Hacking Hardware Picofly - a HWFLY switch modchip

handsom_tomato

Active Member
Newcomer
Joined
Jan 24, 2023
Messages
43
Trophies
0
Age
20
XP
444
Country
Japan
lockpick_rcm.png

I have successfully dumped the key after flashing the unlock.uf2 file !!
But, the secure boot key value remains unchanged at ffff. Could you please explain to me if installing Piko would overwrite the secure boot key to ffff regardless of whether the unlock.uf2 file is flashed or not? Also, are there any potential negative effects of this? I would appreciate your guidance.
 

HenryMin

Well-Known Member
Member
Joined
Jun 19, 2020
Messages
141
Trophies
0
XP
1,136
Country
Korea, South
View attachment 362519
I have successfully dumped the key after flashing the unlock.uf2 file !!
But, the secure boot key value remains unchanged at ffff. Could you please explain to me if installing Piko would overwrite the secure boot key to ffff regardless of whether the unlock.uf2 file is flashed or not? Also, are there any potential negative effects of this? I would appreciate your guidance.
It's normal that hekate shows sbk as FFF... on mariko.
You need to use 'partial overwrite attack' to dump sbk on mariko, but no reason to do that.
 

tactical-waffle

Member
Newcomer
Joined
Sep 15, 2021
Messages
22
Trophies
0
Age
19
XP
60
Country
United Kingdom
Hey im really sorry if this is the wrong place to ask but i have an OLED switch that ofc cant be hacked with fusee gelee. Is this mod chip ready to go or should i wait a bit longer. Also is this chip independant of firmware version (im guessing that it is but its a good idea to check).
 

linuxares

The inadequate, autocratic beast!
Global Moderator
Joined
Aug 5, 2007
Messages
13,302
Trophies
2
XP
18,145
Country
Sweden
Hey im really sorry if this is the wrong place to ask but i have an OLED switch that ofc cant be hacked with fusee gelee. Is this mod chip ready to go or should i wait a bit longer. Also is this chip independant of firmware version (im guessing that it is but its a good idea to check).
It's ready to go. But OLED is the hardest/most annoying to mod since you need an ankor or reballing of the eMMC. The Firmware doesn't matter since it's the bootloader that is being abused to inject custom code.
V2.6 that is being developed seem to be a big upgrade so if you don't have to mod it right now, wait a bit.
 

tactical-waffle

Member
Newcomer
Joined
Sep 15, 2021
Messages
22
Trophies
0
Age
19
XP
60
Country
United Kingdom
It's ready to go. But OLED is the hardest/most annoying to mod since you need an ankor or reballing of the eMMC. The Firmware doesn't matter since it's the bootloader that is being abused to inject custom code.
V2.6 that is being developed seem to be a big upgrade so if you don't have to mod it right now, wait a bit.
Ahh alr, ty for the help. Btw is there like a github for the firmware and what parts do you need for the mod.
 

linuxares

The inadequate, autocratic beast!
Global Moderator
Joined
Aug 5, 2007
Messages
13,302
Trophies
2
XP
18,145
Country
Sweden
  • Like
Reactions: khuong and Ricky_25

tactical-waffle

Member
Newcomer
Joined
Sep 15, 2021
Messages
22
Trophies
0
Age
19
XP
60
Country
United Kingdom
If this is your first soldering job. It isn't for you.

Here is a summary page that try to collect all info and make it easier to find - https://gbatemp.net/threads/picofly-aio-thread.628951/
Ty and yeah after seeing everything here im defo gonna actually learn how to solder before doing this.
Post automatically merged:

If this is your first soldering job. It isn't for you.

Here is a summary page that try to collect all info and make it easier to find - https://gbatemp.net/threads/picofly-aio-thread.628951/
Hey i just had a look at this thread and saw that it was recomended to get it done by a professional, would this mean sending my switch somewhere or would a high street repair place be able to do it.
 
Last edited by tactical-waffle,
  • Like
Reactions: impeeza

AntonIX

Active Member
Newcomer
Joined
Jan 14, 2023
Messages
34
Trophies
0
Age
23
Website
devpins.org
XP
207
Country
Russia
Use points not on emmc as its safer (The points on diagram has 2 points and they are already connected so a bridge is fine)
Use toshiba fix then use unlock all on pc first
47ohm some boot ofw some dont but you get slow mode so use it for sure
Are there any other soldering points besides the emmc chip on patched erista and big mariko switches? I've seen it somewhere, but I don't remember where.
 

T0kyora1n

New Member
Newbie
Joined
Apr 1, 2023
Messages
1
Trophies
0
Age
23
XP
12
Country
Venezuela
Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success



Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card do not use, bugged.

Boot into Full Stock and perform a full system reset.
Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success



Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card do not use, bugged.

Boot into Full Stock and perform a full system reset.
Has any information come out about the scheme of the welding points for the Rp2040 Pi Pico? (the version that is a little larger than the zero) in the Pi pico version some names change and I would like to know their equivalence. Thank you
Post automatically merged:

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success



Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card do not use, bugged.

Boot into Full Stock and perform a full system reset.


Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card do not use, bugged.

Boot into Full Stock and perform a full system reset.
[/QUOTE]
Has any information come out about the scheme of the welding points for the Rp2040 Pi peak? (the version that is a little larger than the zero) in the Pi pico version some names change and I would like to know their equivalence. Thank you
Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success



Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card do not use, bugged.

Boot into Full Stock and perform a full system reset.
Has any information come out about the scheme of the welding points for the Rp2040 Pi Pico? (the version that is a little larger than the zero) in the Pi pico version some names change and I would like to know their equivalence. Thank you
 

Dee87

Well-Known Member
Member
Joined
Mar 19, 2023
Messages
1,139
Trophies
1
XP
1,575
Country
Germany
Has any information come out about the scheme of the welding points for the Rp2040 Pi Pico? (the version that is a little larger than the zero) in the Pi pico version some names change and I would like to know their equivalence. Thank you
for pico u need to wait for the 2.6 fw release i think it added the pico to it not sure though
no one knows when it will be released u have to wait till its done hes doing this in his free time for free so just be patiant and wait :-)
Post automatically merged:

@everyonesweird, it's been partially answered before

- multi-board support (RPi, xiao, zero, one) within the single fw
- OFW support fixes
- brick-proof firmware update through hekate
- sdloader power fixes, should also improve glitch
- maybe some glitch algo improvements
well maybo not so

the pico is to big anyways just try to ur hand one of these chips
xiao, zero, one
 

RiotRetroGaming

Well-Known Member
Newcomer
Joined
Mar 25, 2023
Messages
60
Trophies
0
Age
43
XP
164
Country
United Kingdom
Oof was the Switch dusty? I noticed the cotton tops or was it just the thermal paste being like black?
Yes, just cleaning up thermal paste on other switch jobs.
I like to get rid of factory. Using Thermal-grizzly paste to replace.

I will try and explain about getting the chip to sit low.
Take the top APU/RAM shield, cut the RAM side of it off.
Then cut off where the RAM shield (you just cut away) would clip onto the metal to Switch's board (the thin metal piece left over).

The chip should then find a home in that area and almost sit in between the other chips.
Just dont forget to insulate the bottom of the Picofly.

I then used the same pair of sharp small scissors to cut out the big main metal shield that screws onto the back of the Switch.
The area where the chip is now sitting.

Insulate the top of the chip with kapton tape in-case the shielding touches the top of the Picofly chip once that big main shield goes back on top.


Ant
 

jkyoho

Well-Known Member
Member
Joined
Sep 2, 2020
Messages
1,270
Trophies
0
Age
39
Location
TORONTO
Website
form.jotform.com
XP
2,201
Country
Canada
for pico u need to wait for the 2.6 fw release i think it added the pico to it not sure though
no one knows when it will be released u have to wait till its done hes doing this in his free time for free so just be patiant and wait :-)
Post automatically merged:


well maybo not so

the pico is to big anyways just try to ur hand one of these chips
Pico is on the 2.6 support list:lol:

@everyonesweird, it's been partially answered before

- multi-board support (RPi, xiao, zero, one) within the single fw
- OFW support fixes
- brick-proof firmware update through hekate
- sdloader power fixes, should also improve glitch
- maybe some glitch algo improvements
Post automatically merged:


they are the same mosfets. third letter means its origin (manufacture)
 
  • Like
Reactions: Dee87

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    Veho @ Veho: Firefox users be like "look at what they have to do to mimic a fraction of our power."