Open firmware for the Xiegu X6100

An open firmware, for years

The X6100 got a second life from the community: Oleg Belousov R1CBU and Georgy Dyuldin R2RFE wrote the R1CBU GUI, and Giovanni Ricciardi IU1WXY built on it: digital modes, Field Ops, the cluster, themes, Bluetooth. All of it under the LGPL, for anyone to read, build and improve.

Then the door closed

On 17 October 2026 IU1WXY published v0.127, the last release with its source. From v0.128 the author chose to close the firmware: binaries only, tied to a phone app and an update server of the author's own. That is the author's right. But the work that got the firmware there was open, and it deserves to stay that way.

So the open line continues

OpenX6X00 forks v0.127 and carries on where the open code stopped, under the same licence, with every author's copyright notice kept. No accounts, no app, no server to depend on: a firmware you can read, build yourself, and update straight from the radio. Maintained by RF.Guru, the makers of the VFO-Knob.

Everything that talked to a closed service or a phone is out, so nothing on the radio talks to a server of its own.

• The X6100 Link phone app and its remote API: the /link/v2 routes, the web Remote page, the GUI's remote socket, the phone voice PTT
• The wfview server
• The x6100-link.it update channel: signed packages, update alert, remote updates
• The diagnostics upload, the site ping and every other telemetry
• The private tests and tools, and the old branding

Then we made it ours: a look, menus and a network protocol that fit the rest of the RF.Guru family.

• The RF.Guru theme: near-black, gold for what is on, electric blue as the second accent; nine more themes with it
• Icon menus: the APP grid, the Modes grid and the Settings icon rail; the text menus stay as an option
• A TCI v2.0 server, so the VFO-Knob and any TCI client tune, hear and key the radio over the network
• Independent VFOs, mode from the band plan, Birdie Cal, a measured S-meter front end, Ethernet and WiFi fixes
• Own boot logo and animation, with "CQ CQ" in Morse when the boot sound is on

A security audit over our code and the upstream v0.129 GPL bundle: four reviewers plus a Codex pass. Every high and medium finding is fixed, one commit each.

• Hand-mic keys and the ATU result handled off the LVGL thread; events delivered to a closed window
• A factory-reset timer that survived a closed panel; a TCI frame-length wrap and a droppable unkey
• A DATA partition script that could format an existing partition; a boot restore that unpacked an archive over /
• WSPR stack overflow on a six-character call; JS8 messages lost in a full store; a WAV that could exhaust memory
• Saves that reported success after a failed fsync; cross-site writes to the web configurator

Each release carries a bundle of the files the GUI and the web server install, a manifest with a SHA-256 per file, and an ECDSA P-256 signature whose public key is in the image. The radio verifies it, stages the files, swaps them in with a journal while keeping the previous set, and restarts its software: about 17 seconds. The new GUI confirms itself after a minute of running; three crashes before that, and the start loop puts the previous files back on its own. A power cut mid-install is undone at the next start. Nothing installs unasked.

Four reviewers went over our code and a Codex audit over the upstream v0.129 GPL bundle. Every high and medium finding has its own commit, so each fix can be read on its own: the ones inherited from upstream, such as hand-mic keys and the ATU result handled off the LVGL thread, and the ones in what we added, such as a TCI frame-length wrap and an unkey that could be dropped. The TCI server refuses browser connections from other sites, bounds its frames, and resends an unkey until it ran.