Hacking Hardware Picofly - a HWFLY switch modchip

[cgtchy0412]

If none of the solder points are working for you, your equipment is not good.
You need a good/fine solder tip that tins well (holds solder).
It needs to reach temperature above 350°
Use high temperature (350°-400°) for a short period of time (2-3seconds) to avoid damaging the board.

Any recomended brand for the solder tip? from price quality standpoint, maybe 5$ max. As i find many cheap, i mean really cheap 1-2$ tip is kinda not hot enough at the tip end, so it difficult to tin/solder a point as small as this mod.

 

[abal1000x]

Any recomended brand for the solder tip? from price quality standpoint, maybe 5$ max. As i find many cheap, i mean really cheap 1-2$ tip is kinda not hot enough at the tip end, so it difficult to tin/solder a point as small as this mod.

I use hakko T12-J02 price around $4 (not the original one of course, the counterfeit).
The temperature never be the problem, i could heat it up until 400 degrees using cheap station.

For me, the problem for all tip is the corrotion, and its got faster when use >350degrees.
And got faster when touching wet sponge (thats is why i don't recommend wet the sponge).

Before soldering i always clean the tip on dry tissue, than dip it into rosin box.
When done, i always coat it with tin, to prevent corrotion, while i am not use the solder.

 

[ppeach]

Any recomended brand for the solder tip? from price quality standpoint, maybe 5$ max. As i find many cheap, i mean really cheap 1-2$ tip is kinda not hot enough at the tip end, so it difficult to tin/solder a point as small as this mod.

At a minimum, low-temperature solder, high-quality flux, a temperature-controlled soldering iron, a fine soldering tip, a metal wire soldering tip cleaner, and a microscope are required.
Soldering like the advanced users' videos on YouTube is impossible for the average person.

 

[btjunkster]

Hi everyone, thanks you for all the good information here, I have one question, someone know if we have an alternativ 3.3v on the switch V2 mariko ? it my last point to solder and it's really tricky for me, I almost destroy the point, but the switch still work fine. I just look for one different way to get the 3.3v on my picofly...if someone can help me !

Thank you so much...

Yes it’s on the underside of EMMC. I prefer to use EMMC instead.

 

[deeps]

Hi everyone, thanks you for all the good information here, I have one question, someone know if we have an alternativ 3.3v on the switch V2 mariko ? it my last point to solder and it's really tricky for me, I almost destroy the point, but the switch still work fine. I just look for one different way to get the 3.3v on my picofly...if someone can help me !

Thank you so much...

I used the left one in this pic https://gbatemp.net/attachments/trinketfinal-jpg.197969/

 

[supergnu]

The through hole via in Orange needs to join with 1,2,3 as well, other wise you need a jumper from EMMC soket pin2 from top to the 123 joint.

My switch seems to still work normally (turns on and off and I can play games from eMMC) - does that mean I don’t need to fix those traces or is it necessary for the modchip to work?

 

[QuiTim]

My switch seems to still work normally (turns on and off and I can play games from eMMC) - does that mean I don’t need to fix those traces or is it necessary for the modchip to work?

if this is the case then you are lucky (and we here also learned a few things today ).
But I still think that the mod will not work, especially now that @jkyoho pointed out that the orange point goes to EMMC, and in your case the trace that connects APU and EMMC is cut.
See the picture below, all these points need to be connected
In your case you have a connection between Blue and Green and also between Red and Violet but you are missing the connection between Green and Red.
So you need to fix the line between Green and Red first in order to proceed.
Anyway, you could just try your luck and try to solder RST point to either RED or Green and see what happens.
Worst case scenario we all learn something new

 

[detilmalala]

hello, how can you turn on a console with picofly without micro sd, so that it starts normally?

 

[abal1000x]

hello, how can you turn on a console with picofly without micro sd, so that it starts normally?

View attachment 371684

After shows nosd, push the vol+ and vol-

 

[Takezo-San]

Could you please share the Modville video with UV mask?
Also, why would we need a grinding pen to set permanent dat0?
I'm curious

Edit: nevermind the grinding pen part, @doom95 answered it

Just got the email from him and its reads as follows:

'Yes for the dat0 adapters I used I use uv resin to secure them. The ones with the 4anchors you solder in place. '

Hope that helps.

 

[QuiTim]

Just got the email from him and its reads as follows:

'Yes for the dat0 adapters I used I use uv resin to secure them. The ones with the 4anchors you solder in place. '

Hope that helps.

Thank you for the follow-up. I appreciate it.
I guess that if we get our hands on these "4 anchor" models they will stay in place and there's no need to use UV mask as addition.
Cheers.

 

[bilalhassan341]

Github page is removed for the lock_pick rcm. Is product key important to restore and if we have the full nand backup and boot0/boot1 backup or it both require the product key to restore from backup?

 

[rehius]

A bit of new features in the test version 2.70

- now it's only 3 colours: blue (glitching), white (flashing), yellow (error code). This was made to make possible pi pico debugging + get rid of RGB/GRB issues
Error codes list (= is long pulse, * is short pulse):

= USB flashing done

** RST is not connected
*= CMD is not connected
=* D0 is not connected
== CLK is not connected

=** eMMC init failure during glitch process
=*= CPU never reach BCT check, should not happen
==* CPU always reach BCT check (no glitch reaction, check mosfet)
=== Glitch attempt limit reached, cannot glitch

=*** eMMC init failure
=**= eMMC write failure - comparison failed
=*=* eMMC write failure - write failed
=*== eMMC test failure - read failed
==** eMMC read failed during firmware update
==*= BCT copy failed - write failure
===* BCT copy failed - comparison failure
==== BCT copy failed - read failure

The second major feature is CPU downvoltage. This might be useful when your MOSFET (or the wire) is not strong enough for the glitch. (do you remember the case where you press "RESET" on the rp2040 when joycon logo appears to make it working? that's it, system lowers CPU voltage)
Therefore you can solder two additional wires to the chip so it could lower the CPU voltage making the glitch easier. This is optional! only if you really need.

Waveshare rp2040: SDA=12, SCL=13
Pi Pico: SDA = 19, SCL = 20
XIAO 2040: SDA=3, SCL=4
ItayBitsy 2040: SDA = 18, SCL = 19

pinout for Mariko v2 board:

I have pinouts for Lite & OLED, but haven't tested it yet. You can easily track the i2c wires by yourself using board views here http://balika011.hu/switch/ (OLED here)

The firmware is in alpha stage, so use at your own risk

 

[QuiTim]

Brace for the new "Is this a short pulse or is it a long pulse? here's a picture" wave of posts

 

[lightninjay]

Brace for the new "Is this a short pulse or is it a long pulse? Here's a picture" wave of posts

Guess I'll be coming out with a new V.6 guide once a few people have installed and "enjoy" the 2.7 firmware.

 

[QuiTim]

Guess I'll be coming out with a new V.6 guide once a few people have installed and "enjoy" the 2.7 firmware.

I will take one for the team a do a Lite tonight
I also got some new mosfets so I will give them a test ride as well.

 

[impeeza]

Github page is removed for the lock_pick rcm. Is product key important to restore and if we have the full nand backup and boot0/boot1 backup or it both require the product key to restore from backup?

To backup/restore a backup you don´t need keys, Hekate make all extractions.

 

[detilmalala]

hi guys, question, even if the nand of a switch is bricked, does the hekate charge the same?

 

[abal1000x]

A bit of new features in the test version 2.70

- now it's only 3 colours: blue (glitching), white (flashing), yellow (error code). This was made to make possible pi pico debugging + get rid of RGB/GRB issues
Error codes list (= is long pulse, * is short pulse):

= USB flashing done

** RST is not connected
*= CMD is not connected
=* D0 is not connected
== CLK is not connected

=** eMMC init failure during glitch process
=*= CPU never reach BCT check, should not happen
==* CPU always reach BCT check (no glitch reaction, check mosfet)
=== Glitch attempt limit reached, cannot glitch

=*** eMMC init failure
=**= eMMC write failure - comparison failed
=*=* eMMC write failure - write failed
=*== eMMC test failure - read failed
==** eMMC read failed during firmware update
==*= BCT copy failed - write failure
===* BCT copy failed - comparison failure
==== BCT copy failed - read failure

The second major feature is CPU downvoltage. This might be useful when your MOSFET (or the wire) is not strong enough for the glitch. (do you remember the case where you press "RESET" on the rp2040 when joycon logo appears to make it working? that's it, system lowers CPU voltage)
Therefore you can solder two additional wires to the chip so it could lower the CPU voltage making the glitch easier. This is optional! only if you really need.

Waveshare rp2040: SDA=12, SCL=13
Pi Pico: SDA = 19, SCL = 20
XIAO 2040: SDA=3, SCL=4
ItayBitsy 2040: SDA = 18, SCL = 19

pinout for Mariko v2 board:
View attachment 371698

I have pinouts for Lite & OLED, but haven't tested it yet. You can easily track the i2c wires by yourself using board views here http://balika011.hu/switch/ (OLED here)

The firmware is in alpha stage, so use at your own risk

Can you give a hint about the i2c, to what component it is used or what functionality it is?

 

[Jorian]

I did a nice bullshit, short story:

I installed the picofly chip by myself, I never did a single soldering in my life before, I'm stupid, that was the challenge.
By wanting to solder the 3.3v I damaged the point very much and I had to take the 3.3v on EMMC, everything worked very well I spent hours on games etc... and when I wanted to charge the console, nothing works, it no longer takes charge. And I could not put my switch on the TV too...the USB C Port was like dead.

Suddenly I immediately thought of the thing that I had smashed, I decided once again by my initiative of stupidity, I simply completely removed the part circled in red on the photo (it is not my photo, I would have been happy otherwise) I think it was in contact with the parts just above...

But now, surprise, the charging port is working perfectly again, everything is functional... so my question: Do you know what this thing was for? I must be worried about an overheating to come or a huge problem? Here is my question, otherwise I repeat everything is functional.

My Switch is the Mariko version.

Thanks in advance !