Hacking Hardware Picofly - a HWFLY switch modchip

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
The one that made the first (?) firmware for the rp2040 for the Switch. That never got released. It's canned.
It was put to me that two different people developed a firmware for the rp2040.
The beta version which zecoxao wrote about and the one which pre-dates the beta version by a different unknown dev.
 
  • Like
Reactions: impeeza

linuxares

The inadequate, autocratic beast!
Global Moderator
Joined
Aug 5, 2007
Messages
13,302
Trophies
2
XP
18,145
Country
Sweden
It was put to me that two different people developed a firmware for the rp2040.
The beta version which zecoxao wrote about and the one which pre-dates the beta version by a different unknown dev.
Zeco? No he just posted a video he got sent. He haven't developed anything for the Switch as far as I know. He is in the Playstation scene right?
 

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
FncbbyeXEAAdUjU.jpeg


Another hwfly variant observed in its wild habitat!
Can anyone do me a massive favour and measure the thickness of a normal hwfly chip?
 
  • Like
Reactions: peteruk and impeeza

impeeza

¡Kabito!
Member
Joined
Apr 5, 2011
Messages
6,357
Trophies
3
Age
46
Location
At my chair.
XP
18,699
Country
Colombia
How much is it if you pay for your own shipping?
on the WaveShare the shipping to Colombia is 20 USD, so buying on amazon was a lot cheaper to me, I did buy 35 USD on different items and the shipping was free to Colombia.
Post automatically merged:

You bet!

Trying to catch up with everyone else in this thread that seems to know how to do everything already.

End goal is to get my device ID so if this thing every materializes I'll be ready...

Here's the next thing that stumped me for a bit while trying to get the pico-examples to compile (you might have breezed through this but I'm a nüb sometimes.)

DILLIGAF!

Code:
wwiii@wwiii-VAIO MSYS ~/projects/pico-examples/build
$ cmake ..
-- Building for: Ninja
Using PICO_SDK_PATH from environment ('C:/Users/wwiii/projects/pico-sdk/')
PICO_SDK_PATH is C:/Users/wwiii/projects/pico-sdk
Defaulting PICO_PLATFORM to rp2040 since not specified.
Defaulting PICO platform compiler to pico_arm_gcc since not specified.
-- Defaulting build type to 'Release' since not specified.
PICO compiler is pico_arm_gcc
CMake Error at C:/Users/wwiii/projects/pico-sdk/cmake/preload/toolchains/find_compiler.cmake:28 (message):
  Compiler 'arm-none-eabi-gcc' not found, you can specify search path with
  "PICO_TOOLCHAIN_PATH".
Call Stack (most recent call first):
  C:/Users/wwiii/projects/pico-sdk/cmake/preload/toolchains/pico_arm_gcc.cmake:20 (pico_find_compiler)
  C:/devkitPro/msys2/mingw64/share/cmake/Modules/CMakeDetermineSystem.cmake:124 (include)
  CMakeLists.txt:6 (project)


CMake Error: CMake was unable to find a build program corresponding to "Ninja".  CMAKE_MAKE_PROGRAM is not set.  You probably need to select a different build tool
.
CMake Error: CMAKE_C_COMPILER not set, after EnableLanguage
CMake Error: CMAKE_CXX_COMPILER not set, after EnableLanguage
CMake Error: CMAKE_ASM_COMPILER not set, after EnableLanguage
-- Configuring incomplete, errors occurred!

Install the following (and select all 4 packages)

Code:
pacman -S mingw-w64-x86_64-arm-none-eabi-toolchain

wwiii@wwiii-VAIO MSYS ~/projects/pico-examples
$ mkdir build; cd build

wwiii@wwiii-VAIO MSYS ~/projects/pico-examples/build
$ cmake ..
PICO_SDK_PATH is C:/Users/wwiii/projects/pico-sdk
PICO platform is rp2040.
-- The C compiler identification is GNU 12.2.0
-- The CXX compiler identification is GNU 12.2.0
-- The ASM compiler identification is GNU
-- Found assembler: C:/devkitPro/msys2/mingw64/bin/arm-none-eabi-gcc.exe
Build type is Release
Defaulting PICO target board to pico since not specified.
Using board configuration from C:/Users/wwiii/projects/pico-sdk/src/boards/include/boards/pico.h
-- Found Python3: C:/Users/wwiii/AppData/Local/Programs/Python/Python310/python.exe (found version "3.10.0") found components: Interpreter
TinyUSB available at C:/Users/wwiii/projects/pico-sdk/lib/tinyusb/src/portable/raspberrypi/rp2040; enabling build support for USB.
cyw43-driver available at C:/Users/wwiii/projects/pico-sdk/lib/cyw43-driver
lwIP available at C:/Users/wwiii/projects/pico-sdk/lib/lwip
-- Configuring done
-- Generating done
-- Build files have been written to: C:/Users/wwiii/projects/pico-examples/build
to get your Pico ID (the NOR Flash one) you have different methods:

Using Arduino Genuino
1674963182788.png

1674963283681.png



Or run this program on the Pico:

C:
#include "pico/unique_id.h"
String cadena;
String cadenaHex;

void setup() {
  Serial.begin(115200);
  while (!Serial) {
    ; // wait for serial port to connect. Needed for native USB port only
  }
  // send an intro:
  Serial.println("\n\nPico Unique Board ID:");
  Serial.println();
  // initialize digital pin LED_BUILTIN as an output.
  pinMode(LED_BUILTIN, OUTPUT);
}

// the loop function runs over and over again forever
void loop() {
  digitalWrite(LED_BUILTIN, HIGH);
  cadena = "";
  cadenaHex = "";
  pico_unique_board_id_t board_id;
  pico_get_unique_board_id(&board_id);
  for (int i = 0; i < PICO_UNIQUE_BOARD_ID_SIZE_BYTES; ++i) {
    cadena += String(" " + String(board_id.id[i], DEC));
    cadenaHex += String(" " + String(board_id.id[i], HEX));
  }
  Serial.println("Flash ID (int): " + cadena);
  Serial.println("Flash ID (hex): " + cadenaHex);
  delay(250);
  digitalWrite(LED_BUILTIN, LOW);
  delay(250);
}

then connect to computer and monitor the COM port of the connected pico, you will get something like:

1674963722947.png


This program DO NOT start running on the pico until you open a COM monitor :D
 
Last edited by impeeza,

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
binwalk

There's a blowfish-256 section as well. Here's the raw output:
DECIMAL HEXADECIMAL DESCRIPTION -------------------------------------------------------------------------------- 317964 0x4DA0C mcrypt 2.2 encrypted data, algorithm: blowfish-256, mode: CBC, keymode: 4bit 317971 0x4DA13 mcrypt 2.2 encrypted data, algorithm: blowfish-448, mode: CBC, keymode: 8bit
Interestingly, binwalk only sees these encrypted binary sections in the uf2, when flashed and then dumped it no longer detects anything- just pure binary.
 

shaunsingh0207

New Member
Newbie
Joined
Jan 28, 2023
Messages
2
Trophies
0
Age
23
XP
31
Country
United States
you aren't going to have any luck decompiling the uf2 file. I tried to decrypt the binary file and while it worked, it seems they've done their homework and removed any useful information from that file. It would genuinely be easier to write your own.
From what I understand they're using the PIO on the rp2040 to perform the glitch instead of the fgpa on the hwfly boards
 

binkinator

Garfield’s Fitness Coach
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States
on the WaveShare the shipping to Colombia is 20 USD, so buying on amazon was a lot cheaper to me, I did buy 35 USD on different items and the shipping was free to Colombia.
Post automatically merged:


to get your Pico ID (the NOR Flash one) you have different methods:

Using Arduino Genuino
View attachment 349912
View attachment 349913


Or run this program on the Pico:

C:
#include "pico/unique_id.h"
String cadena;
String cadenaHex;

void setup() {
  Serial.begin(115200);
  while (!Serial) {
    ; // wait for serial port to connect. Needed for native USB port only
  }
  // send an intro:
  Serial.println("\n\nPico Unique Board ID:");
  Serial.println();
  // initialize digital pin LED_BUILTIN as an output.
  pinMode(LED_BUILTIN, OUTPUT);
}

// the loop function runs over and over again forever
void loop() {
  digitalWrite(LED_BUILTIN, HIGH);
  cadena = "";
  cadenaHex = "";
  pico_unique_board_id_t board_id;
  pico_get_unique_board_id(&board_id);
  for (int i = 0; i < PICO_UNIQUE_BOARD_ID_SIZE_BYTES; ++i) {
    cadena += String(" " + String(board_id.id[i], DEC));
    cadenaHex += String(" " + String(board_id.id[i], HEX));
  }
  Serial.println("Flash ID (int): " + cadena);
  Serial.println("Flash ID (hex): " + cadenaHex);
  delay(250);
  digitalWrite(LED_BUILTIN, LOW);
  delay(250);
}

then connect to computer and monitor the COM port of the connected pico, you will get something like:

View attachment 349914

This program DO NOT start running on the pico until you open a COM monitor :D
Yeah…heh…that’s what I was uhhhh….going to try next. Had the code typed up and everything. Yeah…that’s the ticket.

1675000671448.jpeg


(Thanks buddy! It would have taken me quite a bit longer to get to that!)
 
  • Love
Reactions: impeeza

vittorio

Well-Known Member
Member
Joined
May 12, 2014
Messages
243
Trophies
0
Age
26
XP
960
Country
Italy
you aren't going to have any luck decompiling the uf2 file. I tried to decrypt the binary file and while it worked, it seems they've done their homework and removed any useful information from that file. It would genuinely be easier to write your own.
From what I understand they're using the PIO on the rp2040 to perform the glitch instead of the fgpa on the hwfly boards
actually maybe it's easier to write it than to decrypt it, but how does it work?
 
  • Like
Reactions: impeeza

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • Veho @ Veho:
    Talk about propaganda.
  • Veho @ Veho:
    Illinois is working to ban toxic food additives that have been banned for decades in other countries; additives that can be replaced and all those countries still have Skittles and Mountain Dew. Title of the piece: GUBMINT WANTS TO TAKE AWAY YOUR CANDY
  • Veho @ Veho:
    Gee, I wonder if the author is biased?
  • SylverReZ @ SylverReZ:
    @Veho, Sounds and smells like bullshit. They don't give you cancer, and California should know that. I don't get why they stick labels that say "may or may not cause reproductive harm or cancer".
  • Veho @ Veho:
    Arsenic doesn't give you cancer either.
    +2
  • Veho @ Veho:
    California has already banned those additives BTW.
    +2
  • Veho @ Veho:
    Psi has been banned in the state of California.
    +2
  • Psionic Roshambo @ Psionic Roshambo:
    I am the cancer!!! lol
  • Psionic Roshambo @ Psionic Roshambo:
    Yayyy got arcade games on the Pi working lol
  • Veho @ Veho:
    Cool.
  • Psionic Roshambo @ Psionic Roshambo:
    Now to spend 6 months deleting all the garbage lol
  • Psionic Roshambo @ Psionic Roshambo:
    Mame should be two sets one for preservation of everything and one set for people who just want to play and enjoy the old old ganes
  • SylverReZ @ SylverReZ:
    @Psionic Roshambo, Shouldn't preservation be legal tho?
    +1
  • SylverReZ @ SylverReZ:
    @Psionic Roshambo, I always see this dude's shorts, he sounds pretty annoying.
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    Preservation yeah it absolutely should be legal
    +1
  • SylverReZ @ SylverReZ:
    @Psionic Roshambo, Believe Japan was going to make it legal at some point, according to a Kotaku story.
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    I swear like 99% of arcade games wouldn't even exist these days outside of MAME the arcade machines are old and busted very few ever saw any sort of home conversion
  • Psionic Roshambo @ Psionic Roshambo:
    We get 37 versions of Super Mario Bros but 0 of Beast Busters
    +1
  • SylverReZ @ SylverReZ:
    @Psionic Roshambo, There's a lot of obscure Japanese arcade titles that are either lost to time or dumped.
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    It's so unfair, maybe AI can save us lol
  • Psionic Roshambo @ Psionic Roshambo:
    I mean if a company could use AI to do the work of a home conversion for essentially free why not? The rights for some games are completely lost though
  • SylverReZ @ SylverReZ:
    @Psionic Roshambo, AI is taking our jobs!
    +1
    Psionic Roshambo @ Psionic Roshambo: Lol