Hacking Hardware Picofly - a HWFLY switch modchip

darrin41

Well-Known Member
Member
Joined
Jan 13, 2016
Messages
408
Trophies
0
Age
49
XP
1,706
Country
United States
Well, all the same, people will call it pikofly when the firmware is finished and will work.
:)
Post automatically merged:


I would wait... but last time when I waited, sx was closed and there were no chips or they cost a million :/ so now the situation is different but...
Where can you buy these chips from . Thanks in advance
 

mrdude

Developer
Developer
Joined
Dec 11, 2015
Messages
3,071
Trophies
1
Age
56
XP
8,227
Where can you buy these chips from . Thanks in advance
You are probably better waiting for this to be cracked, then a new board will be released with resistors + flex cable points added. Once all the testing is completed and this thing is able to run homebrew properly, it's easy to make a modded board or even a board addon to include those extra components needed to make life easier.
 

icantfly

Well-Known Member
Newcomer
Joined
Dec 13, 2022
Messages
74
Trophies
0
Age
17
XP
536
Country
Portugal
already ordered couple mosfets from ebay, hope we can use original rpi pico instead of rp2040 mini
 

pixxel13

Member
Newcomer
Joined
Feb 5, 2023
Messages
14
Trophies
0
Age
26
XP
24
Country
Portugal
You are probably better waiting for this to be cracked, then a new board will be released with resistors + flex cable points added. Once all the testing is completed and this thing is able to run homebrew properly, it's easy to make a modded board or even a board addon to include those extra components needed to make life easier.
what resistors are we using? and where can I buy those resistors and the flex cable?
 

Tafty

Well-Known Member
Member
Joined
Sep 23, 2016
Messages
116
Trophies
0
Age
36
XP
923
Country
what resistors are we using? and where can I buy those resistors and the flex cable?
47 ohm you need 3, get smd ideally probably 1206 is the best size for this but I haven't acctually checked so don't quote me on that and cpu flex can be ordered from Ali express
 
  • Like
Reactions: binkinator

renoob

Active Member
Newcomer
Joined
Feb 6, 2023
Messages
42
Trophies
0
XP
157
Country
France
is 200259c8 the first byte?
Whole thing, by looking at SDK it seems to be an array (address to that array)
There is a function that does a lot :
Overclocks the chip to 333,
Gets unique_id,
and a lot more,
But its never called anywhere from the binary (maybe its in encrypted part), and setting breakpoint to it does do nothing. So I assume (since my rp is not soldered) this thing may be called later when chip is receiving some data ?
Anyway the function is at : 10015f60
 

saladus

Well-Known Member
Newcomer
Joined
Dec 26, 2022
Messages
95
Trophies
0
Location
your router's unprotected root shell
XP
170
Country
Romania
You can see the current ID as I've shown but the one stored for encryption cannot be found (at least I did not find anything in the ram). Its probably encrypted with the rest
i don't think it has one stored for encryption lmao, that'd be counterproductive. fw is already encrypted, it just reads it from memory and passes it to another function (that presumably decrypts it but i have no idea what it does). the bypass i did is so hilariously dumb that i doubt it'll work. also on the talk of encryption, we quite literally have the key :ha:
 

renoob

Active Member
Newcomer
Joined
Feb 6, 2023
Messages
42
Trophies
0
XP
157
Country
France
i don't think it has one stored for encryption lmao, that'd be counterproductive. fw is already encrypted, it just reads it from memory and passes it to another function (that presumably decrypts it but i have no idea what it does). the bypass i did is so hilariously dumb that i doubt it'll work. also on the talk of encryption, we quite literally have the key :ha:
Well it has to compare it doesn't it? In one form or another. But anyway yeah the right id is there so just a matter how to inject it
 

nerirififi

Well-Known Member
Member
Joined
Nov 18, 2015
Messages
160
Trophies
0
Age
43
XP
607
Country
France
We knows HWFLY flash BOOT0, anybody test to apply this patch for see wha't s happen with this chip , and if we can boot CFW ?

I have many flex, so for erista motherboard it s the same pin to solder to the flex ? Because this flex on the picture is for Mariko. And I don't have HWFLY LITE for verify myself
 

Attachments

  • RP-2040-Zero(lite).jpg
    RP-2040-Zero(lite).jpg
    589.2 KB · Views: 59

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    Xdqwerty @ Xdqwerty: good night