Hacking Hardware Picofly - a HWFLY switch modchip

doom95 · Mar 20, 2023

interesting, thanks

Adran_Marit · Mar 20, 2023

Phantomas77 said:
I've a spare CPU flex from HWFLY, should it be ok to use, or would I need thicker wiring as mentioned by rehius?

Cpu flex is fine

rehius · Mar 20, 2023

flynnsmt4 said:
We then have readWriteOrCall, which, based on the input

that was my own arithmetic compression algorithm used to fit more commands

hippy dave · Mar 20, 2023

So same firmware works on v1, v2, Lite and OLED? (Is it basically the same for all Mariko models?) Amazing job either way, and huge thanks for sharing.

RealYoti · Mar 20, 2023

rehius said:
run picofly_tb from Hekate

So, it's pikofly or picofly?

danielglzt88 · Mar 20, 2023

rehius said:
Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success

View attachment 357132
View attachment 357133
View attachment 357135
View attachment 357134
View attachment 357136

View attachment 357137
View attachment 357138
View attachment 360187
View attachment 357139
View attachment 357140
View attachment 360186

Q: What supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Very sensitive NS. add 20K-30K to RST

Q: Need resistors?
A: SysNAND will not work. Line interference. Only emuMMC.

Q: Chip reset? Learning?
A: Short pin 0 to either 1 or GND. Reset internal statistics.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card

It's a great job, congratulations. just one question, will you have a variant for the Rasperry Pi Pico in the future? Thanks anyway, my repeated congratulations.

Dee87 · Mar 20, 2023

instead of soldering everything to the emmc chip itself i decided to solder it to the emmc connector on the board

Saliciae · Mar 20, 2023

Been following this for a while, amazing work by rehius. Hugely impressive

rehius · Mar 20, 2023

Dee87 said:
View attachment 360114 View attachment 360115

just playing around with some donor boards what solution should i use ?

Post automatically merged: Mar 19, 2023

yeah thats true bulk is the way to go....
still gonna try and create a pcb and then ill check on it again and see how much bulk is and maybe just buy bulk and offer them for picofly we will see

never used pcbway only jlcpcb and never had issues with them

the second one looks cleaner. don't forget to apply green mask on the square pad right under the wire, it's GND

Post automatically merged: Mar 20, 2023

RealYoti said:
So, it's pikofly or picofly?

picofly, no idea where the OP got 'k'

Post automatically merged: Mar 20, 2023

Dee87 said:
View attachment 360216

instead of soldering everything to the emmc chip itself i decided to solder it to the emmc connector on the board

yes, I used the same way. can replace memory much faster

Post automatically merged: Mar 20, 2023

danielglzt88 said:
It's a great job, congratulations. just one question, will you have a variant for the Rasperry Pi Pico in the future? Thanks anyway, my repeated congratulations.

no such plans, it's too large to fit

ppeach · Mar 20, 2023

Congratulations!

What is appropriate for "SMD Resistor" and "mosfet" respectively?

binkinator · Mar 20, 2023

rehius said:
The 'Atmosphere Unlock' part has been added to the main post
to prevent possible partial / badly unlocked firmwares causing damage to a console.

My congratulations with the security bypass, flynnsmt4!

O
M
G
!!!!

I don’t know if I’m ludicrous or ecstatic!
I’m ludicrous! No, I’m ecstatic! No, wait, I’m ludicrous!
Wow man! Just wow!
@rehius @flynnsmt4 @Everybody

Post automatically merged: Mar 20, 2023

rcpd said:
@rehius

Well done friend! Very well done! I guess this means my attempt is no longer worthwhile.

Don’t fret though! I plan to continue simply for the knowledge. Will you still be able to give help?

I’m not telling my wife about this so she will still get me the Logic Analyzer! I’m still in for the knowledge!

It’s official! I’ve changed my vote!

Assidefok · Mar 20, 2023

rehius said:
The 'Atmosphere Unlock' part has been added to the
to prevent possible partial / badly unlocked firmwares causing damage to a console.

My congratulations with the security bypass, flynnsmt4

rehius said:
The 'Atmosphere Unlock' part has been added to the
to prevent possible partial / badly unlocked firmwares causing damage to a console.

My congratulations with the security bypass, flynnsmt4!

You rock!!

binkinator · Mar 20, 2023

A graphical reminder about soldering points for everyone just coming into this thread:

https://gbatemp.net/threads/pikofly-a-probably-fake-hwfly-modchips-or-not.622701/post-10066639

Dee87 · Mar 20, 2023

binkinator said:
O
M
G
!!!!

I don’t know if I’m ludicrous or ecstatic!
I’m ludicrous! No, I’m ecstatic! No, wait, I’m ludicrous!
Wow man! Just wow!
@rehius @flynnsmt4 @Everybody

View attachment 360219

Post automatically merged: Mar 20, 2023

I’m not telling my wife about this so she will still get me the Logic Analyzer! I’m still in for the knowledge!

Wow he replied I really thought he would get arrested for running naked through the streets while screaming: he released it he did it :rofl2:

binkinator · Mar 20, 2023

Dee87 said:
Wow he replied I really thought he would get arrested for running naked through the streets while screaming: he released it he did it

The day is young my friend! I’m naked. running around living room. Hard to type! Much excite!

Piorjade · Mar 20, 2023

Fun times

@rehius I hope we can still stay in contact

Assidefok · Mar 20, 2023

So, of we use flex for CPU, are resistors still need? For example, if we would like to install this in OLED model, with flex should be easier right? And what about Emmc point, are there alternatives?

binkinator · Mar 20, 2023

Assidefok said:
So, of we use flex for CPU, are resistors still need? For example, if we would like to install this in OLED model, with flex should be easier right? And what about Emmc point, are there alternatives?

Yes. Resistors are still needed even w/ flex. Those don’t go to the flex. They go to the board. See @sthetix diagrams on GitHub for all possible points for your board.

marhalloweenvt · Mar 20, 2023

Is there any design of hwfly flex cable on the Internet? I would like to re-implement with easier-to-get method in my country than waiting for nearly 2 month from aliexpress.

zecoxao · Mar 20, 2023

rehius said:
Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success

View attachment 357132
View attachment 357133
View attachment 357135
View attachment 357134
View attachment 357136

View attachment 357137
View attachment 357138
View attachment 360187
View attachment 357139
View attachment 357140
View attachment 360186

Q: What supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Very sensitive NS. add 20K-30K to RST

Q: Need resistors?
A: SysNAND will not work. Line interference. Only emuMMC.

Q: Chip reset? Learning?
A: Short pin 0 to either 1 or GND. Reset internal statistics.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card

so it's not fake? sadge

Hacking Hardware Picofly - a HWFLY switch modchip

Well-Known Member

Walküre's Hacker

Well-Known Member

BBMB

Well-Known Member

Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Garfield’s Fitness Coach

Member

Garfield’s Fitness Coach

Well-Known Member

Garfield’s Fitness Coach

Well-Known Member

Member

Garfield’s Fitness Coach

Well-Known Member

Well-Known Member

Similar threads

Popular threads in this forum