upvote
at least from whatever's been published, a good chunk of NSA's tools exploit low level firmware bugs like this...

also wondering how great my Asrock firmware is vs. say the bog standard Lenovo (i assume Apple is the one company that's expended significant thought into locking this process down)

reply
Worse is how little information exists on firmware or how development for firmware works.

Its certainly not something regularly taught in higher education.

reply
In a past life I held the title Firmware Engineer. The day-to-day development process did not differ from subsequent positions as a Software Engineer. Write-Compile-Test-Repeat. Then put it up for review so your colleagues can skewer it, or, on rare occasion, offer considerate and thorough feedback.

Firmware development is indeed taught in higher education. But not under the name "Firmware". It will be an "embedded systems" course or series of courses. At least in my experience, those courses are run by the Electrical Engineering department and the average Computer Science student stays far away from them.

reply
How do you test stuff that's deployed to firmware? At least when it comes to normie software your Linux or Mac box resembles the server you deploy to. And you can close the distance quite a bit with Docker.

But firmware? Totally different. FreeRTOS does have a POSIX backend, which helps some. Maybe you can run it under a hardware emulator. But it seems like lots of the stuff you want to test isn't really testable from the perspective of what a typical dev knows.

A lot of firmware dev iteration seems to be build -> flash -> watch serial connection for debug prints.

reply
> A lot of firmware dev iteration seems to be build -> flash -> watch serial connection for debug prints.

Serial port? Maybe for the fancy folks. Us lunch-pail types would find an unused GPIO, blue-wire an LED, and blink out a code of your choosing.

Okay, I never actually had to blink an LED but it was in my bag of tricks. The real golden-ticket to debugging embedded devices was a development kit with JTAG. JTAG, coupled with expensive additional hardware and equally expensive software license, gave you a gdb-like interface for debug. Breakpoints, stack traces, all the good stuff you take for granted when working with Windows, Linux, or those ugly abominations we call web browsers.

Emulators were also a thing, especially if your product had a custom ASIC and you needed pre-silicon development. But I didn't use them a lot myself and it seemed like by the time you had your emulation environment setup, there was 1st gen silicon and a debug board sitting at your desk.

reply
I'm not a firmware dev but the one's I've seen working usually have all sorts of fancy test kits, debug instrumentation, Software (chip scope?), etc. to debug with, not just relying on print debugging.

Not to say it isn't a valid way to debug, but there are definately better options available.

reply
As someone in the security field, who is currently in a security degree program...I have a major overlap with the EE and computer engineering degree requirements.

Iv dabbled in some basic MIPS assembly and some microcontroller programming but don't consider that as complicated as boot level firmware or say the firmware that controls complex stuff.

I view embedded as the closest I will ever get to actual hardware engineering and it shocks me how complex everything is.

reply
If you're curious go walk through the bootloaders of an embedded platform, they serve roughly the same role as firmware that implements UEFI on traditional x86 systems.

Example, start with bl1 (first stage boot loader) for a Rasberry Pi here:

https://github.com/raspberrypi/arm-trusted-firmware

The Pi's hardware (register map, etc) is well documented so it's a good way to learn this stuff.

reply
Maybe not on compsci? but when I did electronic engineering it was covered as part of our embedded systems course.

There’s quite a lot of info out there on UEFI, and tiano core is open source. I taught myself enough to implement a small game you had to solve to be able to boot your machine, for example :)

reply