For enthusiasts the firmware was both map and riddle. Extract it, and you found filesystem snapshots—BusyBox utilities stitched together in minimalistic harmony, shell scripts that ran at boot, and blobs of vendor code that managed radio calibration tables. There were signs of lineage: open-source components dancing beside proprietary drivers, the echo of a common SoC vendor in the driver symbols. The web UI was a thin veneer: HTML pages and javascript handlers that hid a REST-like backend and, occasionally, undocumented endpoints that glowed with possibility. A repaired upload script, a coaxed shell, and suddenly the device surrendered small freedoms: custom DNS, firewall rules beyond the GUI’s timid options, or the ability to keep a log that spanned days rather than minutes.