The MCU Under Your Fingertips: Reversing Tablet Touchscreen Controller

Modern tablet's touchscreen is not just a capacitive grid wired to a Linux driver. It contains a full 32-bit MCU running its own firmware with a command-dispatch table, interrupt handlers, and a pen-input subsystem.

The Linux kernel loads a 192 KiB blob into your tablet's touchscreen controller and moves on. The driver gets touch events and stylus input. Nobody asks what happens in between.

This talk documents the reverse-engineering of the Novatek NT36523 TDDI (Touch + Display Driver Integrated) controller firmware shipped with the Xiaomi Pad 5.

All without soldering a single wire. Binary heuristics fingerprint the ISA (Instruction Set Architecture) as NDS32 belonging to Andes Technology, a Taiwanese RISC IP licensor. Getting the firmware to actually run in emulation required extending radare2's ESIL engine with the missing NDS32 instructions, lifting coverage on this blob from baseline to 93.8%.

The result is a dynamic MMIO tracer that logs every hardware register access the firmware makes on a cold boot - surfacing the complete register map, the pen-state machine implementing Wacom Generic Protocol, and a 256-slot host-command dispatch table reachable over SPI, all cross-referenced against the mainline Linux driver's named register struct.