Ghidra headless analysis of Ultra/Ripple v9.2+v7.14, MeshOS v1.00-alpha+v1.0.8+v1.0.10, Aurora v0.0.6, and Tdeck-FOSS v1.0. Exported functions, string xrefs, and decompiled C for each. New ESP32-S3 ELF converter (esptool v5 compatible), Ghidra export script, and batch analysis runner. Comprehensive subsystem analysis doc covering radio, protocol, UI, storage, routing, BLE, audio, and licensing across all firmwares. Removed Meshtastic (different protocol, unrelated) and Meck (T-Deck Pro only hardware). Portable Meck patterns (journaled storage, scoped flood routing, active discovery, web OTA, serial CLI) preserved in Ghidra-Decompilation-Analysis.md. Updated comparison report to reflect removals and incorporate Ghidra findings.
14 KiB
T-Deck Firmware Comparison Report
This document provides a comprehensive analysis and feature comparison of every firmware available for the LilyGo T-Deck / T-Deck Plus, based on source code analysis and binary string extraction.
Extraction and Decompilation Summary
| Firmware | Version | Type | Functions | String Xrefs | Decompiled C |
|---|---|---|---|---|---|
| Ultra/Ripple | v9.2 | Proprietary (merged) | 5,222 | 2,263 | 5,979 KB |
| Ultra/Ripple | v7.14 | Proprietary (merged) | 4,923 | 2,212 | 5,729 KB |
| MeshOS | v1.00-alpha | Proprietary (merged) | 4,282 | 3,445 | 4,997 KB |
| MeshOS | v1.0.8 | Proprietary (app-only) | 4,646 | 3,733 | 5,423 KB |
| MeshOS | v1.0.10 | Proprietary (app-only) | 4,311 | 3,579 | 4,649 KB |
| Aurora | v0.0.6-alpha | Open Source (merged) | 6,820 | 3,690 | 6,462 KB |
| Meck | v1.5 | Proprietary (merged) | 6,604 | 4,400 | 7,129 KB |
| Tdeck-FOSS | v1.0 | Open Source (app-only) | 3,632 | 1,742 | 3,414 KB |
All binaries are stripped. Ghidra decompilation used Xtensa:LE:32:default processor with full auto-analysis. See docs/Ghidra-Decompilation-Analysis.md for detailed subsystem breakdown.
All merged binaries share an identical partition layout:
nvs(0x9000, 20KB),otadata(0xE000, 8KB),app0(0x10000, 6.25MB),app1(0x650000, 6.25MB),spiffs(0xC90000, 3.4MB),coredump(0xFF0000, 64KB)
Individual Firmware Profiles
1. Ultra T-Deck / Ripple GUI (Proprietary)
| Attribute | Details |
|---|---|
| Creator | Ripplebiz (rippleradios.com) |
| Protocol | MeshCore (proprietary mesh) |
| License | Closed source, freemium model via BuyMeACoffee |
| UI Framework | LVGL (evidence: LVGL-style UI strings in binary) |
| Build System | PlatformIO + Arduino (espressif32@3.20014, built on macOS by user "ripple") |
| Versions Analyzed | v7.14, v9.2 |
Features (from string analysis):
- Direct messaging and channel messaging (Primary Channel #0, Channels #1-#6)
- Contact management (add, remove, exchange keys, contact tags)
- GPS support (GPS Config, GPS Tracker, GPS Info, GPS Baud Rate, Append GPS Loc)
- SD Card support (Insert SD Card and reboot)
- Encryption key management (128-bit keys, public key display, key exchange)
- BLE companion support (Ripple.%s BLE naming)
- Registration system (register.rippleradios.com)
- Double ACK support
- OTA rollback capability (OTA verification strings present)
- Audio/I2S support (I2S channel strings)
- WiFi stack compiled in (ESP_ERR_WIFI strings)
- SPIFFS filesystem
- T-Deck keyboard driver (TDeckKeyboard)
- Backlight/display preferences
- MeshCore logo (PNG asset embedded)
Key Differences v7.14 vs v9.2:
- v9.2 has slightly more strings (16,291 vs 15,093), suggesting added features
- Both share identical partition layout
- Both built from same PlatformIO toolchain on macOS
2. MeshOS (Proprietary, Liam Cottle)
| Attribute | Details |
|---|---|
| Creator | Liam Cottle / MeshCore community |
| Protocol | MeshCore |
| License | Closed source, tiered licensing (store.meshcore.co.uk) |
| UI Framework | Custom terminal-style UI (ANSI color codes in strings) |
| Build System | PlatformIO + Arduino |
| Versions Analyzed | v1.00-alpha, v1.0.8, v1.0.10 |
Features (from string analysis):
- Terminal/CLI-based chat interface ("MeshCore Chat Terminal")
- Full channel system (channels 1-4, setchannel, channel info)
- Contact management with hex prefix addressing (/contacts delete c08b)
- GPS support (GPS coordinates, "No GPS lock", Set GPS)
- WiFi Control panel
- Admin password system
- Repeater administration (/repeateradmin command)
- License key system (Enter license key from store.meshcore.co.uk)
- Auto-add contacts/repeaters toggle
- Path discovery and trace packets (/getpath, /resetpath)
- Flood and direct message routing ([CHANNEL MSG -> (Flood)], [CHANNEL MSG -> (Direct!)])
- HybridMessageStore with LittleFS backend
- Advert display toggle
- Radio settings configuration
- Contact business card sharing (meshcore:// URI)
- DM retry tracking
- Low memory warnings
- Audio playback engine (ID3 v1/v2, FLAC, AAC, M3U8 playlists)
- Always-on display option
- MeshCore username configuration
- Region-based radio settings selection
- OTA support (rollback strings present)
Key Differences across versions:
- v1.00-alpha (merged, 16MB): Full flash image, largest binary
- v1.0.8 and v1.0.10 (app-only): Stripped binaries, ~19K strings each (more than alpha, suggesting feature growth)
3. Aurora (Open Source)
| Attribute | Details |
|---|---|
| Creator | Wrewdison (forge.hackers.town) |
| Protocol | MeshCore (bundled in lib/meshcore/) |
| License | Open Source |
| UI Framework | LVGL v8.3 with TFT_eSPI driver |
| Build System | PlatformIO + Arduino (espressif32@6.3.0) |
| Source | forge.hackers.town/Wrewdison/Aurora |
Features (from source code analysis):
- LVGL dark-themed UI with custom color palette
- Direct and channel messaging (up to 5 extra channels)
- Message history (500 messages stored in SPIFFS)
- Contact management (32 contacts, persistent to /contacts.bin)
- GPS support (configurable baud rate, enable/disable)
- T-Deck keyboard (I2C 0x55, debouncing, brightness control)
- GT911 touchscreen support
- 4-directional trackball with click
- SX1262 LoRa radio (915MHz, BW 250kHz, SF 10, CR 5, 20dBm)
- BLE companion (SerialBLEInterface with dynamic PIN)
- Battery monitoring with voltage-to-percent conversion
- SD card support (config export/import, .cfg/.json scanning)
- SPIFFS internal storage
- Backlight control (16-level PWM, configurable timeout)
- Telemetry (base, location, environment modes)
- RTC support (RV3028)
- Watchdog timer (15s timeout)
- No OTA support
4. MeshCore Official (Open Source)
| Attribute | Details |
|---|---|
| Creator | meshcore-dev community |
| Protocol | MeshCore |
| License | Open Source |
| UI Framework | Adafruit GFX + ST7789 (NOT LVGL) |
| Build System | PlatformIO + Arduino (espressif32@6.11.0) |
| Source | github.com/TyIsI/meshcore-dev-MeshCore |
Features (from source code analysis):
- Adafruit GFX-based display (128x64 logical, scaled to physical)
- Direct and group messaging (up to 40 channels, 350 contacts)
- Offline message queue (256 messages)
- Contact import/export
- GPS via MicroNMEALocationProvider (NMEA over Serial1, 38400 baud)
- GPS time sync to RTC (every 30 min)
- Trackball button input (MomentaryButton with long/short press)
- SX1262 LoRa radio (869.618MHz EU, BW 62.5kHz, SF 8, 22dBm)
- BLE companion (SerialBLEInterface with configurable PIN)
- Serial/USB companion interface
- Deep sleep with LoRa packet wakeup
- Battery voltage monitoring (ADC pin 4)
- SPIFFS storage
- AsyncElegantOTA (web-based OTA)
- Multiple build variants: standalone, companion_radio_usb, companion_radio_ble, repeater
- Telemetry (CayenneLPP format)
- CLI rescue mode
- MCU temperature reading
- QR code contact sharing
5. Meck (Proprietary, T-Deck Pro only -- REMOVED)
Meck targets the T-Deck Pro (A7682E 4G modem), not the standard T-Deck Plus. Binary and decompilation removed from project. Portable patterns (journaled storage, scoped flood routing, active discovery protocol, web OTA, serial CLI architecture) preserved in docs/Ghidra-Decompilation-Analysis.md.
6. Tdeck-FOSS (Open Source)
| Attribute | Details |
|---|---|
| Creator | dobrishinov |
| Protocol | MeshCore |
| License | Open Source |
| UI Framework | LVGL v8.x |
| Build System | PlatformIO + Arduino (IDF v4.4.5) |
| Source | github.com/dobrishinov/Tdeck-FOSS-firmware-Meshcore |
Features (from source + Ghidra decompilation):
- LVGL-based UI with channel and chat screens
- MeshCore channel messaging (add/remove channels, Public default)
- Contact sync from mesh
- GPS support (UART init, fix tracking, location sharing)
- T-Deck keyboard driver (I2C, key event handling)
- Shared SPI bus for radio
- LittleFS internal storage
- Encrypted DMs
- Splash screen, navigation between screens
- Smallest codebase (3,632 functions) -- focused MeshCore chat client
7. T-Deck Terminal (Open Source)
| Attribute | Details |
|---|---|
| Creator | Warren Ridley |
| Protocol | None (standalone terminal emulator) |
| License | Open Source |
| UI Framework | Custom frame-buffer rendering |
| Source | github.com/warrenridley/tdeckterminal |
Features:
- VT100/ANSI terminal emulator
- Full keyboard handling (ESP32-C3 I2C co-processor)
- Fast text rendering to ST7789 display
- No mesh networking
- No GPS
- No radio
- Useful as a reference for keyboard and display driver implementation
Master Comparison Table
| Feature | Ultra/Ripple | MeshOS | Aurora | MeshCore Official | Tdeck-FOSS | T-Deck Terminal |
|---|---|---|---|---|---|---|
| Protocol | MeshCore | MeshCore | MeshCore | MeshCore | MeshCore | None |
| Source Available | No | No | Yes | Yes | Yes | Yes |
| UI Framework | LVGL | Terminal/CLI | LVGL v8.3 | Adafruit GFX | LVGL v8.x | Custom |
| Target HW | T-Deck | T-Deck | T-Deck | T-Deck | T-Deck | T-Deck |
| MESSAGING | ||||||
| Direct Messages | Yes | Yes | Yes | Yes | Yes | No |
| Channel Messages | Yes (6 ch) | Yes (4 ch) | Yes (5 ch) | Yes (40 ch) | Yes | No |
| Message History | Yes (SD) | Yes (HybridStore) | Yes (500 msg) | Yes (256 queue) | Unknown | No |
| meshcore:// URI | Yes | Yes | No | No | No | No |
| CONTACTS | ||||||
| Contact Management | Yes | Yes | Yes (32 max) | Yes (350 max) | Yes (mesh sync) | No |
| Contact Import/Export | Yes (keys) | Yes (meshcore://) | Yes (SD card) | Yes (QR code) | No | No |
| HARDWARE | ||||||
| T-Deck Keyboard | Yes | Yes | Yes | Yes (button only) | Yes | Yes |
| Trackball | Unknown | Unknown | Yes (4-dir+click) | Yes (button) | Unknown | No |
| Touchscreen | Unknown | Unknown | Yes (GT911) | No | Unknown | No |
| GPS | Yes | Yes | Yes | Yes | Yes | No |
| SD Card | Yes (FAT) | Yes (FAT) | Yes (config I/O) | No | Unknown | No |
| Audio/Speaker | Yes (MP3 SFX) | Yes (MP3/FLAC/AAC) | No | No | No | No |
| RADIO | ||||||
| LoRa Chip | SX1262 | SX1262 | SX1262 | SX1262 | SX1262 | None |
| Radio Config UI | Freq select | CLI commands | Hardcoded | Source config | Unknown | N/A |
| ROUTING | ||||||
| Flood Routing | Yes | Yes | Yes | Yes | Yes | No |
| Direct Routing | Yes | Yes | Yes | Yes | Unknown | No |
| Path Discovery | Yes (Find Path) | Yes (/getpath, trace) | Unknown | Unknown | Unknown | No |
| Path Hash Modes | Unknown | Yes | Unknown | Unknown | Unknown | No |
| Repeater Mode | Unknown | Yes (/repeateradmin) | No | Yes (dedicated) | No | No |
| CONNECTIVITY | ||||||
| BLE Companion | Yes | Unknown | Yes (cmd protocol) | Yes (configurable) | Unknown | No |
| Serial Companion | Unknown | Yes (CLI) | Yes | Yes (USB + BLE) | Unknown | No |
| WiFi | Compiled in | Yes (WiFi Control) | No | No | No | No |
| POWER | ||||||
| Battery Monitor | Unknown | Unknown | Yes (ADC) | Yes (ADC pin 4) | Unknown | No |
| Deep Sleep | Unknown | Unknown | Yes (screen blank) | Yes (LoRa wakeup) | Unknown | No |
| Backlight Control | Yes | Yes | Yes (16-level PWM) | Yes (on/off) | Unknown | Unknown |
| SYSTEM | ||||||
| OTA Updates | Yes (rollback) | Yes (rollback) | No | Yes (ElegantOTA) | No | No |
| Filesystem | SPIFFS | LittleFS+SPIFFS | SPIFFS | SPIFFS | LittleFS | None |
| License/DRM | Yes (rippleradios) | Yes (meshcore.co.uk) | No | No | No | No |
| Telemetry | Unknown | Yes | Yes (3 modes) | Yes (CayenneLPP) | Unknown | No |
| RTC Clock | Unknown | Unknown | Yes (RV3028) | Yes (AutoDiscover) | Unknown | No |
Key Takeaways for MESHTANIC
-
Protocol: MeshCore is the target. All firmwares in this comparison (except T-Deck Terminal) speak MeshCore.
-
UI: LVGL is the clear winner. Aurora, Ultra/Ripple, and Tdeck-FOSS all use it. Adafruit GFX (MeshCore Official) is too simple. MeshOS's terminal style is functional but not user-friendly.
-
Channel Capacity: MeshCore Official supports up to 40 channels and 350 contacts, far exceeding the proprietary firmwares.
-
Audio: MeshOS has the most capable audio engine (MP3/FLAC/AAC with encrypted audio frames). Ultra/Ripple uses MP3 for notification sounds. At minimum, MESHTANIC should support notification sounds.
-
WiFi: MeshOS includes WiFi for web config. This is a high-value feature for MESHTANIC's OTA and configuration.
-
OTA: Critical gap in Aurora and Tdeck-FOSS. All proprietary firmwares support OTA. MESHTANIC must have OTA from day one.
-
Licensing: The proprietary firmwares (Ultra/Ripple, MeshOS) gate features behind registration and license keys. MESHTANIC will be completely free and open.
-
Storage: Journaled writes (
.tmp+ atomic rename, pattern documented from Meck decompilation) are the most robust approach. MeshOS's HybridMessageStore (RAM + LittleFS) is the best message persistence design. -
Routing: MeshOS has the most user-facing routing tools (/getpath, trace packets, repeater admin). Scoped flood routing and active discovery protocol patterns documented from Meck decompilation in
docs/Ghidra-Decompilation-Analysis.md. -
Best-in-Class References:
- For UI: Aurora (LVGL + MeshCore, open source)
- For Protocol: MeshCore Official (most complete open implementation, 40ch/350 contacts)
- For Storage: Meck patterns (journaled writes, documented in Ghidra analysis), MeshOS patterns (HybridMessageStore)
- For Routing: MeshOS (path discovery, repeater admin), Meck patterns (flood scoping, active discovery, documented in Ghidra analysis)
- For Keyboard: T-Deck Terminal (cleanest keyboard implementation)
- For BLE Companion: Aurora (documented command protocol via string xrefs)