From 890dee360d3c9f938ce722f1d6986258c245c35f Mon Sep 17 00:00:00 2001 From: PrincessPi3 Date: Sat, 24 Aug 2024 18:55:09 -0600 Subject: [PATCH] cleaned up, documented some --- ES32-S3_Exploit_UART.v | 73 ------------------ .../ESP32-S3_Exploit_BitBang/.core | 0 .../ES32-S3_Exploit_BitBang.v | 0 .../lushayproject.lushay.json | 0 .../ESP32-S3_Exploit_BitBang/tangnano9k.cst | 0 .../ESP32-S3_Exploit_UART/.core | 0 .../ESP32-S3_Exploit_UART.v | 0 .../lushayproject.lushay.json | 0 .../ESP32-S3_Exploit_UART/tangnano9k.cst | 0 .../README.md | 6 +- .../elf-memory-map.txt | 0 ...hidra-progject-esp32s3-bootrom-exploit.gpr | 0 .../idata/00/00000000.prp | 0 .../idata/00/~00000000.db/db.2.gbf | Bin .../idata/00/~00000000.db/db.3.gbf | Bin .../idata/~index.bak | 0 .../idata/~index.dat | 0 .../idata/~journal.bak | 0 .../project.prp | 0 .../user/00/00000000.prp | 0 .../user/00/~00000000.db/db.1.gbf | Bin .../user/~index.bak | 0 .../user/~index.dat | 0 .../user/~journal.bak | 0 .../versioned/~index.dat | 0 README.md | 10 +++ ...esp32s3_rev0_rom_compiled_from_elf.bin.png | Bin ghidra-progject-esp32s3-bootrom-exploit.lock | 9 --- ghidra-progject-esp32s3-bootrom-exploit.lock~ | 0 ...-dev.txt => notes-espe32s3-exploit-dev.txt | 0 30 files changed, 15 insertions(+), 83 deletions(-) delete mode 100644 ES32-S3_Exploit_UART.v rename {ESP32-S3_Exploit => ESP32-S3_Exploit_FPGA}/ESP32-S3_Exploit_BitBang/.core (100%) rename {ESP32-S3_Exploit => ESP32-S3_Exploit_FPGA}/ESP32-S3_Exploit_BitBang/ES32-S3_Exploit_BitBang.v (100%) rename {ESP32-S3_Exploit => ESP32-S3_Exploit_FPGA}/ESP32-S3_Exploit_BitBang/lushayproject.lushay.json (100%) rename {ESP32-S3_Exploit => ESP32-S3_Exploit_FPGA}/ESP32-S3_Exploit_BitBang/tangnano9k.cst (100%) rename {ESP32-S3_Exploit => ESP32-S3_Exploit_FPGA}/ESP32-S3_Exploit_UART/.core (100%) rename {ESP32-S3_Exploit => ESP32-S3_Exploit_FPGA}/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v (100%) rename {ESP32-S3_Exploit => ESP32-S3_Exploit_FPGA}/ESP32-S3_Exploit_UART/lushayproject.lushay.json (100%) rename {ESP32-S3_Exploit => ESP32-S3_Exploit_FPGA}/ESP32-S3_Exploit_UART/tangnano9k.cst (100%) rename {ESP32-S3_Exploit => ESP32-S3_Exploit_FPGA}/README.md (54%) rename elf-memory-map.txt => Ghidra/elf-memory-map.txt (100%) rename ghidra-progject-esp32s3-bootrom-exploit.gpr => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.gpr (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/idata/00/00000000.prp (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/idata/00/~00000000.db/db.2.gbf (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/idata/00/~00000000.db/db.3.gbf (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/idata/~index.bak (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/idata/~index.dat (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/idata/~journal.bak (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/project.prp (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/user/00/00000000.prp (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/user/00/~00000000.db/db.1.gbf (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/user/~index.bak (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/user/~index.dat (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/user/~journal.bak (100%) rename {ghidra-progject-esp32s3-bootrom-exploit.rep => Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep}/versioned/~index.dat (100%) rename esp32s3_rev0_rom_compiled_from_elf.bin.png => entropy/esp32s3_rev0_rom_compiled_from_elf.bin.png (100%) delete mode 100644 ghidra-progject-esp32s3-bootrom-exploit.lock delete mode 100644 ghidra-progject-esp32s3-bootrom-exploit.lock~ rename espe32s3notes-exploit-dev.txt => notes-espe32s3-exploit-dev.txt (100%) diff --git a/ES32-S3_Exploit_UART.v b/ES32-S3_Exploit_UART.v deleted file mode 100644 index e810a92..0000000 --- a/ES32-S3_Exploit_UART.v +++ /dev/null @@ -1,73 +0,0 @@ -module exploit -( - // exploit - input clk_in, - output bang_tx, - output power_tx, - output [5:0] led -); - -////////// EXPLOIT -localparam INSTRUCTION_OFFSET = 100; - -// da official exploit code -localparam EXPLOIT_BYTES = {16'hFA,16'hEB,16'h11,16'hDD}; - -localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed - -localparam LEDS_ON = 0; -localparam LEDS_OFF = 6'b111111; - -reg [1:0] bang_tx_reg = 0; -reg [1:0] power_tx_reg = 1; -reg [1:0] led_run = 1; -reg [1:0] rst = 0; -reg [1:0] running = 1; -reg [5:0] ledCounter = 0; -reg [23:0] instruction_counter = 0; -reg [23:0] exploit_tx_count = 0; -reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES; - -always @(posedge clk_in) begin - if(rst == 1) begin - running = 1; - power_tx_reg = 1; - rst = 0; - end - - if(instruction_counter == INSTRUCTION_OFFSET) begin - power_tx_reg = 0; - rst = 1; - end - - if(running == 1) begin - if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin - bang_tx_reg <= exploit_bytes_reg[exploit_tx_count]; - exploit_tx_count <= exploit_tx_count + 1; - led_run <= 1; - end else begin - led_run <= 0; - end - - if(led_run == 1) begin - ledCounter <= ledCounter + 1; - if(ledCounter == LEDS_OFF) begin - ledCounter <= LEDS_ON; - end - end - - if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin - ledCounter <= LEDS_ON; - rst = 1; - running = 0; - end - - instruction_counter <= instruction_counter + 1; - end -end - -assign led = ledCounter; -assign bang_tx = bang_tx_reg; -assign power_tx = power_tx_reg; - -endmodule \ No newline at end of file diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/.core b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/.core similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/.core rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/.core diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/ES32-S3_Exploit_BitBang.v b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/ES32-S3_Exploit_BitBang.v similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/ES32-S3_Exploit_BitBang.v rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/ES32-S3_Exploit_BitBang.v diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/lushayproject.lushay.json b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/lushayproject.lushay.json similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/lushayproject.lushay.json rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/lushayproject.lushay.json diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/tangnano9k.cst b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/tangnano9k.cst similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_BitBang/tangnano9k.cst rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/tangnano9k.cst diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/.core b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/.core similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_UART/.core rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/.core diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/lushayproject.lushay.json b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/lushayproject.lushay.json similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_UART/lushayproject.lushay.json rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/lushayproject.lushay.json diff --git a/ESP32-S3_Exploit/ESP32-S3_Exploit_UART/tangnano9k.cst b/ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/tangnano9k.cst similarity index 100% rename from ESP32-S3_Exploit/ESP32-S3_Exploit_UART/tangnano9k.cst rename to ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/tangnano9k.cst diff --git a/ESP32-S3_Exploit/README.md b/ESP32-S3_Exploit_FPGA/README.md similarity index 54% rename from ESP32-S3_Exploit/README.md rename to ESP32-S3_Exploit_FPGA/README.md index 3b590e9..86eee07 100644 --- a/ESP32-S3_Exploit/README.md +++ b/ESP32-S3_Exploit_FPGA/README.md @@ -1,2 +1,6 @@ Made for the [Tang Nano 9K FPGA](https://www.aliexpress.us/item/3256807026232976.html?channel=twinner) -Build using [Lushay Code](https://learn.lushaylabs.com/vscode-extension/) for VS Code/* \ No newline at end of file +Build using [Lushay Code](https://learn.lushaylabs.com/vscode-extension/) for VS Code + +Testing using the two versions +[Bit-bang version](ESP32-S3_Exploit_BitBang/) +[UART version](ESP32-S3_Exploit_UART/) \ No newline at end of file diff --git a/elf-memory-map.txt b/Ghidra/elf-memory-map.txt similarity index 100% rename from elf-memory-map.txt rename to Ghidra/elf-memory-map.txt diff --git a/ghidra-progject-esp32s3-bootrom-exploit.gpr b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.gpr similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.gpr rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.gpr diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/00000000.prp b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/00000000.prp similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/00000000.prp rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/00000000.prp diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.2.gbf b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.2.gbf similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.2.gbf rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.2.gbf diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.3.gbf b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.3.gbf similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.3.gbf rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/~00000000.db/db.3.gbf diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.bak b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.bak similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.bak rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.bak diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.dat b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.dat similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.dat rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.dat diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~journal.bak b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~journal.bak similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~journal.bak rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~journal.bak diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/project.prp b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/project.prp similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/project.prp rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/project.prp diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/00000000.prp b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/00000000.prp similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/00000000.prp rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/00000000.prp diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/~00000000.db/db.1.gbf b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/~00000000.db/db.1.gbf similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/~00000000.db/db.1.gbf rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/~00000000.db/db.1.gbf diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.bak b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.bak similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.bak rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.bak diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.dat b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.dat similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.dat rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.dat diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~journal.bak b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~journal.bak similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/user/~journal.bak rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~journal.bak diff --git a/ghidra-progject-esp32s3-bootrom-exploit.rep/versioned/~index.dat b/Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/versioned/~index.dat similarity index 100% rename from ghidra-progject-esp32s3-bootrom-exploit.rep/versioned/~index.dat rename to Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/versioned/~index.dat diff --git a/README.md b/README.md index 506566f..ee0a0dc 100644 --- a/README.md +++ b/README.md @@ -2,5 +2,15 @@ Working on an exploit to break the security on the ESP32-S3 Highly a work in progress +[entropy](entropy/) - entropy images of the bootroms +[esp-rom-elfs-20230320](esp-rom-elfs-20230320/) - all of the ESP32-X bootloader elfs from [here](https://github.com/espressif/esp-rom-elfs/releases/tag/20230320) +[ESP32-S3_Exploit_FPGA](ESP32-S3_Exploit_FPGA/) - runs the exploit, based on a cheap [Tang Nano 9K FPGA](https://www.aliexpress.us/item/3256807026232976.html?channel=twinner) using [Lushay Code](https://learn.lushaylabs.com/vscode-extension/) for VS Code +[existing_files](existing_files/) - assorted existing roms I found +[Ghidra](Ghidra/) - Ghidra project for reverse engineering and exploit dev +[libs](libs/) - extra libraries that Espressif disclosed was used in the roms, excepting those found natively in esp-idf (useful for reverse engineering and debugging) +[sillyfillyespdumper](sillyfillyespdumper/) - tool I made to dump arbitrary data from ESP32-Xs +[silltfillyespdumper/live-roms](sillyfillyespdumper/live-roms/) - full, redundant rom dumps from two production ESP32-S3s + + Based much on [Coruk's attack on the ESP32-C3](https://courk.cc/esp32-c3-c6-fault-injection) diff --git a/esp32s3_rev0_rom_compiled_from_elf.bin.png b/entropy/esp32s3_rev0_rom_compiled_from_elf.bin.png similarity index 100% rename from esp32s3_rev0_rom_compiled_from_elf.bin.png rename to entropy/esp32s3_rev0_rom_compiled_from_elf.bin.png diff --git a/ghidra-progject-esp32s3-bootrom-exploit.lock b/ghidra-progject-esp32s3-bootrom-exploit.lock deleted file mode 100644 index b85eeec..0000000 --- a/ghidra-progject-esp32s3-bootrom-exploit.lock +++ /dev/null @@ -1,9 +0,0 @@ -#Ghidra Lock File -#Sun Aug 18 08:19:25 MDT 2024 -\ Supports\ File\ Channel\ Locking=Channel Lock -Hostname=princesspi2 -OS\ Architecture=amd64 -OS\ Name=Windows 11 -OS\ Version=10.0 -Timestamp=8/18/24, 8\:19\u202FAM -Username=human diff --git a/ghidra-progject-esp32s3-bootrom-exploit.lock~ b/ghidra-progject-esp32s3-bootrom-exploit.lock~ deleted file mode 100644 index e69de29..0000000 diff --git a/espe32s3notes-exploit-dev.txt b/notes-espe32s3-exploit-dev.txt similarity index 100% rename from espe32s3notes-exploit-dev.txt rename to notes-espe32s3-exploit-dev.txt