Hacking Hardware Picofly - a HWFLY switch modchip

renoob

Active Member
Newcomer
Joined
Feb 6, 2023
Messages
42
Trophies
0
XP
157
Country
France
I'm personally only any good at RE when I have source or at least a legible decompilation.
Having to get into disassembly is outside my wheelhouse.
see unique_id in pico-examples its literally it. You have code and when you compile it you get also .dis file where you can see what its doing (which is literal 1:1 copy of functions in this FW)
 

hippy dave

BBMB
Member
Joined
Apr 30, 2012
Messages
9,868
Trophies
2
XP
29,064
Country
United Kingdom
Holding both vol buttons triggers it to boot to hos all be it stock? 🤔

I wonder......
Presumably that prevents it from doing the glitching so the Switch uses one of the unmodified copies of the thing (bct?), after verifying the custom copies fails, so you just get a normal clean boot from that point. I don't think there's much to pursue in that direction in terms of fixing the custom boot.
 
  • Like
Reactions: binkinator

thesjaakspoiler

Well-Known Member
Member
Joined
Nov 20, 2018
Messages
973
Trophies
0
Age
124
XP
1,481
Country
Afghanistan
Well since this is the ID of the chip, maybe it can be spoofed now (really out of my knowledge scope).

If its possible to inject this id into that address (someone with arm asm knowledge would need to do it) maybe it will run.
The Pico has no unique chip id. This is what the documentation says :

RP2040 does not have an on-board unique identifier (all instances of RP2040 silicon are identical and have no persistent state). However, RP2040 boots from serial NOR flash devices which have a 64-bit unique ID as a standard feature, and there is a 1:1 association between RP2040 and flash, so this is suitable for use as a unique identifier for an RP2040-based board.

https://raspberrypi.github.io/pico-sdk-doxygen/group__pico__unique__id.html
 

binkinator

Garfield’s Fitness Coach
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States
This diagram and to solder chip in v1 and v2?

someone has diagram for V1 and V2? I want to try,
Thanks

This post has the chip pin outs: https://gbatemp.net/threads/pikofly-a-probably-fake-hwfly-modchips-or-not.622701/post-10066639

This post has points to attach on emmc: https://gbatemp.net/threads/pikofly-a-probably-fake-hwfly-modchips-or-not.622701/post-10067546
This post is similar to the above points on emmc: https://gbatemp.net/threads/pikofly-a-probably-fake-hwfly-modchips-or-not.622701/post-10067582
 

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
Waiting on CPU flex, arrives this week. Excuse the actual swamps of flux, I haven't run it through the board cleaner after reballing the CPU and RAM, and the filthy housing is from some sticky sh!t from the previous owner (who sold it as broken)

BTW, buttons and type-C port are far too thick to fit in the Lite. they'll need to be removed, and we might want to run USB lines to the Switch's type-C port like with SAMD21 chips, and maybe even connect the Switch's vol+ line in place of the BOOT button, just in case we ever need to update the firmware on the RP2040. Given that the Switch isn't terribly far from EoL, and these just load whatever is on the SD, I'm sure that once we have a proper BCT and SD loader there will be no need to update. Even more so due to the fact that the firmware seems to already support dual booting just by holding both vol buttons, but ideally there would be stored boot default like with SAMD21.
 

Attachments

  • IMG_0070.jpeg
    IMG_0070.jpeg
    1,009.3 KB · Views: 90
Last edited by TheSynthax,
  • Like
Reactions: FruithatMods

Brunh

Active Member
Newcomer
Joined
Apr 15, 2022
Messages
30
Trophies
0
Age
37
Location
Toronto, ON, Canada
XP
190
Country
Canada

binkinator

Garfield’s Fitness Coach
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States

binkinator

Garfield’s Fitness Coach
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States
Anyone know of a source of just the flex cables other than aliexpress?
Right next to the modchips that aren’t from Aliexpress…oh wait.

e: might be able to find an installer with a spare set from a failed install or something but it’s going to be one off.
 

vittorio

Well-Known Member
Member
Joined
May 12, 2014
Messages
243
Trophies
0
Age
26
XP
960
Country
Italy
Can anyone convert this to bin me, I don't have a pico currently
 

Attachments

  • FlashE6_61_1C_B7_1F_32_68_29(Mariko_and_Erista).rar
    90.4 KB · Views: 23

nerirififi

Well-Known Member
Member
Joined
Nov 18, 2015
Messages
160
Trophies
0
Age
43
XP
607
Country
France
For recapitulate.

We have firmware for erista and Mariko.

All rp040 works it s a unique version.
If I got cpu flex erista and mariko does I need to buy the moffset.
We need 47ohm resistor for 3 points

I will test I got many flex, so what s happen if we update the switch, the rp040 need an update I guess ?
 

Mansi

Well-Known Member
Newcomer
Joined
Jan 14, 2023
Messages
70
Trophies
0
Age
30
XP
331
Country
Belarus
Can anyone convert this to bin me, I don't have a pico currently
You can do it yourself, manually. Just remove the bootloader header.
Code:
55 46 32 0A 57 51 5D 9E 00 20 00 00 00 00 00 10 00 01 00 00 00 00 00 00 00 20 00 00 56 FF 8B E4
and
Code:
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 6F B1 0A 55 46 32 0A 57 51 5D 9E 00 20 00 00 00 01 00 10 00 01 00 00 01 00 00 00 00 20 00 00 56 FF 8B E4
and next...
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    Veho @ Veho: The cybertruck is a death trap.