Hacking Hardware Picofly - a HWFLY switch modchip

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
The one that made the first (?) firmware for the rp2040 for the Switch. That never got released. It's canned.
It was put to me that two different people developed a firmware for the rp2040.
The beta version which zecoxao wrote about and the one which pre-dates the beta version by a different unknown dev.
 
  • Like
Reactions: impeeza

linuxares

The inadequate, autocratic beast!
Global Moderator
Joined
Aug 5, 2007
Messages
13,285
Trophies
2
XP
18,105
Country
Sweden
It was put to me that two different people developed a firmware for the rp2040.
The beta version which zecoxao wrote about and the one which pre-dates the beta version by a different unknown dev.
Zeco? No he just posted a video he got sent. He haven't developed anything for the Switch as far as I know. He is in the Playstation scene right?
 

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
FncbbyeXEAAdUjU.jpeg


Another hwfly variant observed in its wild habitat!
Can anyone do me a massive favour and measure the thickness of a normal hwfly chip?
 
  • Like
Reactions: peteruk and impeeza

impeeza

¡Kabito!
Member
Joined
Apr 5, 2011
Messages
6,320
Trophies
3
Age
46
Location
At my chair.
XP
18,570
Country
Colombia
How much is it if you pay for your own shipping?
on the WaveShare the shipping to Colombia is 20 USD, so buying on amazon was a lot cheaper to me, I did buy 35 USD on different items and the shipping was free to Colombia.
Post automatically merged:

You bet!

Trying to catch up with everyone else in this thread that seems to know how to do everything already.

End goal is to get my device ID so if this thing every materializes I'll be ready...

Here's the next thing that stumped me for a bit while trying to get the pico-examples to compile (you might have breezed through this but I'm a nüb sometimes.)

DILLIGAF!

Code:
wwiii@wwiii-VAIO MSYS ~/projects/pico-examples/build
$ cmake ..
-- Building for: Ninja
Using PICO_SDK_PATH from environment ('C:/Users/wwiii/projects/pico-sdk/')
PICO_SDK_PATH is C:/Users/wwiii/projects/pico-sdk
Defaulting PICO_PLATFORM to rp2040 since not specified.
Defaulting PICO platform compiler to pico_arm_gcc since not specified.
-- Defaulting build type to 'Release' since not specified.
PICO compiler is pico_arm_gcc
CMake Error at C:/Users/wwiii/projects/pico-sdk/cmake/preload/toolchains/find_compiler.cmake:28 (message):
  Compiler 'arm-none-eabi-gcc' not found, you can specify search path with
  "PICO_TOOLCHAIN_PATH".
Call Stack (most recent call first):
  C:/Users/wwiii/projects/pico-sdk/cmake/preload/toolchains/pico_arm_gcc.cmake:20 (pico_find_compiler)
  C:/devkitPro/msys2/mingw64/share/cmake/Modules/CMakeDetermineSystem.cmake:124 (include)
  CMakeLists.txt:6 (project)


CMake Error: CMake was unable to find a build program corresponding to "Ninja".  CMAKE_MAKE_PROGRAM is not set.  You probably need to select a different build tool
.
CMake Error: CMAKE_C_COMPILER not set, after EnableLanguage
CMake Error: CMAKE_CXX_COMPILER not set, after EnableLanguage
CMake Error: CMAKE_ASM_COMPILER not set, after EnableLanguage
-- Configuring incomplete, errors occurred!

Install the following (and select all 4 packages)

Code:
pacman -S mingw-w64-x86_64-arm-none-eabi-toolchain

wwiii@wwiii-VAIO MSYS ~/projects/pico-examples
$ mkdir build; cd build

wwiii@wwiii-VAIO MSYS ~/projects/pico-examples/build
$ cmake ..
PICO_SDK_PATH is C:/Users/wwiii/projects/pico-sdk
PICO platform is rp2040.
-- The C compiler identification is GNU 12.2.0
-- The CXX compiler identification is GNU 12.2.0
-- The ASM compiler identification is GNU
-- Found assembler: C:/devkitPro/msys2/mingw64/bin/arm-none-eabi-gcc.exe
Build type is Release
Defaulting PICO target board to pico since not specified.
Using board configuration from C:/Users/wwiii/projects/pico-sdk/src/boards/include/boards/pico.h
-- Found Python3: C:/Users/wwiii/AppData/Local/Programs/Python/Python310/python.exe (found version "3.10.0") found components: Interpreter
TinyUSB available at C:/Users/wwiii/projects/pico-sdk/lib/tinyusb/src/portable/raspberrypi/rp2040; enabling build support for USB.
cyw43-driver available at C:/Users/wwiii/projects/pico-sdk/lib/cyw43-driver
lwIP available at C:/Users/wwiii/projects/pico-sdk/lib/lwip
-- Configuring done
-- Generating done
-- Build files have been written to: C:/Users/wwiii/projects/pico-examples/build
to get your Pico ID (the NOR Flash one) you have different methods:

Using Arduino Genuino
1674963182788.png

1674963283681.png



Or run this program on the Pico:

C:
#include "pico/unique_id.h"
String cadena;
String cadenaHex;

void setup() {
  Serial.begin(115200);
  while (!Serial) {
    ; // wait for serial port to connect. Needed for native USB port only
  }
  // send an intro:
  Serial.println("\n\nPico Unique Board ID:");
  Serial.println();
  // initialize digital pin LED_BUILTIN as an output.
  pinMode(LED_BUILTIN, OUTPUT);
}

// the loop function runs over and over again forever
void loop() {
  digitalWrite(LED_BUILTIN, HIGH);
  cadena = "";
  cadenaHex = "";
  pico_unique_board_id_t board_id;
  pico_get_unique_board_id(&board_id);
  for (int i = 0; i < PICO_UNIQUE_BOARD_ID_SIZE_BYTES; ++i) {
    cadena += String(" " + String(board_id.id[i], DEC));
    cadenaHex += String(" " + String(board_id.id[i], HEX));
  }
  Serial.println("Flash ID (int): " + cadena);
  Serial.println("Flash ID (hex): " + cadenaHex);
  delay(250);
  digitalWrite(LED_BUILTIN, LOW);
  delay(250);
}

then connect to computer and monitor the COM port of the connected pico, you will get something like:

1674963722947.png


This program DO NOT start running on the pico until you open a COM monitor :D
 
Last edited by impeeza,

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
binwalk

There's a blowfish-256 section as well. Here's the raw output:
DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 317964 0x4DA0C mcrypt 2.2 encrypted data, algorithm: blowfish-256, mode: CBC, keymode: 4bit 317971 0x4DA13 mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
Interestingly, binwalk only sees these encrypted binary sections in the uf2, when flashed and then dumped it no longer detects anything- just pure binary.
 

shaunsingh0207

New Member
Newbie
Joined
Jan 28, 2023
Messages
2
Trophies
0
Age
23
XP
31
Country
United States
you aren't going to have any luck decompiling the uf2 file. I tried to decrypt the binary file and while it worked, it seems they've done their homework and removed any useful information from that file. It would genuinely be easier to write your own.
From what I understand they're using the PIO on the rp2040 to perform the glitch instead of the fgpa on the hwfly boards
 

binkinator

Garfield’s Fitness Coach
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States
on the WaveShare the shipping to Colombia is 20 USD, so buying on amazon was a lot cheaper to me, I did buy 35 USD on different items and the shipping was free to Colombia.
Post automatically merged:


to get your Pico ID (the NOR Flash one) you have different methods:

Using Arduino Genuino
View attachment 349912
View attachment 349913


Or run this program on the Pico:

C:
#include "pico/unique_id.h"
String cadena;
String cadenaHex;

void setup() {
  Serial.begin(115200);
  while (!Serial) {
    ; // wait for serial port to connect. Needed for native USB port only
  }
  // send an intro:
  Serial.println("\n\nPico Unique Board ID:");
  Serial.println();
  // initialize digital pin LED_BUILTIN as an output.
  pinMode(LED_BUILTIN, OUTPUT);
}

// the loop function runs over and over again forever
void loop() {
  digitalWrite(LED_BUILTIN, HIGH);
  cadena = "";
  cadenaHex = "";
  pico_unique_board_id_t board_id;
  pico_get_unique_board_id(&board_id);
  for (int i = 0; i < PICO_UNIQUE_BOARD_ID_SIZE_BYTES; ++i) {
    cadena += String(" " + String(board_id.id[i], DEC));
    cadenaHex += String(" " + String(board_id.id[i], HEX));
  }
  Serial.println("Flash ID (int): " + cadena);
  Serial.println("Flash ID (hex): " + cadenaHex);
  delay(250);
  digitalWrite(LED_BUILTIN, LOW);
  delay(250);
}

then connect to computer and monitor the COM port of the connected pico, you will get something like:

View attachment 349914

This program DO NOT start running on the pico until you open a COM monitor :D
Yeah…heh…that’s what I was uhhhh….going to try next. Had the code typed up and everything. Yeah…that’s the ticket.

1675000671448.jpeg


(Thanks buddy! It would have taken me quite a bit longer to get to that!)
 
  • Love
Reactions: impeeza

vittorio

Well-Known Member
Member
Joined
May 12, 2014
Messages
243
Trophies
0
Age
26
XP
956
Country
Italy
you aren't going to have any luck decompiling the uf2 file. I tried to decrypt the binary file and while it worked, it seems they've done their homework and removed any useful information from that file. It would genuinely be easier to write your own.
From what I understand they're using the PIO on the rp2040 to perform the glitch instead of the fgpa on the hwfly boards
actually maybe it's easier to write it than to decrypt it, but how does it work?
 
  • Like
Reactions: impeeza

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    ButterScott101 @ ButterScott101: +1