added UART version to FPGA tool

ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ES32-S3_Exploit_UART.v

@@ -1,75 +0,0 @@
-module exploit
-(
-    // exploit
-    input clk_in,
-    output bang_tx,
-    output power_tx,
-    output [5:0] led
-);
-
-////////// EXPLOIT
-localparam INSTRUCTION_OFFSET = 100;
-
-// da official exploit code
-localparam EXPLOIT_BYTES = {16'hFA,16'hEB,16'h11,16'hDD};
-
-localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed
-
-localparam LEDS_ON = 0;
-localparam LEDS_OFF = 6'b111111;
-
-reg [1:0] bang_tx_reg = 0;
-reg [1:0] power_tx_reg = 1;
-reg [1:0] led_run = 1;
-reg [1:0] rst = 0;
-reg [1:0] running = 1; 
-reg [5:0] ledCounter = 0;
-reg [23:0] instruction_counter = 0;
-reg [23:0] exploit_tx_count = 0;
-reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES; 
-
-always @(posedge clk_in) begin
-    if(rst == 1) begin
-        running = 1;
-        power_tx_reg = 1;
-        rst = 0;
-    end
-
-    if(instruction_counter == INSTRUCTION_OFFSET) begin
-        power_tx_reg = 0;
-        rst = 1;
-    end
-
-    if(running == 1) begin
-        if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin 
-            bang_tx_reg <= exploit_bytes_reg[exploit_tx_count];
-            exploit_tx_count <= exploit_tx_count + 1;
-            led_run <= 1;
-        end else begin
-            led_run <= 0;
-        end
-
-        if(led_run == 1) begin
-           ledCounter <= ledCounter + 1;
-           if(ledCounter == LEDS_OFF) begin
-                ledCounter <= LEDS_ON;
-           end
-        end
-
-        if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
-            ledCounter <= LEDS_ON;
-            rst = 1;
-            running = 0;
-        end
-
-        instruction_counter <= instruction_counter + 1;
-    end
-end
-
-assign led = ledCounter;
-assign bang_tx = bang_tx_reg;
-assign power_tx = power_tx_reg;
-
-endmodule
-
-`include "uart.v"

ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v

@@ -1,19 +1,83 @@
-`default_nettype none
+module exploit
-
-// ganked from https://raw.githubusercontent.com/lushaylabs/tangnano9k-series-examples/
-// of https://learn.lushaylabs.com
-module uart
 #(
     parameter DELAY_FRAMES = 234 // 27,000,000 (27Mhz) / 115200 Baud rate
 )
 (
+    // exploit
+    input clk_in,
+    output power_tx,
+    output [5:0] led,
+
+    // uart
     input clk,
+    input btn1,
     input uart_rx,
-    output uart_tx,
+    output uart_tx
-    output reg [5:0] led,
-    input btn1
 );
 
+////////// EXPLOIT
+localparam INSTRUCTION_OFFSET = 100;
+
+// da official exploit code
+localparam EXPLOIT_BYTES = {8'h5D,8'h5D,8'h5D,8'h5D};
+
+
+//// glitch logic
+
+localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed
+localparam LEDS_ON = 0;
+localparam LEDS_OFF = 6'b111111;
+
+reg [1:0] power_tx_reg = 1;
+reg [1:0] led_run = 1;
+reg [1:0] rst = 0;
+reg [1:0] running = 1; 
+reg [5:0] ledCounter = 0;
+reg [23:0] instruction_counter = 0;
+reg [23:0] exploit_tx_count = 0;
+reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES; 
+
+always @(posedge clk_in) begin
+    if(rst == 1) begin
+        running = 1;
+        power_tx_reg = 1;
+        rst = 0;
+    end
+
+    if(instruction_counter == INSTRUCTION_OFFSET) begin
+        power_tx_reg = 0;
+        rst = 1;
+    end
+
+    if(running == 1) begin
+        if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin 
+            led_run <= 1;
+        end else begin
+            led_run <= 0;
+        end
+
+        if(led_run == 1) begin
+           ledCounter <= ledCounter + 1;
+           if(ledCounter == LEDS_OFF) begin
+                ledCounter <= LEDS_ON;
+           end
+        end
+
+        if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
+            ledCounter <= LEDS_ON;
+            rst = 1;
+            running = 0;
+        end
+
+        instruction_counter <= instruction_counter + 1;
+    end
+end
+
+
+//// uart rx
+// uart shit ganked from https://raw.githubusercontent.com/lushaylabs/tangnano9k-series-examples/
+// of https://learn.lushaylabs.com
+
 localparam HALF_DELAY_WAIT = (DELAY_FRAMES / 2);
 
 reg [3:0] rxState = 0;
@@ -71,38 +135,16 @@ always @(posedge clk) begin
     endcase
 end
 
-always @(posedge clk) begin
+
-    if (byteReady) begin
+//// uart tx
-        led <= ~dataIn[5:0];
-    end
-end
 
 reg [3:0] txState = 0;
 reg [24:0] txCounter = 0;
-reg [7:0] dataOut = 0;
+reg [1:0] txPinRegister = 1;
-reg txPinRegister = 1;
 reg [2:0] txBitNumber = 0;
 reg [3:0] txByteCounter = 0;
 
-assign uart_tx = txPinRegister;
+localparam MEMORY_LENGTH = 5;
-
-localparam MEMORY_LENGTH = 12;
-reg [7:0] testMemory [MEMORY_LENGTH-1:0];
-
-initial begin
-    testMemory[0] = "L";
-    testMemory[1] = "u";
-    testMemory[2] = "s";
-    testMemory[3] = "h";
-    testMemory[4] = "a";
-    testMemory[5] = "y";
-    testMemory[6] = " ";
-    testMemory[7] = "L";
-    testMemory[8] = "a";
-    testMemory[9] = "b";
-    testMemory[10] = "s";
-    testMemory[11] = " ";
-end
 
 localparam TX_STATE_IDLE = 0;
 localparam TX_STATE_START_BIT = 1;
@@ -126,16 +168,15 @@ always @(posedge clk) begin
             txPinRegister <= 0;
             if ((txCounter + 1) == DELAY_FRAMES) begin
                 txState <= TX_STATE_WRITE;
-                dataOut <= testMemory[txByteCounter];
                 txBitNumber <= 0;
                 txCounter <= 0;
             end else 
                 txCounter <= txCounter + 1;
         end
         TX_STATE_WRITE: begin
-            txPinRegister <= dataOut[txBitNumber];
+            txPinRegister <= exploit_bytes_reg[txBitNumber];
             if ((txCounter + 1) == DELAY_FRAMES) begin
-                if (txBitNumber == 3'b111) begin
+                if (txBitNumber == 7) begin
                     txState <= TX_STATE_STOP_BIT;
                 end else begin
                     txState <= TX_STATE_WRITE;
@@ -167,4 +208,10 @@ always @(posedge clk) begin
         end
     endcase      
 end
+
+// assigns to output 
+assign led = ledCounter;
+assign power_tx = power_tx_reg;
+assign uart_tx = txPinRegister;
+
 endmodule

ESP32-S3_Exploit/ESP32-S3_Exploit_UART/lushayproject.lushay.json

@@ -1,7 +1,7 @@
 {
     "name": "ESP32-S3_Exploit_UART",
     "board": "tangnano9k",
-    "includedFiles": ["ES32-S3_Exploit_UART.v"],
+    "includedFiles": ["ESP32-S3_Exploit_UART.v"],
     "constraintsFile": "tangnano9k.cst",
     "baudRate": 115200,
     "top":"exploit"

ESP32-S3_Exploit/ESP32-S3_Exploit_UART/tangnano9k.cst

@@ -1,3 +1,6 @@
+IO_LOC  "clk" 52;
+IO_PORT "clk" PULL_MODE=UP;
+
 IO_LOC  "uart_rx" 18;
 IO_PORT "uart_rx" IO_TYPE=LVCMOS33;