Entry main: 0x40043A2C
Resides in: 0x40040000 to 0x4005FFFF - 128KB -  Internal ROM 1
Address space begins at: 0x3FF00000 ?

list available machines:
	/home/kali/.emulate-debug/qemu-xtensa/bin/qemu-system-xtensa -machine help
	/home/kali/.emulate-debug/qemu-riscv/bin/qemu-system-riscv32 -machine help
emulate esp32s3:
	/home/kali/.emulate-debug/qemu-xtensa/bin/qemu-system-xtensa -machine esp32s3
emulate riscv:
	/home/kali/.emulate-debug/qemu-riscv/bin/qemu-system-riscv32 -machine esp32c3

espressif gdb
	/home/kali/.emulate-debug/binutils-gdb/gdb/gdb --help
	/home/kali/.emulate-debug/binutils-gdb/gdb/gdb -l 300 # set timeount to 300 seconds

exploit_dev folder:
	/home/kali/sync/esp32s3-boot-rom-elf-uni.rep/exploit_dev/
.emulation-debug folder:
	/home/kali/.emulate-debug/

esptool.py --chip esp32s3 elf2image --use_segments esp32s3_rev0_rom.elf
	--output bin_file_name.bin
	--flash_size 8MB 
	--pad-to-size 8MB

ROM Elfs:
	./esp-rom-elfs-20230320

	https://github.com/espressif/esp-rom-elfs/releases/tag/20230320

	Full version in ROM ELF's filenames (major * 100 + minor). E.g:
	esp32_rev300_rom.elf is for version 3.0
	esp32c3_rev3_rom.elf is for version 0.3
	Fix esp32c2 revision to 1.0


todo:
 x reinstall esp-idf fucking again to test the reinstall script
 - run dump on freenove fuckin again (twice) with latest for testing and final binutils
 - run dump fuckin twice on another esp32s3 for compare
 - save the shit and back the shit up
 - add and push git projects
  - document lmfao
 - study the fuck out of cuork's c3 exploit
 - get on that fuckin binary exploit lmfao

== scratch ==

# running on byobu:
export ESPBAUD=115200; ./espdump.sh devkit; ./espdump.sh devkit; export ESPPORT=/dev/ttyACM1; ./espdump.sh freenove; ./espdump.sh freenove;

#dump_section "internal-ROM0" "instruction-bus" 0x4000_0000 0x4003_FFFF $chip



#dump_section "internal-ROM1" "data-bus" 0x3FF0_0000 0x3FF1_FFFF $chip

#dump_section "internal-ROM1" "instruction-bus" 0x4004_0000 0x4005_FFFF $chip

# internal ROM0, instruction bus, 0x4000_0000 to 0x4003_FFFF, 0x3FFFF length (256KB)
#echo "\n\ninterenal ROM0, instruction bus, 0x4000_0000 to 0x4003_FFFF, 0x3FFFF length (256KB)\n\n"
#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x4000_0000 0x3FFFF "$out_dir/live-freenove-boot-ROM0-instruction-bus-0x4000_0000-0x4003_FFFF-0x3FFFF-full-address-esp32s3-$datestamp.bin"

# internal ROM1, data bus, 0x3FF0_0000 to 0x3FF1_FFFF, 0x1FFFF length (128KB)
#echo "\n\ninternal ROM1, data bus, 0x3FF0_0000 to 0x3FF1_FFFF, 0x1FFFF length (128KB)\n\n"
#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x3FF00000 0x1FFFF "$out_dir/live-freenove-boot-ROM1-data-bus-0x3FF0_0000-0x3FF1_FFFF-0x1FFFF-full-address-esp32s3-$datestamp.bin"

# internal ROM1, instruction bus, 0x4004_0000 to 0x4005_FFFF, 0x1FFFF length (128KB)
#echo "\n\ninternal ROM1, instruction bus, 0x4004_0000 to 0x4005_FFFF, 0x1FFFF length (128KB)\n\n"
#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x3FF0_0000 0x1FFFF "$out_dir/live-freenove-boot-ROM1-instruction-bus-0x4004_0000-0x4005_FFF-0x1FFFF-full-address-esp32s3-$datestamp.bin"