Hacking Hardware Picofly - a HWFLY switch modchip

[karatefeet]

It is dirt cheap this way 5 individual or 5 panels like this are roughly same price.

Really? For me 5 and 30 pieces were the same price but anything over 30 was a big increase.

 

[jkyoho]

Hey all. Hope you're all well. I have posted this a few days ago on the AIO thread and have updated my findings but here because I wanted some input atleast. So freinds oled switch modded a month ago. Working fine. He left it on dock overnight. Morning he found it was hot and turned it on. It went into emmc but then died. and the cmd error code flashed when trying to turn it on again. So black screen and cmd code.

He gave it to me and I found a short on both ends of the cmd resitor and one end of the 47k resistor next to it. So i replaced the 4.7kR first. That didn't fix the issue so I did some research and found that reflowing the emmc would fix it. Did that and that fixed the picomod as it glitched successfully again but there was still no picture (black screen). The 4.7k R was now giving correct resistance values and not showing shorts. The short on the 47kR was still there so I went to replace that resistor. When taking off the resistor I double checked the empty pads of the resistor and there was a short still on the pad!? Replaced the resistors anyway and still have a short and no correct Resistance values either.

I have racked my brain around it but im getting no where. I removed the mosfet and even the emmc to completely rule out them as possible variables. Still getting that short. Followed some lines to that Resistor point to some nearby caps and the audio chip and they all are fine. So it does not boot into Anything. No OFW nothing. but it did finally glitch right. Weird.

Anyone have any ideas? Thanks

left side is ground on the 47k resistor. Not short but Normal.

FYI, your 4.7k resistor solder looks cold to me. Use flux and rework on both sides

 

[FreeLander]

Guys this is the thread where all started and i am very grateful to rehius and all the people that helped to make this possible, but there are so so so many misleading posts at these pages that will frustrate so many people that dont have the experience on these stuff. All of us must have the responsibility and the knowledge to support our conclusions. We cant simply tell something that comes up to our minds.

First of all rp2040 clone chips dont burn resistors and other stuff. I have used all of them out there with no issue exept for some modifications on the boards adding or removing some resistors. If you dont know how to solder properly or you use very high heat on these tiny 0201 resistors you will partially damage them or burn them. This is the reason of damaged cmd resistors and nothing else. Different well known used rehius firmwares burning resistors is just ridiculous and dont even post that stuff.

Second the hight quality dat0 adapters which can be found only at the shop on ali that i mentioned before are the only high quality adapters in existence. On all the other shops you just gamble and prey for the correct ones to come. With these adapters there is no way to bridge dat0 with dat1 even if you are sadistic and want to burn your switch. The only thing i can not guarantee you is if this adapter will get loose in the future and lose connection to dat0( which i highly doubt) but i havent got any of them getting loose even after a year of intallation YET! If this dat0 adapter material is real capton then the temps that it can withstand are much much hinger that the temps that the emmc can withstand so bending possiblity is just impossible.

Lastly. As for the corruption on these emmc chips.

The first thing that you must do after a modchip installation is to make a backup of your emmc chip!
If no proper backup of your nand is made follow the sthetix level1 level2 and level3 guides.

If nothing of that works you might have a broken nand chip.
If you have a working boot0 boot1 backup from you nand, order a new emmc chip of the original size of your switch.
You just need this complete kit :
https://www.aliexpress.com/item/1005003618552075.html
It is one of the cheapest kits available. If you have an oled you just desolder the emmc chip, reball and solder it on the adapter that you can find at the kit.
Download Ubuntu 20.04.1 and make a bootable flash drive to boot from it.
Connect the adapter with the emmc chip on the pc.
Open a terminal and press the command : sudo fdisk -l
This will make a list of all your disk drives. Find the 32gb or the 64gb oled emmc and remember the name!
Then use these commands :
sudo su
echo 0 > /sys/block/mmcblk0/force_ro
echo 0 > /sys/block/mmcblk0boot0/force_ro
echo 0 > /sys/block/mmcblk0boot1/force_ro
exit
This will give you superuser privileges and let you use the write commands on the emmc chip. I skipped the read commands because they are useless if you have a proper backup of your emmc chip made from hekate.
Copy the backup of your boot0, boot1 and rawnand to any folder of ubuntu oparating system. Browse to that folder and use these commands:

sudo dd of=/dev/mmcblk0boot0 if=boot0.bin where mmcblk0 must be replaced with your emmc name
sudo dd of=/dev/mmcblk0boot1 if=boot1.bin where mmcblk0 must be replaced with your emmc name
sudo dd of=/dev/mmcblk0 if=rawnand.bin where mmcblk0 must be replaced with your emmc name

The rawnand will take some time to finish. The writing speed times are not so good.
Solder the emmc chip back to switch if you have an Oled.
And you switch is back to life again. Like a virgin.

Thanks, Snaker. I followed all your restore steps, but after doing the sudo dd of=/dev/mmcblk0 if=rawnand.bin. It runs for a minute then gives an error " no space left" I'm using an eMMC from another broken Switch. Please advise.

 

[jkyoho]

make sure

Thanks, Snaker. I followed all your restore steps, but after doing the sudo dd of=/dev/mmcblk0 if=rawnand.bin. It runs for a minute then gives an error " no space left" I'm using an eMMC from another broken Switch. Please advise.

make sure mmcblk0 is your targeted emmc not any other partition/device

 

[Takezo-San]

left side is ground on the 47k resistor. Not short but Normal.

FYI, your 4.7k resistor solder looks cold to me. Use flux and rework on both sides

Oh. I'm just using low melt solder. But will redo it properly. Thanks for the suggestion. Will keep ya posted

 

[FreeLander]

make sure

make sure mmcblk0 is your targeted emmc not any other partition/device

Thanks. How do I make sure of that? Do you see anything wrong in the commands I shared?

Post automatically merged: Sep 22, 2023

So I moved it from before to after (Erista install) and it glitches fast, same MOSFET. Looks like it was a connection issue, so thanks for your help.

Still I'm a bit perplexed, since the wires were short and large enough to handle the current (0.31mm). The important thing is that it works fine now

Neat. I got to say I'm in love with your microscope.

 

[jkyoho]

Thanks. How do I make sure of that? Do you see anything wrong in the commands I shared?

use fdisk -l command to show all device partition

 

[FreeLander]

ohnuse the fdisk -l command to show all device partition

Thanks. I did that and got mmcblk0, mmcblk0boot0, and mmcblk0boot1.
I attacked each with dd and was able to inject boot0 and boot1to my eMMC, but rawnand is giving me all sorts of headaches. sometimes I'd get "input/output error occured" and others it'd just give no space available. I should mention that I'm doing this using a virtual machine and my backup is stored on an external HDD that I shared with the virtual machine and did the commands. I don't know if that's what's causing the issue, but I'm having a hard time copying Rawnand to my eMMC.

 

[jkyoho]

Thanks. I did that and got mmcblk0, mmcblk0boot0, and mmcblk0boot1.
I attacked each with dd and was able to inject boot0 and boot1to my eMMC, but rawnand is giving me all sorts of headaches. sometimes I'd get "input/output error occured" and others it'd just give no space available. I should mention that I'm doing this using a virtual machine and my backup is stored on an external HDD that I shared with the virtual machine and did the commands. I don't know if that's what's causing the issue, but I'm having a hard time copying Rawnand to my eMMC.

could be the VM issue, try just put the Ubuntu on USB driver and boot from there.

 

[FreeLander]

could be the VM issue, try just put the Ubuntu on USB driver and boot from there.

Thanks, brother. Appreciate it.

 

[Vault76]

I had this on switch lite, it was bad solder join

Lmao problem solved, ded emmc. I replace new emmc and it working againt lol

 

[Laufzeitfehler]

Hi Guys,
Today i tried to Install a PicoFly in my Erista V1 Patched switch.
Currently i need a another FLEX Cable (got only V2). In the meantime i tried to solder the wires on my Board. I've messed up the super tricky 3,3v point. The Cap was bridged with the nearest Cap around the point. I unsoldered this one and by this process the cap jumps from my Table. Switch ist starting with no issues but i think a need a new one.
What capacity has this one?

 

[Dk2022]

Hi Guys,
Today i tried to Install a PicoFly in my Erista V1 Patched switch.
Currently i need a another FLEX Cable (got only V2). In the meantime i tried to solder the wires on my Board. I've messed up the super tricky 3,3v point. The Cap was bridged with the nearest Cap around the point. I unsoldered this one and by this process the cap jumps from my Table. Switch ist starting with no issues but i think a need a new one.
What capacity has this one?

In the next install, you can got 3.3v direct from nand. This way is easier to weld and safe.

 

[FreeLander]

Hello guys, What is the difference between these two errors?
**= No eMMC block 1 read (should not happen) *=* No eMMC block 0 read (eMMC init failure?)

Based on a couple of OLEDs, it seems to me that block 1 is dead eMMC, and block 0 is related to poor reballing. Could anyone confirm?

 

[twins333]

Hello guys, What is the difference between these two errors?
**= No eMMC block 1 read (should not happen) *=* No eMMC block 0 read (eMMC init failure?)

Based on a couple of OLEDs, it seems to me that block 1 is dead eMMC, and block 0 is related to poor reballing. Could anyone confirm?

I've seen the block1 one with faulty soldering/connection or with bad pico, but the ocurrences are so small that I cannot confirm this.

 

[RatchetRussian]

I'm always so impressed by the back mosfet installations everyone posts here. Could anyone lend some advice? I've tried 3 separate times on 3 separate OLEDs but always get the same issue... ==* Error and boot to OFW.

I used a lot of lead free solder in my last attempt as you recommend @abal1000x but still nothing

The same system booted instantly with my usual $0.90 AliExpress cpu flex.

 

[Laufzeitfehler]

In the next install, you can got 3.3v direct from nand. This way is easier to weld and safe.

OK,
Do you have some Pictures for this alternate Point? I can only find some for Mariko and the Oleds.
By the way how important ist this cap i discribed above? Currently the Switch works without it - is this necessary to bring them back in position?

 

[bvang913]

In the AiO thread is posted on the first page

 

[abal1000x]

OK,
Do you have some Pictures for this alternate Point? I can only find some for Mariko and the Oleds.
By the way how important ist this cap i discribed above? Currently the Switch works without it - is this necessary to bring them back in position?

V1 point i used
https://gbatemp.net/threads/picofly-a-hwfly-switch-modchip.622701/post-10238860

 

[Dk2022]

OK,
Do you have some Pictures for this alternate Point? I can only find some for Mariko and the Oleds.
By the way how important ist this cap i discribed above? Currently the Switch works without it - is this necessary to bring them back in position?