Hacking Hardware Picofly - a HWFLY switch modchip

binkinator

Garfield’s Fitness Coach
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,152
Country
United States

AntonIX

Active Member
Newcomer
Joined
Jan 14, 2023
Messages
34
Trophies
0
Age
23
Website
devpins.org
XP
207
Country
Russia
The original id is just a 64bit number and it is retrieved from the flash chip.
The RP2040 does not have an internal id in the cpu itself (according to the documentation) :
https://raspberrypi.github.io/pico-sdk-doxygen/group__pico__unique__id.html
I don't know if the dump is just a raw dump of the flash chip?
If so, then it should be there.

If not, someone will be able to hack it.
Just speculating here but the firmware is probably the same as for the hwfly.
So we know the decoding algorithm. Then it is just a matter of trying all keys and comparing the output.
With a 64bit key, that will be peanuts for a normal cpu.
I'm sure there are smart kids here who can break this encryption on a Sunday afternoon.
I messaged one guy from 4pda and he gave me contacts of guy who got this dump. This guy said that he bought this picofly on platform like ebay. He said it costs about 50$. And also as I get in, it is just his dump and not complete flash solution. Read command somewhere, like ""some tool" dump all".
 
  • Like
Reactions: peteruk and Tafty

Tafty

Well-Known Member
Member
Joined
Sep 23, 2016
Messages
116
Trophies
0
Age
36
XP
923
Country
We have a dump of firmware from another one, but I've allready flashed that and it isn't working, so obviously a step is missing etc.
 
  • Like
Reactions: peteruk

impeeza

¡Kabito!
Member
Joined
Apr 5, 2011
Messages
6,064
Trophies
3
Age
46
Location
At my chair.
XP
17,657
Country
Colombia
I messaged one guy from 4pda and he gave me contacts of guy who got this dump. This guy said that he bought this picofly on platform like ebay. He said it costs about 50$. And also as I get in, it is just his dump and not complete flash solution. Read command somewhere, like ""some tool" dump all".
yeah, "PicoToll save --all" is the command.
 

AntonIX

Active Member
Newcomer
Joined
Jan 14, 2023
Messages
34
Trophies
0
Age
23
Website
devpins.org
XP
207
Country
Russia
I have thoughts about he is dev, because he ignores any asks about seller and answer parically. He said that it is starting in different time. Can start immediately or takes much more than hwfly.
 
  • Like
Reactions: impeeza

IgraBIT1

Member
Newcomer
Joined
Jan 27, 2023
Messages
15
Trophies
0
Age
24
XP
122
Country
Russia
i thought we already had the firmware. Is yours different?
Yes,
We have a dump of firmware from another one, but I've allready flashed that and it isn't working, so obviously a step is missing etc.
Of course it doesn't work lol. there is a binding by id. on your flash another id
other
 
  • Like
Reactions: FruithatMods

Doodka

Active Member
Newcomer
Joined
Jan 26, 2023
Messages
25
Trophies
0
Age
20
XP
94
Country
Belarus
I messaged one guy from 4pda and he gave me contacts of guy who got this dump. This guy said that he bought this picofly on platform like ebay. He said it costs about 50$. And also as I get in, it is just his dump and not complete flash solution. Read command somewhere, like ""some tool" dump all".
i think thats the same guy, who drop firmware here
u can install picotool from github and compare it with this dump in hxd
 

AntonIX

Active Member
Newcomer
Joined
Jan 14, 2023
Messages
34
Trophies
0
Age
23
Website
devpins.org
XP
207
Country
Russia
getting the id of your flash is not a problem.
We can compare bytecode of two different dumps.
Post automatically merged:

i think thats the same guy, who drop firmware here
u can install picotool from github and compare it with this dump in hxd
Yes it is.
 
  • Like
Reactions: Tafty

AntonIX

Active Member
Newcomer
Joined
Jan 14, 2023
Messages
34
Trophies
0
Age
23
Website
devpins.org
XP
207
Country
Russia
well we'd need a second dump wouldn't we?
Just checked both dumps, md5 is different. Possibly this is dumps from different chips. Uf2 is the same
Post automatically merged:

View attachment 349725difficult to read?) delete it is not a pity.
and you are bald, I will not give the firmware)))
Can you share your firmware too? Or you dont have it?
 

Attachments

  • PicoFly.zip
    215.8 KB · Views: 72

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
My best friend's sister's boyfriend's brother's girlfriend heard from this guy who knows this kid who is able to crack these sort of ID checks.

That kid would need a legit firmware dump though for him to do his magic. Can anyone fill me in on the firmware? Do we have any binaries? Is the posted blob a single program or are those a bunch of binaries?
 

Doodka

Active Member
Newcomer
Joined
Jan 26, 2023
Messages
25
Trophies
0
Age
20
XP
94
Country
Belarus
My best friend's sister's boyfriend's brother's girlfriend heard from this guy who knows this kid who is able to crack these sort of ID checks.

That kid would need a legit firmware dump though for him to do his magic. Can anyone fill me in on the firmware? Do we have any binaries? Is the posted blob a single program or are those a bunch of binaries?
a little higher in the subject there is an archive with a firmware dump
Just checked both dumps, md5 is different. Possibly this is dumps from different chips. Uf2 is the same
bins same too, its just cleared of empty blocks, so md5 must be identical
 
  • Like
Reactions: SylverReZ

SylverReZ

GBAtemp Lurker
Member
Joined
Sep 13, 2022
Messages
6,888
Trophies
3
Location
The Wired
Website
m4x1mumrez87.neocities.org
XP
23,023
Country
United Kingdom
a little higher in the subject there is an archive with a firmware dump

bins same too, its just cleared of empty blocks, so md5 must be identical
The dump is the same as this guy's dump here: https://gbatemp.net/threads/pikofly...y-modchips-or-not.622701/page-8#post-10049937

They just added extra padding to the dump to make it more convincing. You ain't fooling nobody, kiddo.

thingy.jpg
 

Doodka

Active Member
Newcomer
Joined
Jan 26, 2023
Messages
25
Trophies
0
Age
20
XP
94
Country
Belarus
View attachment 349725difficult to read?) delete it is not a pity.
and you are bald, I will not give the firmware)))
so, is it works? can you upload video? and can you upload dump?
Post automatically merged:

Little update on this...after posting I thought I better go and check I had soldered in the flex's correctly so took the rp out and wired up a sx core manually using the same wires i was using for the rp(dont have any lites currently) and it wouldn't glitch...turns out I hadn't soldered dat 0 correctly.

fixed that issue and confirmed my wiring was good with the sx, rewired the RP back in but unfortunately getting the same result. blue light then red light...BUT now im NOT getting into OFW like I was before, this is similar to what happens when you have soldered a sx/hw chip in incorrectly(again I confirmed this wasn't the case)

removing 3.3v does allow the console to then boot OFW like normal(expected behaviour)

so IMO at this point its trying to do something and failing...maybe this is to do with the ID encryption I read a few pages back...maybe its missing something but im now in a position where I can test anything hardware side. so please let me know.

also ive tested the install with and without resistors as the picture on page 1 clearly doesn't have them installed. so not sure why schematic a few pages ago does
how did you upload uf2? by using usb or picotool?
Post automatically merged:

The dump is the same as this guy's dump here: https://gbatemp.net/threads/pikofly...y-modchips-or-not.622701/page-8#post-10049937

They just added extra padding to the dump to make it more convincing. You ain't fooling nobody, kiddo.

View attachment 349743
he said that he received the file from the 4PDA user, most likely this is the same guy who threw off the first dump
 
Last edited by Doodka,
  • Like
Reactions: SylverReZ

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Xdqwerty @ Xdqwerty: