>Espressif's radio firmware blobs are closed source, and must run within ESP-IDF's FreeRTOS framework. It's near impossible to reverse-engineer them (not to mention legal risks.)
It's not nearly impossible, it has already been done :)
Slides: https://fahrplan.events.ccc.de/congress/2024/fahrplan/media/...