Entry main: 0x40043A2C
Resides in: 0x40040000 to 0x4005FFFF - 128KB -  Internal ROM 1
Address space begins at: 0x3FF00000 ?

list available machines:
	/home/kali/.emulate-debug/qemu-xtensa/bin/qemu-system-xtensa -machine help
	/home/kali/.emulate-debug/qemu-riscv/bin/qemu-system-riscv32 -machine help
emulate esp32s3:
	/home/kali/.emulate-debug/qemu-xtensa/bin/qemu-system-xtensa -machine esp32s3
emulate riscv:
	/home/kali/.emulate-debug/qemu-riscv/bin/qemu-system-riscv32 -machine esp32c3

espressif gdb
	/home/kali/.emulate-debug/binutils-gdb/gdb/gdb --help
	/home/kali/.emulate-debug/binutils-gdb/gdb/gdb -l 300 # set timeount to 300 seconds

exploit_dev folder:
	/home/kali/sync/esp32s3-boot-rom-elf-uni.rep/exploit_dev/
.emulation-debug folder:
	/home/kali/.emulate-debug/

esptool.py --chip esp32s3 elf2image --use_segments esp32s3_rev0_rom.elf
	--output bin_file_name.bin
	--flash_size 8MB 
	--pad-to-size 8MB

ROM Elfs:
	./esp-rom-elfs-20230320

	https://github.com/espressif/esp-rom-elfs/releases/tag/20230320

	Full version in ROM ELF's filenames (major * 100 + minor). E.g:
	esp32_rev300_rom.elf is for version 3.0
	esp32c3_rev3_rom.elf is for version 0.3
	Fix esp32c2 revision to 1.0


todo:
 x reinstall esp-idf fucking again to test the reinstall script
 - run dump on freenove fuckin again (twice) with latest for testing and final binutils
 - run dump fuckin twice on another esp32s3 for compare
 - save the shit and back the shit up
 - add and push git projects
  - document lmfao
 - study the fuck out of cuork's c3 exploit
 - get on that fuckin binary exploit lmfao

== scratch ==

# running on byobu:
export ESPBAUD=115200; ./espdump.sh devkit; ./espdump.sh devkit; export ESPPORT=/dev/ttyACM1; ./espdump.sh freenove; ./espdump.sh freenove;

#dump_section "internal-ROM0" "instruction-bus" 0x4000_0000 0x4003_FFFF $chip



#dump_section "internal-ROM1" "data-bus" 0x3FF0_0000 0x3FF1_FFFF $chip

#dump_section "internal-ROM1" "instruction-bus" 0x4004_0000 0x4005_FFFF $chip

# internal ROM0, instruction bus, 0x4000_0000 to 0x4003_FFFF, 0x3FFFF length (256KB)
#echo "\n\ninterenal ROM0, instruction bus, 0x4000_0000 to 0x4003_FFFF, 0x3FFFF length (256KB)\n\n"
#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x4000_0000 0x3FFFF "$out_dir/live-freenove-boot-ROM0-instruction-bus-0x4000_0000-0x4003_FFFF-0x3FFFF-full-address-esp32s3-$datestamp.bin"

# internal ROM1, data bus, 0x3FF0_0000 to 0x3FF1_FFFF, 0x1FFFF length (128KB)
#echo "\n\ninternal ROM1, data bus, 0x3FF0_0000 to 0x3FF1_FFFF, 0x1FFFF length (128KB)\n\n"
#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x3FF00000 0x1FFFF "$out_dir/live-freenove-boot-ROM1-data-bus-0x3FF0_0000-0x3FF1_FFFF-0x1FFFF-full-address-esp32s3-$datestamp.bin"

# internal ROM1, instruction bus, 0x4004_0000 to 0x4005_FFFF, 0x1FFFF length (128KB)
#echo "\n\ninternal ROM1, instruction bus, 0x4004_0000 to 0x4005_FFFF, 0x1FFFF length (128KB)\n\n"
#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x3FF0_0000 0x1FFFF "$out_dir/live-freenove-boot-ROM1-instruction-bus-0x4004_0000-0x4005_FFF-0x1FFFF-full-address-esp32s3-$datestamp.bin"

# seems to be Internal SRAM2, data-bus
segment_0 data-bus 0x3fcd7000 0x3fcd75b3
0.static_dram_start data-bus 0x3fcd7e00 0x3fcd7e03

# Internal ROM1, data-bus
0.rodata data-bus 0x3ff18c00 0x3ff1eb3b

# Inernal ROM0, instruction-bus
0.WindowVectors.text instruction-bus 0x40000000 0x4000016f
0.Level2InterruptVector.text instruction-bus 0x40000180 0x40000185
0.Level3InterruptVector.text instruction-bus 0x400001c0 0x400001c5
0.Level4InterruptVector.text instruction-bus 0x40000200 0x40000205
0.Level5InterruptVector.text instruction-bus 0x40000240 0x40000245
0.DebugExceptionVector.text instruction-bus 0x40000280 0x4000028a
0.NMIExceptionVector.text instruction-bus 0x400002c0 0x400002c2
0.KernelExceptionVector.text instruction-bus 0x40000300 0x40000305
0.UserExceptionVector.text instruction-bus 0x40000340 0x40000364
0.DoubleExceptionVector.text instruction-bus 0x400003c0 0x400003c5
0.ResetVector.text instruction-bus 0x40000400 0x4000056b
0.fixed.test instruction-bus 0x4000056c 0x40006433
0.bt_text instruction-bus 0x40006434 0x40034af1
0.text instruction-bus 0x40034af4 0x400577a7

# External
EXTERNAL 0x40058000 0x40058427