Hacking Hardware Picofly - a HWFLY switch modchip

cgtchy0412

Well-Known Member
Member
Joined
Apr 26, 2023
Messages
287
Trophies
0
Age
41
XP
436
Country
Indonesia
300 degrees and 3s to 5s same.

I used to installed with sx, hwfly before and all of it work fine.
but after the instinct-nx chip came out and I try it, this issued happen.
and now I switch to use rp2040 the issued is still happen.

so I doubt maybe myself did something wrong but I don't know, try to inspect myself and every solder point and try another tools, wire. the problem still the same.

Maybe the solder point on the cpu bridge with the plate, I will try to add kapton tape there.
Yup, if glitch/gate wire short with ground then it will throw no glitch mosfet error, also the same if the wire detached/not connected from mosfet gate.
Try to install bare mosfet, and try it without closing the cpu cover to avoid any short with metal cover.
Even with kapton if your soldering blob have some sharp edges the it will still goes through the kapton layer and short.
You try to touch/rub it with your finger to feel and make sure they are smooth blob.
 

Minkaxy

Active Member
Newcomer
Joined
Nov 19, 2018
Messages
43
Trophies
0
Age
40
XP
547
Country
Thailand
Yup, if glitch/gate wire short with ground then it will throw no glitch mosfet error, also the same if the wire detached/not connected from mosfet gate.
Try to install bare mosfet, and try it without closing the cpu cover to avoid any short with metal cover.
Even with kapton if your soldering blob have some sharp edges the it will still goes through the kapton layer and short.
You try to touch/rub it with your finger to feel and make sure they are smooth blob.
This one come today, It cannot glitch when microsd is insert.

Eveything look good, no blob at cpu.
IMG_9691.jpeg
 

Ganesha0112

Well-Known Member
Newcomer
Joined
Jan 22, 2023
Messages
56
Trophies
0
Age
28
XP
286
Country
Mexico
Hello friends.

Need some help.

I have some issues with a picofly installation on a oled board and RP2040 tiny.

1.- The RP2040 keeps green led after successfully glitching process and programmed chip

2.- The RP2040 don’t show correctly led colors, when I program the 2.73 firmware the led don’t show any colors like death chip but works correctly, glitch the board.
When i program the 2.67 firmware the chip shows blue -> white -> combination between white and cyan colors breathing -> orange -> infinite green led. I do the bridge in led mod points but the same result

3.- When I insert a micro sd card the RP2040 after show an orange led that in this case means successfully glitch process, send me to OFW. But when I remove the micro sd card the chip send me to the “NO SD CARD” image.

Any idea what can be happen? I

Im Thinking the problem it’s the RP2040 that keeps taking energy from 3.3v cap but idk

Additional information:

This Nintendo switch before the installation sometimes shows randomly the error “2002-3537” and the console won’t turn on until I open the console and desconecta and connect the battery
 

Attachments

  • IMG_7644.mov
    29.2 MB
  • IMG_7645.mov
    37.4 MB

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,070
Trophies
0
XP
1,395
Country
Gaza Strip
Hello friends.

Need some help.

I have some issues with a picofly installation on a oled board and RP2040 tiny.

1.- The RP2040 keeps green led after successfully glitching process and programmed chip

2.- The RP2040 don’t show correctly led colors, when I program the 2.73 firmware the led don’t show any colors like death chip but works correctly, glitch the board.
When i program the 2.67 firmware the chip shows blue -> white -> combination between white and cyan colors breathing -> orange -> infinite green led. I do the bridge in led mod points but the same result

3.- When I insert a micro sd card the RP2040 after show an orange led that in this case means successfully glitch process, send me to OFW. But when I remove the micro sd card the chip send me to the “NO SD CARD” image.

Any idea what can be happen? I

Im Thinking the problem it’s the RP2040 that keeps taking energy from 3.3v cap but idk

Additional information:

This Nintendo switch before the installation sometimes shows randomly the error “2002-3537” and the console won’t turn on until I open the console and desconecta and connect the battery
Can't help on 2.67 already forgot.
Use 2.73 or 2.74, at least that what i use everyday for playing around.

2.73 use signal code not color.
Post automatically merged:

This one come today, It cannot glitch when microsd is insert.

Eveything look good, no blob at cpu. View attachment 391988
Maybe you do something uniquely that made the power problematic.
I never met cases like this, where the glitch not work if microsd inserted.
And not hear anyone have it before.

Theres similar, but not quite same. That when using microsd, the glitch worked, but the hekate always failed.
Its turnout he use 'extraordinary' point of 3.3v which is from the microsd.
 
Last edited by abal1000x,

Minkaxy

Active Member
Newcomer
Joined
Nov 19, 2018
Messages
43
Trophies
0
Age
40
XP
547
Country
Thailand
Can't help on 2.67 already forgot.
Use 2.73 or 2.74, at least that what i use everyday for playing around.

2.73 use signal code not color.
Post automatically merged:


Maybe you do something uniquely that made the power problematic.
I never met cases like this, where the glitch not work if microsd inserted.
And not hear anyone have it before.

Theres similar, but not quite same. That when using microsd, the glitch worked, but the hekate always failed.
Its turnout he use 'extraordinary' point of 3.3v which is from the microsd.
Thanks, I try to figure it out where is it too.

This case have to reflow cpu and everything back to normal.
 

Phantomas77

Well-Known Member
Member
Joined
Dec 19, 2022
Messages
285
Trophies
0
XP
727
Country
Italy
Hello friends.

Need some help.

I have some issues with a picofly installation on a oled board and RP2040 tiny.

1.- The RP2040 keeps green led after successfully glitching process and programmed chip

2.- The RP2040 don’t show correctly led colors, when I program the 2.73 firmware the led don’t show any colors like death chip but works correctly, glitch the board.
When i program the 2.67 firmware the chip shows blue -> white -> combination between white and cyan colors breathing -> orange -> infinite green led. I do the bridge in led mod points but the same result

3.- When I insert a micro sd card the RP2040 after show an orange led that in this case means successfully glitch process, send me to OFW. But when I remove the micro sd card the chip send me to the “NO SD CARD” image.

Any idea what can be happen? I

Im Thinking the problem it’s the RP2040 that keeps taking energy from 3.3v cap but idk

Additional information:

This Nintendo switch before the installation sometimes shows randomly the error “2002-3537” and the console won’t turn on until I open the console and desconecta and connect the battery
The LED issue is related to sh*tty RP2040-tiny knowoffs which have huge flex connector and they did something with the LED wiring (and maybe something else). In FW2.73 the LED is always off, but if you see "NO SD" sreen the glitch was successful and should be ok.

Regarding SD+OFW, try with different card and files.
 

Dee87

Well-Known Member
Member
Joined
Mar 19, 2023
Messages
1,139
Trophies
1
XP
1,589
Country
Germany
Hello friends.

Need some help.

I have some issues with a picofly installation on a oled board and RP2040 tiny.

1.- The RP2040 keeps green led after successfully glitching process and programmed chip

2.- The RP2040 don’t show correctly led colors, when I program the 2.73 firmware the led don’t show any colors like death chip but works correctly, glitch the board.
When i program the 2.67 firmware the chip shows blue -> white -> combination between white and cyan colors breathing -> orange -> infinite green led. I do the bridge in led mod points but the same result

3.- When I insert a micro sd card the RP2040 after show an orange led that in this case means successfully glitch process, send me to OFW. But when I remove the micro sd card the chip send me to the “NO SD CARD” image.

Any idea what can be happen? I

Im Thinking the problem it’s the RP2040 that keeps taking energy from 3.3v cap but idk

Additional information:

This Nintendo switch before the installation sometimes shows randomly the error “2002-3537” and the console won’t turn on until I open the console and desconecta and connect the battery
use a original waveshark rp2040 tiny and not those clones and u will not have any issue i bet , ur not the first one the last couple day with a clone tiny that has issues.
Post automatically merged:

This one come today, It cannot glitch when microsd is insert.

Eveything look good, no blob at cpu. View attachment 391988
is the a device that u have already handed out?

if u give people a devices like this with solder blobs flying all over the place then it is no wonder that u are having issues.
i cant tell that u def have solder blobs laying around atleast between the apu and the ram.
thermal past is flying all over the place.
u should atleast clean the board before u give it back to a customer
 
Last edited by Dee87,

Minkaxy

Active Member
Newcomer
Joined
Nov 19, 2018
Messages
43
Trophies
0
Age
40
XP
547
Country
Thailand
use a original waveshark rp2040 tiny and not those clones and u will not have any issue i bet , ur not the first one the last couple day with a clone tiny that has issues.
Post automatically merged:


is the a device that u have already handed out?

if u give people a devices like this with solder blobs flying all over the place then it is no wonder that u are having issues.
i cant tell that u def have solder blobs laying around atleast between the apu and the ram.
thermal past is flying all over the place.
u should atleast clean the board before u give it back to a customer
I just clean it to take a pic. Maybe the blob drop from some of my brush.
 

cgtchy0412

Well-Known Member
Member
Joined
Apr 26, 2023
Messages
287
Trophies
0
Age
41
XP
436
Country
Indonesia
Thanks, I try to figure it out where is it too.

This case have to reflow cpu and everything back to normal.
I have theory behind this...
There no way that apu solder ball is disturbed let alone became loose just by only soldering the caps.

So the most likely culprit is small solder tin residue contaminating underneath apu ..
And of course if you reflow it then all residue will melt, and base on luck it will solve the problem.. yeah base on luck i must say.

Please onwards can be more clean, especially if you give these unit to somebody else.. be proud of your work by being clean.
 
  • Like
Reactions: twins333 and QuiTim

ShadowFox7

Member
Newcomer
Joined
Mar 19, 2023
Messages
12
Trophies
0
Age
123
XP
105
Country
Spain
Hi everyone,

I need some help.

While installing the modchip on a V2, I accidentally ripped a pad (I think is gone, see pic), specifically the RST pad and now the switch is not turning on (no screen, no sound).

Someone knows if it's fixable bridging the traces with the cap?

Thanks!
 

Attachments

  • IMG20230904151333.jpg
    IMG20230904151333.jpg
    707.2 KB · Views: 41
  • Like
Reactions: achm3t

Ganesha0112

Well-Known Member
Newcomer
Joined
Jan 22, 2023
Messages
56
Trophies
0
Age
28
XP
286
Country
Mexico
The LED issue is related to sh*tty RP2040-tiny knowoffs which have huge flex connector and they did something with the LED wiring (and maybe something else). In FW2.73 the LED is always off, but if you see "NO SD" sreen the glitch was successful and should be ok.

Regarding SD+OFW, try with different card and files.
Thanks for the help, the problem was the files on the SD. The chip works but it’s annoying don’t see any led when I turn on the switch, and it takes a long time glitch the switch. Any idea if it’s possible fix the led issue? And yes, this rp2040 clones are garbage, it’s necessary remove the USB conector cause the oled don’t close properly.
 
Last edited by Ganesha0112,

jkyoho

Well-Known Member
Member
Joined
Sep 2, 2020
Messages
1,305
Trophies
0
Age
39
Location
TORONTO
Website
form.jotform.com
XP
2,244
Country
Canada
Hi everyone,

I need some help.

While installing the modchip on a V2, I accidentally ripped a pad (I think is gone, see pic), specifically the RST pad and now the switch is not turning on (no screen, no sound).

Someone knows if it's fixable bridging the traces with the cap?

Thanks!
That's resistor broken not like pad broken.
 

cgtchy0412

Well-Known Member
Member
Joined
Apr 26, 2023
Messages
287
Trophies
0
Age
41
XP
436
Country
Indonesia
I've made a research this weekend on the firmware.

I've googling rp2040, and it seems it couldn't shutdown itself properly.
https://forums.raspberrypi.com/viewtopic.php?t=340301
The best solution is to make a physical/electronical mechanism to take the 3.3v out from the board.
With current resistor setup i think if you cut 3.3v line then it will result in blackscreen (if i remember, correct me if wrong).
I've tried to disable vreg regulator programatically turns out it make the gpio impedance into 14ohms, which ofcourse interfering the cmd's emmc line. So back with using the lowest vreg, to minimize draining power, and it gives the good high impedance.
Why not try to add resistor value on cmd line(or any othe connected gpio) to up the impedance, or these actually will make the glitch it self failed so is not an option.
Turns out, the problem with slow emmc, some of it could be from the firmware.
I recently got a v1 device which got slow emmc even with 100ohms on dat0/cmd.
Yes, even on different day can be reported as slow, whether current r values is already around the edge or there is some bug(minor) in current codes.
@rehius
This line of code, seems never executed
https://github.com/rehius/usk/blob/1a39e9b46dac3ab7ddddad647d03575e41655dbb/misc.c#L38
I don't know exactly what happened. It seems the rp2040 still running.
I kind of fixed that part, and the slow emmc problem disappeared.

If you want too, i could PR it. But its an ugly patch. Theres dependency on pico-extras.
How did you know it was never executed, how can you debug it, please can share the steps.
 

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,070
Trophies
0
XP
1,395
Country
Gaza Strip
With current resistor setup i think if you cut 3.3v line then it will result in blackscreen (if i remember, correct me if wrong).
I've done it on v1, and it boot on ofw correctly no blackscreen.
First let the glitch works, goes to hekate, then i CAREFULLY unsoldered the 3.3v (dont replicate this without deep understanding). then from hekate goes to ofw. all running fine.

I do this in couple of time. So eventually rather use solder carefully i rather use magnetic switch. Its much more easier.
Why not try to add resistor value on cmd line(or any othe connected gpio) to up the impedance, or these actually will make the glitch it self failed so is not an option.
I am afraid adding the resistance to around kiloohms might troubling the glitch process. And it doesn't solve the rp2040 power consumption after it. The best solution is cut off the 3.3v maybe using external circuitry like a flip flop or somekind of self latched. I also think whether to use the power switch, vol swith, or the audio jack to conditioning this 3.3v goes to the rp2040. But theres no safe route, except made another circuit, which will increase the price.
Yes, even on different day can be reported as slow, whether current r values is already around the edge or there is some bug(minor) in current codes.
Yes, the bug is found, because i meet that cases. I wonder why it interfere the cpu communication, turns out the rp2040 are not properly 'sleep'

How did you know it was never executed, how can you debug it, please can share the steps.
You could turn the serial communication and read from usb/jtag. But since i am too lazy, so i use different route. I just measure the cmd pin (or other gpio pin), voltage and resistance. To get a gist, i use unconnected rp2040 zero (new one), upload rehius firmware. Turn it on, it will failed since its not connected to anything. Then after failed it will run the zzz() function which will 'sleep' the board. So at this point, check the cmd line (or other gpio) voltage and resistance. You will get the voltage around 1.1v and the resistance are high impedance. Its means the code doesn't work. At first i thought maybe the code is wrong. So read the datasheet and run some example. Turns out the code is alright, it just doesnt get executed. Then i keep on using the datasheet and example trying minimal code to for example turn off the memory one by one. And this is the culprit guess. The previous logics is move the code to sram4 and turn off all sram except sram4. Turns out this code is not working somehow. So the code stopped at this point, and the sleep code after it is not executed. I change the logics to check if current code on sram n dont turn off the sram n.

So to confirm this, you could upload rehius firmware, and check the cmd voltage and resistance. Than try to upload my custom firmware, and check it. You will see the difference.

The modify is in my github if you want to read, on branch 'fix_shutdown'.
I am sure with this code you could use the ordinary 47ohms.

Yet i still couldn't turn of the VREG_VOUT. When i disable it, the resistance goes low, and the voltage is totally zero. I don't know why the resistance goes low. In off condition, the voltage is zero and the resistance in high impedance.
Post automatically merged:

With current resistor setup i think if you cut 3.3v line then it will result in blackscreen (if i remember, correct me if wrong).

Why not try to add resistor value on cmd line(or any othe connected gpio) to up the impedance, or these actually will make the glitch it self failed so is not an option.

Yes, even on different day can be reported as slow, whether current r values is already around the edge or there is some bug(minor) in current codes.

How did you know it was never executed, how can you debug it, please can share the steps.
If you uncomment this, the VREG will be disabled and the cmd pin will be zero voltage but its more like pulldown then floating.

https://github.com/abal1000x/usk/blob/b0f64d375e482eba71eefbbdbf631725f62a056d/misc.c#L153
 
Last edited by abal1000x,

cgtchy0412

Well-Known Member
Member
Joined
Apr 26, 2023
Messages
287
Trophies
0
Age
41
XP
436
Country
Indonesia
The best solution is cut off the 3.3v maybe using external circuitry like a flip flop or somekind of self latched. I also think whether to use the power switch, vol swith, or the audio jack to conditioning this 3.3v goes to the rp2040. But theres no safe route, except made another circuit, which will increase the price.
Ussualy in 3.5mm jack there is some mechanical switch/metal lever thats indicates whether is plugged or not, not yet check whats on the Switch yet, but the problem is this lever is normaly On (commonly) so to cut you need to insert a plug.

Maybe also we can somehow us GC slot cover to install a mini switch(mechanical) and position it i a way that when we open GC slot cover it will turn on and when we close it will cut off.
With this then when we want to glitch then just open the GC cover .. after boot we close it .. clean solution.
 

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,070
Trophies
0
XP
1,395
Country
Gaza Strip
Ussualy in 3.5mm jack there is some mechanical switch/metal lever thats indicates whether is plugged or not, not yet check whats on the Switch yet, but the problem is this lever is normaly On (commonly) so to cut you need to insert a plug.

Maybe also we can somehow us GC slot cover to install a mini switch(mechanical) and position it i a way that when we open GC slot cover it will turn on and when we close it will cut off.
With this then when we want to glitch then just open the GC cover .. after boot we close it .. clean solution.
Thats GC might work.
 

twins333

Well-Known Member
Newcomer
Joined
May 30, 2023
Messages
86
Trophies
0
XP
325
Country
Afghanistan
Acctually im more interested in the promise of zero power sipping after the glitch by a total shutdown of pico, more than slow emmc error solution as this is in one way or another already covered by upping resistor values
wouldn't that be solved via firmware? enter low power mode after successful glitch.
 

thesjaakspoiler

Well-Known Member
Member
Joined
Nov 20, 2018
Messages
990
Trophies
0
Age
124
XP
1,513
Country
Afghanistan
Ussualy in 3.5mm jack there is some mechanical switch/metal lever thats indicates whether is plugged or not, not yet check whats on the Switch yet, but the problem is this lever is normaly On (commonly) so to cut you need to insert a plug.

Maybe also we can somehow us GC slot cover to install a mini switch(mechanical) and position it i a way that when we open GC slot cover it will turn on and when we close it will cut off.
With this then when we want to glitch then just open the GC cover .. after boot we close it .. clean solution.
Why not use a reed switch placed in the cartridge slot and a 3d printed empty cartridge with a magnet that can be put in 2 positions? Left position to have the reed switch make contact, right position to break the contact.
Early internal payload injector hacks were using the reed switch in order to press a button.
The DragonInjector also showed that you can put a lot of stuff in a single cartridge.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    AncientBoi @ AncientBoi: Hilarious :rofl2: