Hacking Hardware Picofly - a HWFLY switch modchip

[deeps]

you have a photo?
i wonder how to connect mosfet to cap

 

[fox87]

there will never be anything better then a permanent dat0

let me guess flashed 2.5X firmware without unlock ?

Is there no way to scratch the sealing off the dat0 line on the board to solder a wire to there?

 

[QuiTim]

Is there no way to scratch the sealing off the dat0 line on the board to solder a wire to there?

You can always try this, but it's alot of scratchin to do

 

[Fezaan]

Just tried to boot EmuMMC CFW and it says "A fatal error occured when running Fusée. Package1 seems corrupt!"

Also Warmboot says "Unknown pkg1 version. HOS version not supported"

What can I do now?

Update picofly chip to v2.67.uf2 (file download is located at top of the page > important posts > firmwares. That will take you to Rhieus post. See firmware drop down menu in his post for 2.67.uf2.
Either solder direct usb A to rp2040 chip and flash via laptop/pc or use toolbox loader to update to 2.67.uf2.

After that. Remove microsd card out of your switch and Boot ur switch in stock / normal. Connect to nintendo and update ur switch to latest nintendo system update. Once your switch is updated to latest version.

Put ur microsd card in pc/laptop and download latest atmosphere, fusee.bin, hekate and nyx. Copy them all over to your micro sd and over write.

Turn off ur switch.
Put ur micro sd back in ur switch. Turn on and thank me!

Post automatically merged: Apr 27, 2023

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot
v2.6 + software update, xiao & itsy support
v2.61 + Instinct-NX sdloader, bug fixes
v2.62 + Make 16.0.1 happy (fix OFW boot)
v2.63 + roll back some 2.62 boot speed tricks
v2.64 + enable back the board detection
v2.65 + RP Pico support, double reset removed
v2.66 + Bypass to OFW after update for proper fuse burning
v2.67 + Don't bypass to OFW on first install

Spoiler: LED indication

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
PINK = NS eMMC init fails, inoperative eMMC ?
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success

Spoiler: Diagrams by Dee87

View attachment 357132
View attachment 363821
View attachment 364242
View attachment 364990
View attachment 357133
View attachment 357135
View attachment 357134
View attachment 357136

Spoiler: Solder example

View attachment 357137
View attachment 357138
View attachment 360187
View attachment 363817
View attachment 357139
View attachment 357140
View attachment 360186
View attachment 364818

Spoiler: Issues, questions

Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: rp2040 boards support
A: WaveShare 2040-zero/one, xiao-rp2040, adafruit itsybitsy (Pi Pico is not supported for now)

Q: GREEN, but instant reset
A: Clean flux near the RST point

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot (sysNAND data can be damaged).

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

Spoiler: Reboot to OFW / Vol+ & Vol- doesn't work, blue/black screen

v2.5 firmware had a bug with BOOT0 corruption. To recover it:
- boot "Full Stock" using hekate
- update to the latest official firmware over Wi-Fi

Spoiler: Sleep mode does not work

- boot "Full Stock" using hekate
- perform a full system reset

Spoiler: Toolbox 0.2 features

- show firmware information
- update firmware from SD card (place update.bin into the root folder)
- rollback to the backup firmware slot
- reset learning statistics
- dump / write sdloader

Spoiler: RGB LED explanation by lightninjay

if you have an rp2040-zero from waveshare/ali then it has a neopixel. It is used for diagnosing proper firmware flashes as well as console glitching. If you plug it in, and flash the uf2 firmware to it and immediately see a red light after flashing (this is not the same as flashing, then unplugging and replugging), then no rgb jumper needs to be made. If on the other hand, you get one quick green flashing light, then you need to bridge the jumper pads indicated to swap the LED colors for proper diagnoses capability.

I successfully jailbroke my switch lite with rp2040. All thanks to you rehius!

i love my microscope. So handy.
Video coming on my youtube soon: Intelli Ali

 

[MrNatto]

A little observation from me:

2019 switch lite with samsung emmc: glitch time 1-5 seconds
2019 switch lite with samsung emmc: glitch time 1-5 seconds
2021 switch lite with toshiba emmc: glitch time 5-30 seconds
2019 switch lite with samsung emmc: glitch time 1-5 seconds

Does the led on your rp light up the whole time when it takes 5-30 seconds to glitch, or just towards the end?

Sometimes my lite doesn’t glitch into rcm (or seem to turn on). Maybe I’m not waiting long enough for it to glitch?

 

[malgamer]

i installed it on 3 oled with skhynix and havent had a issue

your pico firmware version?

 

[deeps]

Does the led on your rp light up the whole time when it takes 5-30 seconds to glitch, or just towards the end?

Sometimes my lite doesn’t glitch into rcm (or seem to turn on). Maybe I’m not waiting long enough for it to glitch?

yeah blue all the time

 

[Dee87]

Is there no way to scratch the sealing off the dat0 line on the board to solder a wire to there?

naaa the ninjas did that on purpose

Post automatically merged: Apr 27, 2023

You can always try this, but it's alot of scratchin to do

really shouldnt take that risk then reball bevor that because if u mess this up u wont be able to fix it that easy

 

[A-Hacked-Soul]

Took the advice and got me some 2mm wires. This should be easier to solder than the 1mm

 

[QuiTim]

naaa the ninjas did that on purpose

Post automatically merged: Apr 27, 2023

really should take that risk then reball bevor that because if u mess this up u wont be able to fix it that easy

Yeah, no way I'm doing this. It's just that seing this photo makes reballing look much easier.

 

[Dee87]

Yeah, no way I'm doing this. It's just that seing this photo makes reballing look much easier.

reballing isnt that hard really just take ur time maybe use some old emmcs for training if u have some

 

[FreeLander]

just buy solderpast to reball it with a stencil
what stencil did u buy ?

Hey D,
I bought this based on someone’s recommendation here. Pretty cheap, 4 bucks.

https://aliexpress.com/_mteqYGU

 

[wikisa]

A little observation from me:

2019 switch lite with samsung emmc: glitch time 1-5 seconds
2019 switch lite with samsung emmc: glitch time 1-5 seconds
2021 switch lite with toshiba emmc: glitch time 5-30 seconds
2019 switch lite with samsung emmc: glitch time 1-5 seconds

I've got turqoise 2021 switch lite with picofly + toshiba emmc and it glitches in about 1.5 seconds

 

[NooBziN]

How is your skHynix eMMC doing on the mod ?

Working perfectly

 

[malgamer]

why installed pico need do boot0 boot1 gppraw backup? any ideal

 

[Raugo]

why installed pico need do boot0 boot1 gppraw backup? any ideal

You don't need to do it if you don't want but I think that you need a better printer to make a better fake cover.

 

[impeeza]

Always is better to make a FULL NAND backup as soon as possible. you need a working return point.

 

[NooBziN]

Update picofly chip to v2.67.uf2 (file download is located at top of the page > important posts > firmwares. That will take you to Rhieus post. See firmware drop down menu in his post for 2.67.uf2.
Either solder direct usb A to rp2040 chip and flash via laptop/pc or use toolbox loader to update to 2.67.uf2.

After that. Remove microsd card out of your switch and Boot ur switch in stock / normal. Connect to nintendo and update ur switch to latest nintendo system update. Once your switch is updated to latest version.

Put ur microsd card in pc/laptop and download latest atmosphere, fusee.bin, hekate and nyx. Copy them all over to your micro sd and over write.

Turn off ur switch.
Put ur micro sd back in ur switch. Turn on and thank me!

Post automatically merged: Apr 27, 2023

I successfully jailbroke my switch lite with rp2040. All thanks to you rehius!

i love my microscope. So handy.
Video coming on my youtube soon: Intelli Ali

For those who already have it installed, do you need to update fw2.67?

 

[jkyoho]

For those who already have it installed, do you need to update fw2.67?

WHY NOT, you can rollback old version from toolbox

 

[aahli]

can you make a place for an optional onboard mosfet?

After trying to put it on the motherboard, pico won't boot