Hacking Hardware Picofly - a HWFLY switch modchip

deeps

Well-Known Member
Member
Joined
Jul 3, 2007
Messages
454
Trophies
1
XP
1,273
Country
Hey guys i want to impruve My work for future consoles . this uis my latest install. Any advice??

this looks good to me. Here's mine, for reference
 

Attachments

  • photo_2023-07-05_00-06-33.jpg
    photo_2023-07-05_00-06-33.jpg
    177.8 KB · Views: 36
  • photo_2023-07-05_00-06-29.jpg
    photo_2023-07-05_00-06-29.jpg
    267.5 KB · Views: 31

floxcap

Well-Known Member
Newcomer
Joined
May 21, 2023
Messages
69
Trophies
0
XP
281
Country
Australia
Just wanted to share an experience that i had yesterday.
My friend told me his Switch (v1 unpatched) is not glitching anymore so i took the switch and dived in.
This was my installation so I was pretty sure I did not fck something up but since this was the only Unpatched switch I did to this day I wanted to see why this happened and also him having 2 children that treat this poor thing like a piñata I was sure that some wire came loose (if not the whole chip)
The soldering was ok, nothing moved there (single irf8342 single wire 2 caps), the fw was 2.67 and it was showing yellow (CLK problem).
I took the Pico off, resoldered the usbc, flashed 2.73 and attached everything back but the problem persisted, now showing == CLK not connected (same error but different fw).
I tried also removing the voltage regulator (known to go bad sometime), changing the resistors, using a different 3v3 point and what not but there was no way to make it work.
In the end I replaced the Pico with a new one and it works normally.
I never touched the other soldered points on the pcb, they remain the same so there was no issue there.
My best guess at this point is that it might have been a bad crystal so I saved the old Pico and I will swap the crystal and give it one more go when I find time for it just to get to the bottom of it.
Anyone had a similar issue?
My concern with the bare mosfet install is that we may be over-loading the output pin from the RP2040 which could cause internal damage to the IC.
General practice is to have a resistor in the gate drive line to limit the current drawn from GPIO.

This article may be informative:

"The initial current is very high. It slows down as the capacitor charges. That initial current rush, also known as in-rush current, can be a problem. Even though it is a short time, there is a significant current surge that can damage an I/O pin."

https://www.baldengineer.com/7-mosfet-myths-and-misconceptions-addressed.html
 
Last edited by floxcap,

tootallnate

Developer
Developer
Joined
Mar 31, 2023
Messages
60
Trophies
0
Age
35
Website
n8.io
XP
466
Country
United States
what did you try exactly?

In Hekate:
  • Console Info -> eMMC gives the "slow mode" warning and only shows init errors.
  • Attempting to create an emuNAND also shows the "slow mode" warning, but if I try to continue anyways it shows "eMMC init failed" and nothing more.
  • Trying to create a backup of BOOT0 or BOOT1 also prints "eMMC init failed".
  • Reboot -> OFW gives the purple screen.
I've also updated the modchip with fw_2.73.uf2, but it didn't seem to make any difference.
 

deeps

Well-Known Member
Member
Joined
Jul 3, 2007
Messages
454
Trophies
1
XP
1,273
Country
In Hekate:
  • Console Info -> eMMC gives the "slow mode" warning and only shows init errors.
  • Attempting to create an emuNAND also shows the "slow mode" warning, but if I try to continue anyways it shows "eMMC init failed" and nothing more.
  • Trying to create a backup of BOOT0 or BOOT1 also prints "eMMC init failed".
  • Reboot -> OFW gives the purple screen.
I've also updated re-flahsed the modchip with fw_2.73.uf2, but it didn't seem to make any difference.

does it show any useful info about the emmc after pressing ok on the slow mode warning screen?
 

deeps

Well-Known Member
Member
Joined
Jul 3, 2007
Messages
454
Trophies
1
XP
1,273
Country

I see three possibilities:

- your dat0 adapter shorts between dat0 and dat1
- your cmd resistor is blown, or your cmd wire is shorted to gnd somehow
- you need higher resistance for dat0/cmd connections to the chip

I would start by measuring your cmd resistor and wire with a multimeter.
If it seems good then test by disconnecting cmd/clk/dat0/3v3 from the chip (leave gnd/cpu/rst connected) and see if the system boots at all.
If it does, you might want to try stronger resistors (add another 47 ohm for dat0/cmd)
If no go then remove dat0 adapter.
Still no go? Use it as a paper weight, or replace and rebuild emmc
 
  • Like
Reactions: Takezo-San

tootallnate

Developer
Developer
Joined
Mar 31, 2023
Messages
60
Trophies
0
Age
35
Website
n8.io
XP
466
Country
United States
I see three possibilities:

- your dat0 adapter shorts between dat0 and dat1
- your cmd resistor is blown, or your cmd wire is shorted to gnd somehow
- you need higher resistance for dat0/cmd connections to the chip

I would start by measuring your cmd resistor and wire with a multimeter.
If it seems good then test by disconnecting cmd/clk/dat0/3v3 from the chip (leave gnd/cpu/rst connected) and see if the system boots at all.
If it does, you might want to try stronger resistors (add another 47 ohm for dat0/cmd)
If no go then remove dat0 adapter.
Still no go? Use it as a paper weight, or replace and rebuild emmc

I got a reading of 70 ohms from the CMD resistor. Does that sound correct?

Will try your other debugging steps and follow-up here.
 
Last edited by tootallnate,

DinhoS

New Member
Newbie
Joined
Jun 23, 2023
Messages
1
Trophies
0
Age
36
XP
36
Country
Brazil
sorry for the language. I've already done 3 lite but tomorrow I'm going to do my first oled. the OATO arrived today. In your opinion, are they of quality or are they problematic and will I need to make the modification? grateful to everyone.
 

Attachments

  • 4B04EDBA-E21B-47E5-866A-06C034937A21.jpeg
    4B04EDBA-E21B-47E5-866A-06C034937A21.jpeg
    841.1 KB · Views: 26

CarlosGo

Member
Newcomer
Joined
May 23, 2023
Messages
5
Trophies
0
Age
23
XP
26
Country
Mexico
Hello, yesterday I modified my Switch Lite with the hwfly v6 from the official store and everything worked perfectly. I was able to install games, Homebrew, etc. I turned it off with 100% battery and now waking up the battery was totally gone. Does anyone know how I can fix this? I am doing tests and the battery is low between 10 and 13% hourly only in standby. And I don't understand what the hell is going on. Someone help me.
 

Attachments

  • unnamed.jpg
    unnamed.jpg
    3.5 MB · Views: 23

cgtchy0412

Well-Known Member
Member
Joined
Apr 26, 2023
Messages
287
Trophies
0
Age
41
XP
437
Country
Indonesia
My concern with the bare mosfet install is that we may be over-loading the output pin from the RP2040 which could cause internal damage to the IC.
General practice is to have a resistor in the gate drive line to limit the current drawn from GPIO.
(You'll see those resistors in the CPU flex cable - driver resistor(s) and pull down).

This article may be informative:

"The initial current is very high. It slows down as the capacitor charges. That initial current rush, also known as in-rush current, can be a problem. Even though it is a short time, there is a significant current surge that can damage an I/O pin."

https://www.baldengineer.com/7-mosfet-myths-and-misconceptions-addressed.html
Will try this in my next, ill use 1k, lets see how it goes.
Post automatically merged:

Hello, yesterday I modified my Switch Lite with the hwfly v6 from the official store and everything worked perfectly. I was able to install games, Homebrew, etc. I turned it off with 100% battery and now waking up the battery was totally gone. Does anyone know how I can fix this? I am doing tests and the battery is low between 10 and 13% hourly only in standby. And I don't understand what the hell is going on. Someone help me
With picofly its roughly 5% a day with sleep function, for standby(i mean just pressing the power button in the middle of gameplay session) im not testing it yet.
Just try to remove the hwfly board and test the battery again, maybe the board is defective and there is a voltage leak.
 
Last edited by cgtchy0412,

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,070
Trophies
0
XP
1,400
Country
Gaza Strip
sorry for the language. I've already done 3 lite but tomorrow I'm going to do my first oled. the OATO arrived today. In your opinion, are they of quality or are they problematic and will I need to make the modification? grateful to everyone.
Its problematic.

You could identify on the contact pin. Its circle then its problematic, those circle might bridge other pin. Look for a 'rectangular' shape.
Post automatically merged:

My concern with the bare mosfet install is that we may be over-loading the output pin from the RP2040 which could cause internal damage to the IC.
General practice is to have a resistor in the gate drive line to limit the current drawn from GPIO.
(You'll see those resistors in the CPU flex cable - driver resistor(s) and pull down).

This article may be informative:

"The initial current is very high. It slows down as the capacitor charges. That initial current rush, also known as in-rush current, can be a problem. Even though it is a short time, there is a significant current surge that can damage an I/O pin."

https://www.baldengineer.com/7-mosfet-myths-and-misconceptions-addressed.html
Nice article, but i am not convince with the reasoning.

First the gpio have their own pulldown resistor configured when the rp2040 turn on.
Second, if those rush current is a problem, than any capacitor connected to any gpio in the rp2040 might destroyed the chip, not just only mosfet. The bigger the capacitor, the bigger rush current.

I worry more of the current accumulated on the gate that make the DS connected and this will lead a huge current flows from power line to the mosfet and lead to a fried mosfet.
Post automatically merged:

I got a reading of 70 ohms from the CMD resistor. Does that sound correct?

Will try your other debugging steps and follow-up here.
Its ambigue.
What CMD resistor do you check?

The purple screen might because the CMD resistor (the pullup resistor) in the Board which you need to check.
Also i have my own theory (which still doubtfull) is the CMD resistor on the picofly (47ohms) is not enough, thats why i encourage to use 100ohms on CMD line especially but might also the Dat0.
Post automatically merged:

Ok that makes a lot of sense, and to clarify, do you avoid the corner pads? Like my drawing arcs away to avoid them, but from the pictures it almost looks like it's a straight line through them.
Yes just like @QuiTim stated.

Those corner pad are connected internally, for example the D part will connect the whole center pad and 4 pin around it.
And the S part will connect the corner with the bottom center pad.

So we only need to concern whether our connection is solid, and the solder could deliver high current from it. You need not to worry on avoiding those corner pad.

 
Last edited by abal1000x,

floxcap

Well-Known Member
Newcomer
Joined
May 21, 2023
Messages
69
Trophies
0
XP
281
Country
Australia
Will try this in my next, ill use 1k, lets see how it goes.
Post automatically merged:


With picofly its roughly 5% a day with sleep function, for standby(i mean just pressing the power button in the middle of gameplay session) im not testing it yet.
Just try to remove the hwfly board and test the battery again, maybe the board is defective and there is a voltage leak.
1K is probably too big & may cause glitching issues.
For reference see: https://www.build-electronic-circuits.com/mosfet-gate-resistor/

For GPIO 12mA current @ 3.3V
- I'd try 300 ohms (275 ohms - 12mA) which should draw 11mA
 
Last edited by floxcap,

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,070
Trophies
0
XP
1,400
Country
Gaza Strip

floxcap

Well-Known Member
Newcomer
Joined
May 21, 2023
Messages
69
Trophies
0
XP
281
Country
Australia
Ah i see, you mean the Gate Resistor not the pulldown resistor.
AFAIK cpu flex cable doesn't use Gate Resistor, only pulldown resistor. CMIIW.
Yep - you're right - the flex doesn't have a series resistor.
I wonder if they had one on the pcb?
TBH I haven't tested putting in a series resistor yet - but the theory is there that we may be stressing the GPIO which may lead to failures over time.
Perhaps someone with the right tools can measure and share the current draw on the GPIO during glitching. :)
 

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,070
Trophies
0
XP
1,400
Country
Gaza Strip
Yep - you're right - the flex doesn't have a series resistor.
I wonder if they had one on the pcb?
TBH I haven't tested putting in a series resistor yet - but the theory is there that we may be stressing the GPIO which may lead to failures over time.
Perhaps someone with the right tools can measure and share the current draw on the GPIO during glitching. :)
I don't see any information or warning from the datasheet about that we need to put a series resistor on GPIO. Its only stated that the GPIO maximum current could deliver at 50mA.

What i usually do, putting led on the gpio pin, directly without any resistor, is usually works without error. As long as the gpio configured as an output, and the line used as an output, usually nothing happened. The bad thing happened, usually when we're playing the pin as an input, and we inject the voltage more than what the datasheet recommended.

I more worried on the accumulated charge on the Gate. But i doubt the accumulated charge (the capacitance is so small, when we read on the mosfet datasheet), could destroy gpio internal circuit. Almost all modern ic have their own anti ESD mechanism.
 

floxcap

Well-Known Member
Newcomer
Joined
May 21, 2023
Messages
69
Trophies
0
XP
281
Country
Australia
I don't see any information or warning from the datasheet about that we need to put a series resistor on GPIO. Its only stated that the GPIO maximum current could deliver at 50mA.

What i usually do, putting led on the gpio pin, directly without any resistor, is usually works without error. As long as the gpio configured as an output, and the line used as an output, usually nothing happened. The bad thing happened, usually when we're playing the pin as an input, and we inject the voltage more than what the datasheet recommended.

I more worried on the accumulated charge on the Gate. But i doubt the accumulated charge (the capacitance is so small, when we read on the mosfet datasheet), could destroy gpio internal circuit. Almost all modern ic have their own anti ESD mechanism.
50mA is for sum of all IO pins:
"Maximum Total IOVDD current IOVDD_MAX 50 mA Sum of all current being sourced by GPIO and QSPI pins"
Depending on setting it should be limited to 12mA per pin.
Sure - you can pull more current from an IO - but it's beyond spec... it may be fine in the short term - but no guarantee for the long term.
Anyway - I'm just sharing my thoughts and experiences and at the end of the day everyone is free to make their own choices.
 

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,070
Trophies
0
XP
1,400
Country
Gaza Strip
50mA is for sum of all IO pins:
"Maximum Total IOVDD current IOVDD_MAX 50 mA Sum of all current being sourced by GPIO and QSPI pins"
Depending on setting it should be limited to 12mA per pin.
Sure - you can pull more current from an IO - but it's beyond spec... it may be fine in the short term - but no guarantee for the long term.
Anyway - I'm just sharing my thoughts and experiences and at the end of the day everyone is free to make their own choices.
Its okay, its positive light discussion.
Its just one probable cause. We might take note on it.

Subjectively, for me, i am not convince enough that the current from the mosfet gate able to destroy the rp2040.
 
  • Like
Reactions: AceCuba and floxcap

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: https://youtu.be/LM0Y6RWvcr8?si=RjMLNrx1TEX301g1 Already has cfw lol