it's pretty easy to dump an SPI chip and some vendors/customers routinely do so. In this model, the implant basically contains a binary patch that is injected

it's pretty easy to dump an SPI chip and some vendors/customers routinely do so. In this model, the implant basically contains a binary patch that is injected at boot time over a segment of the BMC binary - counter overflows, chip cuts out the SPI and transmits its payload instead. After the payload is injected the implant goes dormant again/resumes passing through the SPI, so dumping the ROM after boot, or even physically clipping onto the SPI chip will not reveal the wu-tang secret.