Wi-Fi & Radios (Drivers & Low-level Hardware): open-source projects that exist because someone reverse engineered a closed product, sorted by GitHub stars.
Turns RTL2832U DVB-T dongles into SDR receivers via reverse-engineered debug mode
Reverse-engineered open-source Wi-Fi MAC layer for the ESP32
Ham radio control library for rigs, rotators and amplifiers using vendor CAT protocols
Programming tool for many handheld and mobile radios using reverse engineered cloning protocols
Fully open firmware for Atheros AR9271/AR7010 USB Wi-Fi chips
Extract Wi-Fi channel state information from Broadcom chips via Nexmon firmware patches
GUI to configure and program cheap DMR radios on Linux and macOS
Free GSM baseband firmware for Calypso-based phones built by reverse engineering
Configuration utility for DMR radios (TYT, Baofeng, Radioddity) with reverse engineered protocols
Reverse engineering of the BL602 Wi-Fi/BLE binary blobs
Reverse engineering of the ESP32 Bluetooth controller
Open driver for Mirics MSi001/MSi2500 SDR dongles (SDRplay-type)
SEEMOO Broadcom Wi-Fi firmware analysis and patching resources
Reverse engineering the Silabs EZRadioPRO sub-GHz radios
Uses FL2000 USB-to-VGA adapters as cheap SDR transmitters
b43 firmware tools: fwcutter, assembler and disassembler for Broadcom Wi-Fi microcode
Reverse-engineered Linux driver for mobile WiMAX devices on the Samsung CMC-730 chip
Linux driver for TI ACX100/ACX111 wireless chipsets
Linux driver for Atmel at76c503/505 USB wireless adapters
Clean-room specifications of Broadcom 43xx wireless chips used to write the b43 driver
Software for the Mirics MSi2500 + MSi001 SDR chipset