Service
Embedded control software review
For sites that run custom or lightly forked firmware on gateways, RTUs, and edge computers, we review the software that interprets commands and drives outputs.
Many IoT control stacks look tidy in the cloud console and messy on the device. This review covers the application image, boot scripts, local rule engines, and any vendor “edge logic” that can act without a round trip to a server.
We ask for a representative device (or a golden image), the bill of materials for libraries, and the procedure used to sign and load updates. Where source is available under NDA, we read command handlers, watchdog behaviour, and how the device treats clock skew, duplicate sequence numbers, and truncated payloads. Where source is not available, we work from configuration, serial consoles, and observed traffic.
Findings usually cluster around unsigned update channels, debug shells left on production images, hardcoded broker credentials, and local fallback modes that ignore the same access rules the cloud UI claims to enforce.
The deliverable is a device-software note: what the image can do without the cloud, how it is updated, and which of those abilities should be constrained before the next production window.