[exikyut]

My understanding was that it sat between the BMC and its boot flash and (assuming it was real) was designed to bit-twiddle regions of the firmware as it flew past over SPI. So basically streaming strpos() (or maybe even counting bytes) and then sending some alternate sequence of data.

That would require some processing chops to handle whatever speed the SPI bus ran at, and a bit of space to store the replacement bytes. Firmly within the margin for plausibility with even basic off-the-shelf kit. Honestly depressing really.