diff --git a/ES32-S3_Exploit_UART.v b/ES32-S3_Exploit_UART.v deleted file mode 100644 index e810a92..0000000 --- a/ES32-S3_Exploit_UART.v +++ /dev/null @@ -1,73 +0,0 @@ -module exploit -( - // exploit - input clk_in, - output bang_tx, - output power_tx, - output [5:0] led -); - -////////// EXPLOIT -localparam INSTRUCTION_OFFSET = 100; - -// da official exploit code -localparam EXPLOIT_BYTES = {16'hFA,16'hEB,16'h11,16'hDD}; - -localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed - -localparam LEDS_ON = 0; -localparam LEDS_OFF = 6'b111111; - -reg [1:0] bang_tx_reg = 0; -reg [1:0] power_tx_reg = 1; -reg [1:0] led_run = 1; -reg [1:0] rst = 0; -reg [1:0] running = 1; -reg [5:0] ledCounter = 0; -reg [23:0] instruction_counter = 0; -reg [23:0] exploit_tx_count = 0; -reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES; - -always @(posedge clk_in) begin - if(rst == 1) begin - running = 1; - power_tx_reg = 1; - rst = 0; - end - - if(instruction_counter == INSTRUCTION_OFFSET) begin - power_tx_reg = 0; - rst = 1; - end - - if(running == 1) begin - if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin - bang_tx_reg <= exploit_bytes_reg[exploit_tx_count]; - exploit_tx_count <= exploit_tx_count + 1; - led_run <= 1; - end else begin - led_run <= 0; - end - - if(led_run == 1) begin - ledCounter <= ledCounter + 1; - if(ledCounter == LEDS_OFF) begin - ledCounter <= LEDS_ON; - end - end - - if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin - ledCounter <= LEDS_ON; - rst = 1; - running = 0; - end - - instruction_counter <= instruction_counter + 1; - end -end - -assign led = ledCounter; -assign bang_tx = bang_tx_reg; -assign power_tx = power_tx_reg; - -endmodule \ No newline at end of file diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/.core b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/.core similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/.core rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/.core diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/ES32-S3_Exploit_BitBang.v b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/ES32-S3_Exploit_BitBang.v similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/ES32-S3_Exploit_BitBang.v rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/ES32-S3_Exploit_BitBang.v diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/lushayproject.lushay.json b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/lushayproject.lushay.json similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/lushayproject.lushay.json rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/lushayproject.lushay.json diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/tangnano9k.cst b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/tangnano9k.cst similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/tangnano9k.cst rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/tangnano9k.cst diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/.core b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/.core similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_UART/.core rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/.core diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/lushayproject.lushay.json b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/lushayproject.lushay.json similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_UART/lushayproject.lushay.json rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/lushayproject.lushay.json diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/tangnano9k.cst b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/tangnano9k.cst similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_UART/tangnano9k.cst rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/tangnano9k.cst diff --git a/ESP32-S3_Exploit/README.md b/ESP32-S3_Exploit_FPGA/README.md similarity index 54% rename from ESP32-S3_Exploit/README.md rename to ESP32-S3_Exploit_FPGA/README.md index 3b590e9..86eee07 100644 --- a/ESP32-S3_Exploit/README.md +++ b/ESP32-S3_Exploit_FPGA/README.md @@ -1,2 +1,6 @@ Made for the [Tang Nano 9K FPGA](https://www.aliexpress.us/item/3256807026232976.html?channel=twinner) -Build using [Lushay Code](https://learn.lushaylabs.com/vscode-extension/) for VS Code/* \ No newline at end of file +Build using [Lushay Code](https://learn.lushaylabs.com/vscode-extension/) for VS Code + +Testing using the two versions +[Bit-bang version](ESP32-S3_Exploit_BitBang/) +[UART version](ESP32-S3_Exploit_UART/) \ No newline at end of file diff --git a/elf-memory-map.txt b/Ghidra/elf-memory-map.txt similarity index 100% rename from elf-memory-map.txt rename to Ghidra/elf-memory-map.txt diff --git a/ghidra-progject-esp32s3-bootrom-exploit.gpr b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.gpr similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.gpr rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.gpr diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/00000000.prp b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/00000000.prp similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/00000000.prp rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/00000000.prp diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.2.gbf b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.2.gbf similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.2.gbf rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.2.gbf diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.3.gbf b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.3.gbf similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.3.gbf rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.3.gbf diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.bak b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.bak similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.bak rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.bak diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.dat b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.dat similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.dat rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.dat diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~journal.bak b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~journal.bak similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~journal.bak rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~journal.bak diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/project.prp b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/project.prp similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/project.prp rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/project.prp diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/00000000.prp b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/00000000.prp similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/00000000.prp rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/00000000.prp diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/~00000000.db/db.1.gbf b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/~00000000.db/db.1.gbf similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/~00000000.db/db.1.gbf rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/~00000000.db/db.1.gbf diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.bak b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.bak similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.bak rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.bak diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.dat b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.dat similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.dat rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.dat diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~journal.bak b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~journal.bak similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/user/~journal.bak rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~journal.bak diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/versioned/~index.dat b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/versioned/~index.dat similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/versioned/~index.dat rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/versioned/~index.dat diff --git a/README.md b/README.md index 506566f..ee0a0dc 100644 --- a/README.md +++ b/README.md @@ -2,5 +2,15 @@ Working on an exploit to break the security on the ESP32-S3 Highly a work in progress +[entropy](entropy/) - entropy images of the bootroms +[esp-rom-elfs-20230320](esp-rom-elfs-20230320/) - all of the ESP32-X bootloader elfs from [here](https://github.com/espressif/esp-rom-elfs/releases/tag/20230320) +[ESP32-S3_Exploit_FPGA](ESP32-S3_Exploit_FPGA/) - runs the exploit, based on a cheap [Tang Nano 9K FPGA](https://www.aliexpress.us/item/3256807026232976.html?channel=twinner) using [Lushay Code](https://learn.lushaylabs.com/vscode-extension/) for VS Code +[existing_files](existing_files/) - assorted existing roms I found +[Ghidra](Ghidra/) - Ghidra project for reverse engineering and exploit dev +[libs](libs/) - extra libraries that Espressif disclosed was used in the roms, excepting those found natively in esp-idf (useful for reverse engineering and debugging) +[sillyfillyespdumper](sillyfillyespdumper/) - tool I made to dump arbitrary data from ESP32-Xs +[silltfillyespdumper/live-roms](sillyfillyespdumper/live-roms/) - full, redundant rom dumps from two production ESP32-S3s + + Based much on [Coruk's attack on the ESP32-C3](https://courk.cc/esp32-c3-c6-fault-injection) diff --git a/esp32s3_rev0_rom_compiled_from_elf.bin.png b/entropy/esp32s3_rev0_rom_compiled_from_elf.bin.png similarity index 100% rename from esp32s3_rev0_rom_compiled_from_elf.bin.png rename to entropy/esp32s3_rev0_rom_compiled_from_elf.bin.png diff --git a/ghidra-progject-esp32s3-bootrom-exploit.lock b/ghidra-progject-esp32s3-bootrom-exploit.lock deleted file mode 100644 index b85eeec..0000000 --- a/ghidra-progject-esp32s3-bootrom-exploit.lock +++ /dev/null @@ -1,9 +0,0 @@ -#Ghidra Lock File -#Sun Aug 18 08:19:25 MDT 2024 -\ Supports\ File\ Channel\ Locking=Channel Lock -Hostname=princesspi2 -OS\ Architecture=amd64 -OS\ Name=Windows 11 -OS\ Version=10.0 -Timestamp=8/18/24, 8\:19\u202FAM -Username=human diff --git a/ghidra-progject-esp32s3-bootrom-exploit.lock~ b/ghidra-progject-esp32s3-bootrom-exploit.lock~ deleted file mode 100644 index e69de29..0000000 diff --git a/espe32s3notes-exploit-dev.txt b/notes-espe32s3-exploit-dev.txt similarity index 100% rename from espe32s3notes-exploit-dev.txt rename to notes-espe32s3-exploit-dev.txt