Hacking Hardware Picofly - a HWFLY switch modchip

billybobxxx

Active Member
Newcomer
Joined
Sep 12, 2021
Messages
29
Trophies
0
Age
38
XP
254
Country
Canada
All you really need is a heat gun, 0.15mm BGA153 stencil and solder paste, some flux, a decent scraping tool to scrape paste into the holes, and a pair of tweezers to hold the stencil in place while scraping and applying heat. I reballed an EMMC recently just to try in case I'd have to at some point, see pic. I simply placed the emmc on a napkin for some movement resistance, then placed the stencil on top and aligned it, then held it in place with tweezers. I applied flux after melting the solder balls and applied low heat to melt the flux and loosen the chip from the stencil.
The holder and alignment kit linked above probably makes things easier and I would buy it if I were to do reballs every day, but as long as it's just occasionally then eh.
If you fail you can just wipe the emmc clean with solder wick and try again.
All you really need is a heat gun, 0.15mm BGA153 stencil and solder paste, some flux, a decent scraping tool to scrape paste into the holes, and a pair of tweezers to hold the stencil in place while scraping and applying heat. I reballed an EMMC recently just to try in case I'd have to at some point, see pic. I simply placed the emmc on a napkin for some movement resistance, then placed the stencil on top and aligned it, then held it in place with tweezers. I applied flux after melting the solder balls and applied low heat to melt the flux and loosen the chip from the stencil.
The holder and alignment kit linked above probably makes things easier and I would buy it if I were to do reballs every day, but as long as it's just occasionally then eh.
If you fail you can just wipe the emmc clean with solder wick and try again.
Just upgraded my emmc today for a 128gb sk hynix..emmc arrived already reballed. Works like a charm! 😁 Next time i will try with a 256gb but its much more expensive.
 

Attachments

  • B1BA659B-9E9A-4C8C-8540-B019116EA2CB.jpeg
    B1BA659B-9E9A-4C8C-8540-B019116EA2CB.jpeg
    1.5 MB · Views: 75

lightninjay

Well-Known Member
Member
Joined
Mar 28, 2023
Messages
560
Trophies
0
Age
31
XP
1,380
Country
United States
Just wanted to give an update on my Pokemon Let's Go patched V1. I had to disassemble and reassemble a few times to get everything to fit properly in the case and not ruin the glitching process.

Still had a few loose-ish solder points apparently, as when I went and retouched some areas after checking for continuity, I managed to get the Hekate ipl consistently to load.

Thanks to everyone involved in this project, including all the brave souls willing to be on the front line of testing out the newest hardware mod to the scene.

I would post some photos, but I'm too busy reading all the things about how to load different software on this sucker now, ENDLESS POSSIBILITIES! :D

EDIT to add photos:
IMG_20230331_234638.jpg
I ended up doing the same mod as a few other folks earlier in the forum of installing a ps4 controller flex connector in the stead of the USB C that gets removed. This was my second or third attempt at stripping the flex cable and getting to the pins without bending them. I used a razor blade to scrape the surface away and reveal fresh copper in the flex cable, then tinned them which causes the rest of the flex cable to melt away. Then I tinned the pins on the USB C port and held the flex cable down with some electrical tape and lined up the usb-c with tweezers while hitting the pins with my hot-air station. Once I had a solid connection, I used UV-cure resin to reinforce the solder joint. It is sitting on an American Dime for scale.

IMG_20230401_003540.jpg
This is what the CPU wire looks like when attached using 30awg Kynar. Kynar is not LARGE wire by any means, but these components are certainly a little more challenging with 30awg wire wanting to move... we'll get to that in a second. That is the head of a Q-Tip for referenc scale.

IMG_20230403_011635.jpg
After seeing where the ground points are, I decided on the easy and sure-fire way out of just ground to the leg of the USB-C port.

IMG_20230403_011640.jpg
The 3.3v line was the first tiny spot that I went for, and this was where I learned how valuable uv-cure resin and a UV handheld laserpointer can be to keeping your wires held in place after soldering.

IMG_20230401_235103.jpg
These are the Dat0 and Clk pins prior to getting a UV-cure resin treatment to more permanently hold the wire leads down.

IMG_20230403_011623.jpg
Here are my RST and CMD lines along with the two previous pins after being cured with resin. There is also a wooden toothpick for scale.

IMG_20230402_023443.jpg
This was while things were looking good. I had just gotten the mosfet situated in place on the left cap. As I was feeding the CPU wire through the APU shielding, I jiggled the backend a little too hard and ripped the capacitor clean off the pads, taking the pad closest to the APU completely off, and de-tinning the ground pad... Recovery involved sulking a little, making sure my console still booted to OFW, and then pressing onward to the following...

IMG_20230403_011541.jpg
This abomination is layers of resin used to both mask solder joints from bridging, and to prevent my clumsy self from ripping off my last remaining lifeline to glitching this switch. Am I proud of it? Oddly yes, a little. I had to cut part of my APU shield to make sure this doesn't get disturbed, but WORTH IT. It's nearly unrecognizable at this point, but that is the same MOSFET from earlier on in this post.

IMG_20230403_011531.jpg
Here was my bodged long-wire setup to prove that the pico would work for me. This is the second rp2040 zero that I installed, which ultimately led me to check every last one of my solder joints again. After confirming I could glitch my switch, I swapped back to my flex-cable modded picofly to be able to fully install it with no bulge, but still be able to easily update it through USB to at least make the jump to 2.6 when it's released. As everyone else is hoping, we'll hopefully be able to remotely update future firmwares through the switch (if even needed).


Thank you again for all the insight, and I hope this can provide even a little inspiration (or even an eye-opener to how small-scale this solder job is) for anyone seeking to do this kind of mod to their own switch. It's a real chore, even if you are good at soldering. Things can and will go wrong, even if you do everything right. Just be prepared to fix things if you mess them up. As others have stated, you can ruin your console if you mess up installing these kinds of mods (and several members have openly mentioned that they have learned from losing consoles as experience) but with careful planning and the right tools, you too can own a picofly modded switch.
 
Last edited by lightninjay,

FueledSamantha

Active Member
Newcomer
Joined
Apr 4, 2023
Messages
26
Trophies
0
Age
31
XP
189
Country
Australia
Post automatically merged:

I also added a 47 ohm resistor, but EMMC is also a slow mode
I am in the same situation as you. Is it because of the Chinese system

Did you use unlock. bin
I just had this fault myself on a switch lite (Australia delivered)
After double checking my wiring with a friends scope, I found a bridge on CMD.

After repairing the bridge, I no longer get the emmc slow error.
 

Attachments

  • 336791784_521978950014408_2679206086429520325_n.jpg
    336791784_521978950014408_2679206086429520325_n.jpg
    394 KB · Views: 59
  • IMG_8882.jpeg
    IMG_8882.jpeg
    708.3 KB · Views: 59
  • Like
Reactions: Ricky_25

Adran_Marit

Walküre's Hacker
Member
Joined
Oct 3, 2015
Messages
3,781
Trophies
1
Location
42*South
XP
4,559
Country
Australia
My wafer thin rp2040 board (measured as 1.5mm on a .6mm PCB) powers on and works with picofly! Need to get the rest of the components from the UPS man and send some out for real testing in switches but this is a big step
nice

I just had this fault myself on a switch lite (Australia delivered)
After double checking my wiring with a friends scope, I found a bridge on CMD.

After repairing the bridge, I no longer get the emmc slow error.
i brokeded my lite here in teh apple isle XD
 

Dee87

Well-Known Member
Member
Joined
Mar 19, 2023
Messages
1,139
Trophies
1
XP
1,578
Country
Germany
Just wanted to give an update on my Pokemon Let's Go patched V1. I had to disassemble and reassemble a few times to get everything to fit properly in the case and not ruin the glitching process.

Still had a few loose-ish solder points apparently, as when I went and retouched some areas after checking for continuity, I managed to get the Hekate ipl consistently to load.

Thanks to everyone involved in this project, including all the brave souls willing to be on the front line of testing out the newest hardware mod to the scene.

I would post some photos, but I'm too busy reading all the things about how to load different software on this sucker now, ENDLESS POSSIBILITIES! :D

EDIT to add photos:
View attachment 362961
I ended up doing the same mod as a few other folks earlier in the forum of installing a ps4 controller flex connector in the stead of the USB C that gets removed. This was my second or third attempt at stripping the flex cable and getting to the pins without bending them. I used a razor blade to scrape the surface away and reveal fresh copper in the flex cable, then tinned them which causes the rest of the flex cable to melt away. Then I tinned the pins on the USB C port and held the flex cable down with some electrical tape and lined up the usb-c with tweezers while hitting the pins with my hot-air station. Once I had a solid connection, I used UV-cure resin to reinforce the solder joint. It is sitting on an American Dime for scale.

View attachment 362962
This is what the CPU wire looks like when attached using 30awg Kynar. Kynar is not LARGE wire by any means, but these components are certainly a little more challenging with 30awg wire wanting to move... we'll get to that in a second. That is the head of a Q-Tip for referenc scale.

View attachment 362969
After seeing where the ground points are, I decided on the easy and sure-fire way out of just ground to the leg of the USB-C port.

View attachment 362970
The 3.3v line was the first tiny spot that I went for, and this was where I learned how valuable uv-cure resin and a UV handheld laserpointer can be to keeping your wires held in place after soldering.

View attachment 362963
These are the Dat0 and Clk pins prior to getting a UV-cure resin treatment to more permanently hold the wire leads down.

View attachment 362968
Here are my RST and CMD lines along with the two previous pins after being cured with resin. There is also a wooden toothpick for scale.

View attachment 362964
This was while things were looking good. I had just gotten the mosfet situated in place on the left cap. As I was feeding the CPU wire through the APU shielding, I jiggled the backend a little too hard and ripped the capacitor clean off the pads, taking the pad closest to the APU completely off, and de-tinning the ground pad... Recovery involved sulking a little, making sure my console still booted to OFW, and then pressing onward to the following...

View attachment 362966
This abomination is layers of resin used to both mask solder joints from bridging, and to prevent my clumsy self from ripping off my last remaining lifeline to glitching this switch. Am I proud of it? Oddly yes, a little. I had to cut part of my APU shield to make sure this doesn't get disturbed, but WORTH IT. It's nearly unrecognizable at this point, but that is the same MOSFET from earlier on in this post.

View attachment 362965
Here was my bodged long-wire setup to prove that the pico would work for me. This is the second rp2040 zero that I installed, which ultimately led me to check every last one of my solder joints again. After confirming I could glitch my switch, I swapped back to my flex-cable modded picofly to be able to fully install it with no bulge, but still be able to easily update it through USB to at least make the jump to 2.6 when it's released. As everyone else is hoping, we'll hopefully be able to remotely update future firmwares through the switch (if even needed).


Thank you again for all the insight, and I hope this can provide even a little inspiration (or even an eye-opener to how small-scale this solder job is) for anyone seeking to do this kind of mod to their own switch. It's a real chore, even if you are good at soldering. Things can and will go wrong, even if you do everything right. Just be prepared to fix things if you mess them up. As others have stated, you can ruin your console if you mess up installing these kinds of mods (and several members have openly mentioned that they have learned from losing consoles as experience) but with careful planning and the right tools, you too can own a picofly modded switch.
look good
that with the ps4 4 connector and flex cable was my idea hahahaha
 

Dee87

Well-Known Member
Member
Joined
Mar 19, 2023
Messages
1,139
Trophies
1
XP
1,578
Country
Germany
can anyone tell me how to fix the problem?
is that blue th green or cyan ? can really see what excatly it is

if its cyan check ur mosfet cable if thats not the issue install a second mosfet
Post automatically merged:

My wafer thin rp2040 board (measured as 1.5mm on a .6mm PCB) powers on and works with picofly! Need to get the rest of the components from the UPS man and send some out for real testing in switches but this is a big step
nice
its looking good :-)
if u need someone for testing hit me up B-)
Post automatically merged:

nice


i brokeded my lite here in teh apple isle XD
how bad is it broken probaly fixable ?
or u think its a total Rip aslong as the apu isnt dead it should be fixable
 
Last edited by Dee87,

Spore2

Well-Known Member
Member
Joined
Jan 12, 2016
Messages
221
Trophies
0
Age
45
XP
246
Country
he just did not write unlock.uf2 properly

sometimes people drop two .uf2 files, this does not work, it is needed to write them separately
How to do this? doesn't RP2040 clear the bootloader when we press reset then boot button. I mean drive is always empty when we do this. How to enter boot upload mode without erasing the previously flashed UF2 file? Thanks
 
  • Like
Reactions: Ricky_25

Saliciae

Well-Known Member
Newcomer
Joined
Mar 20, 2023
Messages
83
Trophies
0
Age
24
XP
419
Country
United Kingdom
How to do this? doesn't RP2040 clear the bootloader when we press reset then boot button. I mean drive is always empty when we do this. How to enter boot upload mode without erasing the previously flashed UF2 file? Thanks
The USB drive the rpi presents isnt a real one, just copy the file across, the data wont be overwritten
 
  • Like
Reactions: Spore2 and Ricky_25

Saliciae

Well-Known Member
Newcomer
Joined
Mar 20, 2023
Messages
83
Trophies
0
Age
24
XP
419
Country
United Kingdom
Interesting. Next question now is how do I remove an unwanted uf2 file?
You dont. you have to overwrite it with a UF2 file that addresses that specific area of the flash memory. The uf2 bootloader writes whatever information is contained in the UF2 file to the respective flash address. The unlock uf2 references a different area of flash than the main program and thus it doesn't overwrite the main program
 

Spore2

Well-Known Member
Member
Joined
Jan 12, 2016
Messages
221
Trophies
0
Age
45
XP
246
Country
You dont. you have to overwrite it with a UF2 file that addresses that specific area of the flash memory. The uf2 bootloader writes whatever information is contained in the UF2 file to the respective flash address. The unlock uf2 references a different area of flash than the main program and thus it doesn't overwrite the main program
Many thanks.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Psionic Roshambo @ Psionic Roshambo: @K3Nv2, try SanDisk format tool?