Hacking Hardware Picofly - a HWFLY switch modchip

FruithatMods · Feb 3, 2023

Project File Name: firmware.bin
Last Modified: Fri Feb 03 18:35:59 CET 2023
Readonly: false
Program Name: firmware.bin

Minimum Address: 00000000
Maximum Address: 00014cff
# of Bytes: 85248
# of Memory Blocks: 1
# of Instructions: 0
# of Defined Data: 0
# of Functions: 0
# of Symbols: 17
# of Data Types: 0
# of Data Type Categories: 1

Executable MD5: d40587baee6549652a2ca0e9dec0e307
Executable SHA256: 0343c6fd1ba1ff773dbcc688a14c55dc61fef4df96a294366c4f33c5d4c84abc

These are the hashes of the file from the other thread.
Is this the same one as the previous leak?

Post automatically merged: Feb 3, 2023

I decompiled the firmware from the YouTube video. These are ALL the readable strings using the same decompilation method as the guy does in the video. There is nothing more to it.

Perhaps someone who is more knowledgeable can comment on this.

impeeza · Feb 3, 2023

FruithatMods said:
Project File Name: firmware.bin
Last Modified: Fri Feb 03 18:35:59 CET 2023
Readonly: false
Program Name: firmware.bin

Minimum Address: 00000000
Maximum Address: 00014cff
# of Bytes: 85248
# of Memory Blocks: 1
# of Instructions: 0
# of Defined Data: 0
# of Functions: 0
# of Symbols: 17
# of Data Types: 0
# of Data Type Categories: 1

Executable MD5: d40587baee6549652a2ca0e9dec0e307
Executable SHA256: 0343c6fd1ba1ff773dbcc688a14c55dc61fef4df96a294366c4f33c5d4c84abc

These are the hashes of the file from the other thread.
Is this the same one as the previous leak?

Post automatically merged: Feb 3, 2023

I decompiled the firmware from the YouTube video. These are ALL the readable strings using the same decompilation method as the guy does in the video. There is nothing more to it.

Perhaps someone who is more knowledgeable can comment on this.

the file from YT and mediafire is bit at bit equal to the one on the start of thread.

peteruk · Feb 3, 2023

The collaboration of community dev's, engineers and all round try hard's working on this together with no thought of monetry gain is what I love about this community.... it so often gets called toxic, but this is what happens when clever people work together - it benefits everyone..

It reminds me of days gone by when Dark Samus, plailect and all those other cool people worked publicly on arm9loaderhax, screen init functions and tons of other stuff on freenode (irc).... not just that but they encouraged normies to join up and always made you feel a part of things (really happy memories)

FruithatMods · Feb 3, 2023

Here is the decompiled file in C from the original leak which is the same as the YouTube video.

Post automatically merged: Feb 3, 2023

ByteFun said:
The first thing the startup code does is initialize the hardware, copy the contents of flash memory into RAM, and start the main function. We get the identifier of the flash memory. The chip voltage rises and the clock frequency rises to 333 MHz. In this mode, we can no longer work with flash memory. Perhaps the decryption algorithm expands the flash ID as a key into block 0x100, but perhaps this is the context for the decryptor.

Can you point me to the location in the disassembled code when this occurs? I know there is a string at 00002947 which is related to this function.

When I was researching how to code the firmware from scratch I hypothesised that it is likely that we will need to overclock the rp2040 for it to be fast enough to sniff the emmc signals. The reason why it is loading the code into iram is because the flash chip can only operate at about 300mhz before it refuses to work. The rp2040 can be pushed to about 400mhz.

AntonIX · Feb 3, 2023

Hey, just found leaked sources about how hwfly works.

Post automatically merged: Feb 3, 2023

Also I read on 4pda thats fpga used to fastly generate rsa keys to emulate cartridge. I am not completely understand what does it mean. Looks like it is wrong machine translate.

Doodka · Feb 4, 2023

Tafty said:
yeh that was me, sorry i didnt see your question i just used the uf2 provided.

You can try upload it through picotool, and verify firmware with it

Post automatically merged: Feb 4, 2023

AntonIX said:
Hey, just found leaked sources about how hwfly works.

Post automatically merged: Feb 3, 2023

Also I read on 4pda thats fpga used to fastly generate rsa keys to emulate cartridge. I am not completely understand what does it mean. Looks like it is wrong machine translate.

Can you give a link to this phrase?
I found only about emulating cartridge slot, but I don't understand why this is necessary

AntonIX · Feb 4, 2023

Doodka said:
You can try upload it through picotool, and verify firmware with it

Post automatically merged: Feb 4, 2023

Can you give a link to this phrase?
I found only about emulating cartridge slot, but I don't understand why this is necessary

https://4pda.to/forum/index.php?showtopic=900987&view=findpost&p=106663520
It is use fpga and loading xci in 0.2 ms delay. Alsmost the same time. They suggest that it may be changing the mode of operation.

Piorjade · Feb 4, 2023

I got a question regarding the CLK pin that the HWFLY/SXCore use, do the chips generate the clock signal themselves or does the CLK signal come from the Switch SoC?

vittorio · Feb 4, 2023

can anyone test the leaked fw

saladus · Feb 4, 2023

vittorio said:
can anyone test the leaked fw

already been tested dude, doesn't work

FruithatMods · Feb 4, 2023

Piorjade said:
I got a question regarding the CLK pin that the HWFLY/SXCore use, do the chips generate the clock signal themselves or does the CLK signal come from the Switch SoC?

Usually it is both, but not at the same time. Whatever is talking to the emmc generates the CLK.

When the hwfly is just listening the switch soc should be producing the signal.

Piorjade · Feb 4, 2023

FruithatMods said:
Usually it is both, but not at the same time. Whatever is talking to the emmc generates the CLK.

When the hwfly is just listening the switch soc should be producing the signal.

Alright, so in the payload flashing process we generate it ourselves, got it.

vittorio · Feb 4, 2023

saladus said:
already been tested dude, doesn't work

did you flash uf2 and put firmware.bin in micro sd?

saladus · Feb 4, 2023

vittorio said:
did you flash uf2 and put firmware.bin in micro sd?

wdym, I'm pretty sure uf2 and bing go on the pico and you put hekate as payload.bin on the sd. regardless, i haven't done this, another person in the thread did

impeeza · Feb 4, 2023

saladus said:
wdym, I'm pretty sure uf2 and bing go on the pico and you put hekate as payload.bin on the sd. regardless, i haven't done this, another person in the thread did

yes the bin on the Pico (or the UF2) and hekate on the console's SD will work on the original pico, because the firmware is mostly encrypted.

vittorio · Feb 4, 2023

you say this fw has control id?

impeeza · Feb 4, 2023

vittorio said:
you say this fw has control id?

that seems

saladus · Feb 4, 2023

vittorio said:
you say this fw has control id?

the consensus is that it's encrypted using the pico's flash id

FruithatMods · Feb 4, 2023

saladus said:
the consensus is that it's encrypted using the pico's flash id

It does check for the pico id. We should ask @ByteFun what he thinks though. It seems like he understands assembly enough to know what the code does.

The reason why that is the concensus is because someone here analysed the uf2 file with a tool which shows there are two regions in the file that contain data which is encrypted with blowfish. I ran the same tool on both the uf2 and the bin file. No such encrypted regions are present in the bin file. I can confirm the findings of the uf2 file.

vittorio · Feb 4, 2023

https://github.com/wyattearp/ghidra_uf2loader on ghidra you can try this

Post automatically merged: Feb 4, 2023

i think the (bool)isCurrentModePrivileged() method blocks by id

Post automatically merged: Feb 4, 2023

https://forums.raspberrypi.com/viewtopic.php?t=336409

Post automatically merged: Feb 4, 2023

can anyone try this

Hacking Hardware Picofly - a HWFLY switch modchip

Well-Known Member

Attachments

¡Kabito!

Well-Known Member

Well-Known Member

Attachments

Active Member

Attachments

Active Member

Active Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

¡Kabito!

Well-Known Member

¡Kabito!

Well-Known Member

Well-Known Member

Well-Known Member

Attachments

Similar threads

Popular threads in this forum