109 lines
4.5 KiB
Plaintext
109 lines
4.5 KiB
Plaintext
|
|
|
|
|
|
Entry main: 0x40043A2C
|
|
Resides in: 0x40040000 to 0x4005FFFF - 128KB - Internal ROM 1
|
|
Address space begins at: 0x3FF00000 ?
|
|
|
|
list available machines:
|
|
/home/kali/.emulate-debug/qemu-xtensa/bin/qemu-system-xtensa -machine help
|
|
/home/kali/.emulate-debug/qemu-riscv/bin/qemu-system-riscv32 -machine help
|
|
emulate esp32s3:
|
|
/home/kali/.emulate-debug/qemu-xtensa/bin/qemu-system-xtensa -machine esp32s3
|
|
emulate riscv:
|
|
/home/kali/.emulate-debug/qemu-riscv/bin/qemu-system-riscv32 -machine esp32c3
|
|
|
|
espressif gdb
|
|
/home/kali/.emulate-debug/binutils-gdb/gdb/gdb --help
|
|
/home/kali/.emulate-debug/binutils-gdb/gdb/gdb -l 300 # set timeount to 300 seconds
|
|
|
|
exploit_dev folder:
|
|
/home/kali/sync/esp32s3-boot-rom-elf-uni.rep/exploit_dev/
|
|
.emulation-debug folder:
|
|
/home/kali/.emulate-debug/
|
|
|
|
esptool.py --chip esp32s3 elf2image --use_segments esp32s3_rev0_rom.elf
|
|
--output bin_file_name.bin
|
|
--flash_size 8MB
|
|
--pad-to-size 8MB
|
|
|
|
ROM Elfs:
|
|
./esp-rom-elfs-20230320
|
|
|
|
https://github.com/espressif/esp-rom-elfs/releases/tag/20230320
|
|
|
|
Full version in ROM ELF's filenames (major * 100 + minor). E.g:
|
|
esp32_rev300_rom.elf is for version 3.0
|
|
esp32c3_rev3_rom.elf is for version 0.3
|
|
Fix esp32c2 revision to 1.0
|
|
|
|
|
|
todo:
|
|
x reinstall esp-idf fucking again to test the reinstall script
|
|
x run dump on freenove fuckin again (twice) with latest for testing and final binutils
|
|
x run dump fuckin twice on another esp32s3 for compare
|
|
x save the shit and back the shit up
|
|
x add and push git projects
|
|
- document lmfao
|
|
- study the fuck out of cuork's c3 exploit
|
|
/ get on that fuckin binary exploit lmfao
|
|
|
|
== scratch ==
|
|
|
|
# running on byobu:
|
|
export ESPBAUD=115200; ./espdump.sh devkit; ./espdump.sh devkit; export ESPPORT=/dev/ttyACM1; ./espdump.sh freenove; ./espdump.sh freenove;
|
|
|
|
#dump_section "internal-ROM0" "instruction-bus" 0x4000_0000 0x4003_FFFF $chip
|
|
|
|
|
|
|
|
#dump_section "internal-ROM1" "data-bus" 0x3FF0_0000 0x3FF1_FFFF $chip
|
|
|
|
#dump_section "internal-ROM1" "instruction-bus" 0x4004_0000 0x4005_FFFF $chip
|
|
|
|
# internal ROM0, instruction bus, 0x4000_0000 to 0x4003_FFFF, 0x3FFFF length (256KB)
|
|
#echo "\n\ninterenal ROM0, instruction bus, 0x4000_0000 to 0x4003_FFFF, 0x3FFFF length (256KB)\n\n"
|
|
#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x4000_0000 0x3FFFF "$out_dir/live-freenove-boot-ROM0-instruction-bus-0x4000_0000-0x4003_FFFF-0x3FFFF-full-address-esp32s3-$datestamp.bin"
|
|
|
|
# internal ROM1, data bus, 0x3FF0_0000 to 0x3FF1_FFFF, 0x1FFFF length (128KB)
|
|
#echo "\n\ninternal ROM1, data bus, 0x3FF0_0000 to 0x3FF1_FFFF, 0x1FFFF length (128KB)\n\n"
|
|
#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x3FF00000 0x1FFFF "$out_dir/live-freenove-boot-ROM1-data-bus-0x3FF0_0000-0x3FF1_FFFF-0x1FFFF-full-address-esp32s3-$datestamp.bin"
|
|
|
|
# internal ROM1, instruction bus, 0x4004_0000 to 0x4005_FFFF, 0x1FFFF length (128KB)
|
|
#echo "\n\ninternal ROM1, instruction bus, 0x4004_0000 to 0x4005_FFFF, 0x1FFFF length (128KB)\n\n"
|
|
#esptool.py --baud $ESPBAUD --port $ESPPORT --chip esp32s3 dump_mem 0x3FF0_0000 0x1FFFF "$out_dir/live-freenove-boot-ROM1-instruction-bus-0x4004_0000-0x4005_FFF-0x1FFFF-full-address-esp32s3-$datestamp.bin"
|
|
|
|
# seems to be Internal SRAM2, data-bus
|
|
segment_0 data-bus 0x3fcd7000 0x3fcd75b3
|
|
0.static_dram_start data-bus 0x3fcd7e00 0x3fcd7e03
|
|
|
|
# Internal ROM1, data-bus
|
|
0.rodata data-bus 0x3ff18c00 0x3ff1eb3b
|
|
|
|
# Inernal ROM0, instruction-bus
|
|
0.WindowVectors.text instruction-bus 0x40000000 0x4000016f
|
|
0.Level2InterruptVector.text instruction-bus 0x40000180 0x40000185
|
|
0.Level3InterruptVector.text instruction-bus 0x400001c0 0x400001c5
|
|
0.Level4InterruptVector.text instruction-bus 0x40000200 0x40000205
|
|
0.Level5InterruptVector.text instruction-bus 0x40000240 0x40000245
|
|
0.DebugExceptionVector.text instruction-bus 0x40000280 0x4000028a
|
|
0.NMIExceptionVector.text instruction-bus 0x400002c0 0x400002c2
|
|
0.KernelExceptionVector.text instruction-bus 0x40000300 0x40000305
|
|
0.UserExceptionVector.text instruction-bus 0x40000340 0x40000364
|
|
0.DoubleExceptionVector.text instruction-bus 0x400003c0 0x400003c5
|
|
0.ResetVector.text instruction-bus 0x40000400 0x4000056b
|
|
0.fixed.test instruction-bus 0x4000056c 0x40006433
|
|
0.bt_text instruction-bus 0x40006434 0x40034af1
|
|
0.text instruction-bus 0x40034af4 0x400577a7
|
|
|
|
# External
|
|
EXTERNAL 0x40058000 0x40058427
|
|
|
|
python $IDF_PATH/tools/idf_tools.py install all
|
|
|
|
idf.py qemu --qemu-extra-args "--watch-cycles-breakpoint 100" monitor
|
|
|
|
idf.py fullclean; \
|
|
idf.py python-clean; \
|
|
idf.py set-target esp32s3; \
|
|
idf.py --verbose qemu monitor // output written to build/log |