News - 19/9/2018

First 802.11aa firmware ever released! To understand how it works and to have access to patches and firmware for supporting 802.11 GAT mechanisms go here!

News - 10/10/2016

HBSS firmware released! Click here to download it and understand how to use it.

News - 29/7/2014

Localisation firmware released! Click here to download it and understand how to use it.

News - 29/5/2014

Selective Jammer firmware released! Click here to download it and understand how to use it.

News - 10/8/2010

Maranello firmware released! Download it and all the necessary kernel patches here! To begin using it read the README file in the kernel patches archive and refer to the text in the firmware source code to understand how it works.

News - 5/8/2009

We received reports about firmware problems with PCMCIA 4306/18 based cards. We are working to support them.

News - 7/21/2009

New firmware version: improved handling of phy errors. Now firmware is more stable.

News - 1/29/2009

New firmware version: the firmware is now compliant with header format 410. Firmware tested on kernel 2.6.29-rc2-wl.

News - 1/22/2009

The firmware has been tested on Linksys WRT54GL and it works fine.

Known supported boards until now: 4306, 4311(rev1), 4318 and 4320

News - 1/21/2009

New firmware version: the archive contains firmware and initvals source code. New firmware version was tested on kernel 2.6.29-rc2-wl.

News - 1/14/2009

New firmware version: firmware has been tested with WPA2-personal security mechanism (both TKIP and CCMP) and WPA-enterprise (EAP-TTLS), and seems to work correctly. Firmware was tested with 2.6.27-rc5 kernel version on a 4306 and 4318 PCI device. Please try it!
Initvals: you can download test binary initvals here. They are still under development, so we currently supply only binary images. Source code will be available as soon as possible, meanwhile please try them!


OpenFWWF, Open FirmWare for WiFi networks, is a project that wants to provide an easy and inexpensive platform to implement new Medium Access Control (MAC) mechanism, and wants to be a valid alternative to simulations and expensive ad-hoc platforms. The combination of OpenFWWF and b43 driver is a complete and cheap tool that makes testing of new MAC easy achievable.

This site provides an open source firmware for Broadcom/AirForce chipset based devices. Currently this firmware has been tested on 4306 and 4318 chipset revisions and with kernel 2.6.27-rc5 (module b43 from wireless-testing). Firmware has been developed starting from specifications in we report here some information more we discovered, such as important interactions between the MAC processor, the hardware registers and the operating mechanisms that rules data frames along the transmission and reception paths.
This project has been successfully completed thanks to the work of reverse engineering available at and to the tools that Michael Buesch makes available to the community.

What this firmware supports:

  • works in infrastructured mode as both station and AP, the latter requires hostapd
  • it is compliant with DCF access scheme in b and g modes, not tested in a bands
  • Preliminary testing shows that ad-hoc mode works as it does with proprietary firmware

What this firmware does not support:

  • does not implement RTS/CTS handshake procedure, must be disabled on module load
  • does not work with hardware cryptography acceleration, use without encryption!
  • does not work with dot11 QoS, must be disabled on module load
  • does not work with PCMCIA 4306/18 cards: we are still working to support them

You can download the firmware source code here.
Tools for compilation (b43-tools) can be found here. You can download last snapshot from the site or use git:

git clone

How to use the downloaded firmware

To obtain an executable firmware, once you have installed b43-tools, you need to type 'make' from the firmware folder.
To make the firmware work properly you need at least 2 more files that must be extracted from original Broadcom drivers: b0g0bsinitvals5.fw and b0g0initvals5.fw. To obtain these files you can follow the instructions at

in the section that refers to firmware version 4.80. You then need to put the executable firmware (ucode5.fw), and the couple of files as above, b0g0bsinitvals5.fw and b0g0initvals5.fw, into /lib/firmware/b43 folder. Remember that this firmware was only tested with the b43 driver coming with kernel version 2.6.27-rc5. To make firmware work properly type:

modprobe b43 qos=0

If you need help:

If you need help, send a message to the OpenFWWF team.

WiFi Tux



Useful links: