Hacking Hardware Picofly - a HWFLY switch modchip

marhalloweenvt · Jan 28, 2023

If anyone gets the following error:

Code:

wwiii@wwiii-VAIO MSYS ~/picotool/build
$ cmake -G "MSYS Makefiles" -DPC_LIBUSB_INCLUDEDIR="/mingw64/include/libusb-1.0" ..
CMake Error: Could not create named generator MSYS Makefiles

Yeah, those errors are really annoying with Mingw. I faced it many times when ever I use Mingw on Window environment. My another hobby requires lots of Linux based system to produce FW file. For times, I have set-up a Linux machine act as server with multipurpose and service for ease of mind.

impeeza · Jan 28, 2023

binkinator said:

If anyone gets the following error:

Code:

wwiii@wwiii-VAIO MSYS ~/picotool/build
$ cmake -G "MSYS Makefiles" -DPC_LIBUSB_INCLUDEDIR="/mingw64/include/libusb-1.0" ..
CMake Error: Could not create named generator MSYS Makefiles

Generators
* Unix Makefiles = Generates standard UNIX makefiles.
Ninja = Generates build.ninja files.
Ninja Multi-Config = Generates build-<Config>.ninja files.
CodeBlocks - Ninja = Generates CodeBlocks project files.
CodeBlocks - Unix Makefiles = Generates CodeBlocks project files.
CodeLite - Ninja = Generates CodeLite project files.
CodeLite - Unix Makefiles = Generates CodeLite project files.
Eclipse CDT4 - Ninja = Generates Eclipse CDT 4.0 project files.
Eclipse CDT4 - Unix Makefiles= Generates Eclipse CDT 4.0 project files.
Kate - Ninja = Generates Kate project files.
Kate - Unix Makefiles = Generates Kate project files.
Sublime Text 2 - Ninja = Generates Sublime Text 2 project files.
Sublime Text 2 - Unix Makefiles
= Generates Sublime Text 2 project files.


wwiii@wwiii-VAIO MSYS ~/picotool/build
$ which cmake
/usr/bin/cmake

wwiii@wwiii-VAIO MSYS ~/picotool/build

It's because regular cmake has priority in your path over the mingw version.

Try this to fix it:

Code:

wwiii@wwiii-VAIO MSYS ~/picotool/build
$ export PATH=/mingw64/bin:$PATH

wwiii@wwiii-VAIO MSYS ~/picotool/build
$ which cmake
/mingw64/bin/cmake

wwiii@wwiii-VAIO MSYS ~/picotool/build
$ cmake -G "MSYS Makefiles" -DPC_LIBUSB_INCLUDEDIR="/mingw64/include/libusb-1.0" ..

Thank you so much buddy, copying this information on my personal record

binkinator · Jan 28, 2023

ghjfdtg said:
Didn't look for the JEDEC standard describing these IDs (paywalled) but it's likely 32 bits serial number and everything else is manufacturer id and production date. Not very random at all.

I'm surprised the ID structure is not in the (636 page!) data sheet:
https://datasheets.raspberrypi.com/rp2040/rp2040-datasheet.pdf

That's a BIG bitch! -Duce Bigelow

FruithatMods · Jan 28, 2023

An undocumented function?

binkinator · Jan 28, 2023

impeeza said:
Thank you so much buddy, copying this information on my personal record

You bet!

Trying to catch up with everyone else in this thread that seems to know how to do everything already.

End goal is to get my device ID so if this thing every materializes I'll be ready...

Here's the next thing that stumped me for a bit while trying to get the pico-examples to compile (you might have breezed through this but I'm a nüb sometimes.)

DILLIGAF!

Code:

wwiii@wwiii-VAIO MSYS ~/projects/pico-examples/build
$ cmake ..
-- Building for: Ninja
Using PICO_SDK_PATH from environment ('C:/Users/wwiii/projects/pico-sdk/')
PICO_SDK_PATH is C:/Users/wwiii/projects/pico-sdk
Defaulting PICO_PLATFORM to rp2040 since not specified.
Defaulting PICO platform compiler to pico_arm_gcc since not specified.
-- Defaulting build type to 'Release' since not specified.
PICO compiler is pico_arm_gcc
CMake Error at C:/Users/wwiii/projects/pico-sdk/cmake/preload/toolchains/find_compiler.cmake:28 (message):
  Compiler 'arm-none-eabi-gcc' not found, you can specify search path with
  "PICO_TOOLCHAIN_PATH".
Call Stack (most recent call first):
  C:/Users/wwiii/projects/pico-sdk/cmake/preload/toolchains/pico_arm_gcc.cmake:20 (pico_find_compiler)
  C:/devkitPro/msys2/mingw64/share/cmake/Modules/CMakeDetermineSystem.cmake:124 (include)
  CMakeLists.txt:6 (project)


CMake Error: CMake was unable to find a build program corresponding to "Ninja".  CMAKE_MAKE_PROGRAM is not set.  You probably need to select a different build tool
.
CMake Error: CMAKE_C_COMPILER not set, after EnableLanguage
CMake Error: CMAKE_CXX_COMPILER not set, after EnableLanguage
CMake Error: CMAKE_ASM_COMPILER not set, after EnableLanguage
-- Configuring incomplete, errors occurred!

Install the following (and select all 4 packages)

Code:

pacman -S mingw-w64-x86_64-arm-none-eabi-toolchain

wwiii@wwiii-VAIO MSYS ~/projects/pico-examples
$ mkdir build; cd build

wwiii@wwiii-VAIO MSYS ~/projects/pico-examples/build
$ cmake ..
PICO_SDK_PATH is C:/Users/wwiii/projects/pico-sdk
PICO platform is rp2040.
-- The C compiler identification is GNU 12.2.0
-- The CXX compiler identification is GNU 12.2.0
-- The ASM compiler identification is GNU
-- Found assembler: C:/devkitPro/msys2/mingw64/bin/arm-none-eabi-gcc.exe
Build type is Release
Defaulting PICO target board to pico since not specified.
Using board configuration from C:/Users/wwiii/projects/pico-sdk/src/boards/include/boards/pico.h
-- Found Python3: C:/Users/wwiii/AppData/Local/Programs/Python/Python310/python.exe (found version "3.10.0") found components: Interpreter
TinyUSB available at C:/Users/wwiii/projects/pico-sdk/lib/tinyusb/src/portable/raspberrypi/rp2040; enabling build support for USB.
cyw43-driver available at C:/Users/wwiii/projects/pico-sdk/lib/cyw43-driver
lwIP available at C:/Users/wwiii/projects/pico-sdk/lib/lwip
-- Configuring done
-- Generating done
-- Build files have been written to: C:/Users/wwiii/projects/pico-examples/build

JackTheHorse · Jan 28, 2023

If it's fake don't buy it.

TheSynthax · Jan 28, 2023

Mr Skinner · Jan 28, 2023

eseldiem said:
Honestly, it’s weird. More info and/or uncut video of this thing booting, or it didn’t happen

I had the same feeling with the emmc interface assembly. The correct thing would be to use a pin for voltage control. I still doubt it, because there are pins that are not consistently explained in the assembly (everything is encrypted, so no conclusions) But I don't think it's fake, I'm just curious about the kind of "trick" the dev would have used to flash with custom bootcode with so much limitation. We know it's possible to convert syntax to binary, but could the 2040 REALLY have write access make any like that?

In any case, if it works, I am extremely happy, not so much for the result, but for feeling the amount of effort involved in solving these logical problems.

ghjfdtg · Jan 28, 2023

binkinator said:
I'm surprised the ID structure is not in the (636 page!) data sheet:
https://datasheets.raspberrypi.com/rp2040/rp2040-datasheet.pdf

That's a BIG bitch! -Duce Bigelow

Because it's the datasheet for the microcontroller and not the SPI flash chip the ID is read from.

binkinator · Jan 28, 2023

ghjfdtg said:
Because it's the datasheet for the microcontroller and not the SPI flash chip the ID is read from.

Ah. Makes sense. Appreciate the hint. I was up to page 75...guess I can stop now. Shits dryer than Michener fr tho.

TheSynthax · Jan 28, 2023

unable to find a datasheet for that SPI NOR, top of the chip reads "1p138 0q24fg" probably can't change the unique ID of it anyway, but who knows?

FruithatMods · Jan 28, 2023

Link to the pico ID documentation. It is the first result in startpage.com

https://raspberrypi.github.io/pico-sdk-doxygen/group__pico__unique__id.html

ghjfdtg · Jan 28, 2023

The flash used on the Pico boards is Winbond W25Q080 according to the SDK. Strangely there are only datasheets for W25Q80 without the extra 0. Close enough i guess. Capacity is 16 megabit.

Note that this may differ from what the author of the leaked firmware used. But the ID format description should still be useful.

TheSynthax · Jan 28, 2023

ghjfdtg said:
The flash used on the Pico boards is Winbond W25Q080 according to the SDK. Strangely there are only datasheets for W25Q80 without the extra 0. Close enough i guess.

Might the Zero be using a different model of flash chip?

ghjfdtg · Jan 28, 2023

You can check these headers for officially supported boards. Some boards only have generic flash stage2 bootloaders.
https://github.com/raspberrypi/pico-sdk/tree/master/src/boards/include/boards

TheSynthax · Jan 28, 2023

ghjfdtg said:
You can check these headers for officially supported boards. Some boards only have generic flash stage2 bootloaders.
https://github.com/raspberrypi/pico-sdk/tree/master/src/boards/include/boards

hmm, looks like it is indeed the W25Q080 on these.

FruithatMods · Jan 28, 2023

Who here would buy one of these chips? Would you pay 10€ for one?

TheSynthax · Jan 28, 2023

FruithatMods said:
Who here would buy one of these chips? Would you pay 10€ for one?

I'm sure you'd find an enormous number of people would pay 10€ for a functional Pico-based glitch chip.

saladus · Jan 28, 2023

rather than the wild goose chase with the flash id it'd be better to try to decrypt it in vitro, but that sounds herculean in and of itself

SylverReZ · Jan 28, 2023

FruithatMods said:
Who here would buy one of these chips? Would you pay 10€ for one?

Pico chips aren't that much, they sell for very little. I'd say 5€ is enough for what you're getting.

Hacking Hardware Picofly - a HWFLY switch modchip

Well-Known Member

¡Kabito!

Garfield’s Fitness Coach

Well-Known Member

Garfield’s Fitness Coach

Active Member

Well-Known Member

Well-Known Member

Well-Known Member

Garfield’s Fitness Coach

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

The planet is fine. The people are crazy.

Similar threads

Popular threads in this forum