Genie 1155 iDCM board: Marvell MW300 WiFi module reprogramming and local control

This garage opener has WiFi connectivity, but it appears that it is too old to work with the manufacturer's app.
Oh well, I want local control anyway. Let's see if we can reprogram it.

The opener has two circuit boards: the main board and an add-on board, the iDCM board.

The main board contains the power supply, motor control, radio interface
for the wireless remotes, and wall console connector. This is controlled by a PIC16
MCU.

The iDCM board is the interesting one, this is an add-on board to provide WiFi functionality.
It contains a Marvell MW300 WiFi module with a single-core ARM Cortex-M4F
CPU. It also has another PIC16 microcontroller.

Component	Description
J3	Cortex UART header (compatible with TagConnect TC2030-PKT cable)
J7	Cortex Debug JTAG/SWD header (compatible with TagConnect TC2050-IDC-050 cable)
J8	ICSP interface for the PIC16
U6	Marvell MW 300 WiFi module
U10	PIC16LF15355 microcontroller

There are also two LEDs, two push buttons and a buzzer.

The MW300 module handles all the WiFi networking, whereas the PIC16
controls the LEDs, buzzer and door control (via a connection to the main
board's MCU). The PIC16 and the MW300 are connected via serial port
(UART1 on the MW300) with a full-duplex message protocol.
This protocol also has a facility to update the firmware of the PIC16.

The MW300 module is likely identical to the NXP 88MW320.
It sports 512 kB SRAM, 4 MB flash (XIP capable), and 802.11b/g/n WiFi interface.
A datasheet can be obtained from NXP, as well as a development board.

Using JTAG/SWD, the flash chip can be read and written, so you can write your own.
An aftermarket firmware has been developed: Sesame