initial commit

2024-08-18 02:50:11 -06:00
commit c6f61bffb0
144 changed files with 19082 additions and 0 deletions
@@ -0,0 +1,71 @@
+Entry main: 0x40043A2C
+Resides in: 0x40040000 to 0x4005FFFF - 128KB -  Internal ROM 1
+Address space begins at: 0x3FF00000 ?
+
+list available machines:
+	/home/kali/.emulate-debug/qemu-xtensa/bin/qemu-system-xtensa -machine help
+	/home/kali/.emulate-debug/qemu-riscv/bin/qemu-system-riscv32 -machine help
+emulate esp32s3:
+	/home/kali/.emulate-debug/qemu-xtensa/bin/qemu-system-xtensa -machine esp32s3
+emulate riscv:
+	/home/kali/.emulate-debug/qemu-riscv/bin/qemu-system-riscv32 -machine esp32c3
+
+espressif gdb
+	/home/kali/.emulate-debug/binutils-gdb/gdb/gdb --help
+	/home/kali/.emulate-debug/binutils-gdb/gdb/gdb -l 300 # set timeount to 300 seconds
+
+exploit_dev folder:
+	/home/kali/sync/esp32s3-boot-rom-elf-uni.rep/exploit_dev/
+.emulation-debug folder:
+	/home/kali/.emulate-debug/
+
+esptool.py --chip esp32s3 elf2image --use_segments esp32s3_rev0_rom.elf
+	--output bin_file_name.bin
+	--flash_size 8MB 
+	--pad-to-size 8MB
+
+ROM Elfs:
+	./esp-rom-elfs-20230320
+
+	https://github.com/espressif/esp-rom-elfs/releases/tag/20230320
+
+	Full version in ROM ELF's filenames (major * 100 + minor). E.g:
+	esp32_rev300_rom.elf is for version 3.0
+	esp32c3_rev3_rom.elf is for version 0.3
+	Fix esp32c2 revision to 1.0
+
+
+todo:
+ x reinstall esp-idf fucking again to test the reinstall script
+ - run dump on freenove fuckin again (twice) with latest for testing and final binutils
+ - run dump fuckin twice on another esp32s3 for compare
+ - save the shit and back the shit up
+ - add and push git projects
+  - document lmfao
+ - study the fuck out of cuork's c3 exploit
+ - get on that fuckin binary exploit lmfao
+
+== scratch ==
+
+# running on byobu:
+export ESPBAUD=115200; ./espdump.sh devkit; ./espdump.sh devkit; export ESPPORT=/dev/ttyACM1; ./espdump.sh freenove; ./espdump.sh freenove;
+
+#dump_section "internal-ROM0" "instruction-bus" 0x4000_0000 0x4003_FFFF $chip
+
+
+
+#dump_section "internal-ROM1" "data-bus" 0x3FF0_0000 0x3FF1_FFFF $chip
+
+#dump_section "internal-ROM1" "instruction-bus" 0x4004_0000 0x4005_FFFF $chip
+
+# internal ROM0, instruction bus, 0x4000_0000 to 0x4003_FFFF, 0x3FFFF length (256KB)
+#echo "\n\ninterenal ROM0, instruction bus, 0x4000_0000 to 0x4003_FFFF, 0x3FFFF length (256KB)\n\n"
+#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x4000_0000 0x3FFFF "$out_dir/live-freenove-boot-ROM0-instruction-bus-0x4000_0000-0x4003_FFFF-0x3FFFF-full-address-esp32s3-$datestamp.bin"
+
+# internal ROM1, data bus, 0x3FF0_0000 to 0x3FF1_FFFF, 0x1FFFF length (128KB)
+#echo "\n\ninternal ROM1, data bus, 0x3FF0_0000 to 0x3FF1_FFFF, 0x1FFFF length (128KB)\n\n"
+#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x3FF00000 0x1FFFF "$out_dir/live-freenove-boot-ROM1-data-bus-0x3FF0_0000-0x3FF1_FFFF-0x1FFFF-full-address-esp32s3-$datestamp.bin"
+
+# internal ROM1, instruction bus, 0x4004_0000 to 0x4005_FFFF, 0x1FFFF length (128KB)
+#echo "\n\ninternal ROM1, instruction bus, 0x4004_0000 to 0x4005_FFFF, 0x1FFFF length (128KB)\n\n"
+#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x3FF0_0000 0x1FFFF "$out_dir/live-freenove-boot-ROM1-instruction-bus-0x4004_0000-0x4005_FFF-0x1FFFF-full-address-esp32s3-$datestamp.bin"