PrincessPi/esp-bootrom-exploit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added FPGA project and live bootrom rips

Browse Source
This commit is contained in:
Princess Pi
2024-08-24 14:52:52 -06:00
parent fc5d2edade
commit 20cb1c0dcd
76 changed files with 1626 additions and 259 deletions
Download Patch File Download Diff File Expand all files Collapse all files
espe32s3notes-exploit-dev.txt
+30 -1
View File
@@ -1,3 +1,6 @@
Entry main: 0x40043A2C
Resides in: 0x40040000 to 0x4005FFFF - 128KB - Internal ROM 1
Address space begins at: 0x3FF00000 ?
@@ -68,4 +71,30 @@ export ESPBAUD=115200; ./espdump.sh devkit; ./espdump.sh devkit; export ESPPORT=
# internal ROM1, instruction bus, 0x4004_0000 to 0x4005_FFFF, 0x1FFFF length (128KB)
#echo "\n\ninternal ROM1, instruction bus, 0x4004_0000 to 0x4005_FFFF, 0x1FFFF length (128KB)\n\n"
#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x3FF0_0000 0x1FFFF "$out_dir/live-freenove-boot-ROM1-instruction-bus-0x4004_0000-0x4005_FFF-0x1FFFF-full-address-esp32s3-$datestamp.bin"
#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x3FF0_0000 0x1FFFF "$out_dir/live-freenove-boot-ROM1-instruction-bus-0x4004_0000-0x4005_FFF-0x1FFFF-full-address-esp32s3-$datestamp.bin"
# seems to be Internal SRAM2, data-bus
segment_0 data-bus 0x3fcd7000 0x3fcd75b3
0.static_dram_start data-bus 0x3fcd7e00 0x3fcd7e03
# Internal ROM1, data-bus
0.rodata data-bus 0x3ff18c00 0x3ff1eb3b
# Inernal ROM0, instruction-bus
0.WindowVectors.text instruction-bus 0x40000000 0x4000016f
0.Level2InterruptVector.text instruction-bus 0x40000180 0x40000185
0.Level3InterruptVector.text instruction-bus 0x400001c0 0x400001c5
0.Level4InterruptVector.text instruction-bus 0x40000200 0x40000205
0.Level5InterruptVector.text instruction-bus 0x40000240 0x40000245
0.DebugExceptionVector.text instruction-bus 0x40000280 0x4000028a
0.NMIExceptionVector.text instruction-bus 0x400002c0 0x400002c2
0.KernelExceptionVector.text instruction-bus 0x40000300 0x40000305
0.UserExceptionVector.text instruction-bus 0x40000340 0x40000364
0.DoubleExceptionVector.text instruction-bus 0x400003c0 0x400003c5
0.ResetVector.text instruction-bus 0x40000400 0x4000056b
0.fixed.test instruction-bus 0x4000056c 0x40006433
0.bt_text instruction-bus 0x40006434 0x40034af1
0.text instruction-bus 0x40034af4 0x400577a7
# External
EXTERNAL 0x40058000 0x40058427