Recent content by flynnsmt4

  1. flynnsmt4

    Hacking Hardware Picofly - a HWFLY switch modchip

    as promised:
  2. flynnsmt4

    Hacking Hardware Picofly - a HWFLY switch modchip

    re @binkinator if someone wanted to try and run the stage 2 loader you could technically reverse the stage 1 loader firmware and replace the decryption+swd writes with the decrypted bin (and doing the same writes), and if it doesn't check the board ID then it will just work. I'd recommend that...
  3. flynnsmt4

    Hacking Hardware Picofly - a HWFLY switch modchip

    Here is another firmware as well as its SRAM dump at the second stage loader, plus all of the SWD reads and writes. The person who gave it to me generously allowed me to publish it here. The board ID is E6 61 1C B7 1F 32 68 29, and the bin with the board ID name is the initial flash (loaded at...
  4. flynnsmt4

    Hacking Hardware Picofly - a HWFLY switch modchip

    AFAIK the only difference is that (other than that one having better eMMC support?) it doesn't check the flash ID; none of them can load Atmosphere. I actually considered just patching it and loading it onto my Pico but I'm glad I didn't given that it executes individual PIO instructions which...
  5. flynnsmt4

    Hacking Hardware Picofly - a HWFLY switch modchip

    I have to say I'm impressed by your work :-) 1679293967 ..and what my luck to realize a bit later that rehius posted a firmware that deliberately ignores the firwmare ID check--in fact, it even cuts short the XIP flash ID sequence. As far as I remember this was the most recently posted one...
  6. flynnsmt4

    Hacking Hardware Picofly - a HWFLY switch modchip

    I'm pleased to announce that after significant time working on a cycle-accurate (this is very important) emulator I've finally been able to go past the decryption phase and have dumped the segments of ARM code that is written by the end of the encryption. I have to say, this is the most fun CTF...
  7. flynnsmt4

    Hacking Hardware Picofly - a HWFLY switch modchip

    Okay, after taking some time off I decided to look at this again and realized that they're most definitely fingerprinting (or rather, changing behaviour) based on the flash ID. They call flash_get_unique_id as part of an init callback (I thought this was some random flash func) and then...
  8. flynnsmt4

    Hacking Hardware Picofly - a HWFLY switch modchip

    Mostly because of stuff like this: I'm sure it would make sense if I went through it line-by-line but doing that a thousand times starts to get a bit annoying .. This is also a good candidate, how do I know without looking at that massive STR chain that it doesn't overwrite that magic constant...
  9. flynnsmt4

    Hacking Hardware Picofly - a HWFLY switch modchip

    Not yet, no. I'm not really sure how much further I want to go.
  10. flynnsmt4

    Hacking Hardware Picofly - a HWFLY switch modchip

    From my limited reversal of this firmware you're probably looking at pico SDK runtime init routines which initialize fplib function pointers; different bootrom versions have differing levels of support for them, like double-precision floating point funcs. I'd recommend compiling your own pico...
  11. flynnsmt4

    Hacking Hardware Picofly - a HWFLY switch modchip

    Those addresses are documented, every peripheral MMIO page gets three extra pages from the base address for atomic IO; they're all writes to the DBGFORCE register. Specifically, on each core, it writes a data bit in SWDI by triggering a falling edge on SWCLK. The sequence is something like...
See more