Hacking Hardware Picofly - a HWFLY switch modchip

HackMan37 · Jun 1, 2023

floxcap said:
Yes - in theory.
But to put in perspective - the ums-loader is close to max size for IRAM - so we are very limited in what we can run there.
Also - without being able to mount the emmc we can't do a backup from there.

I presume your GPP, BOOT0 & BOOT1 menu items are grey in ums-loader?
(which means there was a problem connecting to the emmc).

I'm currently working on converting ums-loader to a bit of a diagnostics tool - so that those of us that have this problem might be able to get some more information.

Post automatically merged: Jun 1, 2023

That screenshot looks just like mine - the app is unable to mount the emmc.

Post automatically merged: Jun 1, 2023

I like your train of thought.

As a test I put in a code snippet for starting the DRAM - that seems to work ok... but I didn't think to actually run a read/write DRAM test. I'll add that to my list for the changes I'm making to ums-loader

I can read and write the nand with that payload.

I already did a backup, and restore the boot0/1 before that i flash erista boot without being notice about it.

sergiochendry · Jun 1, 2023

Hello, i bought new switch oled and get toshiba nand
when i press the power on
Picofly logo show normaly, when i press volume -+ to get OFW, just show blackscreen
I unplug battery and plug in back, i got error ** (RST)
I change RST cable and now got =**
Picofly logo show again and cannot get into OFW
Just blakscreen again

So i add more resistor cause i think toshiba need more resistor (47+47)
And now got =***

FreeLander · Jun 1, 2023

POPOLO said:
DAT0 interference
Check if the DAT0 cable is too close to the CLK cable

Thanks, but what about this error? Occurs when trying to link an account. Is it also DAT0 interference?

Danook28 · Jun 1, 2023

sergiochendry said:
Hello, i bought new switch oled and get toshiba nand
when i press the power on
Picofly logo show normaly, when i press volume -+ to get OFW, just show blackscreen
I unplug battery and plug in back, i got error ** (RST)
I change RST cable and now got =**
Picofly logo show again and cannot get into OFW
Just blakscreen again

So i add more resistor cause i think toshiba need more resistor (47+47)
And now got =***

Where is (clk) point you cut sheld and scratch solder mask to solder it????
You soldring (cmd) point???

FreeLander · Jun 1, 2023

Grinding or scratching ? How do you guys like to deal with CLK?

abal1000x · Jun 1, 2023

FreeLander said:
Grinding or scratching ? How do you guys like to deal with CLK?

Scratching.

By grinding you risk to ripped the vias, and the debris could goes under the apu which might inflicted another problem.

floxcap · Jun 1, 2023

So... bit of an update on my emmc issue on my lite device.

After:

checking soldering - hmm looks good.
testing without SD card - "no sdcard" screen - ok good.
testing with Hekate on SD card - black screen - doh!
testing +- for OFW - blue screen - grrr.
testing ums-loader - boots! Great! - but can't mount emmc - doh!
lots of hacking in ums-loader code - emmc connection is working but stops part way through the setup. - hmmm.
testing multiple different resistor values and combinations - doesn't fix - just error codes or good glitch.
A light bulb moment - see below!!!

I decided to put a push-button switch in the 3.3V line going to the picofly - That way I can power it while glitching and then be sure it's completely off afterwards. This WORKS!

Manual timing makes it impossible for me to test booting in to Hekate (yet)... but ums-loader has full access to the emmc and currently doing a full backup!

Next step is to create a little power-down circuit for my picofly (and create a new test firmware for it) - so that as soon as it's finished glitching etc it can completely turn its self off.

QuiTim · Jun 1, 2023

floxcap said:
So... bit of an update on my emmc issue on my lite device.

After:

checking soldering - hmm looks good.

testing without SD card - "no sdcard" screen - ok good.

testing with Hekate on SD card - black screen - doh!

testing +- for OFW - blue screen - grrr.

testing ums-loader - boots! Great! - but can't mount emmc - doh!

lots of hacking in ums-loader code - emmc connection is working but stops part way through the setup. - hmmm.

testing multiple different resistor values and combinations - doesn't fix - just error codes or good glitch.

A light bulb moment - see below!!!

I decided to put a push-button switch in the 3.3V line going to the picofly - That way I can power it while glitching and then be sure it's completely off afterwards. This WORKS!

Manual timing makes it impossible for me to test booting in to Hekate (yet)... but ums-loader has full access to the emmc and currently doing a full backup!

Next step is to create a little power-down circuit for my picofly (and create a new test firmware for it) - so that as soon as it's finished glitching etc it can completely turn its self off.

Wow, nice work

rehius · Jun 1, 2023

floxcap said:
it can completely turn its self off.

according to my tests the complete turn off is a bad thing, the leakage current is much more than in "deep sleep" mode, resulting in not working eMMC and pulled down RST

your blue screen looks like DRAM problems, what 3v3 point do you use?

but you can try it (the only change is vreg[0] = 0; instead of vreg[0] = 1; )

sergiochendry · Jun 1, 2023

Danook28 said:
Where is (clk) point you cut sheld and scratch solder mask to solder it????
You soldring (cmd) point???

and now my switch cannot turn on
I remove pico and all cable
Still same
And get 0.3 A when plug to charger

floxcap · Jun 1, 2023

rehius said:
according to my tests the complete turn off is a bad thing, the leakage current is much more than in "deep sleep" mode, resulting in not working eMMC and pulled down RST

your blue screen looks like DRAM problems, what 3v3 point do you use?

but you can try it

Hmm - very interesting. Thank you @rehius

I don't think DRAM is the cause for my problem though - the ums-loader runs completely in IRAM.
For me (more testing to go):

picofly in deep-sleep = ums-loader can't use emmc (init works, go idle works, op_cond works, cid fails).
picofly with no power = ums-loader can use emmc.

I'm currently running with 75 ohm resistors - so perhaps the combination is the magic for my specific switch lite.

Oh - and I'm using the 3V3 from the guide:

abal1000x · Jun 1, 2023

floxcap said:
Hmm - very interesting. Thank you @rehius

I don't think DRAM is the cause for my problem though - the ums-loader runs completely in IRAM.
For me (more testing to go):

picofly in deep-sleep = ums-loader can't use emmc (init works, go idle works, op_cond works, cid fails).

picofly with no power = ums-loader can use emmc.

I'm currently running with 75 ohm resistors - so perhaps the combination is the magic for my specific switch lite.

Oh - and I'm using the 3V3 from the guide:
View attachment 375199

Have you tried that firmware given?

floxcap · Jun 1, 2023

abal1000x said:
Have you tried that firmware given?

Not yet - I'd have to remove my push button first

More testing later this evening.

NandieeHU · Jun 1, 2023

Guys, this new error code system is killing me.
Is it two long one short? I dont get it. This code is not exist

floxcap · Jun 1, 2023

NandieeHU said:
Guys, this new error code system is killing me.
Is it two long one short? I dont get it. This code is not exist

*== No eMMC CMD1 request (poor wiring, or dead CPU)

abal1000x · Jun 1, 2023

NandieeHU said:
Guys, this new error code system is killing me.
Is it two long one short? I dont get it. This code is not exist

*== No eMMC CMD1 request (poor wiring, or dead CPU)

snaker · Jun 1, 2023

themine1500 said:
This is what I ordered. 3 weeks later those showed up

is this the dat0 adapter link :
https://www.aliexpress.com/item/1005005316412395.html
If yes lets inform the rest of the members to avoid it at any costs!

CodyRoseman · Jun 1, 2023

NandieeHU said:
Guys, this new error code system is killing me.
Is it two long one short? I dont get it. This code is not exist

Check your clk trace, and maybe your mosfet setup is shorted somewhere, make sure the gate isnt shorted to the drain or source

Nephiel · Jun 1, 2023

snaker said:
is this the dat0 adapter link :
https://www.aliexpress.com/item/1005005316412395.html
If yes lets inform the rest of the members to avoid it at any costs!

FWIW I ordered those ~3 weeks ago and received the correct 4-anchor adapter.

QuiTim · Jun 1, 2023

Nephiel said:
FWIW I ordered those ~3 weeks ago and received the correct 4-anchor adapter.

same here, I ordered 5 weeks ago, got them after 2 weeks or so and they are the correct 4anchor (good ones).
I guess they changed the supplier in the meantime

Hacking Hardware Picofly - a HWFLY switch modchip

Active Member

Attachments

Well-Known Member

Attachments

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Well-Known Member

Attachments

Well-Known Member

Attachments

Well-Known Member

Well-Known Member

Well-Known Member

Active Member

Well-Known Member

Well-Known Member

Well-Known Member

Active Member

Artificer

Well-Known Member

Similar threads

Popular threads in this forum