Hacking Booting to hekate without eMMC?

evil_santa

Well-Known Member
Member
Joined
Jan 15, 2020
Messages
380
Trophies
1
Age
39
XP
1,843
Country
Germany
Is this possible only on V2, or also on oled. Asking because after changing sk hynix emmc to a samsung blank one, picofly gives *=* error without further succes.
It doesn't matter, works on any switch.
Try to reflash your Picofly to reset any training data.
Your diode reading's are fine ?
And please send picture from your emmc (which type)
 
Last edited by evil_santa,
  • Like
Reactions: Danook28

Mn3s

Member
Newcomer
Joined
Dec 21, 2023
Messages
8
Trophies
0
Age
23
XP
36
Country
Lithuania
It doesn't matter, works on any switch.
Try to reflash your Picofly to reset any training data.
Your diode reading's are fine ?
And please send picture from your emmc (which type)
Readings are within normal range, Emmc is Samsung KLMCG4JETD 64gb. Tried to reflash pico with 2.73FW, also tried completly new rp2040 zero with picofly 2.74FW. Both ways still gives *=* error two times. PC recognizes switch in rcm mode, indicating that emmc works, but there is missing valid boot0/boot1. So is picofly realy able to glitch switch oled without valid boot0 partition?
 
  • Like
Reactions: Danook28

Mn3s

Member
Newcomer
Joined
Dec 21, 2023
Messages
8
Trophies
0
Age
23
XP
36
Country
Lithuania
I realy doubt that emmc is defective. Maybe this blank emmc have 8 mb boot partitions and picofly doesnt like that. Or maybe there is no boot partitions at all, but i dont think thats possible.
 
  • Like
Reactions: Danook28

evil_santa

Well-Known Member
Member
Joined
Jan 15, 2020
Messages
380
Trophies
1
Age
39
XP
1,843
Country
Germany
I realy doubt that emmc is defective. Maybe this blank emmc have 8 mb boot partitions and picofly doesnt like that. Or maybe there is no boot partitions at all, but i dont think thats possible.
Hmm hard to say from here.
The emmc has a 4mb boot partion. It is possible to deactivate the boot partion but it's not a thing on a new emmc.
Can't tell you what you should do now.
If you have a hwfly chip you can try with these but it should be the same.
You can desolder it and write it with an hardware programmer.
Or you can use a ft232h to write to boot0/1 backup to the emmc.
 

Mn3s

Member
Newcomer
Joined
Dec 21, 2023
Messages
8
Trophies
0
Age
23
XP
36
Country
Lithuania
That would be the hard way, 3 times to unsoldering, 2 times raball. Most of the time these emmc cant even handle 1 reball. Also i think i will use V1 switch for flashing full disk image via hekate, but again, alot of hot air desoldering. So I guess thats the way. Why pico is unable to glitch in easy way is a mistery.
 

evil_santa

Well-Known Member
Member
Joined
Jan 15, 2020
Messages
380
Trophies
1
Age
39
XP
1,843
Country
Germany
Again you can use a ft232h to write your image to your emmc. It's not necessary to desolder the emmc.
Connect dat0, cmd and clk to ft232h power on your switch and you should be able to write the backup to it.
 
  • Like
Reactions: Danook28

vlosopedro

Member
Newcomer
Joined
Jan 13, 2024
Messages
8
Trophies
0
Age
23
XP
41
Country
Brazil
Hello guys im in that same problem, dead oled here, whit picofly, no boot nothing, probable dead emmc after 17.0.0 update.

Whats the easier method can i try to rebuild the emmc nand? no hekate showing, only recognizes APX (Rcm mode) on my pc, and i only have boot1/0 backups, no rawnand backup
 

Mn3s

Member
Newcomer
Joined
Dec 21, 2023
Messages
8
Trophies
0
Age
23
XP
36
Country
Lithuania
Hello guys im in that same problem, dead oled here, whit picofly, no boot nothing, probable dead emmc after 17.0.0 update.

Whats the easier method can i try to rebuild the emmc nand? no hekate showing, only recognizes APX (Rcm mode) on my pc, and i only have boot1/0 backups, no rawnand backup
Hi, there is unfortunatly no easy way to rebuild. You have 3 options that i know of.
1. Solder emmc to switch v1, launch hekate and reflash boot partitions.
2. Solder emmc to specific emmc adapter that can refash partitions (linux environment)
3. Use ft232h programmer as it is stated post before. No need to desolder emmc as it can flash on board.

Also i think it is possible restore emmc using emmu nand image. Just make emmunand backup, and restore it as it is sys nand. You can make and rebuild full disk image using unbrick pack v4, again, using emmunand prodinfo file.
Keep in mind that your emmc could have physical damage and you will need completely new emmc.
Good luck !
 

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
Hi, there is unfortunatly no easy way to rebuild. You have 3 options that i know of.
1. Solder emmc to switch v1, launch hekate and reflash boot partitions.
2. Solder emmc to specific emmc adapter that can refash partitions (linux environment)
3. Use ft232h programmer as it is stated post before. No need to desolder emmc as it can flash on board.

Also i think it is possible restore emmc using emmu nand image. Just make emmunand backup, and restore it as it is sys nand. You can make and rebuild full disk image using unbrick pack v4, again, using emmunand prodinfo file.
Keep in mind that your emmc could have physical damage and you will need completely new emmc.
Good luck !
You don't need to desolder a Mariko eMMC just to reflash it. Picofly or HWfly can boot Hekate with an entirely empty eMMC. If the eMMC is dead, a new eMMC can be soldered to the console and Hekate can image it. If Prodinfo was backed up, then Sthetix level 2 unbrick will work, otherwise level 3 is necessary and the console will not be able to connect to Nintendo servers.
 

vlosopedro

Member
Newcomer
Joined
Jan 13, 2024
Messages
8
Trophies
0
Age
23
XP
41
Country
Brazil
Hi, there is unfortunatly no easy way to rebuild. You have 3 options that i know of.
1. Solder emmc to switch v1, launch hekate and reflash boot partitions.
2. Solder emmc to specific emmc adapter that can refash partitions (linux environment)
3. Use ft232h programmer as it is stated post before. No need to desolder emmc as it can flash on board.

Also i think it is possible restore emmc using emmu nand image. Just make emmunand backup, and restore it as it is sys nand. You can make and rebuild full disk image using unbrick pack v4, again, using emmunand prodinfo file.
Keep in mind that your emmc could have physical damage and you will need completely new emmc.
Good luck !
thank you :)) i dont think its a physical damage bcause happened after someshit my friend has done after 17.0 update, restored some broken backup something like this, for me the easyest way should be solder the emmc to a v1 and reflash. other things here in brazil i have no easy access. thank you so much!
Post automatically merged:

You don't need to desolder a Mariko eMMC just to reflash it. Picofly or HWfly can boot Hekate with an entirely empty eMMC. If the eMMC is dead, a new eMMC can be soldered to the console and Hekate can image it. If Prodinfo was backed up, then Sthetix level 2 unbrick will work, otherwise level 3 is necessary and the console will not be able to connect to Nintendo servers.
but mine is a oled! whats hes telling to me is, dessolder the oled emmc, solder on a v1, boot the v1 on hekate, flash oled boot partitions in v1 board then ressolder the oled emmc in oled board again
Post automatically merged:

You don't need to desolder a Mariko eMMC just to reflash it. Picofly or HWfly can boot Hekate with an entirely empty eMMC. If the eMMC is dead, a new eMMC can be soldered to the console and Hekate can image it. If Prodinfo was backed up, then Sthetix level 2 unbrick will work, otherwise level 3 is necessary and the console will not be able to connect to Nintendo servers.
im trying to not get a new emmc chip, cuz for me is very difficult to shop another one, but i have access to others switches consoles
Post automatically merged:

Hi, there is unfortunatly no easy way to rebuild. You have 3 options that i know of.
1. Solder emmc to switch v1, launch hekate and reflash boot partitions.
2. Solder emmc to specific emmc adapter that can refash partitions (linux environment)
3. Use ft232h programmer as it is stated post before. No need to desolder emmc as it can flash on board.

Also i think it is possible restore emmc using emmu nand image. Just make emmunand backup, and restore it as it is sys nand. You can make and rebuild full disk image using unbrick pack v4, again, using emmunand prodinfo file.
Keep in mind that your emmc could have physical damage and you will need completely new emmc.
Good luck !
actually.. ft232h is very cheap right here too, ill try this one first
Edit to avoid spam:
ill need the emmc adapter? the big black box that was shown up on the arab video? or can i do this only whit a FT323h adapter? here in brazil we have this one FT323RI someone can tell me if can i do whit this little board instead the 323h?:

1705445610444.png
 
Last edited by vlosopedro,

Mn3s

Member
Newcomer
Joined
Dec 21, 2023
Messages
8
Trophies
0
Age
23
XP
36
Country
Lithuania
As evil_santa stated before:
"you can use a ft232h to write your image to your emmc. It's not necessary to desolder the emmc.
Connect dat0, cmd and clk to ft232h, power on your switch and you should be able to write the boot0/boot1 bin files".
That black box is used for friction contact, as it pushes down on emmc to create contact, so you dont need to solder emmc.
Just connect coresponding wires. If 323RI will work is up to you and your knowladge.
Good luck.
 

Myst0gan

Well-Known Member
Member
Joined
Oct 17, 2023
Messages
122
Trophies
0
XP
123
Country
United States
Reporting back on this after I got a replacement eMMC chip.

The Picofly boots to hekate without any issue, and lockpick is able to dump some keys, although it cannot read the eMMC. As expected, among these keys are the BIS keys, and all the device unique keys (which are stored on the CPU ROM).

Then I used prodinfo_gen to generate a PRODINFO partition which is usable by the switch (but will be rejected by nintendo's servers: it's like having a banned switch).

Finally, using an eMMC dump from another working switch, I was able to recreate a working eMMC dump by following sthetix's guide, and flash it to the new eMMC chip. It took some time, but I have now a working switch, which can even boot fully stock. The only strange part is that the switch initially refused to boot stock (black screen after Nintendo logo). I had to boot atmosphere on the sysMMC once before it accepted to boot stock.

TL;DR: yes, it is possible to revive a switch with a dead eMMC and without a backup.
Impressive 👏🏽 can you make a guide?? Pdf with pictures or video. How did you figure out that emmc was completely dead?? Where have you measured 1,8V?


Post automatically merged:

If you have a picofly or an modchip with the newer hwfly-nx firmware you can boot to a completely empty emmc.
After this you can dump your key's and rebuild a new nand.
I did this a while ago.
How did you do that?? I'm asking just because of curiosity
 
Last edited by Myst0gan,
  • Like
Reactions: Danook28

vlosopedro

Member
Newcomer
Joined
Jan 13, 2024
Messages
8
Trophies
0
Age
23
XP
41
Country
Brazil
As evil_santa stated before:
"you can use a ft232h to write your image to your emmc. It's not necessary to desolder the emmc.
Connect dat0, cmd and clk to ft232h, power on your switch and you should be able to write the boot0/boot1 bin files".
That black box is used for friction contact, as it pushes down on emmc to create contact, so you dont need to solder emmc.
Just connect coresponding wires. If 323RI will work is up to you and your knowladge.
Good luck.
Yaeh yeah, i just got myself in asking, why i need a emmc reader if i dont need to ressolder de emmc hahahaha, thank you my friend, i ordered a ft323h on aliexpress, when it arrives ill come back here and post a feedback, really aprecciate your help! Thx so much
 
  • Like
Reactions: Danook28

Mn3s

Member
Newcomer
Joined
Dec 21, 2023
Messages
8
Trophies
0
Age
23
XP
36
Country
Lithuania
Yaeh yeah, i just got myself in asking, why i need a emmc reader if i dont need to ressolder de emmc hahahaha, thank you my friend, i ordered a ft323h on aliexpress, when it arrives ill come back here and post a feedback, really aprecciate your help! Thx so much
Other people helped alot more than i did, but no problem. Also if you are using aliexpress, i suggest buying new samsung 64gb emmc, they are pretty cheap and will definetly come in handy later ;).
Happy waiting !
 
  • Like
Reactions: Danook28

snaker

Well-Known Member
Member
Joined
Mar 30, 2009
Messages
217
Trophies
1
Website
biohazard-era.blogspot.com
XP
667
Country
United States
So if i got this right....
You just buy an ft232h. You simply add 3 10k resistors:
clk=ad0 10k to gnd
cmd=ad1 and dat0=ad2 both 10k to 3.3v
power on switch in order for the nand to have power and you can read write boot0/boot1 sectors,using that postal3 program, on "oled models" blank 64gb nands?

This is amazing! Anyone completely confirm that this works?
 
  • Like
Reactions: Danook28

Mn3s

Member
Newcomer
Joined
Dec 21, 2023
Messages
8
Trophies
0
Age
23
XP
36
Country
Lithuania
In theory it should. But if everything works as intended and working new emmc is soldered perfectly, just not yet written, in other words blank, picofly or hwfly can and will boot to hekate for easier flashing.
 
  • Love
  • Like
Reactions: Danook28 and snaker

Danook28

Well-Known Member
Member
Joined
Jul 17, 2018
Messages
488
Trophies
0
Age
34
XP
1,029
Country
Oman
In theory it should. But if everything works as intended and working new emmc is soldered perfectly, just not yet written, in other words blank, picofly or hwfly can and will boot to hekate for easier flashing.
I have that chip on pic i want to read mmc nand for V1 console not boot to hekate but picofly is glitch and see logo in secreen but with try to boot to hekate msg (failed to read inti sd card) but the sd card adapter for switch working in other console) i need digram for soldring that chip to mmc. Thanks you
IMG_20230929_145130.jpg
 
Last edited by Danook28,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: There has to be some mutual agreement with them all anything over $600 is just pc territory