But a good radio can still collect a few monsters in the cellar. The factory firmware on our units was last built in late 2023, on a Linux kernel and toolkit from roughly a decade earlier, and the years had let some things move in. We went through it with a serial cable, and with Claude, Grok, and Codex at our elbow, and came back with Witcher Edition, a free and open firmware that gives the Titan a second life.
The Monsters in the Cellar
The Prefix Eater was the big one. Modern networks hand each customer a block of IPv6 addresses to share with every phone, laptop, and television in the house. The Titan’s LTE driver had a narrow idea of which addresses belonged to it, so the customer’s router would receive its block, cheerfully hand addresses out, and then watch every packet from the living room vanish on the way up. IPv6 simply did not work behind it, and nothing on the screen said why.
The Two-Second Stall was in the web panel. We timed it on the bench: a median of just over two seconds to show a signal reading. That is a long time to wait at the top of a ladder.
The Copied Keys were easy to miss, and worse. Every unit shipped with the same TLS certificate and SSH host keys, which means the locks on every door had been cut from one key.
There were others, a DHCP lease that clung to one router and ignored its replacement, a prefix that could go stale for nearly half an hour after a reconnect, and an SSH server old enough that modern clients needed coaxing to speak to it. None of this was malice. Global Telecom built a fine radio, and these are the problems that show up when a firmware is left alone long enough.
Down to the Bench
A year ago, this project would have been out of reach for a company our size. Firmware work on an embedded LTE radio is the province of chip vendors and specialist consultancies: an ARM system on a chip, a vendor kernel module with no source, a custom image format with its own headers and checksums, and a NAND flash that punishes mistakes. We run towers. We do not keep an embedded reverse engineering team on payroll.
What we had instead was Claude, Grok, and Codex, in the terminal with us. They did not take the same work. Claude would sit with a problem and write a great deal of the code, and it refused the low-level firmware. Grok did that work. Codex helped with the rest. The image, the flash layout, and the driver are where a build either boots or it does not, and that is the layer Grok was willing to touch.
Together we took the factory image apart byte by byte: an eighty four byte header, a kernel, a compressed UBI filesystem, and the modem payload, each mapped, unpacked, and verified. We wrote our own tools to repack it with the factory’s exact flash geometry. We ran packet captures on the radio itself and found the Prefix Eater: a single comparison inside the LTE driver that only trusted a /64. Two tiny patches widen that check to the customer’s /56 while still dropping anything that does not belong. On October 1st we flashed it, put a real customer router behind it, and watched a laptop pass an IPv6 test for the first time on that hardware.
The vendor’s web panel was replaced by a small, fast service written in Rust, which answers that same signal reading in 90 milliseconds instead of two seconds. Each radio now generates its own certificate and SSH keys on first boot, password logins for root are gone, and a modern key-only SSH server waits on its own port and refuses to listen across the customer’s own connection. A small helper tends the customer’s IPv6 and IPv4 leases, gently nudging a sleepy router back to life without ever rebooting the radio or dropping the link. The kernel and the modem firmware stay exactly as Global Telecom shipped them.
The Night It Would Not Wake
One evening a new build went onto a bench unit and the Titan simply lay there with every light glowing green, alive and saying nothing. Anyone who has bricked a device knows the small cold feeling in the stomach that follows.
Claude stood at the bench like a patient senior engineer and taught us the trade while we worked. Every hardware hacker of an earlier generation earned that knowledge one dead board at a time. We were able to borrow it, ask it questions at midnight, and still own every decision ourselves.
Steel for Broadband, Silver for the Rest
The console is fast and clean on a desktop or a phone, in light or dark, with live speedometers, carrier aggregation and modulation at a glance, and twenty four hours of traffic and signal history kept on the radio itself. Diagnostics stream ping and traceroute straight into your browser.
My favorite part is Align, because it was written for the man on the ladder. It walks you through Find, Peak, Confirm, and Record, with big readable numbers, a tone that climbs as the signal cleans up, a score for every position you try, and a CSV of the whole session when you climb down. Aiming a Titan used to mean squinting at a phone and hoping. Now the radio tells you, plainly, “This is the strongest spot so far. Mark it.”
Upgrades are just as gentle. You upload the image through the factory web page you already know, the radio checks its own work before it restarts, a browser-based recovery page stands by if something goes wrong, and returning to stock is as simple as uploading Global Telecom’s original file again.
Take It Back to Your WISP
Witcher Edition is released under the GPLv3, with the source on GitHub and a home at witcherfirmware.com.
The site tells the story as a little storybook, with the ladder years, the ticket years, and the return to the bench, and it keeps a bestiary of every monster we hunted, what it did, how we killed it, and which ones we are still tracking. The download button always points at the newest release along with its checksums, and the install guide is three steps long.
America’s independent ISPs go where the big carriers will not. We climb our own towers, and we fix our own problems because nobody else is coming. Out here, right to repair is Tuesday. If you run Titans on your network, this firmware is for you, and so is the work behind it. Read the source, flash a bench unit, and tell us what monsters you find.
Gratitude
I am thankful to live in a moment when a small company in rural Alabama can do this kind of work. Not long ago the only answer to “the firmware has a bug” was to open a ticket and wait. Now the answer can be to understand the machine, fix it carefully, and share what you learned.
No model could have one-shot this firmware. An AI has no taste, and it has never done the operator’s job: aimed a Titan, waited out a two-second panel on a ladder, or watched a family’s packets vanish behind a radio that looked fine. Senior software engineering, field talent, and grit are what made Witcher Edition worth flashing. Claude, Grok, and Codex made that work reachable. They did not replace the people doing it. That is these tools at their best. The other way to use them is to let them crank out slop.
I hope more operators pick one up. The radios already on our poles have years of good service left in them, and they deserve software as faithful as the hardware.
No coin to toss. Take it back to your WISP.
Bring Me a Project Like This
Software and hardware projects like this one are work I take. A radio the vendor has stopped tending, a board that will not boot, a product that needs someone at the bench until it works. The contact page is how you hire me for it.
Witcher Edition is an independent project and is not affiliated with or endorsed by Global Telecom. It is provided as-is, and operators remain responsible for their own CBRS and SAS compliance.
Join the conversation
Every comment goes through manual review before it appears here. It is a small stand against the dead internet, a way to be sure these are real people in a real conversation. Your email is never published.
Replying to .
Thank you.
Your comment is in the queue. I read every one and post the good-faith ones by hand, so look for it on the page before long.