Hacking Hardware Picofly - a HWFLY switch modchip

[Takezo-San]

Check ur batteries from ur dmm if it fluctuates so much.

Otherwise change it with a 100ohm resistor then ull see if it works.
Check if u ripped a trace ifso try to fix.

No clue what its for sorry.

no worries, will check it out. thanks

 

[FreeLander]

Another permanent dat0 drilling method.
Samsung s23 ultra photos.

How many did you do so far? This is just BALD.

 

[Flaviocarvalho]

got this v2 that wont turn on...it was a failed installation of picofly..when it boot get a purple/pink light on rp2040. noticed a missing resistor next to rst point. anyone can tell me if it should turn on whitout this ressitor? and if not whats the value of it?

 

[Dee87]

got this v2 that wont turn on...it was a failed installation of picofly..when it boot get a purple/pink light on rp2040. noticed a missing resistor next to rst point. anyone can tell me if it should turn on whitout this ressitor? and if not whats the value of it?

What pico do u have?

We don't use colors anymore

What's the firmware u flashed ?

 

[Flaviocarvalho]

What pico do u have?

We don't use colors anymore

What's the firmware u flashed ?

it was installed woth the 2.67 i guess... came to me today

 

[jkyoho]

got this v2 that wont turn on...it was a failed installation of picofly..when it boot get a purple/pink light on rp2040. noticed a missing resistor next to rst point. anyone can tell me if it should turn on whitout this ressitor? and if not whats the value of it?

4.7K ohm

 

[Flaviocarvalho]

4.7K ohm

but can you tell me if whitout ot the console should turn on?

Post automatically merged: Aug 22, 2023

but can you tell me if whitout ot the console should turn on?

is there

4.7K ohm

is there any place i can find it on a switch lite board?

 

[Takezo-San]

resistor changed and it gives a solid reading now but still got the same error. Removed everything and it still boots into OFW so thats a plus i guess. The pic shows the alleged scratch that is covered by solder mask (between the clk point and the newly installed resistor). I honestly think its not that because it boots fine and going into data management on the switch shows the correct nand storage capacity so its reading fine. I saw @RedFawkes has the exact same problem as me. Wondering to go for another reball. Would it even boot into ofw if the reball was bad? Or could it be the dat0 line has shifted under the reball and is connecting a line with dat1? but then there would be a bridge unless it cleanly makes contact with dat1 but i find it hard to think that plausible because i've solder masked the line like always so it can only stay in the dat0 point with very little end wiggle room. Any ideas? Because I feel like i could play it safe and get rid of it as ofw. Or whatever the fix is but i dont want to chase my own tail. its a head scratcher!

 

[Dee87]

View attachment 389603

resistor changed and it gives a solid reading now but still got the same error. Removed everything and it still boots into OFW so thats a plus i guess. The pic shows the alleged scratch that is covered by solder mask (between the clk point and the newly installed resistor). I honestly think its not that because it boots fine and going into data management on the switch shows the correct nand storage capacity so its reading fine. I saw @RedFawkes has the exact same problem as me. Wondering to go for another reball. Would it even boot into ofw if the reball was bad? Or could it be the dat0 line has shifted under the reball and is connecting a line with dat1? but then there would be a bridge unless it cleanly makes contact with dat1 but i find it hard to think that plausible because i've solder masked the line like always so it can only stay in the dat0 point with very little end wiggle room. Any ideas? Because I feel like i could play it safe and get rid of it as ofw. Or whatever the fix is but i dont want to chase my own tail. its a head scratcher!

Show pics from ur complete install.

If the emmc wouldn't be reballed properly then u would not have ofw running .

Are u sure ur wires are connected to the correct pins on the Rp tiny

 

[Takezo-San]

Show pics from ur complete install.

If the emmc wouldn't be reballed properly then u would not have ofw running .

Are u sure ur wires are connected to the correct pins on the Rp tiny

Everythings disconnected now though (did it to check if ofw runs with the chip disconnected - and it does) but I have done one thing different in this install which is bridging the 3.3v caps. Do you reckon thats the issue? And I've swapped out the tiny with a normal rp2040 this time that was from a working switch i had around. And using that gave the same error code.

Post automatically merged: Aug 22, 2023

Show pics from ur complete install.

If the emmc wouldn't be reballed properly then u would not have ofw running .

Are u sure ur wires are connected to the correct pins on the Rp tiny

Posted this a few pages back here it is again. pins and everything are all fine.

I think tomorrow, I will try and clean up the cap point on the 3.3v line and see how it goes from there. Tried doing it first time before but the solder got stuck in between them and bridged there so will hot air remove one, clean the gunk of the other, kapton it off, install the cap back, then re-do the point. Who knows, stranger things have happened. @lightninjay , would those caps being bridged be an issue in the mod process for the 3.3v line?

 

[jkyoho]

Everythings disconnected now though (did it to check if ofw runs with the chip disconnected - and it does) but I have done one thing different in this install which is bridging the 3.3v caps. Do you reckon thats the issue? And I've swapped out the tiny with a normal rp2040 this time that was from a working switch i had around. And using that gave the same error code.

Post automatically merged: Aug 22, 2023

Posted this a few pages back here it is again. pins and everything are all fine.
View attachment 389611

I think tomorrow, I will try and clean up the cap point on the 3.3v line and see how it goes from there. Tried doing it first time before but the solder got stuck in between them and bridged there so will hot air remove one, clean the gunk of the other, kapton it off, install the cap back, then re-do the point. Who knows, stranger things have happened. @lightninjay , would those caps being bridged be an issue in the mod process for the 3.3v line?

any picture on the backside?

 

[Takezo-San]

any picture on the backside?

Ofw runs as normal. Normal boot. Picture and everything . Or did you mean a photo of the other side of the motherboard (mosfet and emmc side)?

BTW, had a look at the 3.3v but no, seems bridging them doesn't matter because their on the same line. And ofw boots so definitely not an issue on the 3.3v caps.

Dang it. What now?

 

[jkyoho]

did you mean a photo of the other side of the motherboard (mosfet and emmc side)?

yea, that's what I meant. And in your case I dont think eMMC reball was bad

 

[Takezo-San]

yea, that's what I meant. And in your case I dont think eMMC reball was bad

Will take a pic when I have a go at it tomorrow. Now that I think of it, I did use a different ground point this time. Might change that to a point that I'm more familiar with. Who knows.

Quick thought, could it be a bad mosfet?

Oh wait. Reading around some people have the same totk switch oled as mine. This error code is rare but I think I've figured out the reason for this error code. It's a Japanese model oled. Maybe when the pico and rehisus code is trying to execute, it runs into a different syntax language when communicating with the emmc. So throws the cannot read emmc. I think its this myself. What do you guys think?

 

[Takezo-San]

If damage was done with the grinding, I'd think the console wouldn't boot into OFW and work fine.

Replaced emmc b/c I heard someone else had the same issue, but they probably used the dat0 adapter.

Diode reaching with red prob to ground for Dat0 is 0.421 and similar for CMD and CLK readings.

I'll double check the dat0 point and see.

Did you manage to find out what the problem was?

 

[rogras]

Hekate, lockpick_rcm and biskeydump = Blackscreen
OFW = Bluescreen

Does anyone know how else I can get my Biskeys? Thx!

Only ums-loader works as payload.bin maybe this only works because it is started from memory.

 

[abal1000x]

Hekate, lockpick_rcm and biskeydump = Blackscreen
OFW = Bluescreen

Does anyone know how else I can get my Biskeys? Thx!

Only ums-loader works as payload.bin maybe this only works because it is started from memory.

To be precise its uses IRAM which is part of the Nvidia Tegra X1 (CMIIW).

I think the DRAM is the main issue. Maybe you accidentally cut the trace?

 

[ammaralidj]

he needs to use 100 ohm resistors for dat0+cmd. or add another 47 ohm for a total of 94 ohm.

Thank you so much for your reply.
I have some questions in mind: Why I need to add another resistor? because of faulty installation or faulty picofly chip or the sysnand is really that weak??
If sysnand is weak, is there any way to check sysnand's health??

 

[rogras]

To be precise its uses IRAM which is part of the Nvidia Tegra X1 (CMIIW).

I think the DRAM is the main issue. Maybe you accidentally cut the trace?

No, a hardware fault can be ruled out. I installed the chip as usual and the device had also started and I entered into Hekate. However, it got stuck after about 20 minutes when creating the Nand backup. The screen was full of graphic artifacts. I know that this happens when the DAT0 is not seated correctly, but after changing the DAT0 template, I got CFW = Blackscreen and OFW = Bluescreen.

Unfortunately, I also started the OFW before I changed the template. I therefore assume that the Nand is corrupted.

 

[deeps]

Thank you so much for your reply.
I have some questions in mind: Why I need to add another resistor? because of faulty installation or faulty picofly chip or the sysnand is really that weak??
If sysnand is weak, is there any way to check sysnand's health??

because 47 ohm isn't always enough to prevent the electrical noise from the rp2040 from interfering with the cpu-emmc communication. nothing is faulty, there is always some slight variation during the production of electrical components. the 47 ohm standard doesn't come from a specification sheet or anything, it's just something someone tested at some point which happened to work. however with data from enough installs it has turned out that 100 ohm is more likely to work well for everyone.