Hacking Hardware Picofly - a HWFLY switch modchip

evil_santa

Well-Known Member
Member
Joined
Jan 15, 2020
Messages
380
Trophies
1
Age
39
XP
1,860
Country
Germany

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
Try on fw.bin
firmware.bin is the raw dump. Flash firmware.uf2, do a
Code:
picotool save --all
and you'll find it's identical to firmware.bin.
you aren't going to have any luck decompiling the uf2 file. I tried to decrypt the binary file and while it worked, it seems they've done their homework and removed any useful information from that file. It would genuinely be easier to write your own.
From what I understand they're using the PIO on the rp2040 to perform the glitch instead of the fgpa on the hwfly boards
We don't need to decompile it if we can make it run. At that point someone could just reverse engineer it, as long as it's functioning (or use it as-is). Otherwise, you're just trying to reimplement the FPGA's functionality from scratch, and we don't have the bitstream or its source. If someone with one of these chips shares their dump AND their serial (also called unique ID) then we can move forward with this. Otherwise, there's nothing to be done, someone would have to determine exactly how the HWFLY FPGA works and write an RP2040 sketch that does the same thing.
 

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
that's exactly what i was asking myself. how the fuck did he do that? how does he communicate with the emmc (no level shifter)
you can take the starlink hack as an example but I can't really make sense of it.

https://github.com/KULeuven-COSIC/Starlink-FI
A level shifter is not needed, the eMMC is 3.3v tolerant.
well we  do kinda need to decompile it, considering the code is encrypted, we'd need to at least get past that
We don't need to decompile it to make it run if there's a way to spoof the unique ID at the bootloader level.
 

vittorio

Well-Known Member
Member
Joined
May 12, 2014
Messages
243
Trophies
1
Age
26
XP
988
Country
Italy
the fw is similar, obviously the fpga part for the glich is missing
Post automatically merged:

A level shifter is not needed, the eMMC is 3.3v tolerant.

We don't need to decompile it to make it run if there's a way to spoof the unique ID at the bootloader level.
do you think the control is in uf2?
 
Joined
Sep 9, 2019
Messages
904
Trophies
1
Location
Switch scene
Website
github.com
XP
2,663
Country
Korea, North
Won't work, it's not a check, it's decrypting the binary.
I was joking. I mean what you gonna do? Have an RP2040 to glitch an RP2040 just to glitch your Switch?

Well, let's see, considering I already paid $9 (including shipping) for two of them, yah!
OHHH I SEE
fetchimage
 

binkinator

Garfield’s Fitness Coach
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States
You guys should try using fault injection on the RP2040 to make the unique ID check pass
Ohhhh. You mean we could use another RP2040 to glitch the original RP2040!

This would be good for me because I bought 2 already!

Here's my artistic rendition of how that would look. There are some details that will need to be worked out for sure.

1675003784389.png


I added an extra battery to help augment the onboard battery for peak voltage when booting. With this many rPi 2040s it's gotta be taxing on the power system.

(in case anyone thinks this is serious...it is absolutely NOT. It's a joke and you are not to try this with your switch or you will surely burn your house down.)
Post automatically merged:

but then what glitches the Pi that glitches the Pi? :P
By god it's Glitch-ception!!!!
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • Veho @ Veho:
    I mean yeah sure but the specs are the same as a $50 model, it's just those pesky "quality of life" things driving up the price, like an actually working speaker, or buttons that don't melt, and stuff like that.
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    I think all in my Pi 4 was well north of 200 bucks 150ish for the Pi 4 the case the fancy cooler, then like 70 for the 500GB MicroSD then like 70 for the Xbox controller. But honestly it's a nice set up I really enjoy and to me was worth every penny. (even bought more controllers for 2 or 4 player games.) hmmm have never played any 2 player games yet :(
  • Veho @ Veho:
    Yeah that's what I hate about the RPi, it's supposedly $30 or something but it takes an additional $200 of accessories to actually turn it into a working something.
  • Psionic Roshambo @ Psionic Roshambo:
    yes that's the expensive part lol
  • Veho @ Veho:
    I mean sure it's flexible and stuff but so is uremum but it's fiddly.
  • Psionic Roshambo @ Psionic Roshambo:
    Yeah a lot of it I consider a hobby, using Batocera I am constantly adjusting the collection adding and removing stuff, scraping the artwork. Haven't even started on some music for the theme... Also way down the road I am considering attempting to do a WiiFlow knock off lol
  • Veho @ Veho:
    I want everything served on a plate plz ktnx, "work" is too much work for me.
  • Veho @ Veho:
    Hmm, with that in mind, maybe a complete out-the-box solution with all the games collected, pacthed and optimized for me would be worth $150 :unsure:
  • Psionic Roshambo @ Psionic Roshambo:
    Yeah it's all choice and that's a good thing :)
  • Bunjolio @ Bunjolio:
    animal crossing new leaf 11pm music
  • Bunjolio @ Bunjolio:
    avatars-kKKZnC8XiW7HEUw0-KdJMsw-t1080x1080.jpg
    wokey d pronouns
  • SylverReZ @ SylverReZ:
    What its like to do online shopping in 1998: https://www.youtube.com/watch?v=vwag5XE8oJo
  • BakerMan @ BakerMan:
    wokey d pronouns when woku walks in

    "CALL ME THEY SLASH THEEEEEEEEEEEEEEEEEEEEEEEEEEM"
  • AncientBoi @ AncientBoi:
    :tpi::rofl2::rofl2: Right on point :rofl2::rofl2::tpi:
    +2
  • Bunjolio @ Bunjolio:
    politics forum is def a place that exists
    +2
  • Bunjolio @ Bunjolio:
    lol
    +2
  • Psionic Roshambo @ Psionic Roshambo:
    "My party doesn't lie!!" ummm politician not lying? Has hell frozen over? lol
    +1
  • AncientBoi @ AncientBoi:
    Tries calling them
    +2
  • Psionic Roshambo @ Psionic Roshambo:
    Reach around and touch someone! AT&T!!!
    +1
  • AncientBoi @ AncientBoi:
    Especially me :D:evil::shy:
    +1
    AncientBoi @ AncientBoi: lol +1