Reverse Engineering the TI SimpleLink RF MCU Black Box

Despite the popularity of low-cost RF microcontrollers, their internal RF hardware workings remain largely undocumented. This talk delves into the Texas Instruments SimpleLink family of BLE and Sub-GHz RF MCUs. While the reference manual is comprehensive, the radio section is surprisingly sparse. The presenters reverse-engineered the SimpleLink MCU's RF subsystem, explaining its operation from stack to antenna. They also reverse-engineered TI's proprietary RF patch format and investigated the hidden DSP modem cores, potentially opening the door for a cheap single-chip SDR.