[Pwn2Win 2021] Ethernet from Above

from collections import defaultdict
from dataclasses import dataclass, field
from typing import ClassVar, Dict, List, Optional, Set
import pytrellis
import os


def init_renames(filename: str) -> Dict[str, str]:
    import json

    res: Dict[str, str] = {}
    with open(filename, "r") as inf:
        data = json.load(inf)
        for pin_name, pin_data in data.items():
            res["R{row}C{col}_PIO{pio}".format(**pin_data)] = f"{pin_name}_PIO"
            res["R{row}C{col}_IOLOGIC{pio}".format(**pin_data)] = f"{pin_name}_IOLOGIC"

    return res


# iodb_CABGA256.json is value of the packages.CABGA256 key from https://github.com/YosysHQ/prjtrellis-db/blob/master/ECP5/LFE5U-25F/iodb.json
mod_renames = init_renames(os.path.join(os.path.dirname(__file__), "iodb_CABGA256.json"))


@dataclass(eq=True, order=True, frozen=True)
class Ident:
    """ An identifier in the routing graph """

    # place label first so we sort by identifier
    label: str = field(compare=False)
    # Idents are unique by ID so we only need to compare IDs
    id: int = field(repr=False)
    _cache: ClassVar[Dict[int, "Ident"]] = {}

    @classmethod
    def from_id(cls, rgraph: pytrellis.RoutingGraph, id: int) -> "Ident":
        if id in cls._cache:
            return cls._cache[id]
        inst = Ident(rgraph.to_str(id), id)
        cls._cache[id] = inst
        return inst

    @classmethod
    def from_label(cls, rgraph: pytrellis.RoutingGraph, label: str) -> "Ident":
        return cls.from_id(rgraph, rgraph.ident(label))

    def __str__(self) -> str:
        return self.label


@dataclass(eq=True, order=True, frozen=True)
class Node:
    """ A node in the routing graph - either a wire or a BEL pin """

    # put y first so we sort by row, then column
    y: int
    x: int
    id: Ident
    pin: Optional[Ident] = None

    @property
    def loc(self) -> pytrellis.Location:
        return pytrellis.Location(self.x, self.y)

    @property
    def mod_name(self) -> str:
        res = f"R{self.y}C{self.x}_{self.name}"
        return mod_renames.get(res, res)

    @property
    def name(self) -> str:
        return self.id.label

    @property
    def pin_name(self) -> str:
        if self.pin is None:
            return ""
        return self.pin.label

    def __str__(self) -> str:
        res = self.mod_name
        if self.pin is not None:
            res += "$" + self.pin_name
        return res


EdgeMap = Dict[Node, Set[Node]]


@dataclass
class Component:
    graph: "DirectedGraph"
    nodes: Set[Node] = field(default_factory=set)

    def get_roots(self) -> Set[Node]:
        roots = set()
        seen: Dict[Node, int] = {}

        def visit(node: Node) -> None:
            if node in seen:
                if seen[node] == 0:
                    print(f"Warning: node {node} is part of a cycle!")
                return
            seen[node] = 0
            if not self.graph.edges_rev[node]:
                roots.add(node)
            else:
                for x in self.graph.edges_rev[node]:
                    visit(x)
            seen[node] = 1

        for x in self.nodes:
            visit(x)

        return roots

    def get_leaves(self) -> Set[Node]:
        leaves = set()
        seen: Dict[Node, int] = {}

        def visit(node: Node) -> None:
            if node in seen:
                if seen[node] == 0:
                    print(f"Warning: node {node} is part of a cycle!")
                return
            seen[node] = 0
            if not self.graph.edges_fwd[node]:
                leaves.add(node)
            else:
                for x in self.graph.edges_fwd[node]:
                    visit(x)
            seen[node] = 1

        for x in self.nodes:
            visit(x)

        return leaves


@dataclass
class DirectedGraph:
    """ A directed graph of Nodes. """

    edges_fwd: EdgeMap = field(default_factory=lambda: defaultdict(set))
    edges_rev: EdgeMap = field(default_factory=lambda: defaultdict(set))

    def add_edge(self, source: Node, sink: Node) -> None:
        self.edges_fwd[source].add(sink)
        self.edges_rev[sink].add(source)

    def get_components(self) -> List[Component]:
        seen: Set[Node] = set()

        def visit(node: Node, component: Component) -> None:
            if node in seen:
                return
            seen.add(node)

            component.nodes.add(node)
            if node in self.edges_fwd:
                for x in self.edges_fwd[node]:
                    visit(x, component)
            if node in self.edges_rev:
                for x in self.edges_rev[node]:
                    visit(x, component)

        components: List[Component] = []
        for edges in (self.edges_rev, self.edges_fwd):
            for node in edges:
                if node in seen:
                    continue
                component = Component(self)
                visit(node, component)
                components.append(component)

        return components

import pickle
import sys
from collections import defaultdict
from functools import lru_cache
from typing import Callable, Dict, List, Set, Tuple

import pytrellis
from graph import DirectedGraph, Ident, Node

pytrellis.load_database("usr/local/share/trellis/database/")
bitstream = pytrellis.Bitstream.read_bit(sys.argv[1])
chip = bitstream.deserialise_chip()
rgraph = chip.get_routing_graph()


def get_tile_config(chip: pytrellis.Chip, tile: pytrellis.Tile) -> pytrellis.TileConfig:
    """ Get TileConfig for a given tile on the board """
    locator = pytrellis.TileLocator(chip.info.family, chip.info.name, tile.info.type)
    tilebitdb = pytrellis.get_tile_bitdata(locator)
    return tilebitdb.tile_cram_to_config(tile.cram)


def get_tile_location(tile: pytrellis.Tile) -> pytrellis.Location:
    """ Get the location of a tile suitable for lookup in the RoutingGraph """
    rc = tile.info.get_row_col()
    row, col = rc.first, rc.second
    return pytrellis.Location(col, row)


@lru_cache(None)
def get_zero_bit_arcs(chip: pytrellis.Chip, tiletype: str) -> Dict[str, List[str]]:
    """Get configurable zero-bit arcs from the given tile.

    tile_cram_to_config ignores zero-bit arcs when generating the TileConfig,
    which means that if all bits are unset for a given mux, no connection is
    generated at all."""
    locator = pytrellis.TileLocator(chip.info.family, chip.info.name, tiletype)
    tilebitdb = pytrellis.get_tile_bitdata(locator)
    arcs: Dict[str, List[str]] = defaultdict(list)
    for sink in tilebitdb.get_sinks():
        mux_data = tilebitdb.get_mux_data_for_sink(sink)
        for arc_name, arc_data in mux_data.arcs.items():
            if len(arc_data.bits.bits) == 0:
                arcs[sink].append(arc_name)
    return arcs


def bel_to_node(pos: Tuple[pytrellis.RoutingId, int]) -> Node:
    rid, bel_pin = pos
    id = Ident.from_id(rgraph, rid.id)
    pin = Ident.from_id(rgraph, bel_pin)
    return Node(x=rid.loc.x, y=rid.loc.y, id=id, pin=pin)


def wire_to_node(rid: pytrellis.RoutingId) -> Node:
    id = Ident.from_id(rgraph, rid.id)
    return Node(x=rid.loc.x, y=rid.loc.y, id=id)


config_graph = DirectedGraph()
loc_to_tile: Dict[Tuple[int, int], List[pytrellis.Tile]] = defaultdict(list)

for tilename, tile in chip.tiles.items():
    tilecfg = get_tile_config(chip, tile)
    tileloc = get_tile_location(tile)
    loc_to_tile[tileloc.x, tileloc.y].append(tile)
    rtile = rgraph.tiles[tileloc]
    for arc in tilecfg.carcs:
        rarc = rtile.arcs[rgraph.ident(f"{arc.source}->{arc.sink}")]
        sourcenode = wire_to_node(rarc.source)
        sinknode = wire_to_node(rarc.sink)
        config_graph.add_edge(sourcenode, sinknode)


# Expand configuration arcs to include BEL connections and zero-bit arcs
arc_graph = DirectedGraph()
nodes_seen: Set[Node] = set()


def visit_node(node: Node, bel_func: Callable[[Node], None]) -> None:
    """ Add unconfigurable or implicit arcs to the given node """
    if node in nodes_seen:
        return
    nodes_seen.add(node)

    try:
        rtile = rgraph.tiles[node.loc]
        rwire = rtile.wires[node.id.id]
    except KeyError:
        # there's a handful of troublesome cases which are outside of my control.
        # Example: R0C31_G_ULDDRDEL does not exist; it's actually supposed to be the "fixed"
        # connection G_ULDDRDEL=>DDRDEL but G_ULDDRDEL is not in the same tile.
        print(f"Error: failed to find node {str(node)}", file=sys.stderr)
        return

    if node not in config_graph.edges_rev:
        # Not configured - possible zero-bit configuration
        for tile in loc_to_tile[node.x, node.y]:
            arcs = get_zero_bit_arcs(chip, tile.info.type)
            sources = arcs.get(node.id.label, [])
            if not sources:
                continue
            for source in sources:
                sourceid = Ident.from_label(rgraph, source)
                sourcenode = Node(x=node.x, y=node.y, id=sourceid)
                arc_graph.add_edge(sourcenode, node)
                visit_node(sourcenode, bel_func)

    # Add fixed connections
    for bel in rwire.belsUphill:
        arc_graph.add_edge(bel_to_node(bel), node)
        bel_func(wire_to_node(bel[0]))
    for bel in rwire.belsDownhill:
        arc_graph.add_edge(node, bel_to_node(bel))
        bel_func(wire_to_node(bel[0]))
    for routes in [rwire.uphill, rwire.downhill]:
        for rarcrid in routes:
            rarcname = rgraph.to_str(rarcrid.id)
            if "=>" in rarcname:
                # => means a fixed (unconfigurable) connection
                rarc = rgraph.tiles[rarcrid.loc].arcs[rarcrid.id]
                sourcenode = wire_to_node(rarc.source)
                sinknode = wire_to_node(rarc.sink)
                arc_graph.add_edge(sourcenode, sinknode)
                visit_node(sourcenode, bel_func)
                visit_node(sinknode, bel_func)

    # Add global (clock) connections - Project Trellis omits a lot of these :(
    if node.name.startswith("G_HPBX"):
        # TAP_DRIVE -> PLB tile
        tap = chip.global_data.get_tap_driver(node.y, node.x)
        if tap.dir == pytrellis.TapDir.LEFT:
            tap_name = node.name.replace("G_HPBX", "L_HPBX")
        else:
            tap_name = node.name.replace("G_HPBX", "R_HPBX")
        tap_id = Ident.from_label(rgraph, tap_name)
        tap_node = Node(x=tap.col, y=node.y, id=tap_id)
        arc_graph.add_edge(tap_node, node)
        visit_node(tap_node, bel_func)

    elif node.name.startswith("G_VPTX"):
        # Spine tile -> TAP_DRIVE
        tap = chip.global_data.get_tap_driver(node.y, node.x)
        if tap.col == node.x:
            # Spine output
            quadrant = chip.global_data.get_quadrant(node.y, node.x)
            spine = chip.global_data.get_spine_driver(quadrant, node.x)
            spine_node = Node(x=spine.second, y=spine.first, id=node.id)
            arc_graph.add_edge(spine_node, node)
            visit_node(spine_node, bel_func)

    elif node.name.startswith("G_HPRX"):
        # Center mux -> spine tile (qqPCLKn -> G_HPRXnn00)
        quadrant = chip.global_data.get_quadrant(node.y, node.x)
        assert node.name.endswith("00")
        clkid = int(node.name[6:-2])
        global_id = Ident.from_label(rgraph, f"G_{quadrant}PCLK{clkid}")
        global_node = Node(x=0, y=0, id=global_id)
        arc_graph.add_edge(global_node, node)
        visit_node(global_node, bel_func)


# Visit every configured arc and record all BELs seen
bels_todo: Set[Node] = set()
for sourcenode, nodes in config_graph.edges_fwd.items():
    for sinknode in nodes:
        arc_graph.add_edge(sourcenode, sinknode)
        visit_node(sourcenode, bels_todo.add)
        visit_node(sinknode, bels_todo.add)

# Adding *every* fixed connection is too expensive.
# As a compromise, add any fixed connection connected
# to used BELs. Ignore BELs that don't have any configured
# arcs.
for node in bels_todo:
    rtile = rgraph.tiles[node.loc]
    for _, rwire in rtile.wires.items():
        wireident = Ident.from_id(rgraph, rwire.id)
        wirenode = Node(x=node.x, y=node.y, id=wireident)
        for bel in rwire.belsUphill:
            if bel[0].id == node.id.id:
                arc_graph.add_edge(bel_to_node(bel), wirenode)
                visit_node(wirenode, lambda node: None)
        for bel in rwire.belsDownhill:
            if bel[0].id == node.id.id:
                arc_graph.add_edge(wirenode, bel_to_node(bel))
                visit_node(wirenode, lambda node: None)


with open(sys.argv[1] + ".graph", "wb") as outf:
    pickle.dump(arc_graph, outf, protocol=-1)

import pickle
import sys
from typing import Sequence, Callable, Set

from graph import DirectedGraph, Node

with open(sys.argv[1], "rb") as inf:
    graph: DirectedGraph = pickle.load(inf)


def walk_component(roots: Sequence[Node], func: Callable[[int, Node], None]) -> None:
    seen: Set[Node] = set()

    def visit(node: Node, level: int) -> None:
        if node in seen:
            return
        seen.add(node)
        func(level, node)
        for x in sorted(graph.edges_fwd[node]):
            visit(x, level + 1)
    for root in roots:
        visit(root, 0)


def print_rid_node(level: int, node: Node) -> None:
    print(" " * level + str(node))


components = graph.get_components()
sorted_components = [(component, sorted(component.get_roots())) for component in components]
sorted_components = sorted(sorted_components, key=lambda x: x[1][0])
for component, roots in sorted_components:
    walk_component(roots, print_rid_node)
    print()

import pickle
import sys
from collections import defaultdict
from dataclasses import dataclass
from enum import IntEnum
from typing import Dict, List, Optional, Sequence, Set, Tuple

from natsort import natsorted

import pytrellis
from graph import Component, DirectedGraph, Node


pytrellis.load_database("usr/local/share/trellis/database/")
bitstream = pytrellis.Bitstream.read_bit(sys.argv[1])
chip = bitstream.deserialise_chip()


def get_tile_config(chip: pytrellis.Chip, tile: pytrellis.Tile) -> pytrellis.TileConfig:
    """ Get TileConfig for a given tile on the board """
    locator = pytrellis.TileLocator(chip.info.family, chip.info.name, tile.info.type)
    tilebitdb = pytrellis.get_tile_bitdata(locator)
    return tilebitdb.tile_cram_to_config(tile.cram)


def get_tile_location(tile: pytrellis.Tile) -> pytrellis.Location:
    """ Get the location of a tile suitable for lookup in the RoutingGraph """
    rc = tile.info.get_row_col()
    row, col = rc.first, rc.second
    return pytrellis.Location(col, row)


with open(sys.argv[1] + ".graph", "rb") as inf:
    graph: DirectedGraph = pickle.load(inf)


@dataclass
class TileData:
    tile: pytrellis.Tile
    cfg: pytrellis.TileConfig


tiles_by_loc: Dict[Tuple[int, int], List[TileData]] = defaultdict(list)

for tilename, tile in chip.tiles.items():
    tilecfg = get_tile_config(chip, tile)
    tileloc = get_tile_location(tile)
    tiles_by_loc[tileloc.x, tileloc.y].append(TileData(tile, tilecfg))


def filter_node(node: Node) -> bool:
    if node.pin is None:
        # This is a bit extreme, but we assume that all *useful* wires
        # go between BELs.
        return False
    if node.pin_name.startswith("IOLDO") or node.pin_name.startswith("IOLTO"):
        # IOLDO/IOLTO are for internal use:
        # https://freenode.irclog.whitequark.org/~h~openfpga/2018-12-25#23748701;
        # 07:55 <daveshah> kbeckmann: IOLDO and IOLTO are for internal use only
        # 07:55 <daveshah> They are for the dedicated interconnect between IOLOGIC and PIO
        return False
    if node.pin_name in ("RXDATA4", "TXDATA4", "RXDATA5", "TXDATA5", "RXDATA6", "TXDATA6"):
        # {RX,TX}DATA{4,5,6} are connected to some of the same internal pins
        # as {RX,TX}DATA{0,1,2,3}, since they can only be used in DDR 7:1 mode
        # which occupies two IOLOGIC blocks.
        # Since we're not using DDR 7:1 in any of our designs, ignore these pins for now.
        return False
    if node.pin_name == "INDD":
        # I don't know what this pin is, but it often appears to be connected to $DI.
        # Disabling it because sometimes it ends up in a multi-root configuration with PIO$O,
        # which makes it (probably) redundant?
        return False
    return True


# Extract connected components and their roots & leaves
sorted_components: List[Tuple[Component, List[Node], List[Node]]] = []
for component in graph.get_components():
    roots = sorted([node for node in component.get_roots() if filter_node(node)])
    if not roots:
        continue
    leaves = sorted([node for node in component.get_leaves() if filter_node(node)])
    if not leaves:
        continue
    sorted_components.append((component, roots, leaves))
sorted_components = sorted(sorted_components, key=lambda x: x[1][0])

# Verilog input, output, and external wires
mod_sources: Set[Node] = set()
mod_sinks: Dict[Node, Node] = {}
mod_globals: Set[Node] = set()

# Enumerations and words that we've seen (so we can print out unused enums/words at the end)
seen_enums: Set[Tuple[pytrellis.TileConfig, int]] = set()
seen_words: Set[Tuple[pytrellis.TileConfig, int]] = set()


class ModuleType(IntEnum):
    SLICE = 1
    EBR = 2


@dataclass
class ModuleDefinition:
    """ A class to encapsulate a synthesized BEL supported by simulation """

    module_type: ModuleType
    module_name: str
    tiledata: TileData
    pin_map: Dict[str, Node]

    @classmethod
    def create_from_node(cls, node: Node) -> Optional["ModuleDefinition"]:
        if node.name.startswith("SLICE"):
            modtype = ModuleType.SLICE
            tiletype = "PLC2"
        elif node.name.startswith("EBR"):
            modtype = ModuleType.EBR
            tiletype = "MIB_EBR"
        else:
            return None

        for tiledata in tiles_by_loc[node.x, node.y]:
            if tiledata.tile.info.type.startswith(tiletype):
                break
        else:
            raise Exception(f"Tile type {tiletype} not found for node {node}")

        return ModuleDefinition(modtype, node.name, tiledata, {})

    def print_verilog(self, instname: str) -> None:
        if self.module_type == ModuleType.SLICE:
            print("TRELLIS_SLICE #(")
            renames = {
                "K0_INIT": "LUT0_INITVAL",
                "K1_INIT": "LUT1_INITVAL",
            }
            inputs = [
                "A0",
                "B0",
                "C0",
                "D0",
                "A1",
                "B1",
                "C1",
                "D1",
                "M0",
                "M1",
                "FCI",
                "FXA",
                "FXB",
                "CLK",
                "LSR",
                "CE",
                "DI0",
                "DI1",
                "WD0",
                "WD1",
                "WAD0",
                "WAD1",
                "WAD2",
                "WAD3",
                "WRE",
                "WCK",
            ]
        elif self.module_type == ModuleType.EBR:
            print("EBR_BLOCK #(")
            renames = {}
            inputs = [
                "ADA0",
                "ADA1",
                "ADA2",
                "ADA3",
                "ADA5",
                "ADA6",
                "ADA7",
                "ADA8",
                "ADA9",
                "ADA10",
                "ADA11",
                "ADA12",
                "ADA13",
                "ADB5",
                "ADB6",
                "ADB7",
                "ADB8",
                "ADB9",
                "ADB10",
                "ADB11",
                "ADB12",
                "ADB13",
                "CEB",
                "CLKA",
                "CLKB",
                "DIA0",
                "DIA1",
                "DIA2",
                "DIA3",
                "DIA4",
                "DIA5",
                "DIA6",
                "DIA7",
                "DIA8",
                "DIA9",
                "DIA10",
                "DIA11",
                "DIA12",
                "DIA13",
                "DIA14",
                "DIA15",
                "DIA16",
                "DIA17",
                "DIB0",
                "DIB1",
                "DIB2",
                "DIB3",
                "DIB4",
                "DIB5",
                "DIB6",
                "DIB7",
                "DIB8",
                "DIB9",
                "DIB10",
                "DIB11",
                "DIB12",
                "DIB13",
                "DIB14",
                "DIB15",
                "DIB16",
                "DIB17",
            ]
        strs: List[str]

        # Dump enumerations in Verilog-compatible format
        strs = []
        for i, e in enumerate(self.tiledata.cfg.cenums):
            bel, ename = e.name.split(".", 1)
            ename = ename.replace(".", "_")
            ename = renames.get(ename, ename)
            if bel == self.module_name:
                seen_enums.add((self.tiledata.cfg, i))
                strs.append(f'  .{ename}("{e.value}")')
        # Dump initialization words in Verilog format
        for i, w in enumerate(self.tiledata.cfg.cwords):
            bel, ename = w.name.split(".", 1)
            ename = ename.replace(".", "_")
            ename = renames.get(ename, ename)
            if bel == self.module_name:
                seen_words.add((self.tiledata.cfg, i))
                value = [str(int(c)) for c in w.value]
                valuestr = "".join(value[::-1])
                strs.append(f"  .{ename}({len(value)}'b{valuestr})")
        if strs:
            print(",\n".join(strs))

        print(f") {instname} (")

        # Dump input/output pins (already referenced to root pins)
        strs = []
        allpins = inputs + natsorted(set(self.pin_map.keys()) - set(inputs))
        defpin = "1'b0"
        for pin in allpins:
            strs.append(f"  .{pin}({self.pin_map.get(pin, defpin)})")
        if strs:
            print(",\n".join(strs))

        print(");")
        print()


def print_component(roots: Sequence[Node]) -> None:
    def visit(node: Node, level: int) -> None:
        print(" " * level, node, sep="")
        for x in graph.edges_fwd[node]:
            visit(x, level + 1)

    for root in roots:
        visit(root, 0)


modules: Dict[str, ModuleDefinition] = {}


print("/* Automatically generated by a dumb Python script")
for component, roots, leaves in sorted_components:
    if len(roots) > 1:
        print()
        print("Unhandled multi-root component:")
        print(*roots, sep=", ")
        print(" -> ", end="")
        print(*leaves, sep=", ")
        continue

    mod_sources.add(roots[0])
    for node in leaves:
        mod_sinks[node] = roots[0]
    for node in roots + leaves:
        if node.mod_name in modules:
            modules[node.mod_name].pin_map[node.pin_name] = roots[0]
            continue

        mod_def = ModuleDefinition.create_from_node(node)
        if not mod_def:
            mod_globals.add(node)
            continue
        mod_def.pin_map[node.pin_name] = roots[0]
        modules[node.mod_name] = mod_def

# filter out any globals that are just copies of inputs
for node in mod_globals:
    if node in mod_sinks and mod_sinks[node] in mod_globals:
        print(f"filtered out useless output: {mod_sinks[node]} -> {node}")
        del mod_sinks[node]
all_sources: Set[Node] = set()
for sink in mod_sinks:
    all_sources.add(mod_sinks[sink])
for node in mod_globals:
    if node in mod_sources and node not in all_sources:
        print(f"filtered out useless input: {node}")
        mod_sources.discard(node)
print("*/")

print("module top(")
mod_globals_vars = ["  input wire " + str(node) for node in mod_sources & mod_globals]
mod_globals_vars += ["  output wire " + str(node) for node in set(mod_sinks) & mod_globals]
print(",\n".join(natsorted(mod_globals_vars)))
print(");")
print()

# sources are either connected to global inputs
# or are outputs from some other node
for node in natsorted(mod_sources - mod_globals, key=str):
    print(f"wire {node};")
print()

# sinks are either fed directly into a BEL,
# in which case they are directly substituted,
# or they are global outputs
for node in natsorted(set(mod_sinks) & mod_globals, key=str):
    print(f"assign {node} = {mod_sinks[node]};")
print()

for module in natsorted(modules):
    modules[module].print_verilog(module)

print("/* Unhandled enums/words:")
for loc in sorted(tiles_by_loc.keys(), key=lambda loc: (loc[1], loc[0])):
    for tiledata in tiles_by_loc[loc]:
        for i, e in enumerate(tiledata.cfg.cenums):
            if (tiledata.cfg, i) not in seen_enums:
                print(" ", tiledata.tile.info.name, "enum:", e.name, e.value)
        for i, w in enumerate(tiledata.cfg.cwords):
            if (tiledata.cfg, i) not in seen_words:
                valuestr = "".join([str(int(c)) for c in w.value][::-1])
                print(" ", tiledata.tile.info.name, "word:", w.name, valuestr)
print("*/")
print("endmodule")

import zlib
import struct
import socket


# https://electronics.stackexchange.com/questions/170612/fcs-verification-of-ethernet-frame
def calc_fcs(frame_data):
    crc = zlib.crc32(frame_data) & 0xFFFF_FFFF
    out = bytearray()
    for i in range(4):
        byte = (crc >> (8 * i)) & 0xFF
        out.append(byte)
    return bytes(out)


# modified from https://github.com/houluy/UDP/blob/master/udp.py
def ip2int(ip_addr):
    if ip_addr == "localhost":
        ip_addr = "127.0.0.1"
    return [int(x) for x in ip_addr.split(".")]


def checksum_func(data):
    checksum = 0
    data_len = len(data)
    if data_len % 2:
        data_len += 1
        data += struct.pack("!B", 0)

    for i in range(0, data_len, 2):
        w = (data[i] << 8) + (data[i + 1])
        checksum += w

    checksum = (checksum >> 16) + (checksum & 0xFFFF)
    checksum = ~checksum & 0xFFFF
    return checksum


def make_udp(data, src_addr, dest_addr):
    # Generate pseudo header
    src_ip, dest_ip = ip2int(src_addr[0]), ip2int(dest_addr[0])
    src_ip = struct.pack("!4B", *src_ip)
    dest_ip = struct.pack("!4B", *dest_ip)

    zero = 0

    protocol = socket.IPPROTO_UDP

    # Check the type of data
    try:
        data = data.encode()
    except AttributeError:
        pass

    src_port = src_addr[1]
    dest_port = dest_addr[1]

    data_len = len(data)

    udp_length = 8 + data_len

    checksum = 0
    pseudo_header = struct.pack("!BBH", zero, protocol, udp_length)
    pseudo_header = src_ip + dest_ip + pseudo_header
    udp_header = struct.pack("!4H", src_port, dest_port, udp_length, checksum)
    checksum = checksum_func(pseudo_header + udp_header + data)
    udp_header = struct.pack("!4H", src_port, dest_port, udp_length, checksum)
    return udp_header + data


def make_ip_udp(data, src_addr, dest_addr):
    udp = make_udp(data, src_addr, dest_addr)

    src_ip, dest_ip = ip2int(src_addr[0]), ip2int(dest_addr[0])
    src_ip = struct.pack("!4B", *src_ip)
    dest_ip = struct.pack("!4B", *dest_ip)

    checksum = 0
    for i in range(2):
        ip_header = struct.pack(
            "!BBHHHBBH4s4s",
            0x45,  # version 4, header length 5*4
            0,  # dsfield
            20 + len(udp),  # len
            0x1337,  # id
            0,  # flags + frag_offset
            0x40,  # ttl
            socket.IPPROTO_UDP,  # proto
            checksum,  # checksum
            src_ip,  # src
            dest_ip,  # dst
        )
        checksum = checksum_func(ip_header)

    return ip_header + udp


def make_arp(src_mac, src_ip, dest_mac, dest_ip):
    src_ip, dest_ip = ip2int(src_ip), ip2int(dest_ip)
    src_ip = struct.pack("!4B", *src_ip)
    dest_ip = struct.pack("!4B", *dest_ip)
    return (
        struct.pack(
            "!HHBBH",
            1,  # HTYPE
            0x800,  # PTYPE
            6,  # HLEN
            4,  # PLEN
            2,  # OPER=reply
        )
        + src_mac
        + src_ip
        + dest_mac
        + dest_ip
    )


def add_mac(frame, dst, src, ethtype=0x800):
    assert len(dst) == 6
    assert len(src) == 6
    return dst + src + struct.pack(">H", ethtype) + frame


def write_frame(out, delay, frame):
    frame = bytes.fromhex("55 55 55 55 55 55 55 D5") + frame + calc_fcs(frame)
    out.write(struct.pack(">I", delay // 40))
    out.write(struct.pack(">I", len(frame)))
    out.write(frame)


src_mac = bytes.fromhex("12 34 56 78 9a bc")
dest_mac = bytes.fromhex("10 E2 D5 00 00 00")  # from its ARP message
src_ip = "200.18.104.254"  # from the ARP message, it wants this specific address (router/gateway maybe?)
dest_ip = "200.18.104.100"
ETHERTYPE_IPv4 = 0x0800
ETHERTYPE_ARP = 0x0806


def make_output(data: bytes):
    with open("eth_data.bin", "wb") as out:
        write_frame(
            out,
            1000,
            add_mac(
                make_ip_udp(data, (src_ip, 1337), (dest_ip, 6000)),
                dest_mac,
                src_mac,
                ETHERTYPE_IPv4,
            ),
        )

        write_frame(
            out,
            10000,
            add_mac(
                make_arp(src_mac, src_ip, dest_mac, dest_ip),
                dest_mac,
                src_mac,
                ETHERTYPE_ARP,
            ),
        )


if __name__ == '__main__':
    make_output(b"xxx")

import os
import re
import subprocess

from eth_data import (
    ETHERTYPE_IPv4,
    add_mac,
    dest_ip,
    dest_mac,
    make_ip_udp,
    src_ip,
    src_mac,
    write_frame,
)

mydir = os.path.dirname(__file__)


def make_output(data: bytes):
    with open("eth_data.bin", "wb") as out:
        # For the side-channel attack, a single packet is enough:
        # we don't even need to send the ARP or receive a response.
        # This speeds up simulation somewhat.
        write_frame(
            out,
            1000,
            add_mac(
                make_ip_udp(data, (src_ip, 1337), (dest_ip, 6000)),
                dest_mac,
                src_mac,
                ETHERTYPE_IPv4,
            ),
        )


def run_sim(data: bytes):
    make_output(data)
    proc = subprocess.Popen(
        ["unbuffer", "vvp", "-v", os.path.join(mydir, "ethernetfromabove.bit.simexe")],
        stdout=subprocess.PIPE,
    )
    # compute the timestamp after the end of the second UDP packet transmission
    pkt = ""
    for row in proc.stdout:
        row = row.decode().rstrip()
        if row == "Event counts:":
            break
        elif " ns:" in row:
            ts, info = row.split(" ns:")
            ts = float(ts.strip())
            info = info.strip()

            if ts >= 40000 and info.startswith("tx="):
                pkt += info[3:]

    rest = proc.stdout.read().decode()
    nums = re.findall(r"\b\d+\b", rest)
    return [data] + [int(n) for n in nums] + [pkt]


print(run_sim(b"AAAAAAA"))
print(run_sim(b"CTFAAAA"))
print(run_sim(b"CTF-BR{"))

alphabet = "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ!\"#$%&'()*+,-./:;<=>?@[\\]^_`{|}~"
flag = ""
while 1:
    nlen = len(flag) + 1
    baseline = run_sim(b"X" * nlen)[4]
    print(f"len={nlen} base={baseline}")
    # "assign events" (the 4th number) decreases by 2 on correct letters
    # for example, it's 2047306 with 32-character input and zero correct letters,
    # and 2047284 with 11 correct letters.
    for ch in alphabet:
        newval = run_sim((flag + ch).encode())[4]
        print(f"len={nlen} nval={newval} ch={ch!r}")
        if newval == baseline - 2 * nlen:
            flag += ch
            print(f"!!! extended flag: {flag}")
            break