Hacking Hardware Picofly - a HWFLY switch modchip

[TheSynthax]

I have an eMMC low voltage adapter, shouldn't be too difficult to insert the payload and bct manually. Don't think any of my card readers would see eMMC boot partitions though.

 

[Tafty]

No never i received it today to try this

All solder point good, good reading and triple checked under microscope
(i made a lot of modchip install on all switch model and even some install with OLED Chip on lite wich is the same wiring has rp2040 so i'm pretty confident)

i have some hwfly chip to test the theory can try tomorrow

can you let us know what happens when you install the hwfly...if your install is good, that should train then glitch without issue. if it doesnt then we know its install related...if hwfly does boot first time, can you then retest the rp and see what happens

 

[binkinator]

I have a virgin Switch Lite I built just for this project (no bullshit).
I have a Pico 2040 zero and a HWFLY Lite kit both in hand.

I was in the process of tinning my cables when I floated all the components off my flex cable (not paying attention to what was underneath.) I have the resistors I believe I need and I‘m about to repair the flex cable.

Can someone confirm the resistor values I’m about to replace?



Then I can help test too!

 

[RexSonic]

Has there been any meaningful progress yet?

 

[TheSynthax]

Has there been any meaningful progress yet?

No, and we're delaying one week every time someone asks instead of reading the most recent few pages.

 

[Piorjade]

Has there been any meaningful progress yet?

Not really
There are currently three paths being or that have been explored:
- Reverse engineer the first locked .uf2 file so it runs on any RP2040, currently at a road block
- Reverse engineer the current semi-working .uf2 file to fix it so it can boot CFW, as far as I understood the file it must be doing some sketchy encryption/compression so we can't replace the sdloader/BCTs and thus it seems like this is a dead end aswell
- Rewrite an open-source version completely from scratch, I myself don't believe to be able to do that so I only look into this whole thing for fun. I don't know anyone who actually does something in that direction.

 

[RexSonic]

No, and we're delaying one week every time someone asks instead of reading the most recent few pages.

Very funny and original

 

[achm3t]

can you let us know what happens when you install the hwfly...if your install is good, that should train then glitch without issue. if it doesnt then we know its install related...if hwfly does boot first time, can you then retest the rp and see what happens

Well, I’ve already made that on my first try to install rp2040. I had lite with Sx lite. Wired the rp2040 to the solder points as it was on diagram, used already installed cpu flex (Sx orig) - nothing. -> several diode mode readings, resoldering, getting rid of Sx smal upper flex (for emmc and rst points) - nothing. -> just soldered back Sx lite (on wires) - boots like a charm. I thought that may be sx chip is bringing some TX shit code to boot0, and swapped chip to hwfly 4.2 with latest firmware - boots like a charm (with the same wires as it was on rp2040 install). Next I thought that may be I need a virgin console, unsoldered hwfly and updated sysnand to latest firmware (15.0.1). -> soldered rp2040 - nothing. Tested with V2 hwfly flex - nothing. Tested with bare mosfet (from hwfly flex) soldered by wires without removing vertical cap as it was on diagram - nothing. Took another rp2040 - same result… and that was the point were I decided to give up and try later .
P.S. Again, the only thing that I believe could have affected this install is thin and relatively long 36awg wires on cpu mosfet controlling point.

 

[FruithatMods]

Well, I’ve already made that on my first try to install rp2040. I had lite with Sx lite. Wired the rp2040 to the solder points as it was on diagram, used already installed cpu flex (Sx orig) - nothing. -> several diode mode readings, resoldering, getting rid of Sx smal upper flex (for emmc and rst points) - nothing. -> just soldered back Sx lite (on wires) - boots like a charm. I thought that may be sx chip is bringing some TX shit code to boot0, and swapped chip to hwfly 4.2 with latest firmware - boots like a charm (with the same wires as it was on rp2040 install). Next I thought that may be I need a virgin console, unsoldered hwfly and updated sysnand to latest firmware (15.0.1). -> soldered rp2040 - nothing. Tested with V2 hwfly flex - nothing. Tested with bare mosfet (from hwfly flex) soldered by wires without removing vertical cap as it was on diagram - nothing. Took another rp2040 - same result… and that was the point were I decided to give up and try later .
P.S. Again, the only thing that I believe could have affected this install is thin and relatively long 36awg wires on cpu mosfet controlling point.

It is actually quite possible that the rp2040 pico is bad at filtering out noise and interference on the SD wires since those are high speed signals. Much shorter and thicker wires will give a clue if that is a problem.

Another possibility is the SD card itself.
Perhaps the content of the SD card is wrong? Does anyone have a copy of the SD Card image @Tafty is using?
That way we can at least rule out the SD card data being bad.
It is also possible that the SD card driver is only accepting certain size cards or cards from certain manufacturers.

 

[Avellea]

No, and we're delaying one week every time someone asks instead of reading the most recent few pages.

I'm glad someone finally said it. I've been following this thread silently and it's slowly starting to feel like an iOS jailbreak "eta wen" situation. Y'all are doing amazing work, I just wish I could help as well.

 

[FruithatMods]

I have an eMMC low voltage adapter, shouldn't be too difficult to insert the payload and bct manually. Don't think any of my card readers would see eMMC boot partitions though.

You will need a 1bit capable sd reader if your low voltage adapter is wired for 1 bit.
All publicly known usb sd readers which can access boot0 are not capable of 1 bit mode.
You only need a low voltage adapter if you would like to read/write from the emmc while it is still connected to the switch. The nand chips on their own will happily run on 3.3v

 

[TheSynthax]

You will need a 1bit capable sd reader if your low voltage adapter is wired for 1 bit.
All publicly known usb sd readers which can access boot0 are not capable of 1 bit mode.
You only need a low voltage adapter if you would like to read/write from the emmc while it is still connected to the switch. The nand chips on their own will happily run on 3.3v

Don't feel like desoldering the eMMC from my Lite, so I'll be leaving it attached. I have a weird obscure SD reader that works great for the boot partitions on my Tesla's eMMC, but I'm not sure if they use the eMMC boot partition function or not.

 

[FruithatMods]

If your SD card content is good try using 30AWG wires. Keep the wires as short as possible!
@achm3t

 

[TheSynthax]

If your SD card content is good try using 30AWG wires. Keep the wires as short as possible!

Tafty's boots to a "no SD" screen without a card inserted, so it mustn't be the card. Even extremely short and quite thick wires aren't working, so we're pretty sure it isn't able to prepare the eMMC, the Ubuntu version was just too early in development.

 

[malgamer]

I have a virgin Switch Lite I built just for this project (no bullshit).
I have a Pico 2040 zero and a HWFLY Lite kit both in hand.

I was in the process of tinning my cables when I floated all the components off my flex cable (not paying attention to what was underneath.) I have the resistors I believe I need and I‘m about to repair the flex cable.

Can someone confirm the resistor values I’m about to replace?

sorry please take a note, i already measure the middle one is 0.0ohm the rest 2.2k

 

[TheSynthax]

same value 470 ohm

I have a virgin Switch Lite I built just for this project (no bullshit).
I have a Pico 2040 zero and a HWFLY Lite kit both in hand.

I was in the process of tinning my cables when I floated all the components off my flex cable (not paying attention to what was underneath.) I have the resistors I believe I need and I‘m about to repair the flex cable.

Can someone confirm the resistor values I’m about to replace?

View attachment 354957

Then I can help test too!

Where are you getting 470? I just measured on my flex, they're 1.1K resistors. Maybe different revisions used different values?

 

[binkinator]

same value 470 ohm

All 3 are 470 ohm? I thought the middle one for HWFLY Lite was 0 ohm.

(This schematic is for Mariko V2 Switch)

Post automatically merged: Feb 23, 2023

Where are you getting 470? I just measured on my flex, they're all 1K resistors. Maybe different revisions used different values?

What version is yours? Mine is a V5.

https://www.aliexpress.us/item/3256803809562640.html

 

[TheSynthax]

All 3 are 470 ohm? I thought the middle one for HWFLY Lite was 0 ohm.

View attachment 354995

(This schematic is for V2)

Post automatically merged: Feb 23, 2023

What version is yours? Mine is a V5.

https://www.aliexpress.us/item/3256803809562640.html

Measured on the flex I get 1.1k, 0, and 1.1k, which given that the schematic shows them in parallel, they are indeed 2.2K resistors.

 

[binkinator]

Measured on the flex I get 1.1k, 0, and 1.1k, which given that the schematic shows them in parallel, they are indeed 2.2K resistors.

That’s perfect then. Thank you so much. Will solder them up in the morning and give them a go.

 

[evil_santa]

All publicly known usb sd readers which can access boot0 are not capable of 1 bit mode.

This is a Linux driver problem.
I asked Ctcaer for another project and he confirmed this.

On switch lite we can solder 4dat lines to read the emmc content.
On OLED we can use a FT232H and postal to read all the data in 1bit mode.