Ah, lucky that this is an Airoha target without firmware encryption.

Also there's an 010 Editor template for the firmware format if you're curious.

https://github.com/ramikg/airoha-firmware-parser