ljtjerry

## 01-zynq-uart-exploit.md

      
        
          
            
              
              3 files
            
          
          
            
              
              2 forks
            
          
          
            
              
              0 comments
            
          
          
            
              
              14 stars
            
          
        
        
          
              
          
          
            
                four0four
                / 01-zynq-uart-exploit.md
            
            
              Last active
              January 6, 2024 19:17
            
              
                 Zynq BootROM Secrets: BootROM dump exploit
              
          
        
      
        
  
      
    Zynq BootROM Secrets: Exposing the bootROM with the UART loader

Last time I wrote about this, I lied a little - There is an interesting bug in the UART loader, and it may have been exactly why Xilinx didn't document it. In short: The UART loader writes the entire UART payload to a location in memory (nominally 0x4_0000). The ROM is architected such that when the boot mode is selected, it registers a callback that is called when the ROM wants more data from the boot device. For the UART loader, this is pretty simple - here's the whole thing:
; void uart_callback(u32 r0_offset, void* r1_dest, i32 r2_nbytes)
ROM:0000A578 PUSH            {R3,LR}
ROM:0000A57C MOV             R3, #uart_buff
ROM:0000A584 MOV             R12, #1
ROM:0000A588 LDR             R3, [R3]