Hacking OFW goes Black

gghj84 · Oct 10, 2026

I can no longer boot into my OFW. When I power on and hold volume -/+ it shows the "Nintendo" logo but after about exactly a second, it goes black, and stays that way. It does this without an SD card and with an SD card. I powered the entire device off a few times and got an orange screen for the WiFi, but I can't replicate that anymore, so I think it was a fluke. My fuses are at 24 which match the expected fuses for firmware 23.0.0. I am on mariko v2 switch.

I have sysNAND backups from Firmware 22.5.0, but that is no longer useful since I'm on 23.0.0.

Things I've done/tried:

Dumped another RAW EMMC backup for firmware 23.0.0.
Ran FuseCheck and verified it said "OFW can boot normally" (OFW = 23.0.0, burnt fuses = 24)
Updated picofly to latest version using the toolbox payload in hekate.
Ran the TegraExplorer system wipe.
Benchmarked the eMMC. Inspected eMMC info (normal).
Verified the integrity of BOOT0/BOOT1 in eMMC from a backup.
Verified atmosphere/hekate files and observed a kernel panic / missing Minerva files when booting emuMMC.
Open up console and reseat the eMMC and other cables.
Booted without raspberry pico modchip and only the eMMC connected in board slot.
Checked resistances on CPU. (exactly 15 ohms to ground on one side for each set of pads).
Run EmmcHaccGen firmware restore. Wasn't able to dump firmware from eMMC despite benchmark results on that. I dumped the EMU firmware and tried to restore on sysMMC. Then restored on emuMMC. Neither works still. The emuMMC is a "bad" copy of the sysMMC I am trying to boot from.
Restored my backups of firmware 23.0.0 and 22.5.0 and booted with Semi-stock to bypass the fuse check. When booting from hekate, it gives an error about sleep libs and minerva, despite the files being present.

Oddities:

Picofly successfully glitches the CPU from blue to white/yellow and enters hekate successfully.
Hekate reads the eMMC fine, but I cannot guarantee the integrity of HOS yet. (Why it wouldn't be, though?).
I was also unsuccessfully trying to boot into L4S using an approved card (Samsung T7 256gb), but each time it would not be able to read my microSD card and instead have some sort of kernel read error.
The flex cable connecting the tiny ribbon CPU mod cable, connected to the eMMC board slot, and leading to the pico chip which itself is connected to the eMMC, has a little "indent" in it, which came from shipping. I cannot attach a photo here, but it is very small and doesn't seem to hit any of the data lines.
Wasn't able to dump firmware from eMMC using EmmcHaccGen despite benchmark results on that.

Things I've yet to do:

Run NandFixerPro since that wouldn't fix anything.
Verified the resistances of other board components, listed here https://retrosix.wiki/wiki/first-stage-boot-short-checks

gghj84 · Oct 10, 2026

thesjaakspoiler · Oct 11, 2026

A black screen can also occur when the OFW crashes.

Hekate should be able to dump the emmc and should report it is valid/verified.
If that is not the case, then check the resistance of the DAT0 and other points.
You should see something like mega ohms or high kilo ohms.
In diode mode you should see something between 0.45v and 0.85v.

Do you see a warning that your emmc is running in 1 bit mode?

gghj84 · Oct 11, 2026

Using this diagram (It's dubious Ik) I simply measured the orange/blue/yellow/green resistors from the left-to-right instead of to the testpoints above the ribbon b/c those were not exposed for me like in the photo. I got: 50, 50, 50, 500 ohms. I think 500 instead of 250 because my board is probably just yet another chinese clone model.

I'm updating this, because after I removed the modchip it booted from OFW and showed the Nintendo logo, went black, and after a few seconds it booted normally! (In both scenarios, the Nintendo logo is followed by a black screen.)

Removed this^^

This is successful since the last time I tried to do so, because last time I kept the ribbon cable "NS-X" part soldered to the CPU. This implies that the part keeping it from booting was apparently this Picofly flex cable.

While doing this I knocked off capacitor. It doesn't seem to have changed what was actually happening with the switch though, and a few people have told me directly that with the ONE cap removed it will still boot. Looking at the NS-X ribbon pic, it's the right-most set of pads.

What I think happened was when I was removing the modchip, I heated up the APU too much which partially melted one of the caps. I then tugged at the ribbon to remove it, which tore the cap off.

I might look into getting a bag of these caps to try soldering on, though I might call it quits since I have no hot air station.

gghj84 · Oct 12, 2026

Found this. First picture is what I took before the modding. Second picture is somehow after I finished modding. Final picture is what I managed to restore with some wick.

Note: I was only able to boot into OFW once after doing this. Now I am either hanging on the Nintendo logo or never reaching it. Probably indicates several of these chips have shorted or baked completely...

I know how it looks :|

Hacking OFW goes Black

Member

Member

Well-Known Member

Member

Attachments

Member

Similar threads

Popular threads in this forum