Toggle sidebar

Tutorial  Updated

How to flash the HWFLY Clone chips

See below for updates.

IF YOU BREAK YOUR BOOT0 PIN. DO NOT DM ME ASKING FOR HELP. THAT'S IT. YOU BREAK THAT PIN AND YOU CANT FLASH. YOUR CHIP IS STUCK WITH WHATEVER HWFLY PUT ON IT


Pre-requisites:


  • Raspberry Pi Zero W
    • You may use another flasher if you desire.
  • Pinout Diagram
  • Modchip Diagram
  • FULL_CHIP_STOCK.bin
  • Modchip Diagram, find the PA9(TX) and the PA10(RX) pins on your modchip, and do the following:
    • Connect GPIO14(TX) on your Raspberry Pi Zero W to the PA10(RX) pin on your modchip.
    • Connect GPIO15(RX) on your Raspberry Pi Zero W to the PA9(TX) pin on your modchip.

  1. Solder a wire to each of the following pinouts on the Raspberry Pi Zero W:
    • 3.3V
    • Ground
    • GPIO 14 (UART TX)
    • GPIO 15 (UART RX)
  2. Do the following to prepare the modchip:
    1. Lift pin 44 (also known as BOOT0).
    2. You will need a way to power the chip, so you need to find two 3.3v points. It can be on a MOSFET, but it will differ based on the revision of the modchip.
    3. Connect Ground on your Raspberry Pi Zero W to the Ground pin on your modchip.
    4. Check the Modchip Diagram, find the PA9(TX) and the PA10(RX) pins on your modchip, and do the following:
      • Connect GPIO14(TX) on your Raspberry Pi Zero W to the PA10(RX) pin on your modchip.
      • Connect GPIO15(RX) on your Raspberry Pi Zero W to the PA9(TX) pin on your modchip.
  3. Boot your Raspberry Pi Zero W and do the following:
    1. In the terminal, type the following command, and press enter:
      Bash: 
      sudo nano /boot/config.txt
    2. Add the following line to the end of the file:
      INI: 
      dtoverlay=pi3-miniuart-bt
    3. Press CTRL + X to save and exit the editor.
    4. In the terminal, type the following command, and press enter:
      Bash: 
      sudo nano /boot/cmdline.txt
    5. Remove the following line from the file:
      INI: 
      console=serial0,115200
    6. Press CTRL + X to save and exit the editor.
    7. Restart your Raspberry Pi with this command
      Bash: 
      sudo /sbin/reboot
    8. In the terminal, type the following commands, and press enter after each command:

      Bash: 
      git clone https://github.com/Pheeeeenom/stm32flash.git
cd stm32flash
sudo make install
  4. Now you will flash the modchip.
    Note: This will remove read protection, and the modchip will wipe itself (that is what we want).
    1. In the terminal, type the following command, and press enter:
      Bash: 
      stm32flash -k /dev/serial0
    2. Now to flash Spacecraft-NX Version 0.2.0, type the following, and press enter:
      Bash: 
      stm32flash -v -w ./FULL_CHIP_STOCK.bin /dev/serial0
  5. Once you're done flashing your modchip, remove the wiring from the modchip, and restore the 3.3v pin on the modchip to its original position.

Please post pictures of your work here to further the identification of the different board revisions!


UPDATE: So it seems like stitching the spacecraft bootloader and firmware together from the repo causes unstable glitching behaviors. For now, consistent glitching behavior works with this bootload/firmware combo. This is the original file on the OLED variant chip which has 0.2.0 spacecraft. As for glitching, I'll figure it out, give me some time...unless someone else wants to hop in and reverse the differences.

For now, this at least solves the 0.1.0 HWFLY gen 3 issue. More to come.

UPDATE 2: This is only going to work on some HWFLY chips. Older ones use higher protection than the new revisions that seem to use the QFN FPGA.

UPDATE 3: This should fully work on OLED modchips with the QFN FPGA. https://github.com/Pheeeeenom/firmware
 
Last edited by Mena,
  • Like
Reactions: ethchipset, Mazamin, zfreeman and 33 others
Click to expand...
kylum said:
I it took a few tries to get my stlink updated as it isn’t straight forward. However, i think I had to unplug and plug back in for it to work after putting it into update mode. I ant remember honestly. Unfortunate about your chip. Lifting a pad. You could always try to fix the lifted pad with a jumper.


What steps did you do exactly with what files and procedure?
Click to expand...
Ive flashed the r021 and menas bootloader. The chip is dead, because the MCU after running the console is getting very hot. The regulator on the upper left side of the GD32F350 was the problem. There is the shorted circuit. So i need replace the MCU and the 3.3V regulator. Basically i need a new chip, which isnt cheap…and in china is New Year, so i will get my New chip probably in about 2 months. Thanks for Your Help :(
 
Where do you plan on getting a new chip? The seller I used is out. Dunno if Ming has the same one, but I heard bad things about Ming (don’t recall if it was a price problem, product problem, or both). Searching Aliexpress for these things isn’t very straightforward…
 
Hackerman_2137 said:
Ive flashed the r021 and menas bootloader. The chip is dead, because the MCU after running the console is getting very hot. The regulator on the upper left side of the GD32F350 was the problem. There is the shorted circuit. So i need replace the MCU and the 3.3V regulator. Basically i need a new chip, which isnt cheap…and in china is New Year, so i will get my New chip probably in about 2 months. Thanks for Your Help :(
Click to expand...
Sounds like your chip is dead. However, My chip was exhibiting similar behavior using r021 and also Mena’s firmware. Mena’s firmware does not have a bootloader. There was only one that would work for me and I can share that with you if you would like. That is of course if you have not remove the chip as of yet. It’s worth a shot since you can’t break it if it’s already broken.
 
PamanX said:
Hi, I want to tell you about a problem I had trying to install the chip to my oled, the multimeter gave me correct values when checking the points, when I finished installing it, the chip led only blinked 4 times and started the console in OFW, I turned the console off and on 3 times and it started the same in direct OFW, on the fourth attempt it turned on a purple screen and it doesn't come out of there, I don't see that there is much information in forums about this failure, only something oriented to damage in the emmc, do you think there is a solution or it will definitely be a brick? thanks for your help
Click to expand...
man one of my switches are in this situation, it is usually the CLK and CMD line
the via on the CLK might be disconnected to the pad under the cpu by too much scraping, another could be the resistor for the CMD - i've had one switch that boots purple and fixes itself when resoldering cmd point and moving the resistor. it's frustrating when your wiring is good and this happen. that specific switch is still chilling here on the side. you should be able to get hekate working on that, and you will see emmc init fail
 
leerz said:
man one of my switches are in this situation, it is usually the CLK and CMD line
the via on the CLK might be disconnected to the pad under the cpu by too much scraping, another could be the resistor for the CMD - i've had one switch that boots purple and fixes itself when resoldering cmd point and moving the resistor. it's frustrating when your wiring is good and this happen. that specific switch is still chilling here on the side. you should be able to get hekate working on that, and you will see emmc init fail
Click to expand...
oh ok dude, i'll do the install again hoping to revive the console, thanks a lot for your help
 
kylum said:
Sounds like your chip is dead. However, My chip was exhibiting similar behavior using r021 and also Mena’s firmware. Mena’s firmware does not have a bootloader. There was only one that would work for me and I can share that with you if you would like. That is of course if you have not remove the chip as of yet. It’s worth a shot since you can’t break it if it’s already broken.
Click to expand...
FYI, to join the bootloader and the firmware together, you can use HxD.

first open the bootloader file, then add the firmware at 0x08003000 (paste insert)

and save it.

btw here is a new firmware for the oled chip, now on r022. i got it from someone on discord

https://github.com/sthetix/OLED-DIAGRAM/blob/main/firmware_r022.zip
 
Last edited by sthetix,
  • Like
Reactions: NEOGEOKAI, lufeig and kylum
sthetix said:
FYI, to join the bootloader and the firmware together, you can use HxD.

first open the bootloader file, then add the firmware at 0x08003000 (paste insert)

and save it.

btw here is a new firmware for the oled chip, now on r022. i got it from someone on discord

https://github.com/sthetix/OLED-DIAGRAM/blob/main/firmware_r022.zip
Click to expand...
Thanks for this. FYI, while testing some firmware with @Mena we discovered that my OLED chip would only work with a particular bootloader. Every bootloader except for one would result in a constant solid yellow LED and would fail to boot. I joined that bootloader and Mena’s latest to obtain a working setup!

The person I was responding to had flashed vanilla spacecraft and now has a bricked/ possibly dead chip. Maybe their bootloader is the issue like mine! From my understanding these microcontrollers can have pins enable and disabled based on how they are programmed and if the poster attempted to use the bootloader that works for me they could possibly recover!
 
Last edited by kylum,
  • Like
Reactions: leerz and Donnie-Burger
PamanX said:
Hi, I want to tell you about a problem I had trying to install the chip to my oled, the multimeter gave me correct values when checking the points, when I finished installing it, the chip led only blinked 4 times and started the console in OFW, I turned the console off and on 3 times and it started the same in direct OFW, on the fourth attempt it turned on a purple screen and it doesn't come out of there, I don't see that there is much information in forums about this failure, only something oriented to damage in the emmc, do you think there is a solution or it will definitely be a brick? thanks for your help
Click to expand...
I got know someone who had a console returned to him with this issue. He thinks its due to the adapter for Dat0. he's spoken with a few others about it and they think its the same thing. Thinking maybe something is getting shorted under the emmc. I sent him my stencil so he could attempt to reball the chip and hopefully bring it back to life.
 
  • Like
  • Love
Reactions: fragged, leerz and PamanX
kylum said:
Thanks for this. FYI, while testing some firmware with @Mena we discovered that my OLED chip would only work with a particular bootloader. Every bootloader except for one would result in a constant solid yellow LED and would fail to boot. I joined that bootloader and Mena’s latest to obtain a working setup!

The person I was responding to had flashed vanilla spacecraft and now has a bricked/ possibly dead chip. Maybe their bootloader is the issue like mine! From my understanding these microcontrollers can have pins enable and disabled based on how they are programmed and if the poster attempted to use the bootloader that works for me they could possibly recover!
Click to expand...
I will replace the regulator and reflash the chip. Can you send the bootloader?
 
Thanks! i will try it :) maybe there is still an hope. But first i need to replace the voltage regulator, because one of the legs fell off when i was testing the modchip with multimeter. Maybe this was my problem. I will replace it, and test it.

I can't find the orginal regulator (LN1134A332MR-G), but i found a replacement: LC1463CB5ATR33.

I've already merged bootloader with firmware. So when i came back home, after work i will flash it.
 
Last edited by Hackerman_2137,
  • Like
Reactions: Donnie-Burger
btw. what's stopping us from making an open source modchip? I've found a similar chip which is used in HWFly: GD32VF103CBT6. This chip is used in Sipeed Longan Nano. This board is much cheaper than HWfly.
 
Wasn't there another installer video with a guy who said he had a bunch of the different D0 adapters (that are way better than the small corner-looking one that comes with the OLED version)? I need to get me one of those. I'm not messing around with the chip I had, and the seller I used has some more in stock. Said 21, and I just ordered another, so the seller maybe has 20 of them left... FYI (Global E-SPORTS GAME Alliance Store)
 
thats a massive LOL at a clone chip that steals off you know what, to bypass switch consoles protection to allow you to steal games and what do they do, they add their own protection to stop users bypassing their crap and allow you to use it how ever you like.

I wouldn't trust a cheap clone flashcard, never mind a board you solder to your console main board, if anything fucks up on that cheap nasty clone, then kiss your console bye bye, you might as well have stopped been a cheap skate and purchased your games legitimately.

and i would hate to think of the price they sell them at and resellers based on the grounds it has a false demand due to xecuter getting shut down, yup, at least they provided us with quality products, not cheaply manufactured crap and they aimed to make it as user friendly so any one could easily use its product,

anyway, i wonder how long it will take for nintendo to again start targeting its resellers and i will assume they made some form of bargaining chip with the resellers and have them turn over their contacts in order to get inside the circle and get Max, Gary and Cheng busted and shut xecuter down.

absolutely gutted now, no more tx, so you can kiss goodbye to any future console hacks been released or products that are user friendly, unless hackers are able to find easy exploits that dont require additional hardware, i highly doubt we will see future consoles now getting hacked.
 
So... nobody has a link to one of those dat0 adapters? Can't seem to find search terms on aliexpress to show any for sale at all. Well, I'm not patient when I don't need to be, so I found it on ebay for $6.99 (Free shipping). Dunno if that's the going price (or only price)...
 
PamanX said:
Hi, I want to tell you about a problem I had trying to install the chip to my oled, the multimeter gave me correct values when checking the points, when I finished installing it, the chip led only blinked 4 times and started the console in OFW, I turned the console off and on 3 times and it started the same in direct OFW, on the fourth attempt it turned on a purple screen and it doesn't come out of there, I don't see that there is much information in forums about this failure, only something oriented to damage in the emmc, do you think there is a solution or it will definitely be a brick? thanks for your help
Click to expand...
I installed a hwfly lite with spacecraft v1 and bricked my console, I repaired it because before the brick it backed up boot0 and boot1 and I restored it by hardmod and it worked perfect.
 

Attachments

  • MVIMG_20220121_222144.jpg
    MVIMG_20220121_222144.jpg
    1.9 MB · Views: 124
  • Like
Reactions: lufeig and PamanX
NEOGEOKAI said:
https://gbatemp.net/threads/switch-hard-mod-nand-dump-with-low-voltage-emmc-adapter.553032/

take a part of this post and then identify the clk, cmd, dat0, gnd and V+ points and on the PCB (Board) and with the NX Nand Manager program and then inject again.
Click to expand...
https://es.aliexpress.com/item/1005...=glo2esp&spm=a2g0s.8937460.0.0.31c22e0eBvpNxS

this can also help you make things a little easier as far as making the partitions visible I hope it helps you in something friend and you can repair your console
 

Site & Scene News

Go to forum More news

Popular threads in this forum

Emulation Emulator  NetherSX2 - Switch Port

Dekopon - (Mostly) Fullspeed 3DS Emulation on Nintendo Switch

Emulation Emulator  Cemu - Wii U Emulator - Switch Port

Homebrew Homebrew game  Ultimate Switch Port Thread

Emulation Emulator  DrasticDS Emulator - Switch Port

Emulation Emulator  Dolphin - GC/Wii Emulator - Switch Port

Homebrew Homebrew game  Angry Birds Classic - Switch Port

Raikopon - a speedy, experimental 3DS emulator for Nintendo Switch (Dekopon Fork)