This first article talking about how to start reverse engineering the Wi-Fi hardware registers was posted on the Zeus WPI blog: https://zeus.ugent.be/blog/23-24/open-source-esp32-wifi-mac/