diff --git a/source/exploit/dwc3.elf b/source/exploit/dwc3.elf index 9fb9c66..1531389 100755 Binary files a/source/exploit/dwc3.elf and b/source/exploit/dwc3.elf differ diff --git a/source/exploit/dwc3.o b/source/exploit/dwc3.o index 6ecab74..bf81e16 100644 Binary files a/source/exploit/dwc3.o and b/source/exploit/dwc3.o differ diff --git a/source/exploit/readme.md b/source/exploit/readme.md new file mode 100644 index 0000000..7d40077 --- /dev/null +++ b/source/exploit/readme.md @@ -0,0 +1,5 @@ +# Exploit + +## test_dwc3 +simple dwc3 usb implementation to send/receive data. + diff --git a/source/exploit/test_dwc3.c b/source/exploit/test_dwc3.c index 24acf4c..b50ba48 100644 --- a/source/exploit/test_dwc3.c +++ b/source/exploit/test_dwc3.c @@ -13,13 +13,11 @@ extern void rom_send(); #define data_received 0x02021800 + 0x2004 void recv_data_cb(uint32_t endpoint, uint32_t len){ - // void *rbuf; char *dest_buf = (char *)recv_buffer; volatile void *dref = (void *)data_received; void *rbuf = get_endpoint_recv_buffer(endpoint); for(int i= 0; i < len; i++){ - // *(char *)dest_buf = *(char *)(void *)((int)rbuf + i); dest_buf[i] = *(char *)(void *)((int)rbuf + i); } *(uint8_t *)dref = 1; // Mark as ready @@ -44,23 +42,16 @@ void recv_data(){ } void send_data_cb(uint32_t endpoint, uint32_t len){ - // void *rbuf; - // void *dest_buf = (void *)recv_buffer; + // Tell event handler that the data was received volatile void *dref = (void *)data_received; - - // rbuf = get_endpoint_buffer(endpoint); - // for(int i= 0; i < len; i++){ - // *(char *)dest_buf = *(char *)(void *)((int)rbuf + i); - // } *(uint8_t *)dref = 1; // Mark as ready } void send_data(uint32_t address, uint32_t size){ volatile void *dref = (void *)data_received; *(uint8_t *)dref = 0; - uint32_t val = 0x0; maybe_usb_setup_read(0x1, send_data_cb, 0x200); - uint32_t rbuf = get_endpoint_recv_buffer(1); + // uint32_t rbuf = get_endpoint_recv_buffer(1); dwc3_ep0_start_trans(1, address, 0x200); while(1){ usb_event_handler(); @@ -76,14 +67,6 @@ int main() { uint32_t count = 0; while(1){ recv_data(); - // rom_send(); send_data(recv_buffer, 0x200); } - - - - // recv_data(); - // sleep(1, 5000); - asm("mov x0, #0x0"); - asm("br x0"); } \ No newline at end of file