migration

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "Sillyfilly-espdumper"]
+	path = Sillyfilly-espdumper
+	url = https://github.com/PrincessPi3/Sillyfilly-espdumper.git

ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/.core

@@ -0,0 +1 @@
+{file_type:systemVerilogSource}

ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/ES32-S3_Exploit_BitBang.v

@@ -0,0 +1,73 @@
+module exploit
+(
+    // exploit
+    input clk_in,
+    output bang_tx,
+    output power_tx,
+    output [5:0] led
+);
+
+////////// EXPLOIT
+localparam INSTRUCTION_OFFSET = 100;
+
+// da official exploit code
+localparam EXPLOIT_BYTES = {16'hFA,16'hEB,16'h11,16'hDD};
+
+localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed
+
+localparam LEDS_ON = 0;
+localparam LEDS_OFF = 6'b111111;
+
+reg [1:0] bang_tx_reg = 0;
+reg [1:0] power_tx_reg = 1;
+reg [1:0] led_run = 1;
+reg [1:0] rst = 0;
+reg [1:0] running = 1; 
+reg [5:0] ledCounter = 0;
+reg [23:0] instruction_counter = 0;
+reg [23:0] exploit_tx_count = 0;
+reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES; 
+
+always @(posedge clk_in) begin
+    if(rst == 1) begin
+        running = 1;
+        power_tx_reg = 1;
+        rst = 0;
+    end
+
+    if(instruction_counter == INSTRUCTION_OFFSET) begin
+        power_tx_reg = 0;
+        rst = 1;
+    end
+
+    if(running == 1) begin
+        if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin 
+            bang_tx_reg <= exploit_bytes_reg[exploit_tx_count];
+            exploit_tx_count <= exploit_tx_count + 1;
+            led_run <= 1;
+        end else begin
+            led_run <= 0;
+        end
+
+        if(led_run == 1) begin
+           ledCounter <= ledCounter + 1;
+           if(ledCounter == LEDS_OFF) begin
+                ledCounter <= LEDS_ON;
+           end
+        end
+
+        if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
+            ledCounter <= LEDS_ON;
+            rst = 1;
+            running = 0;
+        end
+
+        instruction_counter <= instruction_counter + 1;
+    end
+end
+
+assign led = ledCounter;
+assign bang_tx = bang_tx_reg;
+assign power_tx = power_tx_reg;
+
+endmodule

ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/lushayproject.lushay.json

@@ -0,0 +1,9 @@
+{
+    "name": "ESP32-S3_Exploit_BitBang",
+    "board": "tangnano9k",
+    "includedFiles": ["ES32-S3_Exploit_BitBang.v"],
+    "constraintsFile": "tangnano9k.cst",
+    "baudRate": 115200,
+    "top":"exploit"
+
+}

ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_BitBang/tangnano9k.cst

@@ -0,0 +1,19 @@
+IO_LOC  "bang_tx" 69;
+
+IO_LOC  "power_tx" 57;
+IO_PORT "power_tx" DRIVE=24;
+
+IO_LOC  "clk_in" 56;
+IO_PORT "clk_in" PULL_MODE=UP;
+
+IO_LOC  "led[0]" 10;
+
+IO_LOC  "led[1]" 11;
+
+IO_LOC  "led[2]" 13;
+
+IO_LOC  "led[3]" 14;
+
+IO_LOC  "led[4]" 15;
+
+IO_LOC  "led[5]" 16;

ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/.core

@@ -0,0 +1 @@
+{file_type:systemVerilogSource}

ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/ESP32-S3_Exploit_UART.v

@@ -0,0 +1,217 @@
+module exploit
+#(
+    parameter DELAY_FRAMES = 234 // 27,000,000 (27Mhz) / 115200 Baud rate
+)
+(
+    // exploit
+    input clk_in,
+    output power_tx,
+    output [5:0] led,
+
+    // uart
+    input clk,
+    input btn1,
+    input uart_rx,
+    output uart_tx
+);
+
+////////// EXPLOIT
+localparam INSTRUCTION_OFFSET = 100;
+
+// da official exploit code
+localparam EXPLOIT_BYTES = {8'h5D,8'h5D,8'h5D,8'h5D};
+
+
+//// glitch logic
+
+localparam EXPLOIT_BYTES_LEN = $bits(EXPLOIT_BYTES)-1; // $bits() seems to work // https://www.linkedin.com/pulse/bits-clog2-size-uses-differences-muhammed-kawser-ahmed
+localparam LEDS_ON = 0;
+localparam LEDS_OFF = 6'b111111;
+
+reg [1:0] power_tx_reg = 1;
+reg [1:0] led_run = 1;
+reg [1:0] rst = 0;
+reg [1:0] running = 1; 
+reg [5:0] ledCounter = 0;
+reg [23:0] instruction_counter = 0;
+reg [23:0] exploit_tx_count = 0;
+reg [EXPLOIT_BYTES_LEN:0] exploit_bytes_reg = EXPLOIT_BYTES; 
+
+always @(posedge clk_in) begin
+    if(rst == 1) begin
+        running = 1;
+        power_tx_reg = 1;
+        rst = 0;
+    end
+
+    if(instruction_counter == INSTRUCTION_OFFSET) begin
+        power_tx_reg = 0;
+        rst = 1;
+    end
+
+    if(running == 1) begin
+        if(instruction_counter >= INSTRUCTION_OFFSET && instruction_counter <= INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin 
+            led_run <= 1;
+        end else begin
+            led_run <= 0;
+        end
+
+        if(led_run == 1) begin
+           ledCounter <= ledCounter + 1;
+           if(ledCounter == LEDS_OFF) begin
+                ledCounter <= LEDS_ON;
+           end
+        end
+
+        if(instruction_counter == INSTRUCTION_OFFSET+EXPLOIT_BYTES_LEN) begin
+            ledCounter <= LEDS_ON;
+            rst = 1;
+            running = 0;
+        end
+
+        instruction_counter <= instruction_counter + 1;
+    end
+end
+
+
+//// uart rx
+// uart shit ganked from https://raw.githubusercontent.com/lushaylabs/tangnano9k-series-examples/
+// of https://learn.lushaylabs.com
+
+localparam HALF_DELAY_WAIT = (DELAY_FRAMES / 2);
+
+reg [3:0] rxState = 0;
+reg [12:0] rxCounter = 0;
+reg [7:0] dataIn = 0;
+reg [2:0] rxBitNumber = 0;
+reg byteReady = 0;
+
+localparam RX_STATE_IDLE = 0;
+localparam RX_STATE_START_BIT = 1;
+localparam RX_STATE_READ_WAIT = 2;
+localparam RX_STATE_READ = 3;
+localparam RX_STATE_STOP_BIT = 5;
+
+always @(posedge clk) begin
+    case (rxState)
+        RX_STATE_IDLE: begin
+            if (uart_rx == 0) begin
+                rxState <= RX_STATE_START_BIT;
+                rxCounter <= 1;
+                rxBitNumber <= 0;
+                byteReady <= 0;
+            end
+        end 
+        RX_STATE_START_BIT: begin
+            if (rxCounter == HALF_DELAY_WAIT) begin
+                rxState <= RX_STATE_READ_WAIT;
+                rxCounter <= 1;
+            end else 
+                rxCounter <= rxCounter + 1;
+        end
+        RX_STATE_READ_WAIT: begin
+            rxCounter <= rxCounter + 1;
+            if ((rxCounter + 1) == DELAY_FRAMES) begin
+                rxState <= RX_STATE_READ;
+            end
+        end
+        RX_STATE_READ: begin
+            rxCounter <= 1;
+            dataIn <= {uart_rx, dataIn[7:1]};
+            rxBitNumber <= rxBitNumber + 1;
+            if (rxBitNumber == 3'b111)
+                rxState <= RX_STATE_STOP_BIT;
+            else
+                rxState <= RX_STATE_READ_WAIT;
+        end
+        RX_STATE_STOP_BIT: begin
+            rxCounter <= rxCounter + 1;
+            if ((rxCounter + 1) == DELAY_FRAMES) begin
+                rxState <= RX_STATE_IDLE;
+                rxCounter <= 0;
+                byteReady <= 1;
+            end
+        end
+    endcase
+end
+
+
+//// uart tx
+
+reg [3:0] txState = 0;
+reg [24:0] txCounter = 0;
+reg [1:0] txPinRegister = 1;
+reg [2:0] txBitNumber = 0;
+reg [3:0] txByteCounter = 0;
+
+localparam MEMORY_LENGTH = 5;
+
+localparam TX_STATE_IDLE = 0;
+localparam TX_STATE_START_BIT = 1;
+localparam TX_STATE_WRITE = 2;
+localparam TX_STATE_STOP_BIT = 3;
+localparam TX_STATE_DEBOUNCE = 4;
+
+always @(posedge clk) begin
+    case (txState)
+        TX_STATE_IDLE: begin
+            if (btn1 == 0) begin
+                txState <= TX_STATE_START_BIT;
+                txCounter <= 0;
+                txByteCounter <= 0;
+            end
+            else begin
+                txPinRegister <= 1;
+            end
+        end 
+        TX_STATE_START_BIT: begin
+            txPinRegister <= 0;
+            if ((txCounter + 1) == DELAY_FRAMES) begin
+                txState <= TX_STATE_WRITE;
+                txBitNumber <= 0;
+                txCounter <= 0;
+            end else 
+                txCounter <= txCounter + 1;
+        end
+        TX_STATE_WRITE: begin
+            txPinRegister <= exploit_bytes_reg[txBitNumber];
+            if ((txCounter + 1) == DELAY_FRAMES) begin
+                if (txBitNumber == 7) begin
+                    txState <= TX_STATE_STOP_BIT;
+                end else begin
+                    txState <= TX_STATE_WRITE;
+                    txBitNumber <= txBitNumber + 1;
+                end
+                txCounter <= 0;
+            end else 
+                txCounter <= txCounter + 1;
+        end
+        TX_STATE_STOP_BIT: begin
+            txPinRegister <= 1;
+            if ((txCounter + 1) == DELAY_FRAMES) begin
+                if (txByteCounter == MEMORY_LENGTH - 1) begin
+                    txState <= TX_STATE_DEBOUNCE;
+                end else begin
+                    txByteCounter <= txByteCounter + 1;
+                    txState <= TX_STATE_START_BIT;
+                end
+                txCounter <= 0;
+            end else 
+                txCounter <= txCounter + 1;
+        end
+        TX_STATE_DEBOUNCE: begin
+            if (txCounter == 23'b111111111111111111) begin
+                if (btn1 == 1) 
+                    txState <= TX_STATE_IDLE;
+            end else
+                txCounter <= txCounter + 1;
+        end
+    endcase      
+end
+
+// assigns to output 
+assign led = ledCounter;
+assign power_tx = power_tx_reg;
+assign uart_tx = txPinRegister;
+
+endmodule

ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/lushayproject.lushay.json

@@ -0,0 +1,9 @@
+{
+    "name": "ESP32-S3_Exploit_UART",
+    "board": "tangnano9k",
+    "includedFiles": ["ESP32-S3_Exploit_UART.v"],
+    "constraintsFile": "tangnano9k.cst",
+    "baudRate": 115200,
+    "top":"exploit"
+
+}

ESP32-S3_Exploit_FPGA/ESP32-S3_Exploit_UART/tangnano9k.cst

@@ -0,0 +1,30 @@
+IO_LOC  "clk" 52;
+IO_PORT "clk" PULL_MODE=UP;
+
+IO_LOC  "uart_rx" 18;
+IO_PORT "uart_rx" IO_TYPE=LVCMOS33;
+
+IO_LOC  "uart_tx" 17;
+IO_PORT "uart_tx" IO_TYPE=LVCMOS33;
+
+IO_LOC  "btn1" 3;
+
+IO_LOC  "bang_tx" 69;
+
+IO_LOC  "power_tx" 57;
+IO_PORT "power_tx" DRIVE=24;
+
+IO_LOC  "clk_in" 56;
+IO_PORT "clk_in" PULL_MODE=UP;
+
+IO_LOC  "led[0]" 10;
+
+IO_LOC  "led[1]" 11;
+
+IO_LOC  "led[2]" 13;
+
+IO_LOC  "led[3]" 14;
+
+IO_LOC  "led[4]" 15;
+
+IO_LOC  "led[5]" 16;

ESP32-S3_Exploit_FPGA/README.md

@@ -0,0 +1,6 @@
+Made for the [Tang Nano 9K FPGA](https://www.aliexpress.us/item/3256807026232976.html?channel=twinner)
+Build using [Lushay Code](https://learn.lushaylabs.com/vscode-extension/) for VS Code
+
+Testing using the two versions
+[Bit-bang version](ESP32-S3_Exploit_BitBang/)
+[UART version](ESP32-S3_Exploit_UART/)

Ghidra/elf-memory-map.txt

@@ -0,0 +1,78 @@
+# name start end length R W X
+segment_0	3fcd7000	3fcd75b3	0x5b4	true	true	false
+.static_dram_start	3fcd7e00	3fcd7e03	0x4	true	true	false
+.bss_shared_bufs	3fcd7e04	3fce9703	0x11900	true	true	false
+.stack_pro	3fce9704	3fceb70f	0x200c	true	true	false
+.stack_app	3fceb710	3fced70f	0x2000	true	true	false
+.bss_ets	3fced710	3fcedf1b	0x80c	true	true	false
+.bss_spi_slave	3fcedf1c	3fcedf2f	0x14	true	true	false
+.bss_hal	3fcedf30	3fcedf5f	0x30	true	true	false
+.bss_xtos	3fcee380	3fceee33	0xab4	true	true	false
+.bss_usbdev	3fceeeb4	3fcef12f	0x27c	true	true	false
+.bss_uart	3fcef134	3fcef173	0x40	true	true	false
+.bss_btdm	3fcef180	3fcef1a3	0x24	true	true	false
+.bss_pp_rom	3fcef308	3fcef3d3	0xcc	true	true	false
+.bss_spi_flash	3fcef6c0	3fcef713	0x54	true	true	false
+.bss_cache	3fcef71c	3fcef73b	0x20	true	true	false
+.bss_opi_flash	3fcef73c	3fcef743	0x8	true	true	false
+.bss_ets_printf	3fcef744	3fcef757	0x14	true	true	false
+.bss_ets_rtc	3fcef75c	3fcef75f	0x4	true	true	false
+.bss_ets_apb_backup	3fcef760	3fcef767	0x8	true	true	false
+.bss_newlib	3fcef768	3fcef76f	0x8	true	true	false
+.rodata	3ff18c00	3ff1eb3b	0x5f3c	true	false	false
+.WindowVectors.text	40000000	4000016f	0x170	true	false	true
+.Level2InterruptVector.text	40000180	40000185	0x6	true	false	true
+.Level3InterruptVector.text	400001c0	400001c5	0x6	true	false	true
+.Level4InterruptVector.text	40000200	40000205	0x6	true	false	true
+.Level5InterruptVector.text	40000240	40000245	0x6	true	false	true
+.DebugExceptionVector.text	40000280	4000028a	0xb	true	false	true
+.NMIExceptionVector.text	400002c0	400002c2	0x3	true	false	true
+.KernelExceptionVector.text	40000300	40000305	0x6	true	false	true
+.UserExceptionVector.text	40000340	40000364	0x25	true	false	true
+.DoubleExceptionVector.text	400003c0	400003c5	0x6	true	false	true
+.ResetVector.text	40000400	4000056b	0x16c	true	false	true
+.fixed.test	4000056c	40006433	0x5ec8	true	false	true
+.bt_text	40006434	40034af1	0x2e6be	true	false	true
+.text	40034af4	400577a7	0x22cb4	true	false	true
+EXTERNAL	40058000	40058427	0x428	true	true	false
+.bss.interface.bluetooth	.bss.interface.bluetooth::3fcefa14	.bss.interface.bluetooth::3fceffab	0x598	false	false	false
+.bss.interface.cache	.bss.interface.cache::3fceffc8	.bss.interface.cache::3fceffcf	0x8	false	false	false
+.bss.interface.esp_flash	.bss.interface.esp_flash::3fceffdc	.bss.interface.esp_flash::3fceffdf	0x4	false	false	false
+.bss.interface.newlib	.bss.interface.newlib::3fceffd0	.bss.interface.newlib::3fceffd7	0x8	false	false	false
+.bss.interface.opi_flash	.bss.interface.opi_flash::3fcefff4	.bss.interface.opi_flash::3fcefff7	0x4	false	false	false
+.bss.interface.rom_coexist	.bss.interface.rom_coexist::3fcef820	.bss.interface.rom_coexist::3fcef837	0x18	false	false	false
+.bss.interface.rom_net80211	.bss.interface.rom_net80211::3fcef838	.bss.interface.rom_net80211::3fcef85b	0x24	false	false	false
+.bss.interface.rom_phy	.bss.interface.rom_phy::3fcef81c	.bss.interface.rom_phy::3fcef81f	0x4	false	false	false
+.bss.interface.rom_pp	.bss.interface.rom_pp::3fcef85c	.bss.interface.rom_pp::3fcef957	0xfc	false	false	false
+.bss.interface.spiflash_legacy	.bss.interface.spiflash_legacy::3fceffec	.bss.interface.spiflash_legacy::3fceffef	0x4	false	false	false
+.bss.interface.usb_module	.bss.interface.usb_module::3fceffac	.bss.interface.usb_module::3fceffb7	0xc	false	false	false
+.bss.interface.usb_uart	.bss.interface.usb_uart::3fceffb8	.bss.interface.usb_uart::3fceffbf	0x8	false	false	false
+.comment	.comment::00000000	.comment::00000067	0x68	false	false	false
+.data.interface.bluetooth	.data.interface.bluetooth::3fcef958	.data.interface.bluetooth::3fcefa13	0xbc	false	false	false
+.data.interface.cache	.data.interface.cache::3fceffc4	.data.interface.cache::3fceffc7	0x4	false	false	false
+.data.interface.common	.data.interface.common::3fcefffc	.data.interface.common::3fceffff	0x4	false	false	false
+.data.interface.ecc	.data.interface.ecc::3fceffc0	.data.interface.ecc::3fceffc3	0x4	false	false	false
+.data.interface.esp-dsp	.data.interface.esp-dsp::3fcefff8	.data.interface.esp-dsp::3fcefffb	0x4	false	false	false
+.data.interface.esp_flash	.data.interface.esp_flash::3fceffd8	.data.interface.esp_flash::3fceffdb	0x4	false	false	false
+.data.interface.opi_flash	.data.interface.opi_flash::3fcefff0	.data.interface.opi_flash::3fcefff3	0x4	false	false	false
+.data.interface.spi_flash_chips	.data.interface.spi_flash_chips::3fceffe0	.data.interface.spi_flash_chips::3fceffe3	0x4	false	false	false
+.data.interface.spiflash_legacy	.data.interface.spiflash_legacy::3fceffe4	.data.interface.spiflash_legacy::3fceffeb	0x8	false	false	false
+.data_btdm	.data_btdm::3fcef174	.data_btdm::3fcef17f	0xc	false	false	false
+.data_cache	.data_cache::3fcef714	.data_cache::3fcef71b	0x8	false	false	false
+.data_coexist_rom	.data_coexist_rom::3fcef1a4	.data_coexist_rom::3fcef1a7	0x4	false	false	false
+.data_ets_delay	.data_ets_delay::3fcef758	.data_ets_delay::3fcef75b	0x4	false	false	false
+.data_net80211_rom	.data_net80211_rom::3fcef1a8	.data_net80211_rom::3fcef1ab	0x4	false	false	false
+.data_phyrom	.data_phyrom::3fcef3d4	.data_phyrom::3fcef66b	0x298	false	false	false
+.data_pp_rom	.data_pp_rom::3fcef1ac	.data_pp_rom::3fcef307	0x15c	false	false	false
+.data_spi_flash	.data_spi_flash::3fcef66c	.data_spi_flash::3fcef6bf	0x54	false	false	false
+.data_uart	.data_uart::3fcef130	.data_uart::3fcef133	0x4	false	false	false
+.data_usbdev	.data_usbdev::3fceee34	.data_usbdev::3fceeeb3	0x80	false	false	false
+.data_xtos	.data_xtos::3fcedf60	.data_xtos::3fcee377	0x418	false	false	false
+.rodata.interface	.rodata.interface::3ff1ee50	.rodata.interface::3ff1ffff	0x11b0	false	false	false
+.shstrtab	.shstrtab::00000000	.shstrtab::000006a8	0x6a9	false	false	false
+.strtab	.strtab::00000000	.strtab::0001515f	0x15160	false	false	false
+.symtab	.symtab::00000000	.symtab::0001cebf	0x1cec0	false	false	false
+.xt.lit	.xt.lit::00000000	.xt.lit::00001a17	0x1a18	false	false	false
+.xt.prop	.xt.prop::00000000	.xt.prop::0004edbb	0x4edbc	false	false	false
+.xtensa.info	.xtensa.info::00000000	.xtensa.info::00000037	0x38	false	false	false
+_elfSectionHeaders	_elfSectionHeaders::00000000	_elfSectionHeaders::00001017	0x1018	false	false	false

Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/00/00000000.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="Program" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8381e61265560594118100" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="esp32s3_rev0_rom.elf" />
+    </BASIC_INFO>
+</FILE_INFO>

Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/idata/~index.dat

@@ -0,0 +1,5 @@
+VERSION=1
+/
+  00000000:esp32s3_rev0_rom.elf:c0a8381e61265560594118100
+NEXT-ID:1
+MD5:d41d8cd98f00b204e9800998ecf8427e

Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/project.prp

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="OWNER" TYPE="string" VALUE="human" />
+    </BASIC_INFO>
+</FILE_INFO>

Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/00/00000000.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="ProgramUserData" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8381ec2072237217544300" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="udf_c0a8381e61265560594118100" />
+    </BASIC_INFO>
+</FILE_INFO>

Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/user/~index.dat

@@ -0,0 +1,5 @@
+VERSION=1
+/
+  00000000:udf_c0a8381e61265560594118100:c0a8381ec2072237217544300
+NEXT-ID:1
+MD5:d41d8cd98f00b204e9800998ecf8427e

Ghidra/ghidra-progject-esp32s3-bootrom-exploit.rep/versioned/~index.dat

@@ -0,0 +1,4 @@
+VERSION=1
+/
+NEXT-ID:0
+MD5:d41d8cd98f00b204e9800998ecf8427e

README.md

@@ -1,2 +1,16 @@
-# esp-bootrom-exploit
-
+# esp-bootrom-exploit
+Working on an exploit to break the security on the ESP32-S3
+Highly a work in progress
+
+[entropy](entropy/) - entropy images of the bootroms  
+[esp-rom-elfs-20230320](esp-rom-elfs-20230320/) - all of the ESP32-X bootloader elfs from [here](https://github.com/espressif/esp-rom-elfs/releases/tag/20230320)  
+[ESP32-S3_Exploit_FPGA](ESP32-S3_Exploit_FPGA/) - runs the exploit, based on a cheap [Tang Nano 9K FPGA](https://www.aliexpress.us/item/3256807026232976.html?channel=twinner) using [Lushay Code](https://learn.lushaylabs.com/vscode-extension/) for VS Code  
+[existing_files](existing_files/) - assorted existing roms I found  
+[Ghidra](Ghidra/) - Ghidra project for reverse engineering and exploit dev  
+[libs](libs/) - extra libraries that Espressif disclosed was used in the roms, excepting those found natively in esp-idf (useful for reverse engineering and debugging)  
+[sillyfillyespdumper](sillyfillyespdumper/) - tool I made to dump arbitrary data from ESP32-Xs  
+[silltfillyespdumper/live-roms](sillyfillyespdumper/live-roms/) - full, redundant rom dumps from two production ESP32-S3s  
+   
+
+Based much on [Coruk's attack on the ESP32-C3](https://courk.cc/esp32-c3-c6-fault-injection)
+

XTENSABOOTROM.rep/idata/00/00000000.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="Program" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8381e17a248706805679800" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="esp32s3_rev0_rom.elf" />
+    </BASIC_INFO>
+</FILE_INFO>

XTENSABOOTROM.rep/idata/00/00000001.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="Program" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8381e1bb248882247094000" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="qemu_esp32s3_rev0_rom.bin" />
+    </BASIC_INFO>
+</FILE_INFO>

XTENSABOOTROM.rep/idata/00/00000002.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="Program" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8381de636534513122800" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="second.o" />
+    </BASIC_INFO>
+</FILE_INFO>

XTENSABOOTROM.rep/idata/00/00000003.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="Program" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8381bcb552259264623100" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="esp32-s3-devkit-1-v1.1_internal-ROM0-0x4000_0000-0x3FFFF_instruction-bus_256K_stub_empty-flash.bin" />
+    </BASIC_INFO>
+</FILE_INFO>

XTENSABOOTROM.rep/idata/~index.bak

@@ -0,0 +1,8 @@
+VERSION=1
+/
+  00000003:esp32-s3-devkit-1-v1.1_internal-ROM0-0x4000_0000-0x3FFFF_instruction-bus_256K_stub_empty-flash.bin:c0a8381bcb552259264623100
+  00000000:esp32s3_rev0_rom.elf:c0a8381e17a248706805679800
+  00000001:qemu_esp32s3_rev0_rom.bin:c0a8381e1bb248882247094000
+  00000002:second.o:c0a8381de636534513122800
+NEXT-ID:4
+MD5:d41d8cd98f00b204e9800998ecf8427e

XTENSABOOTROM.rep/idata/~index.dat

@@ -0,0 +1,8 @@
+VERSION=1
+/
+  00000003:esp32-s3-devkit-1-v1.1_internal-ROM0-0x4000_0000-0x3FFFF_instruction-bus_256K_stub_empty-flash.bin:c0a8381bcb552259264623100
+  00000000:esp32s3_rev0_rom.elf:c0a8381e17a248706805679800
+  00000001:qemu_esp32s3_rev0_rom.bin:c0a8381e1bb248882247094000
+  00000002:second.o:c0a8381de636534513122800
+NEXT-ID:4
+MD5:d41d8cd98f00b204e9800998ecf8427e

XTENSABOOTROM.rep/project.prp

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="OWNER" TYPE="string" VALUE="human" />
+    </BASIC_INFO>
+</FILE_INFO>

XTENSABOOTROM.rep/projectState

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<PROJECT>
+    <PROJECT_DATA_XML_NAME NAME="DISPLAY_DATA">
+        <SAVE_STATE>
+            <ARRAY NAME="EXPANDED_PATHS" TYPE="string">
+                <A VALUE="XTENSABOOTROM:" />
+            </ARRAY>
+            <STATE NAME="SHOW_TABLE" TYPE="boolean" VALUE="false" />
+        </SAVE_STATE>
+    </PROJECT_DATA_XML_NAME>
+    <TOOL_MANAGER ACTIVE_WORKSPACE="Workspace">
+        <WORKSPACE NAME="Workspace" ACTIVE="true" />
+    </TOOL_MANAGER>
+</PROJECT>
+

XTENSABOOTROM.rep/user/00/00000000.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="ProgramUserData" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8381d5332590910137400" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="udf_c0a8381e1bb248882247094000" />
+    </BASIC_INFO>
+</FILE_INFO>

XTENSABOOTROM.rep/user/00/00000001.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="ProgramUserData" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8381d5342590954634300" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="udf_c0a8381e17a248706805679800" />
+    </BASIC_INFO>
+</FILE_INFO>

XTENSABOOTROM.rep/user/00/00000002.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="ProgramUserData" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8381f05515177828920600" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="udf_c0a8381de636534513122800" />
+    </BASIC_INFO>
+</FILE_INFO>

XTENSABOOTROM.rep/user/00/00000003.prp

@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FILE_INFO>
+    <BASIC_INFO>
+        <STATE NAME="CONTENT_TYPE" TYPE="string" VALUE="ProgramUserData" />
+        <STATE NAME="PARENT" TYPE="string" VALUE="/" />
+        <STATE NAME="FILE_ID" TYPE="string" VALUE="c0a8381bd1752441915334200" />
+        <STATE NAME="FILE_TYPE" TYPE="int" VALUE="0" />
+        <STATE NAME="READ_ONLY" TYPE="boolean" VALUE="false" />
+        <STATE NAME="NAME" TYPE="string" VALUE="udf_c0a8381bcb552259264623100" />
+    </BASIC_INFO>
+</FILE_INFO>

XTENSABOOTROM.rep/user/~index.bak

@@ -0,0 +1,7 @@
+VERSION=1
+/
+  00000002:udf_c0a8381de636534513122800:c0a8381f05515177828920600
+  00000001:udf_c0a8381e17a248706805679800:c0a8381d5342590954634300
+  00000000:udf_c0a8381e1bb248882247094000:c0a8381d5332590910137400
+NEXT-ID:3
+MD5:d41d8cd98f00b204e9800998ecf8427e

XTENSABOOTROM.rep/user/~index.dat

@@ -0,0 +1,8 @@
+VERSION=1
+/
+  00000003:udf_c0a8381bcb552259264623100:c0a8381bd1752441915334200
+  00000002:udf_c0a8381de636534513122800:c0a8381f05515177828920600
+  00000001:udf_c0a8381e17a248706805679800:c0a8381d5342590954634300
+  00000000:udf_c0a8381e1bb248882247094000:c0a8381d5332590910137400
+NEXT-ID:4
+MD5:d41d8cd98f00b204e9800998ecf8427e

XTENSABOOTROM.rep/user/~journal.bak

@@ -0,0 +1,2 @@
+IADD:00000003:/udf_c0a8381bcb552259264623100
+IDSET:/udf_c0a8381bcb552259264623100:c0a8381bd1752441915334200

XTENSABOOTROM.rep/versioned/~index.bak

@@ -0,0 +1,4 @@
+VERSION=1
+/
+NEXT-ID:0
+MD5:d41d8cd98f00b204e9800998ecf8427e

XTENSABOOTROM.rep/versioned/~index.dat

@@ -0,0 +1,4 @@
+VERSION=1
+/
+NEXT-ID:0
+MD5:d41d8cd98f00b204e9800998ecf8427e

libs/miniz_v115_r4/CMakeLists.txt

@@ -0,0 +1,64 @@
+PROJECT(miniz)
+cmake_minimum_required(VERSION 2.8)
+option(BUILD_X64 "build 64-bit" TRUE)
+
+message("Initial BUILD_X64=${BUILD_X64}")
+message("Initial CMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}")
+
+if( NOT CMAKE_BUILD_TYPE )
+  set( CMAKE_BUILD_TYPE Release )
+endif( NOT CMAKE_BUILD_TYPE )
+
+message( ${PROJECT_NAME} " build type: " ${CMAKE_BUILD_TYPE} )
+
+if (BUILD_X64)
+	message("Building 64-bit")
+else()
+	message("Building 32-bit")
+endif(BUILD_X64)
+
+set(CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG} -g -Wall -Wextra")
+set(CMAKE_C_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG} -g -Wall -Wextra")
+set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -Wall -Wextra")
+set(CMAKE_C_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} -Wall -Wextra")
+set(CMAKE_CXX_FLAGS_RELEASE "-O3")
+
+set(EXAMPLE1_SRC_LIST ${COMMON_SRC_LIST} example1.c)
+set(EXAMPLE2_SRC_LIST ${COMMON_SRC_LIST} example2.c)
+set(EXAMPLE3_SRC_LIST ${COMMON_SRC_LIST} example3.c)
+set(EXAMPLE4_SRC_LIST ${COMMON_SRC_LIST} example4.c)
+set(EXAMPLE5_SRC_LIST ${COMMON_SRC_LIST} example5.c)
+set(EXAMPLE6_SRC_LIST ${COMMON_SRC_LIST} example6.c)
+set(MINIZ_TESTER_SRC_LIST ${COMMON_SRC_LIST} miniz_tester.cpp miniz.c timer.cpp timer.h)
+
+# -fno-strict-aliasing is probably not required to build miniz.c (I've been testing with it not defined for a while), but it's what I'm used to from working with Visual Studio.
+set(GCC_COMPILE_FLAGS "-fno-strict-aliasing -D_LARGEFILE64_SOURCE=1 -D_FILE_OFFSET_BITS=64")
+
+if (NOT BUILD_X64)
+	set(GCC_COMPILE_FLAGS "${GCC_COMPILE_FLAGS} -m32")
+endif()
+
+set(CMAKE_EXE_LINKER_FLAGS  "${CMAKE_EXE_LINKER_FLAGS} ${GCC_LINK_FLAGS}")
+
+set(CMAKE_C_FLAGS  "${CMAKE_C_FLAGS} ${GCC_COMPILE_FLAGS}")
+set(CMAKE_C_FLAGS_RELEASE  "${CMAKE_C_FLAGS_RELEASE} ${GCC_COMPILE_FLAGS}")
+set(CMAKE_C_FLAGS_DEBUG "${CMAKE_C_FLAGS_DEBUG} ${GCC_COMPILE_FLAGS} -D_DEBUG")
+
+set(CMAKE_CXX_FLAGS  "${CMAKE_CXX_FLAGS} ${GCC_COMPILE_FLAGS}")
+set(CMAKE_CXX_FLAGS_RELEASE  "${CMAKE_CXX_FLAGS_RELEASE} ${GCC_COMPILE_FLAGS}")
+set(CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG} ${GCC_COMPILE_FLAGS} -D_DEBUG")
+
+include_directories(${PROJECT_SOURCE_DIR}/.)
+
+set(CMAKE_RUNTIME_OUTPUT_DIRECTORY ${CMAKE_SOURCE_DIR}/bin_linux)
+
+add_executable(example1 ${EXAMPLE1_SRC_LIST})
+add_executable(example2 ${EXAMPLE2_SRC_LIST})
+add_executable(example3 ${EXAMPLE3_SRC_LIST})
+add_executable(example4 ${EXAMPLE4_SRC_LIST})
+add_executable(example5 ${EXAMPLE5_SRC_LIST})
+
+add_executable(example6 ${EXAMPLE6_SRC_LIST})
+target_link_libraries(example6 m)
+
+add_executable(miniz_tester ${MINIZ_TESTER_SRC_LIST})

libs/miniz_v115_r4/example1.c

@@ -0,0 +1,105 @@
+// example1.c - Demonstrates miniz.c's compress() and uncompress() functions (same as zlib's).
+// Public domain, May 15 2011, Rich Geldreich, richgel99@gmail.com. See "unlicense" statement at the end of tinfl.c.
+#include "miniz.c"
+
+typedef unsigned char uint8;
+typedef unsigned short uint16;
+typedef unsigned int uint;
+
+// The string to compress.
+static const char *s_pStr = "Good morning Dr. Chandra. This is Hal. I am ready for my first lesson." \
+  "Good morning Dr. Chandra. This is Hal. I am ready for my first lesson." \
+  "Good morning Dr. Chandra. This is Hal. I am ready for my first lesson." \
+  "Good morning Dr. Chandra. This is Hal. I am ready for my first lesson." \
+  "Good morning Dr. Chandra. This is Hal. I am ready for my first lesson." \
+  "Good morning Dr. Chandra. This is Hal. I am ready for my first lesson." \
+  "Good morning Dr. Chandra. This is Hal. I am ready for my first lesson.";
+
+int main(int argc, char *argv[])
+{
+  uint step = 0;
+  int cmp_status;
+  uLong src_len = (uLong)strlen(s_pStr);
+  uLong cmp_len = compressBound(src_len);
+  uLong uncomp_len = src_len;
+  uint8 *pCmp, *pUncomp;
+  uint total_succeeded = 0;
+  (void)argc, (void)argv;
+
+  printf("miniz.c version: %s\n", MZ_VERSION);
+
+  do
+  {
+    // Allocate buffers to hold compressed and uncompressed data.
+    pCmp = (mz_uint8 *)malloc((size_t)cmp_len);
+    pUncomp = (mz_uint8 *)malloc((size_t)src_len);
+    if ((!pCmp) || (!pUncomp))
+    {
+      printf("Out of memory!\n");
+      return EXIT_FAILURE;
+    }
+
+    // Compress the string.
+    cmp_status = compress(pCmp, &cmp_len, (const unsigned char *)s_pStr, src_len);
+    if (cmp_status != Z_OK)
+    {
+      printf("compress() failed!\n");
+      free(pCmp);
+      free(pUncomp);
+      return EXIT_FAILURE;
+    }
+
+    printf("Compressed from %u to %u bytes\n", (mz_uint32)src_len, (mz_uint32)cmp_len);
+
+    if (step)
+    {
+      // Purposely corrupt the compressed data if fuzzy testing (this is a very crude fuzzy test).
+      uint n = 1 + (rand() % 3);
+      while (n--)
+      {
+        uint i = rand() % cmp_len;
+        pCmp[i] ^= (rand() & 0xFF);
+      }
+    }
+
+    // Decompress.
+    cmp_status = uncompress(pUncomp, &uncomp_len, pCmp, cmp_len);
+    total_succeeded += (cmp_status == Z_OK);
+
+    if (step)
+    {
+      printf("Simple fuzzy test: step %u total_succeeded: %u\n", step, total_succeeded);
+    }
+    else
+    {
+      if (cmp_status != Z_OK)
+      {
+        printf("uncompress failed!\n");
+        free(pCmp);
+        free(pUncomp);
+        return EXIT_FAILURE;
+      }
+
+      printf("Decompressed from %u to %u bytes\n", (mz_uint32)cmp_len, (mz_uint32)uncomp_len);
+
+      // Ensure uncompress() returned the expected data.
+      if ((uncomp_len != src_len) || (memcmp(pUncomp, s_pStr, (size_t)src_len)))
+      {
+        printf("Decompression failed!\n");
+        free(pCmp);
+        free(pUncomp);
+        return EXIT_FAILURE;
+      }
+    }
+
+    free(pCmp);
+    free(pUncomp);
+
+    step++;
+
+    // Keep on fuzzy testing if there's a non-empty command line.
+  } while (argc >= 2);
+
+  printf("Success.\n");
+  return EXIT_SUCCESS;
+}

libs/miniz_v115_r4/example1.cbp

@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
+<CodeBlocks_project_file>
+	<FileVersion major="1" minor="6" />
+	<Project>
+		<Option title="example1" />
+		<Option pch_mode="2" />
+		<Option compiler="gcc" />
+		<Build>
+			<Target title="Debug Win32">
+				<Option output="$(SolutionDir)bin_mingw\example1D" prefix_auto="1" extension_auto="1" />
+				<Option working_dir="$(SolutionDir)bin_mingw" />
+				<Option object_output="example1\Debug Win32_Win32" />
+				<Option type="1" />
+				<Option compiler="gcc" />
+				<Compiler>
+					<Add option="-Wall" />
+					<Add option="-g" />
+					<Add option="-O0" />
+					<Add option="-m32" />
+					<Add option="-DWIN32" />
+					<Add option="-D_DEBUG" />
+					<Add option="-D_CONSOLE" />
+					<Add option="-D_CRT_SECURE_NO_WARNINGS" />
+				</Compiler>
+				<Linker>
+					<Add option="-m32" />
+				</Linker>
+			</Target>
+			<Target title="Debug x64">
+				<Option output="$(SolutionDir)bin_mingw\example1_x64D" prefix_auto="1" extension_auto="1" />
+				<Option working_dir="$(SolutionDir)bin_mingw" />
+				<Option object_output="example1\Debug x64_Win32" />
+				<Option type="1" />
+				<Option compiler="gcc" />
+				<Compiler>
+					<Add option="-DWIN32" />
+					<Add option="-D_DEBUG" />
+					<Add option="-D_CONSOLE" />
+					<Add option="-D_CRT_SECURE_NO_WARNINGS" />
+					<Add option="-Wall" />
+					<Add option="-O0" />
+				</Compiler>
+			</Target>
+			<Target title="Release Win32">
+				<Option output="$(SolutionDir)bin_mingw\example1" prefix_auto="1" extension_auto="1" />
+				<Option working_dir="$(SolutionDir)bin_mingw" />
+				<Option object_output="example1\Release Win32_Win32" />
+				<Option type="1" />
+				<Option compiler="gcc" />
+				<Compiler>
+					<Add option="-O3" />
+					<Add option="-Wall" />
+					<Add option="-m32" />
+					<Add option="-DWIN32" />
+					<Add option="-DNDEBUG" />
+					<Add option="-D_CONSOLE" />
+					<Add option="-D_CRT_SECURE_NO_WARNINGS" />
+				</Compiler>
+				<Linker>
+					<Add option="-s" />
+					<Add option="-m32" />
+				</Linker>
+			</Target>
+			<Target title="Release x64">
+				<Option output="$(SolutionDir)bin_mingw\example1_x64" prefix_auto="1" extension_auto="1" />
+				<Option working_dir="$(SolutionDir)bin_mingw" />
+				<Option object_output="example1\Release x64_Win32" />
+				<Option type="1" />
+				<Option compiler="gcc" />
+				<Compiler>
+					<Add option="-DWIN32" />
+					<Add option="-DNDEBUG" />
+					<Add option="-D_CONSOLE" />
+					<Add option="-D_CRT_SECURE_NO_WARNINGS" />
+					<Add option="-Wall" />
+					<Add option="-O3" />
+				</Compiler>
+			</Target>
+		</Build>
+		<Unit filename="example1.c">
+			<Option compilerVar="CC" />
+		</Unit>
+		<Extensions>
+			<code_completion />
+			<debugger />
+		</Extensions>
+	</Project>
+</CodeBlocks_project_file>

libs/miniz_v115_r4/example1.vcproj

@@ -0,0 +1,346 @@
+<?xml version="1.0" encoding="Windows-1252"?>
+<VisualStudioProject
+	ProjectType="Visual C++"
+	Version="9.00"
+	Name="example1"
+	ProjectGUID="{BE273522-92D8-4B60-95C7-C3AEE10A303E}"
+	RootNamespace="example1"
+	Keyword="Win32Proj"
+	TargetFrameworkVersion="196613"
+	>
+	<Platforms>
+		<Platform
+			Name="Win32"
+		/>
+		<Platform
+			Name="x64"
+		/>
+	</Platforms>
+	<ToolFiles>
+	</ToolFiles>
+	<Configurations>
+		<Configuration
+			Name="Debug|Win32"
+			OutputDirectory="$(SolutionDir)bin"
+			IntermediateDirectory="$(ProjectName)\$(ConfigurationName)_$(PlatformName)"
+			ConfigurationType="1"
+			CharacterSet="1"
+			>
+			<Tool
+				Name="VCPreBuildEventTool"
+			/>
+			<Tool
+				Name="VCCustomBuildTool"
+			/>
+			<Tool
+				Name="VCXMLDataGeneratorTool"
+			/>
+			<Tool
+				Name="VCWebServiceProxyGeneratorTool"
+			/>
+			<Tool
+				Name="VCMIDLTool"
+			/>
+			<Tool
+				Name="VCCLCompilerTool"
+				Optimization="0"
+				PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS"
+				MinimalRebuild="true"
+				BasicRuntimeChecks="3"
+				RuntimeLibrary="1"
+				UsePrecompiledHeader="0"
+				WarningLevel="4"
+				DebugInformationFormat="4"
+			/>
+			<Tool
+				Name="VCManagedResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCPreLinkEventTool"
+			/>
+			<Tool
+				Name="VCLinkerTool"
+				OutputFile="$(OutDir)\$(ProjectName)D.exe"
+				LinkIncremental="2"
+				GenerateDebugInformation="true"
+				SubSystem="1"
+				TargetMachine="1"
+			/>
+			<Tool
+				Name="VCALinkTool"
+			/>
+			<Tool
+				Name="VCManifestTool"
+			/>
+			<Tool
+				Name="VCXDCMakeTool"
+			/>
+			<Tool
+				Name="VCBscMakeTool"
+			/>
+			<Tool
+				Name="VCFxCopTool"
+			/>
+			<Tool
+				Name="VCAppVerifierTool"
+			/>
+			<Tool
+				Name="VCPostBuildEventTool"
+			/>
+		</Configuration>
+		<Configuration
+			Name="Debug|x64"
+			OutputDirectory="$(SolutionDir)bin"
+			IntermediateDirectory="$(ProjectName)\$(ConfigurationName)_$(PlatformName)"
+			ConfigurationType="1"
+			CharacterSet="1"
+			>
+			<Tool
+				Name="VCPreBuildEventTool"
+			/>
+			<Tool
+				Name="VCCustomBuildTool"
+			/>
+			<Tool
+				Name="VCXMLDataGeneratorTool"
+			/>
+			<Tool
+				Name="VCWebServiceProxyGeneratorTool"
+			/>
+			<Tool
+				Name="VCMIDLTool"
+				TargetEnvironment="3"
+			/>
+			<Tool
+				Name="VCCLCompilerTool"
+				Optimization="0"
+				PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS"
+				MinimalRebuild="true"
+				BasicRuntimeChecks="3"
+				RuntimeLibrary="1"
+				UsePrecompiledHeader="0"
+				WarningLevel="4"
+				DebugInformationFormat="3"
+			/>
+			<Tool
+				Name="VCManagedResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCPreLinkEventTool"
+			/>
+			<Tool
+				Name="VCLinkerTool"
+				OutputFile="$(OutDir)\$(ProjectName)_x64D.exe"
+				LinkIncremental="2"
+				GenerateDebugInformation="true"
+				SubSystem="1"
+				TargetMachine="17"
+			/>
+			<Tool
+				Name="VCALinkTool"
+			/>
+			<Tool
+				Name="VCManifestTool"
+			/>
+			<Tool
+				Name="VCXDCMakeTool"
+			/>
+			<Tool
+				Name="VCBscMakeTool"
+			/>
+			<Tool
+				Name="VCFxCopTool"
+			/>
+			<Tool
+				Name="VCAppVerifierTool"
+			/>
+			<Tool
+				Name="VCPostBuildEventTool"
+			/>
+		</Configuration>
+		<Configuration
+			Name="Release|Win32"
+			OutputDirectory="$(SolutionDir)bin"
+			IntermediateDirectory="$(ProjectName)\$(ConfigurationName)_$(PlatformName)"
+			ConfigurationType="1"
+			CharacterSet="1"
+			WholeProgramOptimization="1"
+			>
+			<Tool
+				Name="VCPreBuildEventTool"
+			/>
+			<Tool
+				Name="VCCustomBuildTool"
+			/>
+			<Tool
+				Name="VCXMLDataGeneratorTool"
+			/>
+			<Tool
+				Name="VCWebServiceProxyGeneratorTool"
+			/>
+			<Tool
+				Name="VCMIDLTool"
+			/>
+			<Tool
+				Name="VCCLCompilerTool"
+				Optimization="3"
+				InlineFunctionExpansion="2"
+				EnableIntrinsicFunctions="true"
+				FavorSizeOrSpeed="1"
+				OmitFramePointers="true"
+				PreprocessorDefinitions="WIN32;NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS"
+				RuntimeLibrary="0"
+				EnableFunctionLevelLinking="true"
+				UsePrecompiledHeader="0"
+				WarningLevel="4"
+				DebugInformationFormat="3"
+			/>
+			<Tool
+				Name="VCManagedResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCPreLinkEventTool"
+			/>
+			<Tool
+				Name="VCLinkerTool"
+				LinkIncremental="1"
+				GenerateDebugInformation="true"
+				SubSystem="1"
+				OptimizeReferences="2"
+				EnableCOMDATFolding="2"
+				TargetMachine="1"
+			/>
+			<Tool
+				Name="VCALinkTool"
+			/>
+			<Tool
+				Name="VCManifestTool"
+			/>
+			<Tool
+				Name="VCXDCMakeTool"
+			/>
+			<Tool
+				Name="VCBscMakeTool"
+			/>
+			<Tool
+				Name="VCFxCopTool"
+			/>
+			<Tool
+				Name="VCAppVerifierTool"
+			/>
+			<Tool
+				Name="VCPostBuildEventTool"
+			/>
+		</Configuration>
+		<Configuration
+			Name="Release|x64"
+			OutputDirectory="$(SolutionDir)bin"
+			IntermediateDirectory="$(ProjectName)\$(ConfigurationName)_$(PlatformName)"
+			ConfigurationType="1"
+			CharacterSet="1"
+			WholeProgramOptimization="1"
+			>
+			<Tool
+				Name="VCPreBuildEventTool"
+			/>
+			<Tool
+				Name="VCCustomBuildTool"
+			/>
+			<Tool
+				Name="VCXMLDataGeneratorTool"
+			/>
+			<Tool
+				Name="VCWebServiceProxyGeneratorTool"
+			/>
+			<Tool
+				Name="VCMIDLTool"
+				TargetEnvironment="3"
+			/>
+			<Tool
+				Name="VCCLCompilerTool"
+				Optimization="3"
+				InlineFunctionExpansion="2"
+				EnableIntrinsicFunctions="true"
+				FavorSizeOrSpeed="1"
+				OmitFramePointers="true"
+				PreprocessorDefinitions="WIN32;NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS"
+				RuntimeLibrary="0"
+				EnableFunctionLevelLinking="true"
+				UsePrecompiledHeader="0"
+				WarningLevel="4"
+				DebugInformationFormat="3"
+			/>
+			<Tool
+				Name="VCManagedResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCResourceCompilerTool"
+			/>
+			<Tool
+				Name="VCPreLinkEventTool"
+			/>
+			<Tool
+				Name="VCLinkerTool"
+				OutputFile="$(OutDir)\$(ProjectName)_x64.exe"
+				LinkIncremental="1"
+				GenerateDebugInformation="true"
+				SubSystem="1"
+				OptimizeReferences="2"
+				EnableCOMDATFolding="2"
+				TargetMachine="17"
+			/>
+			<Tool
+				Name="VCALinkTool"
+			/>
+			<Tool
+				Name="VCManifestTool"
+			/>
+			<Tool
+				Name="VCXDCMakeTool"
+			/>
+			<Tool
+				Name="VCBscMakeTool"
+			/>
+			<Tool
+				Name="VCFxCopTool"
+			/>
+			<Tool
+				Name="VCAppVerifierTool"
+			/>
+			<Tool
+				Name="VCPostBuildEventTool"
+			/>
+		</Configuration>
+	</Configurations>
+	<References>
+	</References>
+	<Files>
+		<Filter
+			Name="Source Files"
+			Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
+			UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
+			>
+			<File
+				RelativePath=".\example1.c"
+				>
+			</File>
+		</Filter>
+		<Filter
+			Name="Resource Files"
+			Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav"
+			UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"
+			>
+		</Filter>
+	</Files>
+	<Globals>
+	</Globals>
+</VisualStudioProject>