How does Firmware Restoration actually work?
Apple says firmware restoration from the CD is only possible if the firmware is corrupted. How does the Mac (or its firmware) know the firmware is corrupted. Does it calculate some CRC checksum? Is there any way to launch restoration when the firmware is uncorrupted?
How does the Mac know which firmware file to load from the CD? Evidently the file is chosen by its name, or the first characters of the name. For example, the firmware file for the Mac Pro 3,1 is named MP31_006C_02B.fd. Would it be possible to create a CD with a file by the same name, but with a different content? Does the restoration check for the whole name of only for the first character.? There do not seem to be any cryptographic signature or any other checks involved.
What software or firmware on the Mac Pro controls the restoration process? How can the firmware control the process, if it is itself corrupted? Does the firmware update process maintain two identical copies of a part of the firmware, making sure that at least one of them is able to run?
On modern PC motherboards Device Firmware Update (DFU) is controlled by the Intel Management Engine. The firmware can be read from an USB drive without CPU even being present. On modern Macs
DFU mode is controlled by the T2 chip. Is the Intel Management Engine responsible for firmware restoration on older Macs? If so, where is the firmware for the Management Engine stored?
The reason I ask is because I would like to test
experimental firmware for the Mac Pro 1,1 without the
risk of bricking the Mac.