Hacking Hardware Picofly - a HWFLY switch modchip

  • Thread starter Thread starter mathew77
  • Start date Start date
  • Views Views 3,679,365
  • Replies Replies 17,052
  • Likes Likes 15
there is no answer yet
Only 2 change, everything the same with rehius code:

1. Modify the d0 voltage checker
From 1.8V +- 0.2V
To 1.6V +- 0.35V
Calculated from the datasheet, read this post

2. Change the power off mechanism
After glitch, the rp2040 should be turn off, to reduce battery power consumption.
The original rehius code have buggy shutdown mechanism.
(AFAIK rehius remove the shutdown mechanism to fix the bug, so the rp2040 still on, only consume a little bit of power.)
I try to fixed that. I read the whole document of rp2040.
In conclustion rp2040 doesn't have total shutdown mechanism.
But we could turn off partially the module inside rp2040.
I turn off any functionality inside rp2040 that i could turn off.
Its called deep sleep or something like that in the document.
The best solution is to use somekind of physical switch to reduce consumption.
But it will lead to add more cost, so little bit of power consumption is okay, i think.
 
Only 2 change, everything the same with rehius code:

1. Modify the d0 voltage checker
From 1.8V +- 0.2V
To 1.6V +- 0.35V
Calculated from the datasheet, read this post

2. Change the power off mechanism
After glitch, the rp2040 should be turn off, to reduce battery power consumption.
The original rehius code have buggy shutdown mechanism.
(AFAIK rehius remove the shutdown mechanism to fix the bug, so the rp2040 still on, only consume a little bit of power.)
I try to fixed that. I read the whole document of rp2040.
In conclustion rp2040 doesn't have total shutdown mechanism.
But we could turn off partially the module inside rp2040.
I turn off any functionality inside rp2040 that i could turn off.
Its called deep sleep or something like that in the document.
The best solution is to use somekind of physical switch to reduce consumption.
But it will lead to add more cost, so little bit of power consumption is okay, i think.
Hello, do you have link to your latest FW please ? i will give it a try ...
 
I've messed up my CPU ribbon for my Picofly (don't ask). I've been looking around, and all I can seem to find are repos and gerber files for the Picofly and not the auxiliary flex PCBs. Would anyone know where I could find those files?
 
I've messed up my CPU ribbon for my Picofly (don't ask). I've been looking around, and all I can seem to find are repos and gerber files for the Picofly and not the auxiliary flex PCBs. Would anyone know where I could find those files?
There are so many boards out there and there isn't a standard for that cable.
Some boards have the mosfet on the board while others have it on the flatcable.

This repo has some cpu flex cable gerber files.
But you might to edit them to match your board.
Buying a new board + flex cable from Aliexpress might be cheaper than ordering your home made flex cable.
And since you have the mosfets, you might opt doing an oldschool mosfet mod :
1767757310901.png
 
There are so many boards out there and there isn't a standard for that cable.
Some boards have the mosfet on the board while others have it on the flatcable.

This repo has some cpu flex cable gerber files.
But you might to edit them to match your board.
Buying a new board + flex cable from Aliexpress might be cheaper than ordering your home made flex cable.
Thank you very much for the info. When you say "this repo" do you mean this thread?
 
What is the difference between

rehius / usk
PicoFly_2.80_2024.09.04_04-12
https://github.com/rehius/usk/releases/tag/PicoFly_2.80_2024.09.04_04-12

and

abal1000x / usk
PicoFly_200.76_2025.11.02_16-30
https://github.com/abal1000x/usk/releases/tag/PicoFly_200.76_2025.11.02_16-30

I currently use the rehius 2.80 - Curious what changes were made between these two variants. Thanks.

3 posts above yours ...
 
  • Like
Reactions: YoNoid

3 posts above yours ...
Thanks. My apology for not looking higher. I will give this a try. If it functions the same with less PWR consumption that is a good thing. Nice work.
 
Only 2 change, everything the same with rehius code:

1. Modify the d0 voltage checker
From 1.8V +- 0.2V
To 1.6V +- 0.35V
Calculated from the datasheet, read this post

2. Change the power off mechanism
After glitch, the rp2040 should be turn off, to reduce battery power consumption.
The original rehius code have buggy shutdown mechanism.
(AFAIK rehius remove the shutdown mechanism to fix the bug, so the rp2040 still on, only consume a little bit of power.)
I try to fixed that. I read the whole document of rp2040.
In conclustion rp2040 doesn't have total shutdown mechanism.
But we could turn off partially the module inside rp2040.
I turn off any functionality inside rp2040 that i could turn off.
Its called deep sleep or something like that in the document.
The best solution is to use somekind of physical switch to reduce consumption.
But it will lead to add more cost, so little bit of power consumption is okay, i think.
Nice, thanks for all the work and explanation, will be adding the git to my favorites for updates!

Just for everyone else less techy on the first step.

The Change:
  • Improves signal reliability on the data line
  • Reduce overvoltage-related instability
  • Allows greater variance from modchips, flex cables, or long traces, etc
  • Increase tolerance to timing skew and noise

Plain English TLDR: The change lowers the expected voltage slightly and makes the system much more tolerant to voltage variation, especially on the low end, improving robustness at the cost of stricter upper limits.
 
From datasheet:
View attachment 393392
Dat0 works on push-pull mode, means,
View attachment 393395
View attachment 393396
View attachment 393393
View attachment 393394
When theres no signal (high level) it should be between Voh to Vdd.
Theres two table i assume the emmc could use 2 mode of voltage.

Vccq = Vdd = 1.70 ~ 1.95

Table 30:
Vdat0 = 0.75Vdd ~ Vdd
= 1.275 ~ 1.95
Table 31:
Vdat0 = Vccq - 0.45 ~ Vdd
= 1.25 ~ 1.95

So based on the datasheet it should be around 1.25V to 1.95V.
Or using the code style it should be 1.6V +- 0,35V

You can, when its powered on. Its pulled up, so the low bit is high voltage.

Its safe if you know what you're doing.
Those fault detection is for safety.
For example if the dat0 is in the wrong voltage, then theres something wrong with the installation.
What if you switch the dat0 with the 3.3v for example.
Post automatically merged:


Logically speaking, the glitch is not affected directly by the dat0.

I assume,
The dat0 line is needed to inject (write) the loader to the emmc (the whitelight in the first time powered on).
And checked (read) that the loader is indeed in the emmc, everytime picofly powered on.

So if the 'white light on first installation' workings then the dat0 line is working.

But indeed the glitch operation use the CMD line to compare data, to check whether the glitch works or not. Or to get the time reference of when the glitch will be executed. So the CMD line is very important on the glitch (Also the CLK line to sync the signal).

But remember that CMD/CLK/Dat0 is in one package of emmc. So it doesn't remove the possibility that wrongdoing in Dat0 might interfere the CMD line. For the its illogical, and have a lesser probability.
If glitch problematic, the number one suspect is mosfet and the gate line, second is the cmd/clk line.
the attachments are gone. could you please add them again.
 

Can I use a switch lite modchip for a V1/V2 console?​

Screenshot_12-1-2026_142924_www.aliexpress.us.jpeg

I bought this modchip for the switch lite and was wondering if I could use it to on V1/V2 console. Would I have to use wires to solder the parts together? I do not want to waste this modchip. If you can, please use a diagram to help me understand.
 
Last edited by Justin12345,

Can I use a switch lite modchip for a V1/V2 console?​

View attachment 551418
I bought this modchip for the switch lite and was wondering if I could use it to on V1/V2 console. Would I have to use wires to solder the parts together? I do not want to waste this modchip. If you can, please use a diagram to help me understand.
https://www.reddit.com/submit/?source_id=t3_1qdxrez
Yes, of course, manually install the points, one by one with the wire, obviously discard the flex.
 
Could you be a little more specific?
How should I be more precise? Look at the points that the flex touches by analyzing the motherboard of a Lite, I'll post you a photo, and you can see on the chip pads where they correspond and translate the diagram for a standard Switch. If you’re not able to do these basic operations, how can you think you can succeed?
 

Attachments

  • alt cmd_clk lite.jpg
    alt cmd_clk lite.jpg
    2.6 MB · Views: 44
There is another method that doesnt use DAT0 connector that avoids altering the board???
There used to be emmc adapters that you could place in between the emmc and the board.
You would need the skills to remove the emmc and reball the emmc though but it is less invasive as digging into the board in search for the DAT0 line.
 

Site & Scene News

Popular threads in this forum