Hacking Booting to hekate without eMMC?

[evil_santa]

Is this possible only on V2, or also on oled. Asking because after changing sk hynix emmc to a samsung blank one, picofly gives *=* error without further succes.

It doesn't matter, works on any switch.
Try to reflash your Picofly to reset any training data.
Your diode reading's are fine ?
And please send picture from your emmc (which type)

 

[Mn3s]

It doesn't matter, works on any switch.
Try to reflash your Picofly to reset any training data.
Your diode reading's are fine ?
And please send picture from your emmc (which type)

Readings are within normal range, Emmc is Samsung KLMCG4JETD 64gb. Tried to reflash pico with 2.73FW, also tried completly new rp2040 zero with picofly 2.74FW. Both ways still gives *=* error two times. PC recognizes switch in rcm mode, indicating that emmc works, but there is missing valid boot0/boot1. So is picofly realy able to glitch switch oled without valid boot0 partition?

 

[evil_santa]

Rehius says yes.
https://gbatemp.net/threads/picofly-a-hwfly-switch-modchip.622701/post-10120712

RCM mode is also if you don't have an Emmc installed.
Emmc defective

 

[Mn3s]

I realy doubt that emmc is defective. Maybe this blank emmc have 8 mb boot partitions and picofly doesnt like that. Or maybe there is no boot partitions at all, but i dont think thats possible.

 

[evil_santa]

I realy doubt that emmc is defective. Maybe this blank emmc have 8 mb boot partitions and picofly doesnt like that. Or maybe there is no boot partitions at all, but i dont think thats possible.

Hmm hard to say from here.
The emmc has a 4mb boot partion. It is possible to deactivate the boot partion but it's not a thing on a new emmc.
Can't tell you what you should do now.
If you have a hwfly chip you can try with these but it should be the same.
You can desolder it and write it with an hardware programmer.
Or you can use a ft232h to write to boot0/1 backup to the emmc.

 

[Mn3s]

That would be the hard way, 3 times to unsoldering, 2 times raball. Most of the time these emmc cant even handle 1 reball. Also i think i will use V1 switch for flashing full disk image via hekate, but again, alot of hot air desoldering. So I guess thats the way. Why pico is unable to glitch in easy way is a mistery.

 

[evil_santa]

Again you can use a ft232h to write your image to your emmc. It's not necessary to desolder the emmc.
Connect dat0, cmd and clk to ft232h power on your switch and you should be able to write the backup to it.

 

[vlosopedro]

Hello guys im in that same problem, dead oled here, whit picofly, no boot nothing, probable dead emmc after 17.0.0 update.

Whats the easier method can i try to rebuild the emmc nand? no hekate showing, only recognizes APX (Rcm mode) on my pc, and i only have boot1/0 backups, no rawnand backup

 

[Mn3s]

Hello guys im in that same problem, dead oled here, whit picofly, no boot nothing, probable dead emmc after 17.0.0 update.

Whats the easier method can i try to rebuild the emmc nand? no hekate showing, only recognizes APX (Rcm mode) on my pc, and i only have boot1/0 backups, no rawnand backup

Hi, there is unfortunatly no easy way to rebuild. You have 3 options that i know of.
1. Solder emmc to switch v1, launch hekate and reflash boot partitions.
2. Solder emmc to specific emmc adapter that can refash partitions (linux environment)
3. Use ft232h programmer as it is stated post before. No need to desolder emmc as it can flash on board.

Also i think it is possible restore emmc using emmu nand image. Just make emmunand backup, and restore it as it is sys nand. You can make and rebuild full disk image using unbrick pack v4, again, using emmunand prodinfo file.
Keep in mind that your emmc could have physical damage and you will need completely new emmc.
Good luck !

 

[TheSynthax]

Hi, there is unfortunatly no easy way to rebuild. You have 3 options that i know of.
1. Solder emmc to switch v1, launch hekate and reflash boot partitions.
2. Solder emmc to specific emmc adapter that can refash partitions (linux environment)
3. Use ft232h programmer as it is stated post before. No need to desolder emmc as it can flash on board.

Also i think it is possible restore emmc using emmu nand image. Just make emmunand backup, and restore it as it is sys nand. You can make and rebuild full disk image using unbrick pack v4, again, using emmunand prodinfo file.
Keep in mind that your emmc could have physical damage and you will need completely new emmc.
Good luck !

You don't need to desolder a Mariko eMMC just to reflash it. Picofly or HWfly can boot Hekate with an entirely empty eMMC. If the eMMC is dead, a new eMMC can be soldered to the console and Hekate can image it. If Prodinfo was backed up, then Sthetix level 2 unbrick will work, otherwise level 3 is necessary and the console will not be able to connect to Nintendo servers.

 

[vlosopedro]

Hi, there is unfortunatly no easy way to rebuild. You have 3 options that i know of.
1. Solder emmc to switch v1, launch hekate and reflash boot partitions.
2. Solder emmc to specific emmc adapter that can refash partitions (linux environment)
3. Use ft232h programmer as it is stated post before. No need to desolder emmc as it can flash on board.

Also i think it is possible restore emmc using emmu nand image. Just make emmunand backup, and restore it as it is sys nand. You can make and rebuild full disk image using unbrick pack v4, again, using emmunand prodinfo file.
Keep in mind that your emmc could have physical damage and you will need completely new emmc.
Good luck !

thank you ) i dont think its a physical damage bcause happened after someshit my friend has done after 17.0 update, restored some broken backup something like this, for me the easyest way should be solder the emmc to a v1 and reflash. other things here in brazil i have no easy access. thank you so much!

Post automatically merged: Jan 16, 2024

You don't need to desolder a Mariko eMMC just to reflash it. Picofly or HWfly can boot Hekate with an entirely empty eMMC. If the eMMC is dead, a new eMMC can be soldered to the console and Hekate can image it. If Prodinfo was backed up, then Sthetix level 2 unbrick will work, otherwise level 3 is necessary and the console will not be able to connect to Nintendo servers.

but mine is a oled! whats hes telling to me is, dessolder the oled emmc, solder on a v1, boot the v1 on hekate, flash oled boot partitions in v1 board then ressolder the oled emmc in oled board again

Post automatically merged: Jan 16, 2024

You don't need to desolder a Mariko eMMC just to reflash it. Picofly or HWfly can boot Hekate with an entirely empty eMMC. If the eMMC is dead, a new eMMC can be soldered to the console and Hekate can image it. If Prodinfo was backed up, then Sthetix level 2 unbrick will work, otherwise level 3 is necessary and the console will not be able to connect to Nintendo servers.

im trying to not get a new emmc chip, cuz for me is very difficult to shop another one, but i have access to others switches consoles

Post automatically merged: Jan 16, 2024

Hi, there is unfortunatly no easy way to rebuild. You have 3 options that i know of.
1. Solder emmc to switch v1, launch hekate and reflash boot partitions.
2. Solder emmc to specific emmc adapter that can refash partitions (linux environment)
3. Use ft232h programmer as it is stated post before. No need to desolder emmc as it can flash on board.

Also i think it is possible restore emmc using emmu nand image. Just make emmunand backup, and restore it as it is sys nand. You can make and rebuild full disk image using unbrick pack v4, again, using emmunand prodinfo file.
Keep in mind that your emmc could have physical damage and you will need completely new emmc.
Good luck !

actually.. ft232h is very cheap right here too, ill try this one first
Edit to avoid spam:
ill need the emmc adapter? the big black box that was shown up on the arab video? or can i do this only whit a FT323h adapter? here in brazil we have this one FT323RI someone can tell me if can i do whit this little board instead the 323h?:

 

[Mn3s]

As evil_santa stated before:
"you can use a ft232h to write your image to your emmc. It's not necessary to desolder the emmc.
Connect dat0, cmd and clk to ft232h, power on your switch and you should be able to write the boot0/boot1 bin files".
That black box is used for friction contact, as it pushes down on emmc to create contact, so you dont need to solder emmc.
Just connect coresponding wires. If 323RI will work is up to you and your knowladge.
Good luck.

 

[Myst0gan]

Reporting back on this after I got a replacement eMMC chip.

The Picofly boots to hekate without any issue, and lockpick is able to dump some keys, although it cannot read the eMMC. As expected, among these keys are the BIS keys, and all the device unique keys (which are stored on the CPU ROM).

Then I used prodinfo_gen to generate a PRODINFO partition which is usable by the switch (but will be rejected by nintendo's servers: it's like having a banned switch).

Finally, using an eMMC dump from another working switch, I was able to recreate a working eMMC dump by following sthetix's guide, and flash it to the new eMMC chip. It took some time, but I have now a working switch, which can even boot fully stock. The only strange part is that the switch initially refused to boot stock (black screen after Nintendo logo). I had to boot atmosphere on the sysMMC once before it accepted to boot stock.

TL;DR: yes, it is possible to revive a switch with a dead eMMC and without a backup.

Impressive can you make a guide?? Pdf with pictures or video. How did you figure out that emmc was completely dead?? Where have you measured 1,8V?

Post automatically merged: Jan 17, 2024

If you have a picofly or an modchip with the newer hwfly-nx firmware you can boot to a completely empty emmc.
After this you can dump your key's and rebuild a new nand.
I did this a while ago.

How did you do that?? I'm asking just because of curiosity

 

[vlosopedro]

As evil_santa stated before:
"you can use a ft232h to write your image to your emmc. It's not necessary to desolder the emmc.
Connect dat0, cmd and clk to ft232h, power on your switch and you should be able to write the boot0/boot1 bin files".
That black box is used for friction contact, as it pushes down on emmc to create contact, so you dont need to solder emmc.
Just connect coresponding wires. If 323RI will work is up to you and your knowladge.
Good luck.

Yaeh yeah, i just got myself in asking, why i need a emmc reader if i dont need to ressolder de emmc hahahaha, thank you my friend, i ordered a ft323h on aliexpress, when it arrives ill come back here and post a feedback, really aprecciate your help! Thx so much

 

[Mn3s]

Yaeh yeah, i just got myself in asking, why i need a emmc reader if i dont need to ressolder de emmc hahahaha, thank you my friend, i ordered a ft323h on aliexpress, when it arrives ill come back here and post a feedback, really aprecciate your help! Thx so much

Other people helped alot more than i did, but no problem. Also if you are using aliexpress, i suggest buying new samsung 64gb emmc, they are pretty cheap and will definetly come in handy later .
Happy waiting !

 

[snaker]

So if i got this right....
You just buy an ft232h. You simply add 3 10k resistors:
clk=ad0 10k to gnd
cmd=ad1 and dat0=ad2 both 10k to 3.3v
power on switch in order for the nand to have power and you can read write boot0/boot1 sectors,using that postal3 program, on "oled models" blank 64gb nands?

This is amazing! Anyone completely confirm that this works?

 

[Mn3s]

In theory it should. But if everything works as intended and working new emmc is soldered perfectly, just not yet written, in other words blank, picofly or hwfly can and will boot to hekate for easier flashing.

 

[Danook28]

In theory it should. But if everything works as intended and working new emmc is soldered perfectly, just not yet written, in other words blank, picofly or hwfly can and will boot to hekate for easier flashing.

I have that chip on pic i want to read mmc nand for V1 console not boot to hekate but picofly is glitch and see logo in secreen but with try to boot to hekate msg (failed to read inti sd card) but the sd card adapter for switch working in other console) i need digram for soldring that chip to mmc. Thanks you

 

[rull_bull]

If you have a v1 that is unpatched, boot with rcm instead of picofly.

 

[vlosopedro]

Hi, there is unfortunatly no easy way to rebuild. You have 3 options that i know of.
1. Solder emmc to switch v1, launch hekate and reflash boot partitions.
2. Solder emmc to specific emmc adapter that can refash partitions (linux environment)
3. Use ft232h programmer as it is stated post before. No need to desolder emmc as it can flash on board.

Also i think it is possible restore emmc using emmu nand image. Just make emmunand backup, and restore it as it is sys nand. You can make and rebuild full disk image using unbrick pack v4, again, using emmunand prodinfo file.
Keep in mind that your emmc could have physical damage and you will need completely new emmc.
Good luck !

Hello man, my ft232h arrived a few time back, but it's only now that I've been able to try to solve the problem.
Thats what happened, conected clk dat0 and cmd but i dont soldered the 10k resistors, is it needed to the program works?

Post automatically merged: Sep 12, 2024

In theory it should. But if everything works as intended and working new emmc is soldered perfectly, just not yet written, in other words blank, picofly or hwfly can and will boot to hekate for easier flashing.

continuating the message, i removed the entire picofly and tried to open the emmc on the program but only showed an error, think thats caused by the missing 10k resistors, ill try tomorrow and come back here

Post automatically merged: Sep 13, 2024

att.
Even whit resistors i cant read the emmc