From 5d7e117ea0203af288e550341595d1c20182c4db Mon Sep 17 00:00:00 2001
From: Eljakim Herrewijnen <eljakim.herrewijnen@gmail.com>
Date: Fri, 2 Aug 2024 22:13:27 +0200
Subject: [PATCH] added working dwc3

---
 source/exploit/dwc3.elf    | Bin 7928 -> 7920 bytes
 source/exploit/dwc3.o      | Bin 1864 -> 1832 bytes
 source/exploit/readme.md   |   5 +++++
 source/exploit/test_dwc3.c |  21 ++-------------------
 4 files changed, 7 insertions(+), 19 deletions(-)
 create mode 100644 source/exploit/readme.md

diff --git a/source/exploit/dwc3.elf b/source/exploit/dwc3.elf
index 9fb9c66f7e594c9bedd634a3337d026a89029e2e..153138950c1b18fc7f5c7a8d230c93173583a341 100755
GIT binary patch
delta 112
zcmexi`@wdC24lfQO>@o*k_=#QVPocWamL)uj1t|9yi5)aK@XXQwH{5cpWZrop`<eJ
zssI0{Gca@pIXEmRdb0VVq&^elmdT7V{){o317+G7881w}DQgZS1?B7+T_*<u$&Ser
Lfn>wvi*o7!ni3}U

delta 128
zcmexh`@?pE24lrUO>@p0k_=#QV`JuYamM`3j1t|9qBb+?rz<ct1Ti@@1U+OH)_O3#
zetPrdnUc!9C;tDR&cM(a<lwNN=+WkrlKM=HdnW&s_Ge7l>?zaE$arJ&MOkwo$th>g
Z=sVdHNKTmCDQC~wAp^1I=;S~-c>q@UD?<PP

diff --git a/source/exploit/dwc3.o b/source/exploit/dwc3.o
index 6ecab744ba84c2bd8c1cdb66e26ca362ca4fe865..bf81e162b085c496f6395244856eb2043e0ae558 100644
GIT binary patch
delta 105
zcmX@Xw}Nki24luXO@7A74vYr8r~dz+&cM(a<lwNN=*i|<#%M-Hg~>OW(ivkmJ2I;?
zGBQkVWD#d%**ufQosn_E<cF;8j5d=s*~~c$m>Ix8VR9y$Ib+S_g>3eWhLaxxNsGyf
G?CJo&<{f<i

delta 111
zcmZ3%cY<$%24lxYO@7A728<TGC;tDR&cM(a<lwNN=+Wj<#%M-Hjma08(iu}WTQaLN
zGX9uc$SlstF*%V%oRMd9C5t;F<A%uxS=||3CUdfxb5<}jfPuwiPd0PLmdTB5_KcR3
M4+2St$&Bpk0GVDN5C8xG

diff --git a/source/exploit/readme.md b/source/exploit/readme.md
new file mode 100644
index 0000000..7d40077
--- /dev/null
+++ b/source/exploit/readme.md
@@ -0,0 +1,5 @@
+# Exploit
+
+## test_dwc3
+simple dwc3 usb implementation to send/receive data.
+
diff --git a/source/exploit/test_dwc3.c b/source/exploit/test_dwc3.c
index 24acf4c..b50ba48 100644
--- a/source/exploit/test_dwc3.c
+++ b/source/exploit/test_dwc3.c
@@ -13,13 +13,11 @@ extern void rom_send();
 #define data_received 0x02021800 + 0x2004
 
 void recv_data_cb(uint32_t endpoint, uint32_t len){
-    // void *rbuf;
     char *dest_buf = (char *)recv_buffer;
     volatile void *dref = (void *)data_received;
     
     void *rbuf = get_endpoint_recv_buffer(endpoint);
     for(int i= 0; i < len; i++){
-        // *(char *)dest_buf = *(char *)(void *)((int)rbuf + i);
         dest_buf[i] = *(char *)(void *)((int)rbuf + i);
     }
     *(uint8_t *)dref = 1; // Mark as ready
@@ -44,23 +42,16 @@ void recv_data(){
 }
 
 void send_data_cb(uint32_t endpoint, uint32_t len){
-    // void *rbuf;
-    // void *dest_buf = (void *)recv_buffer;
+    // Tell event handler that the data was received
     volatile void *dref = (void *)data_received;
-    
-    // rbuf = get_endpoint_buffer(endpoint);
-    // for(int i= 0; i < len; i++){
-    //     *(char *)dest_buf = *(char *)(void *)((int)rbuf + i);
-    // }
     *(uint8_t *)dref = 1; // Mark as ready
 }
 
 void send_data(uint32_t address, uint32_t size){
     volatile void *dref = (void *)data_received;
     *(uint8_t *)dref = 0;
-    uint32_t val = 0x0;
     maybe_usb_setup_read(0x1, send_data_cb, 0x200);
-    uint32_t rbuf = get_endpoint_recv_buffer(1);
+    // uint32_t rbuf = get_endpoint_recv_buffer(1);
     dwc3_ep0_start_trans(1, address, 0x200);
     while(1){
         usb_event_handler();
@@ -76,14 +67,6 @@ int main() {
     uint32_t count = 0;
     while(1){
         recv_data();
-        // rom_send();
         send_data(recv_buffer, 0x200);
     }
-    
-    
-
-    // recv_data();
-    // sleep(1, 5000);
-    asm("mov x0, #0x0");
-    asm("br x0");
 }
\ No newline at end of file