NORbert: SPI bus logging and TOCTOU attacks

The two things I flagged at the end of the last post – real-time SPI command logging and a time-of-check-time-of-use primitive – are both landed on NORbert now. This post walks through how they work, shows the log wire format, and gives a reproducible TOCTOU demo against an FT4222H driving flashprog. What it looks like spi-flash-tool monitor decodes the bus in real time: TXN# COMMAND ADDRESS INFO…