Hacking Hardware Picofly - a HWFLY switch modchip

[chappo]

.

 

[TheSynthax]

Try on fw.bin

firmware.bin is the raw dump. Flash firmware.uf2, do a

picotool save --all

and you'll find it's identical to firmware.bin.

you aren't going to have any luck decompiling the uf2 file. I tried to decrypt the binary file and while it worked, it seems they've done their homework and removed any useful information from that file. It would genuinely be easier to write your own.
From what I understand they're using the PIO on the rp2040 to perform the glitch instead of the fgpa on the hwfly boards

We don't need to decompile it if we can make it run. At that point someone could just reverse engineer it, as long as it's functioning (or use it as-is). Otherwise, you're just trying to reimplement the FPGA's functionality from scratch, and we don't have the bitstream or its source. If someone with one of these chips shares their dump AND their serial (also called unique ID) then we can move forward with this. Otherwise, there's nothing to be done, someone would have to determine exactly how the HWFLY FPGA works and write an RP2040 sketch that does the same thing.

 

[saladus]

well we  do kinda need to decompile it, considering the code is encrypted, we'd need to at least get past that

 

[TheSynthax]

that's exactly what i was asking myself. how the fuck did he do that? how does he communicate with the emmc (no level shifter)
you can take the starlink hack as an example but I can't really make sense of it.

https://github.com/KULeuven-COSIC/Starlink-FI

A level shifter is not needed, the eMMC is 3.3v tolerant.

well we  do kinda need to decompile it, considering the code is encrypted, we'd need to at least get past that

We don't need to decompile it to make it run if there's a way to spoof the unique ID at the bootloader level.

 

[saladus]

indeed, but have fun brute forcing that

 

[CompSciOrBust]

You guys should try using fault injection on the RP2040 to make the unique ID check pass

 

[TheSynthax]

You guys should try using fault injection on the RP2040 to make the unique ID check pass

Won't work, it's not a check, it's decrypting the binary.

indeed, but have fun brute forcing that

it's impossible, we 100% need Mansi's ID

 

[vittorio]

pikofly it looks like this https://github.com/Spacecraft-NX/firmware

 

[TheSynthax]

pikofly it looks like this https://github.com/Spacecraft-NX/firmware

No, it doesn't. "Pikofly" includes the functionality of the FPGA bitstream, this is just the MCU firmware.

 

[vittorio]

the fw is similar, obviously the fpga part for the glich is missing

Post automatically merged: Jan 29, 2023

A level shifter is not needed, the eMMC is 3.3v tolerant.

We don't need to decompile it to make it run if there's a way to spoof the unique ID at the bootloader level.

do you think the control is in uf2?

 

[TheSynthax]

the fw is similar, obviously the fpga part for the glich is missing

Post automatically merged: Jan 29, 2023

do you think the control is in uf2?

control?

 

[vittorio]

ID verification

 

[CompSciOrBust]

Won't work, it's not a check, it's decrypting the binary.

I was joking. I mean what you gonna do? Have an RP2040 to glitch an RP2040 just to glitch your Switch?

Well, let's see, considering I already paid $9 (including shipping) for two of them, yah!

OHHH I SEE

 

[TheSynthax]

I was joking. I mean what you gonna do? Have an RP2040 to glitch an RP2040 just to glitch your Switch?


OHHH I SEE

but then what glitches the Pi that glitches the Pi?

 

[binkinator]

You guys should try using fault injection on the RP2040 to make the unique ID check pass

Ohhhh. You mean we could use another RP2040 to glitch the original RP2040!

This would be good for me because I bought 2 already!

Here's my artistic rendition of how that would look. There are some details that will need to be worked out for sure.

I added an extra battery to help augment the onboard battery for peak voltage when booting. With this many rPi 2040s it's gotta be taxing on the power system.

(in case anyone thinks this is serious...it is absolutely NOT. It's a joke and you are not to try this with your switch or you will surely burn your house down.)

Post automatically merged: Jan 29, 2023

but then what glitches the Pi that glitches the Pi?

By god it's Glitch-ception!!!!

 

[CompSciOrBust]

but then what glitches the Pi that glitches the Pi?

A couple chunks of Uranium should do it

 

[FruithatMods]

Can anyone measure the thickness of a hwfly pcb board without the components?

 

[hippy dave]

You guys should try using fault injection on the RP2040 to make the unique ID check pass

You win the thread

 

[binkinator]

Can anyone measure the thickness of a hwfly pcb board without the components?

If nobody else can help I will open mine up and measure later today.

 

[Shadow_The_Hedgehog82]

Can anyone measure the thickness of a hwfly pcb board without the components?

0.45mm on my oled one