Dive into a 40-minute conference talk from the 38th Chaos Communication Congress (38C3) that uncovers the hidden workings of RF microcontrollers, specifically focusing on the TI SimpleLink family of BLE and Sub-GHz RF MCUs. Learn how researchers reverse engineered the proprietary RF patch format and decoded hidden DSP Modem cores, revealing previously undocumented capabilities of these widely-used chips. Explore the complete RF subsystem architecture from stack to antenna, understand how to modify RF subsystem behavior, and discover the potential for creating a cost-effective single-chip SDR. Gain insights into circumventing the limitations of vendor-provided APIs and secret ROMs, enabling new possibilities for custom RF applications beyond the standard BLE protocol.