Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

Could please someone explain, 1) if firmware is stored on a Wifi chip or rather loaded during the boot process?

2) Do apple/google have binary image from Broadcom or rather source code?

It is quite interesting how this patch production/delivery process works.

> 1) if firmware is stored on a Wifi chip or rather loaded during the boot process?

Typically it's loaded during the boot process. On Linux, see the binary blobs in /usr/lib/firmware or: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/lin...

Source: I did some work with some broadcom (wired) firmware years ago and found it to be pretty unpleasant.

http://ipxe.org/gsoc/bnx2 and https://github.com/dewyatt/bnx2-fw-utils

I worked with both QCA and Broadcom wireless, and can confirm. Generally a version of the driver is compatible with only a specific version of the firmware; the system manufacturer gets the driver source and a firmware binary as a package.