diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ES32-S3_Exploit_UART.v b/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ES32-S3_Exploit_UART.v deleted file mode 100644 index 374cd01..0000000 --- a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ES32-S3_Exploit_UART.v +++ /dev/null @@ -1,75 +0,0 @@ -module exploit -( - // exploit - input clk_in, - output bang_tx, - output power_tx, - output [5:0] led -); - -////////// EXPLOIT -localparam INSTRUCTION_OFFSET = 100; - -// da official exploit code -localparam EXPLOIT_BYTES = {16'hFA,16'hEB,16'h11,16'hDD}; - -localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed - -localparam LEDS_ON = 0; -localparam LEDS_OFF = 6'b111111; - -reg [1:0] bang_tx_reg = 0; -reg [1:0] power_tx_reg = 1; -reg [1:0] led_run = 1; -reg [1:0] rst = 0; -reg [1:0] running = 1; -reg [5:0] ledCounter = 0; -reg [23:0] instruction_counter = 0; -reg [23:0] exploit_tx_count = 0; -reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES; - -always @(posedge clk_in) begin - if(rst == 1) begin - running = 1; - power_tx_reg = 1; - rst = 0; - end - - if(instruction_counter == INSTRUCTION_OFFSET) begin - power_tx_reg = 0; - rst = 1; - end - - if(running == 1) begin - if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin - bang_tx_reg <= exploit_bytes_reg[exploit_tx_count]; - exploit_tx_count <= exploit_tx_count + 1; - led_run <= 1; - end else begin - led_run <= 0; - end - - if(led_run == 1) begin - ledCounter <= ledCounter + 1; - if(ledCounter == LEDS_OFF) begin - ledCounter <= LEDS_ON; - end - end - - if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin - ledCounter <= LEDS_ON; - rst = 1; - running = 0; - end - - instruction_counter <= instruction_counter + 1; - end -end - -assign led = ledCounter; -assign bang_tx = bang_tx_reg; -assign power_tx = power_tx_reg; - -endmodule - -`include "uart.v" \ No newline at end of file diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/uart.v b/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v similarity index 65% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_UART/uart.v rename to ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v index 1b4944c..7f399f4 100644 --- a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/uart.v +++ b/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v @@ -1,19 +1,83 @@ -`default_nettype none - -// ganked from https://raw.githubusercontent.com/lushaylabs/tangnano9k-series-examples/ -// of https://learn.lushaylabs.com -module uart +module exploit #( parameter DELAY_FRAMES = 234 // 27,000,000 (27Mhz) / 115200 Baud rate ) ( + // exploit + input clk_in, + output power_tx, + output [5:0] led, + + // uart input clk, + input btn1, input uart_rx, - output uart_tx, - output reg [5:0] led, - input btn1 + output uart_tx ); +////////// EXPLOIT +localparam INSTRUCTION_OFFSET = 100; + +// da official exploit code +localparam EXPLOIT_BYTES = {8'h5D,8'h5D,8'h5D,8'h5D}; + + +//// glitch logic + +localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed +localparam LEDS_ON = 0; +localparam LEDS_OFF = 6'b111111; + +reg [1:0] power_tx_reg = 1; +reg [1:0] led_run = 1; +reg [1:0] rst = 0; +reg [1:0] running = 1; +reg [5:0] ledCounter = 0; +reg [23:0] instruction_counter = 0; +reg [23:0] exploit_tx_count = 0; +reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES; + +always @(posedge clk_in) begin + if(rst == 1) begin + running = 1; + power_tx_reg = 1; + rst = 0; + end + + if(instruction_counter == INSTRUCTION_OFFSET) begin + power_tx_reg = 0; + rst = 1; + end + + if(running == 1) begin + if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin + led_run <= 1; + end else begin + led_run <= 0; + end + + if(led_run == 1) begin + ledCounter <= ledCounter + 1; + if(ledCounter == LEDS_OFF) begin + ledCounter <= LEDS_ON; + end + end + + if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin + ledCounter <= LEDS_ON; + rst = 1; + running = 0; + end + + instruction_counter <= instruction_counter + 1; + end +end + + +//// uart rx +// uart shit ganked from https://raw.githubusercontent.com/lushaylabs/tangnano9k-series-examples/ +// of https://learn.lushaylabs.com + localparam HALF_DELAY_WAIT = (DELAY_FRAMES / 2); reg [3:0] rxState = 0; @@ -71,38 +135,16 @@ always @(posedge clk) begin endcase end -always @(posedge clk) begin - if (byteReady) begin - led <= ~dataIn[5:0]; - end -end + +//// uart tx reg [3:0] txState = 0; reg [24:0] txCounter = 0; -reg [7:0] dataOut = 0; -reg txPinRegister = 1; +reg [1:0] txPinRegister = 1; reg [2:0] txBitNumber = 0; reg [3:0] txByteCounter = 0; -assign uart_tx = txPinRegister; - -localparam MEMORY_LENGTH = 12; -reg [7:0] testMemory [MEMORY_LENGTH-1:0]; - -initial begin - testMemory[0] = "L"; - testMemory[1] = "u"; - testMemory[2] = "s"; - testMemory[3] = "h"; - testMemory[4] = "a"; - testMemory[5] = "y"; - testMemory[6] = " "; - testMemory[7] = "L"; - testMemory[8] = "a"; - testMemory[9] = "b"; - testMemory[10] = "s"; - testMemory[11] = " "; -end +localparam MEMORY_LENGTH = 5; localparam TX_STATE_IDLE = 0; localparam TX_STATE_START_BIT = 1; @@ -126,16 +168,15 @@ always @(posedge clk) begin txPinRegister <= 0; if ((txCounter + 1) == DELAY_FRAMES) begin txState <= TX_STATE_WRITE; - dataOut <= testMemory[txByteCounter]; txBitNumber <= 0; txCounter <= 0; end else txCounter <= txCounter + 1; end TX_STATE_WRITE: begin - txPinRegister <= dataOut[txBitNumber]; + txPinRegister <= exploit_bytes_reg[txBitNumber]; if ((txCounter + 1) == DELAY_FRAMES) begin - if (txBitNumber == 3'b111) begin + if (txBitNumber == 7) begin txState <= TX_STATE_STOP_BIT; end else begin txState <= TX_STATE_WRITE; @@ -167,4 +208,10 @@ always @(posedge clk) begin end endcase end + +// assigns to output +assign led = ledCounter; +assign power_tx = power_tx_reg; +assign uart_tx = txPinRegister; + endmodule \ No newline at end of file diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/lushayproject.lushay.json b/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/lushayproject.lushay.json index 201fd98..8351c15 100644 --- a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/lushayproject.lushay.json +++ b/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/lushayproject.lushay.json @@ -1,7 +1,7 @@ { "name": "ESP32-S3_Exploit_UART", "board": "tangnano9k", - "includedFiles": ["ES32-S3_Exploit_UART.v"], + "includedFiles": ["ESP32-S3_Exploit_UART.v"], "constraintsFile": "tangnano9k.cst", "baudRate": 115200, "top":"exploit" diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/tangnano9k.cst b/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/tangnano9k.cst index 525c261..b34cc2c 100644 --- a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/tangnano9k.cst +++ b/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/tangnano9k.cst @@ -1,3 +1,6 @@ +IO_LOC "clk" 52; +IO_PORT "clk" PULL_MODE=UP; + IO_LOC "uart_rx" 18; IO_PORT "uart_rx" IO_TYPE=LVCMOS33;