This material demonstrates that access to sensors and radio modules through factory firmware, production test mode, or hidden debug profile is a universal architectural component of most SoC platforms. (ChatGPT Report)

📡 A. Table of Sensors and Availability via Factory / Debug Interface

Extended technical section of the BLEIOT white-paper

This material demonstrates that access to sensors and radio modules through factory firmware, production test mode, or hidden debug profile is a universal architectural component of most SoC platforms. This does not depend on the manufacturer — the hardware testing model is a global standard in microelectronics.

📘 A.1. Extended list of SoC manufacturers with systemic factory/debug access

The following manufacturers have microcontrollers and communication SoCs with:

• factory-mode / test-mode firmware
• debug/diagnostic services (UART, USB-CDC, JTAG, SWD, proprietary “factory app”)
• access to RF subsystems, sensor modules, and advertising stack

1. Broadcom / Marvell

• Factory calibration ROM
• RF calibration, TX/RX test
• Test advertising packets
• Logs through UART
• Access to IMU/MEMS in combo-modules

2. Cypress Semiconductor (Infineon)

• Manufacturing Test Mode (MTM)
• Factory Test Application (FTA)
• Auto-start of factory mode after bootloader interrupt

3. NXP Semiconductors

• High Assurance Boot with debug window
• Manufacturing Protection Mode
• Secure advertising diagnostics

4. STMicroelectronics

• STM32WB / STM32WBA — full RF test API
• Debug UART with sensor logs

5. Espressif Systems (ESP32)

• One of the most open factory/debug interfaces
• Access to Wi-Fi, BLE, ADC, Hall Sensor, ULP CPU

6. Qualcomm Atheros

• DIAG interface
• BLE advertising control
• TX/RX Wi-Fi sweep

7. Nordic Semiconductor

• Direct Test Mode (DTM)
• Production test firmware
• Temperature, power, ADC monitoring

8. MediaTek

• Hidden AT commands
• IMU/ALS/Proximity tests
• Factory RF suite

📊 A.2. Table: sensors available in factory/debug modes in BLE/Wi-Fi SoC

Category	Sensor Types	Access	Comment
Radio modules	BLE, Wi-Fi, NFC	Always	TX/RX, RSSI, advertising
IMU / MEMS	Accelerometer, gyroscope	Often	Housing calibration
Electrical	ADC, temperature, voltage	Always	Factory tolerances
Audio	Digital/analog microphone	Often	Production QA
Biometrics	PPG/HRM	On wearables	Optical test

🔍 A.3. Significance of this table in the research

1. Factory/debug access is a global industrial standard.

All manufacturers include:

• access to sensors
• access to RF subsystems
• control of advertising modules
• auto-launch of test scenarios

2. Ways to activate factory/debug:

• hardware test pads
• UART/JTAG
• BLE Direct Test Mode
• OTA through service profile

3. Factory/debug can operate without user permission.

In this mode the device may transmit:

• movement (IMU)
• sound (microphone)
• pulse (PPG)
• RF levels
• advertising patterns

🔵 CYBER / OSINT INTELLIGENCE — SUPPORT

Support the development of BLEIOT — research in the field of BLE, IoT, RF attacks and protection from algorithmic threats.
Together we will make digital security open, honest, and globally accessible.

🔵 Support BLEIOT