Hacking Hardware Picofly - a HWFLY switch modchip

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
So how do you explain the non flashable hwfly booting to a black screen on an oled switch with a skhynix emmc instead of the no sd screen?

The same modchip boots fine with a Samsung emmc. The only difference is the emmc manufacturer.

Which emmc chip does @Nagaa 's switch use?
Nagaa's is a Samsung
Post automatically merged:

Can anyone test with their install removing a single line at a time and see if they get these error LED colors using the Ubuntu firmware?
 

Attachments

  • pinout diagram.jpg
    pinout diagram.jpg
    111.3 KB · Views: 69

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
Other people have said that they tried to boot into hekate with the pico using the leaked ubuntu firmware and were not able to do so, but as soon as they tried an hwfly it worked. I do think their soldering skills are sufficient too. Bad solder joints shouldn't be the issue here.

We also know that the rp2040 can successfully glitch switches with the right coding.
Post automatically merged:

@achm3t Can you please check your emmc memory chip. Which company manufactured the chip?
 

Raugo

Well-Known Member
Member
Joined
Nov 22, 2014
Messages
630
Trophies
0
XP
2,451
Country
Spain
The dat0 is used for glitching or is only needed to modify the emmc? If its the second what would happend if we edit the boot0 with the bootloader of hwfly and then remove the dat0 from the chip?
 
  • Like
Reactions: FruithatMods

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
The dat0 is used for glitching or is only needed to modify the emmc? If its the second what would happend if we edit the boot0 with the bootloader of hwfly and then remove the dat0 from the chip?
It *might* work, but it might also be using DAT0 to sniff the SDMMC bus, hard to say without source code. Might be using CMD for that though.
 

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
The dat0 is used for glitching or is only needed to modify the emmc? If its the second what would happend if we edit the boot0 with the bootloader of hwfly and then remove the dat0 from the chip?
That's a great idea! It isn't a permanent solution because you will still need to rewrite boot0 when HOS is updated, but this would actually mak it a great test!
If the pico firmware doesn't use dat0 as one of the timing anchors ,which I don't think it does, I don't see a reason why it shouldn't work!
Post automatically merged:

If this test fails we will know if the current firmware uses dat0 as one of the timing anchors.
There is no harm in trying that!
 
Last edited by FruithatMods,

achm3t

Member
Newcomer
Joined
Apr 10, 2022
Messages
15
Trophies
0
Age
38
Location
Nursultan
XP
350
Country
Kazakhstan
Other people have said that they tried to boot into hekate with the pico using the leaked ubuntu firmware and were not able to do so, but as soon as they tried an hwfly it worked. I do think their soldering skills are sufficient too. Bad solder joints shouldn't be the issue here.

We also know that the rp2040 can successfully glitch switches with the right coding.
Post automatically merged:

@achm3t Can you please check your emmc memory chip. Which company manufactured the chip?
Ok. Will be able to check in 12 hours from now. But 90% sure it was Samsung emmc there.
Anyway, I have several V2 and lite switches in stock, will try to find one with Hynix emmc. Also I have many oleds, but just don’t want to mess with oled rp2040 installation :), it would be better to test with easier ones.
 
Last edited by achm3t,
  • Love
Reactions: FruithatMods

Piorjade

Well-Known Member
Member
Joined
Nov 8, 2015
Messages
142
Trophies
0
XP
407
Country
Gambia, The
Ok. Will be able to check in 12 hours from now. But 90% sure it was Samsung emmc there.
Anyway, I have several V2 and lite switches in stock, will try to find one with Hynix emmc. Also I have many oleds, but just don’t want to mess with oled rp2040 installation :), it would be better to test with easier ones.
It would be interesting to see it on a Kioxia, on Tafty‘s skhynix both my test code an the ubuntu fw work

TheSynthax has a Kioxia and there both mine and the ubuntu fw don‘t work.
 

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
It would be interesting to see it on a Kioxia, on Tafty‘s skhynix both my test code an the ubuntu fw work

TheSynthax has a Kioxia and there both mine and the ubuntu fw don‘t work.
Guess I gotta bite the bullet and hook up an SD card reader, hope it doesn't brick this Switch
 
  • Like
Reactions: peteruk

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
Last edited by FruithatMods,

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
https://github.com/ignasurba/mmcblkNX/issues/1
Post automatically merged:

Alternatively you can use an SD card reader with the low voltage adapter. You will be restricted to 1 bit mode so the SD card reader will need to support that. SD card readers that support 1 bit Mode are quite rare but they do exist.
I have two readers that support 1-bit mode, and an exploitee.rs low voltage adapter.
 
  • Love
Reactions: FruithatMods

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
I have two readers that support 1-bit mode, and an exploitee.rs low voltage adapter.
Would you mind sharing which adapters you use that support 1bit mode so others can buy one if they need it.

The small black transcend SD card reader which is recommended on Exploitee.rs doesn't support 1 bit mode these days. Only the new revision with a different chipset is available on amazon.
 

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
Would you mind sharing which adapters you use that support 1bit mode so others can buy one if they need it.

The small black transcend SD card reader which is recommended on Exploitee.rs doesn't support 1 bit mode these days. Only the new revision with a different chipset is available on amazon.
I've got that very same card reader, they definitely don't support 1-bit mode anymore. This is the exact one I use for reading my car's eMMC in 1-bit mode, this rather obscure adapter- https://www.walmart.com/ip/onn-SD-micro-SD-Card-Reader/339922305 no idea where I got it, I definitely didn't get it at Walmart and it's not in my Amazon history.
 

evil_santa

Well-Known Member
Member
Joined
Jan 15, 2020
Messages
380
Trophies
1
Age
39
XP
1,863
Country
Germany
  • Like
Reactions: binkinator

binkinator

Garfield’s Fitness Coach
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
SD card readers which show up as mass storage devices can't be used to access boot0/boot1 AFAIK.

Unfortunately I don't actually have any adapter or card reader that can access boot0 over 1bit mode. If such a thing exists do say so.

FT232H with postal looks promising but it only works in Windows. It would be nice if we had a Linux equivalent which could access the partitions natively without having to clone them.

The adapter which uses a realtek chip is great but it can't be used in 1 bit mode. This one: https://www.tindie.com/products/ignas/emmc-reader-for-hac-emmc/

Using an rp2040 for this is actually a brilliant idea!
Post automatically merged:

On second thought it might not be very convenient to use the rp2040 as a usb emmc reader either. Wouldn't we be limited to the usb 1 speeds of the rp2040? 26kBs isn't a lot of fun when interfacing a lot of data.
Post automatically merged:

It looks like FT232H could be used in Linux with mmc-utils: https://github.com/mhei/mmc-utils
 
Last edited by FruithatMods,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • BigOnYa @ BigOnYa:
    That is cheap, I used to pay $100 for a tine.
  • Psionic Roshambo @ Psionic Roshambo:
    Tine? One gram?
  • BigOnYa @ BigOnYa:
    Sixteenth
  • Psionic Roshambo @ Psionic Roshambo:
    Also it was literally out of a kilo when I got it off the boat so absolutely pure
  • Psionic Roshambo @ Psionic Roshambo:
    Holy shiz that's a lot
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    I was getting 3.5 Grams for 320 could have stepped on it and doubled my money easy lol
    +1
  • BigOnYa @ BigOnYa:
    I'd be afraid to it nowdays, my heart would explode prob. I just stick beers n buds nowdays.
  • Psionic Roshambo @ Psionic Roshambo:
    I would get to drive from tarpon springs to like Miami a thousand bucks lol do that twice a week and back in 92 that was good money
  • Xdqwerty @ Xdqwerty:
    @BigOnYa,
    @Psionic Roshambo what are you guys talking about?
  • Psionic Roshambo @ Psionic Roshambo:
    Blew it on women and muscle cars lol
    +1
  • BigOnYa @ BigOnYa:
    @Xdqwerty Hamster food, its pricey nowadays to keep PCs running.
    +2
  • Psionic Roshambo @ Psionic Roshambo:
    I don't do anything except cigarettes and gotta stop eventually lol
    +1
  • BigOnYa @ BigOnYa:
    I'd do shrooms again if could find, and I was outside camping/fishing, and had a cooler full of beer.
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    I wouldn't mind some LSD, laughing until my face hurt sounds fun lol
    +1
  • BigOnYa @ BigOnYa:
    You ever try soaper powder/qauludes? I did once and like a dumbass drank beer on top of taking, I woke up laying in my backyard in the pouring rain, it knocked me out. I have not seen it around in many many years.
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    No never tried a lot of things but never that lol
  • Psionic Roshambo @ Psionic Roshambo:
    I did pass out one time on a floor after taking a bunch of Ambien lol thought it would help me sleep and did it lol
  • Psionic Roshambo @ Psionic Roshambo:
    Girlfriend was working at a pharmacy and stole like 500 of them, was and still is the biggest pill bottle I have ever seen lol
  • K3Nv2 @ K3Nv2:
    Ativan is pretty legit
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    The last time I had to take something to help me sleep, I was prescribed Trazadone it was pretty OK to be honest.
  • Psionic Roshambo @ Psionic Roshambo:
    Not something I need at all these days, doing a lot better lol
  • BigOnYa @ BigOnYa:
    That Nuka Cola video with old ice grinder is cool, I want one.
    +1
    Xdqwerty @ Xdqwerty: @salazarcosplay, hi