v1.1.0):
- IO80211Controller.h: Add full 463-slot Tahoe Skywalk vtable declaration (slots 394..462, offsets 0xc50..0xe70) and exact 0x80 filler size when __IO80211_TARGET >= 260000 while preserving legacy compatibility.
- QualcommWifi.hpp/.cpp: Implement Tahoe IO80211Controller pure virtual methods (isCommandProhibited, handleCardSpecific, getDRIVER_VERSION, getHARDWARE_VERSION, getCARD_CAPABILITIES, getPOWER, setPOWER, getCOUNTRY_CODE, setCOUNTRY_CODE, setGET_DEBUG_INFO, getLogger, getFaultReporterFromDriver) and guard un-reserved IONetworkController slots 6..7 on SDK 26.5.
- QualcommWireless.cpp: Add non-null vtable slot sanity check prior to installing the shadow vtable hook on IOUSBHostDevice::deviceRequest.
- project.pbxproj & Info.plist: Upgrade to Xcode 26.6 (MacOSX26.5.sdk), MACOSX_DEPLOYMENT_TARGET = 26.0, __IO80211_TARGET = 260000, and bump version to 1.1.0.
- docs & README: Document macOS Tahoe (Darwin 25) architecture, bluetoothd offsets, and Skywalk IO80211Controller ABI.
 2026-10-16 02:41:25 +02:00
nawrhehe b03b6c8197 premier push 2026-10-15 18:07:10 +02:00