Hacking Hardware Picofly - a HWFLY switch modchip

[binkinator]

So then, I've installed one into a switch lite as per the instructions on one of the previous posts..I then used the uf2 from the firmware dump.

When you turn the console on the led goes blue then red and ofw launchs,compared to before I installed where it went pink.

So something is happening now it's wired in

Please ignore the nonsense resistors.. I didn't have any smd 450 so have ordered some to swap those ones out if we can get it working

Are you using some really thin wire? I think I see them but wanted to make sure. There’s supposed to be 5 wires + power and ground, right? Perhaps you could shed a little more light on what you’re doing for n00bs like myself to follow along?

 

[Tafty]

Are you using some really thin wire? I think I see them but wanted to make sure. There’s supposed to be 5 wires + power and ground, right? Perhaps you could shed a little more light on what you’re doing for n00bs like myself to follow along?

Im using enemal wire for the main points, which I've soldered directly to the flexs test points and cpu pad.. Then for ground and 3.3v I'm using kynar. I've used the sx lite flex for the simple reason if this doesn't work I can at least just straight fit in a chip as I've done all the hard work allready....

 

[binkinator]

Im using enemal wire for the main points, which I've soldered directly to the flexs test points and cpu pad.. Then for ground and 3.3v I'm using kynar. I've used the sx lite flex for the simple reason if this doesn't work I can at least just straight fit in a chip as I've done all the hard work allready....

Makes perfect sense. Thank you for confirming.

 

[achm3t]

Yes, it works

Well, how can it work without those 2 mosfets on cpu flex?

 

[heinrich_frei]

Well, how can it work without those 2 mosfets on cpu flex?

I only soldered these two mosfets

 

[achm3t]

I only soldered these two mosfets

Ok, that makes sense And obviously cpu flex (or only 2pcs np2016dr from it) is still needed.

 

[sudeki300]

write in english, it's official here by the forum rules, and the moderators here are horrible racists, they tear down any non-english texts without even looking

or maybe it's the most common language spoken worldwide.

 

[impeeza]

srsly?
Use ubuntu in win. MinGW is bad shell)

Hi, for me MinGW has been the best shell under windows, selfcontained and do not affected by any other config on WIndows.

A VM or the linux on windows, are difficult for me, Think is a matter of taste

 

[Adran_Marit]

Im using enemal wire for the main points, which I've soldered directly to the flexs test points and cpu pad.. Then for ground and 3.3v I'm using kynar. I've used the sx lite flex for the simple reason if this doesn't work I can at least just straight fit in a chip as I've done all the hard work allready....

That reminds me I need to do my lite XD

 

[Tafty]

So then, I've installed one into a switch lite as per the instructions on one of the previous posts..I then used the uf2 from the firmware dump.

When you turn the console on the led goes blue then red and ofw launchs,compared to before I installed where it went pink.

So something is happening now it's wired in

Please ignore the nonsense resistors.. I didn't have any smd 450 so have ordered some to swap those ones out if we can get it working

Little update on this...after posting I thought I better go and check I had soldered in the flex's correctly so took the rp out and wired up a sx core manually using the same wires i was using for the rp(dont have any lites currently) and it wouldn't glitch...turns out I hadn't soldered dat 0 correctly.

fixed that issue and confirmed my wiring was good with the sx, rewired the RP back in but unfortunately getting the same result. blue light then red light...BUT now im NOT getting into OFW like I was before, this is similar to what happens when you have soldered a sx/hw chip in incorrectly(again I confirmed this wasn't the case)

removing 3.3v does allow the console to then boot OFW like normal(expected behaviour)

so IMO at this point its trying to do something and failing...maybe this is to do with the ID encryption I read a few pages back...maybe its missing something but im now in a position where I can test anything hardware side. so please let me know.

also ive tested the install with and without resistors as the picture on page 1 clearly doesn't have them installed. so not sure why schematic a few pages ago does

 

[evil_santa]

Hmm wonder if it's possible to change the flash Id from the nor memory
or tell the firmware that the ID is the same as that of the original chip.
But I don't think it's possible

 

[saladus]

well we'd have to know the original id in the first place and afaik we don't

 

[thesjaakspoiler]

well we'd have to know the original id in the first place and afaik we don't

The original id is just a 64bit number and it is retrieved from the flash chip.
The RP2040 does not have an internal id in the cpu itself (according to the documentation) :
https://raspberrypi.github.io/pico-sdk-doxygen/group__pico__unique__id.html
I don't know if the dump is just a raw dump of the flash chip?
If so, then it should be there.

If not, someone will be able to hack it.
Just speculating here but the firmware is probably the same as for the hwfly.
So we know the decoding algorithm. Then it is just a matter of trying all keys and comparing the output.
With a 64bit key, that will be peanuts for a normal cpu.
I'm sure there are smart kids here who can break this encryption on a Sunday afternoon.

 

[evil_santa]

well we'd have to know the original id in the first place and afaik we don't

But the guy who's uploaded the firmware has a working chip.
or have I not read something?

 

[Adran_Marit]

But the guy who's uploaded the firmware has a working chip.
or have I not read something?

I think ya missed something.

 

[heinrich_frei]

But the guy who's uploaded the firmware has a working chip.

Yes, that's right.

 

[impeeza]

Someone asks if the raspberry pico would fit inside the console, I think maybe, Here are two pictures, a RP2040-Zero on a Raspberry pico, and a Raspberry pico on a V1 Switch.

 

[anhminh]

So is this it? Is it the hwfly replacement with cheaper price that the rumor said?

 

[impeeza]

The little one, yes. This is the gossip

 

[binkinator]

OK, I’m all in.

Picked up a junker Switch Lite w/ a bad screen on flea bay. The screen is cracked and the joysticks are shot.



Going to put this one piece screen on it and a pair of those garbage Gulikit Hall Effect sticks on it and call it good.
https://www.aliexpress.us/item/3256804496995627.html

Grabbing a HWFLY lite kit…just in case this all turns out to be much ado about nothing.



At worst I can resell it on flea bay as a fully modded switch lite for $200 and get my money back.

Let’s go!