Hacking INSTINCT-NX Chip

[linkref]

I use xshell as I also need to ssh into some linux vps, just change connection type to serial and change baud rate to 115200 in serial settings: View attachment 464174

also the new line symbol instinct sends is different, default cr will cause character to scroll all over the place, using auto fixes the issue:
View attachment 464175

if it's kamikaze dat0 then idk, never done it before only emmc reball. what does it say when you press d? paste the output here and i'll take a look

Thanks a lot
Just before I start. In what state I need to be before connecting the chip to the pc?

Switch off, battery connector on, then I connect to pc?

 

[SudoRoot]

Hi all
Do we have an explicit error code description ?
I have solid white sometimes, dunno what it is..

Thanks all

there's no documentation on v6/v6s led error code afaik. based on my experience, solid white could mean anything...

That's not true actually

V6
Solid white light for 5 seconds CMD not connected (A) or RST not connected (B)
White light flashes 15 times CLK not connected (D)
Red light flashes 5 times DAT0 not connected (C)
Blue light flashes 3 times CPU not connected


V6S
Point D is not connected: flashes white once, then stays on white for 20 seconds.
Point A is not connected: flashes white 3 times, lasting 20 seconds
Point C is not connected: flashing red for 20 seconds
Point B is not connected: blue flashing lasts 20 seconds
CPU flex cable not connected: flashes blue 3 times quickly for 20 seconds
fpga problem: red light flashes 9 times
Switch motherboard is not powered on: solid white light


But yeah, sometimes these errors codes could indicate something completely different, e.g. DAT0 can cause any of these.

 

[linkref]

I use xshell as I also need to ssh into some linux vps, just change connection type to serial and change baud rate to 115200 in serial settings: View attachment 464174

also the new line symbol instinct sends is different, default cr will cause character to scroll all over the place, using auto fixes the issue:
View attachment 464175

if it's kamikaze dat0 then idk, never done it before only emmc reball. what does it say when you press d? paste the output here and i'll take a look

Hi thanks a lot, i did not do that since i've redone all my soldering and remove that *** flex tape from nand points. From this day i will never use nand flex ever, it's supposed to make us gain time but at the end of the day it's a wasting of time

 

[randy_w]

That's not true actually

V6
Solid white light for 5 seconds CMD not connected (A) or RST not connected (B)
White light flashes 15 times CLK not connected (D)
Red light flashes 5 times DAT0 not connected (C)
Blue light flashes 3 times CPU not connected


V6S
Point D is not connected: flashes white once, then stays on white for 20 seconds.
Point A is not connected: flashes white 3 times, lasting 20 seconds
Point C is not connected: flashing red for 20 seconds
Point B is not connected: blue flashing lasts 20 seconds
CPU flex cable not connected: flashes blue 3 times quickly for 20 seconds
fpga problem: red light flashes 9 times
Switch motherboard is not powered on: solid white light


But yeah, sometimes these errors codes could indicate something completely different, e.g. DAT0 can cause any of these.

I know, someone extracted the error list/led pattern by reversing the mcu firmware when instinct chips first came out. Problem is, as you said, these codes are very unreliable. I've got led reporting dat0 issue while it's actually a cpu ribbon issue after running diagnostics in serial. Also got a dat0 issue according to led, reballed the emmc 3 times till realizing cmd/A is loose. Never gonna use the led for diagnosing.

Hi thanks a lot, i did not do that since i've redone all my soldering and remove that *** flex tape from nand points. From this day i will never use nand flex ever, it's supposed to make us gain time but at the end of the day it's a wasting of time

I usually use enameled wires for A/C/D points, also used the included ribbon from instinct v6 several times. Tbh they are not too bad, design and build quality improved a lot from earlier hwfly ribbons. Anyway glad you sorted it out

 

[linkref]

I use xshell as I also need to ssh into some linux vps, just change connection type to serial and change baud rate to 115200 in serial settings: View attachment 464174

also the new line symbol instinct sends is different, default cr will cause character to scroll all over the place, using auto fixes the issue:
View attachment 464175

if it's kamikaze dat0 then idk, never done it before only emmc reball. what does it say when you press d? paste the output here and i'll take a look

Hi, i have again an issue with a instinct. I tried to diagnose booting but it never failed while debugging.... But know the issue is gone... i did not do something in particular, just pressing D in xshell.. I doubt if i should trust this install or not...

What's your advice here ?

 

[Almgandhi]

Hey all,
found that blog while searching for help regarding the V6S Chip.
My switch lately doenst boot anymore into hekate. It just boots into OFW and I usually see red light blinking for 2 seconds or something and then shortly turning blue before it goes out and console boots to OFW and chip is blinking blue again.
First I rarely could stillr each hekate after view attempts. But now I cant anymore. Tried for 30+ times.

I thought reseting / updating the V6s could help so I first tryed that by using the toolbox. It fails and sais "couldnt communicate with modchip"

Then I tried via USB Adapter and PC (modchip connected to switch, switch turned off, switch battery connected.
I see blue blinking for 2 sec before turning red shortly and then into constant white. I dont see any COM port in device manager... so basically no connection to the chip.

Is the chip bricked? Anyone having experience with that here?

Any other option I have to reset the chip ? There is a "reset" sign on the chip neaer two contacts, but I dont find any information on how to use this.

Since I cant reach the chip at all this looks like a chip problem to me rather then any loose connections, what do you guys think?

Post automatically merged: Oct 26, 2024

That's not true actually

V6
Solid white light for 5 seconds CMD not connected (A) or RST not connected (B)
White light flashes 15 times CLK not connected (D)
Red light flashes 5 times DAT0 not connected (C)
Blue light flashes 3 times CPU not connected


V6S
Point D is not connected: flashes white once, then stays on white for 20 seconds.
Point A is not connected: flashes white 3 times, lasting 20 seconds
Point C is not connected: flashing red for 20 seconds
Point B is not connected: blue flashing lasts 20 seconds
CPU flex cable not connected: flashes blue 3 times quickly for 20 seconds
fpga problem: red light flashes 9 times
Switch motherboard is not powered on: solid white light


But yeah, sometimes these errors codes could indicate something completely different, e.g. DAT0 can cause any of these.

regarding my post above, when I read the documentation:
"Switch motherboard is not powered on: solid white light" -- that is exactly what I get (switch powered off, battery connected, USB adapter to PC connected.
Does that mean I should turn on the switch (V6s installed) WHILE I connect the chip via USB adapter to PC?

Edit: Managed to update the v6s to v2 and afterwards reseted it via putty.
Access via putty was only possible by doing as follows: connecting the console via usb -> console turns on and v6s blue light pulsing. Then I could unplug usb again and could connect the USB tail to the modchip.

I ran diagnosis:

anybody can see whats wrong? If I am not wrong it sais my solderings are ok and some things wrong with this "mmc_send_command". What does it mean?

 

[linkref]

Hi !

I modded like 50+ OLEDs but this one is very strange..

I have an instinct-nx v6s on an OLED. 1 time out of 5/6 it can't glitch error code is purple --> fixed white.
I did reflow my points, changed chip but nothing.

I wanted to connect the chip to the computer, to diagnose the boot and then try to read de error code.
But when I diagnose the boot through computer 'd' it NEVER fails... So I have no error code to read...

I tried 'r' (reset) and 'e' (erase boot0 payload) and 't' (retrain) but nothing worked...

Any ideas ? (My dat0 is kamikazed)

 

[SudoRoot]

...

HA! Happened to me few times, and I never saw anyone mention it anywhere.

It seems like it's a result of interference. Assuming you used the ABCD flex cable, redo everything with wires (as short as possible) and flash the latest v2.0 firmware. Also stick the modchip with 3M tape to the APU shield and THEN let it learn (it had happend to me exactly like to you when I was testing it "mid-air")

At this point, it should work fine, but you can also try resetting the modchip and letting it learn to glitch after screwing the metal back cover back on.

 

[Greasson]

New Switch Lite, instinct NX-V6S, triple checked all the soldering with multimeter and everything is OK, but the screen glitches as on the picture when trying to load payload.bin from microSD.
- Inserting a microSD without any payload.bin gives a warning about not able to load it.
- Booting without microSD, appears the classic no SD card of the Instinct NX load screen
- Trying to boot to OFW gives a blue screen.
- Tried different micro SD format/brand/size too but nothing changed.
- Tried to reflash firmware 2.0 and reset the instinct NX chip but nothing.

Instinct NX console:
> v
Board ID: OLED
SoC detection successful:
eMMC CLK ok: yes
eMMC CMD ok: yes
eMMC DAT ok: yes
eMMC PKT ok: yes
SoC type: Mariko
Device voltage:
Erista rails: 1300
Mariko rails: 1638
FPGA ID: INSTINCT

"The only strange thing is that says OLED instead of Lite... or is it correct?"

Pressng "d" on console, the verbose at the end says the Glitch is successfull but screen is always as pic.

Can be a fried eMMC?

 

[Greasson]

OK, i was able to boot UMS-Loader as payload and i'm doing a full dump using NXnand manager 5.2.1, so i hope this means the eMMC is OK but the program is not able to read the FW version and as Device ID says : keyset needed!

BTW still BSOD with OFW and corrupted screen with any payload apart usm-loader.

 

[Deleted member 693035]

OK, i was able to boot UMS-Loader as payload and i'm doing a full dump using NXnand manager 5.2.1, so i hope this means the eMMC is OK but the program is not able to read the FW version and as Device ID says : keyset needed!

BTW still BSOD with OFW and corrupted screen with any payload apart usm-loader.

You need to dump your keys to read firmware version with NXNand Manager

 

[Sir_Charles]

Hey all,
found that blog while searching for help regarding the V6S Chip.
My switch lately doenst boot anymore into hekate. It just boots into OFW and I usually see red light blinking for 2 seconds or something and then shortly turning blue before it goes out and console boots to OFW and chip is blinking blue again.
First I rarely could stillr each hekate after view attempts. But now I cant anymore. Tried for 30+ times.

I thought reseting / updating the V6s could help so I first tryed that by using the toolbox. It fails and sais "couldnt communicate with modchip"

Then I tried via USB Adapter and PC (modchip connected to switch, switch turned off, switch battery connected.
I see blue blinking for 2 sec before turning red shortly and then into constant white. I dont see any COM port in device manager... so basically no connection to the chip.

...

Edit: Managed to update the v6s to v2 and afterwards reseted it via putty.
Access via putty was only possible by doing as follows: connecting the console via usb -> console turns on and v6s blue light pulsing. Then I could unplug usb again and could connect the USB tail to the modchip.

anybody can see whats wrong? If I am not wrong it sais my solderings are ok and some things wrong with this "mmc_send_command". What does it mean?

Have you figured out this issue? I'm having the same problems (Instinct V6S, OLED, Toshiba emmc, 19.0.1). Tried PuTTY diag but ended up getting white LED (no connection to main board), then it stopped showing up in COM, but using a diff USB port got it working again so I flashed FW v2.0.0.
But while trying to figure out how to connect to PuTTY while powered my Switch stopped powering on like normal, the only way I could get it to turn on was to hard shut down (power 15s) then tap power. It also wouldn't reboot (just power off), and stopped showing charge indicator while off, and plugging in charger wouldn't make it boot either. I left it on OFW charging for a while and somehow it just started powering on like normal again. Very strange issue.

Anyhow, I reinstalled the V6S and got it to glitch correctly with repeated attempts, but after I put everything back together it started having that red 3x to blue flashing 15+s. Or sometimes it does red white red to red flashing 10s. And when I power off from OFW and wait 15s, it'll sometimes do red 3x to blue 3x.

Here's some glitch session/training reports from NX-toolbox:

 

[Greasson]

I think this mod is not so reliable or there are some samples bugged in some way.

 

[Sir_Charles]

I think this mod is not so reliable or there are some samples bugged in some way.

It's weird, sometimes it glitches consistently, sometimes not. It worked fine with maybe 10 reboots/power cycles and then I ran the battery down and started charging, tried reboot while charging and it failed again (straight to OFW, led either flashes red for a long time or sometimes blue). The error code list says flash red is FPGA error and blue is CPU error. After the battery charged to nearly 95% I tried another reboot from OFW and this time it glitched successfully.

I think I messed up the chip when trying to do console diagnostics with PuTTY. I bought a PicoFly to try instead (uses same flex cables). Hopefully that will work better, or at least give me some error codes to know what to fix.

 

[Greasson]

It's weird, sometimes it glitches consistently, sometimes not. It worked fine with maybe 10 reboots/power cycles and then I ran the battery down and started charging, tried reboot while charging and it failed again (straight to OFW, led either flashes red for a long time or sometimes blue). The error code list says flash red is FPGA error and blue is CPU error. After the battery charged to nearly 95% I tried another reboot from OFW and this time it glitched successfully.

I think I messed up the chip when trying to do console diagnostics with PuTTY. I bought a PicoFly to try instead (uses same flex cables). Hopefully that will work better, or at least give me some error codes to know what to fix.

I don't think you can mess it using PuTTY and the console; commands are very limited; there's also a menu bug, there 2 options are the same.

 

[Sir_Charles]

I don't think you can mess it using PuTTY and the console; commands are very limited; there's also a menu bug, there 2 options are the same.

I didn't mess it up with PuTTY commands, but I think I messed up by trying to plug in the USB to the console to get it to turn on/power the chip while the chip was already connected to my PC. I wasn't thinking at the time, but I don't think it's good to have current going to the chip and from the console at the same time, stupid mistake almost bricked my switch (it didn't boot like normal after that, only with hard shutdown 15sec. Charging it while in OFW for a while fixed it somehow.)

Do you happen to know where I can find sdloader.enc to update sdloader from toolbox? I flashed FW 2.0.0 from my PC but I don't know if bootloader.bin is the same as sdloader.enc?

 

[Hayato213]

Have you figured out this issue? I'm having the same problems (Instinct V6S, OLED, Toshiba emmc, 19.0.1). Tried PuTTY diag but ended up getting white LED (no connection to main board), then it stopped showing up in COM, but using a diff USB port got it working again so I flashed FW v2.0.0.
But while trying to figure out how to connect to PuTTY while powered my Switch stopped powering on like normal, the only way I could get it to turn on was to hard shut down (power 15s) then tap power. It also wouldn't reboot (just power off), and stopped showing charge indicator while off, and plugging in charger wouldn't make it boot either. I left it on OFW charging for a while and somehow it just started powering on like normal again. Very strange issue.

Anyhow, I reinstalled the V6S and got it to glitch correctly with repeated attempts, but after I put everything back together it started having that red 3x to blue flashing 15+s. Or sometimes it does red white red to red flashing 10s. And when I power off from OFW and wait 15s, it'll sometimes do red 3x to blue 3x.

Here's some glitch session/training reports from NX-toolbox:
View attachment 480666 View attachment 480668
View attachment 480669 View attachment 480670
View attachment 480671

I would say it is dat0 problem

 

[Greasson]

I didn't mess it up with PuTTY commands, but I think I messed up by trying to plug in the USB to the console to get it to turn on/power the chip while the chip was already connected to my PC. I wasn't thinking at the time, but I don't think it's good to have current going to the chip and from the console at the same time, stupid mistake almost bricked my switch (it didn't boot like normal after that, only with hard shutdown 15sec. Charging it while in OFW for a while fixed it somehow.)

Do you happen to know where I can find sdloader.enc to update sdloader from toolbox? I flashed FW 2.0.0 from my PC but I don't know if bootloader.bin is the same as sdloader.enc?

I don't think you will damage the chip having both USB cable connected, i did it too and it worked.
Sorry but i don't know where to find that files.

 

[Sir_Charles]

I would say it is dat0 problem

I was hoping that's not the case since I double/triple checked each point for consistent values after each step in reassembly and they stayed the same. My CPU SP1/SP2 points were kinda high but I think it was about the same as before I even soldered anything, so I thought it was ok. And I didn't know I should also check ohms for those points until after closing it up.

Just for reference here's all the diode readings I got:

Point ≈ (-gnd | +gnd):
SP1 ≈ 0.29 | 0.43
SP2 ≈ 0.29 | 0.43
3.3V ≈ 0.856 | 0.440
D ≈ 0.758 | 0.490
A ≈ 0.742 | 0.577
C ≈ 0.755 | 0.511
B ≈ 1.983 | 0.434

 

[Drayid]

My switch literally stopped working overnight, the chip flashes Red then purple, then stays White for 2 seconds and turns off, the console Is not booting : /. What does the White led signal?

Same thing here did you get a solution?