Hacking Hardware Picofly - a HWFLY switch modchip

[floxcap]

interesting, so lack of core power still does not help

I'm going to see if moving the 3V3 source helps - will try the one hidden under the card reader.
Will share results.

 

[rehius]

I'm going to see if moving the 3V3 source helps - will try the one hidden under the card reader.
Will share results.

Try removing 2040's 3v3 regulator, they sometimes shortcut

 

[ppeach]

Thanks for telling me. I won't order from them again. One thing I'm trying is buying directly from the Chinese market through Sugargoo.

I already ordered 10 pieces from this 1688.com buyer. Will report back

The image is the same as used in ali.
Furthermore, the store has not been open long.
It is very likely that you will receive 3 anchor type trash instead of the 4 anchor type in the image.

 

[Adran_Marit]

I have a question. My Switch emmc is corrupted and I don't have a backup btw I have another switch backup and prod key. Can I use the other backup or nintendo will ban the switch because they both have same seriel number. Or should I go with a blank product key with zero seriel?

No. If you can glitch use emmchacgen to rebuild. If you can get to hekate. you should still be able to dump keys.

Emmchacgen to rebuild the switch firmware

 

[CodyRoseman]

I got that error too and lost hope.
Correct me if I'm wrong: when fully installing a MOSFET, is it normal for D and S to show continuity ( if G was somehow triggered), but G should not to either?

Post automatically merged: Jun 1, 2023

Hi @rehius. I've seen quite a few people complain about the *== error (dead CPU, poor wiring).

Some say it's CLK, CMD, and others think it's MOSFETs. Would you kindly clarify what wiring I should think of when I see this error? Thanks <3

Yes all my installs have continuity from drain to source, I assume there is either leakage through the cpu or through the mosfet, either way every install is working fine

 

[ypeeLs]

Is there a document or post anywhere about the diode range for all points? Wanting to confirm CPU diode was in spec. I replaced the v2 flex 2x after installing the first. Reading is .246 área when I’ve also seen .46X.. wanting to double check to make sure this is in a proper range. Thanks!

There is only a diode range for 3.3v, RST, CLK, CMD, DAT0

 

[hothotramen]

Anybody tried this? Seems to have replaced Instinct chips. Claims to be RP2040 based.

 

[Mr Skinner]

Update: POC (Proof of Concept)

Modify the adapter little bit.
View attachment 373066

Shift it slightly to the right.
View attachment 373067

The diode value will not be different, when Dat1 Short Circuit (SC) with Dat0.
Its around 600.

When Dat1 SC with the Dat0 picofly will throws error:
=*== eMMC test failure - read failed

I've confirmed this and the picofly working until nosd shown (by shift the adapter a little bit to right).

I realized I bought 30 pcs of these damn crappy dat0 cables. Currently I have the Black screen and error *=* No eMMC block 0 read (eMMC init failure?). My diode reading for dat0 is 687, hynx chip.

Is it possible that the short caused by these cables could kill the EMMC? Is there anything I can do to test my Switch and verify the extent of the damage?

 

[Takezo-San]

I have same problem with my lite after install i get "no sd card" then when i insert sd card then black screen then when i boot to ofw using +&- button it's blue screen

Hmmmm your not alone with the exact same problem as me and like 4-5 switch lites. Something is being reproduced here but I have no idea what it could be! Weird thing is, I've not seen this problem with HWFLY lite installs but lots of pico installs with this problem. What is going on? Is the Pico drawing to much power from the lite that is more power starved than the other switch versions or something!?

 

[Adran_Marit]

Hmmmm your not alone with the exact same problem as me and like 4-5 switch lites. Something is being reproduced here but I have no idea what it could be! Weird thing is, I've not seen this problem with HWFLY lite installs but lots of pico installs with this problem. What is going on? Is the Pico drawing to much power from the lite that is more power starved than the other switch versions or something!?

Could be an installation point?

 

[Takezo-San]

Could be an installation point?

That does sound like the most logical variable here. Hwfly lite 3.3v is sourced from the cap that is directly above the sd card reader. All other data lines are the same as Pico install. So.....that improper line we use could be the cause of bsod etc and seems like the odd variable out. Apart from the circuitry of the hwfly modchip but I doubt that's super cutting edge ahead of us.

Edit - That point gives 0.8v voltage drop. What does the pico 3.3v value give?

Edit - Nonetheless it's from a different part of the board. Different voltage rail. I wonder if this is it. But first thing is to restore out the bsod. Unless, trying this line with the pico would fix it. Isn't this all just so fun!

Reference:

 

[abal1000x]

.

 

[ppeach]

I finally got the rp2040-tiny.
It has a 0201 smd resistor of 47 ohms,
The revision is 1.1.
The inference that they got the resistor values wrong was correct lol.

 

[Takezo-San]

From the datasheet
View attachment 375407

The dat0 neighbour is same datn, not the vss or vdd which is dangerous to short circuited.
Logically short circuited the data line is not that dangerous (wont burn the ic), but it might corrupt the data when there is write to the nand via those data lines. And corrupt the loaded data (in ram) when the cpu read from the nand. In which i suspect the cause of purple or blue screen.

The diode mode should be 600 - 607. I don't know whether diode mode is different between multimeter. But i think it should be the same. Shift it to right is okay, pin A2 is NC (Not connected). Thats why i shift it to right rather go to left (A4) which is the Dat1.

If i am gonna revise the design of the flex, i will put 3 point (A2, A3, A4), in there with 0.5 mm apart (according to the datasheet). So we could detect whether its short circuited with the neighbour point or not, before connecting the power.

Post automatically merged: Jun 2, 2023

Both point comes in the same line.
You could track the traces yourself in here https://balika011.hu/switch/lite/

All I knows is, thats the only point difference in the hwfly install and the pico install.

 

[Adran_Marit]

That does sound like the most logical variable here. Hwfly lite 3.3v is sourced from the cap that is directly above the sd card reader. All other data lines are the same as Pico install. So.....that improper line we use could be the cause of bsod etc and seems like the odd variable out. Apart from the circuitry of the hwfly modchip but I doubt that's super cutting edge ahead of us.

Edit - That point gives 0.8v voltage drop. What does the pico 3.3v value give?

Edit - Nonetheless it's from a different part of the board. Different voltage rail. I wonder if this is it. But first thing is to restore out the bsod. Unless, trying this line with the pico would fix it. Isn't this all just so fun!

Reference:

i wonder what point @HackMan37 used and if they could swap points?

 

[abal1000x]

.

 

[Nephiel]

If i am gonna revise the design of the flex, i will put 3 point (A2, A3, A4), in there with 0.5 mm apart (according to the datasheet). So we could detect whether its short circuited with the neighbour point or not, before connecting the power.

That seems a good idea on paper, but unless there is even tension keeping the flex against the solder, and some independent give on each point to compensate for variances, as soon as you have more than 1 point, the edge connection will become unreliable (seesaw).

 

[abal1000x]

.

 

[Dee87]

Hmmmm your not alone with the exact same problem as me and like 4-5 switch lites. Something is being reproduced here but I have no idea what it could be! Weird thing is, I've not seen this problem with HWFLY lite installs but lots of pico installs with this problem. What is going on? Is the Pico drawing to much power from the lite that is more power starved than the other switch versions or something!?

Hello here I am with a Oled that has the same Problem after a hwfly install (no I did not install the hwfly) someone else did , so this has nothing to do with the picofly this is a issue that occurs during installation

 

[_kedo_]

From the datasheet

Hi, can you share a link to this particular datasheet?

Shift it to right is okay, pin A2 is NC (Not connected). Thats why i shift it to right rather go to left (A4) which is the Dat1.

Hey guys, does anybody has desoldered EMMC BGA153 and crappy OLED DAT0 cable?
Can we just flip over this EMMC chip and put this cable above to see if DAT0 on cable shorts neighbour DAT1? Is that make sense?