Hacking Hardware Picofly - a HWFLY switch modchip

[fabjef]

I'm about to create a new thread with information in one place including, firmware, images etc.

go ahead we are happy and waiting

 

[mrdude]

How could you easily program it?

Temp solder a usb cable onto it, you only need to flash it once.

 

[DankBreak270]

Man I know why I love modding switch’s now I just spent 4 hours trying to figure out why my wifi wasn’t working after getting preparations done for my rp2040 that arrives tomorrow I must have turned on my switch 30 times hoping for the Wi-Fi to work now I don’t know if replacing the caps near the apu or reflowing the Wi-Fi card fixed it but I’ll take it the joy you get when it works is so great

 

[mrdude]

Man I know why I love modding switch’s now I just spent 4 hours trying to figure out why my wifi wasn’t working after getting preparations done for my rp2040 that arrives tomorrow I must have turned on my switch 30 times hoping for the Wi-Fi to work now I don’t know if replacing the caps near the apu or reflowing the Wi-Fi card fixed it but I’ll take it the joy you get when it works is so great

I once spent about an hour trying to figure out why my wifi wouldn't connect and the switch would crash trying to connect to my wifi, then I remembered I'd changed the DNS settings - doh!

 

[SorataVP69]

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

Spoiler: LED indication

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success

Spoiler: Diagrams

View attachment 357132
View attachment 357133
View attachment 357135
View attachment 357134
View attachment 357136

Spoiler: Solder example

View attachment 357137
View attachment 357138
View attachment 360187
View attachment 357139
View attachment 357140
View attachment 360186

Spoiler: Issues, questions

Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

Spoiler: Atmosphere unlock

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card

Spoiler: Reboot to OFW / Vol+ & Vol- doesn't work, blue/black screen

Boot into Full Stock and perform a full system reset.

hello, if I have the flex cables of the hwfly for the V2, Lite or Oled, should I still solder "irfsh8342" and the resistors? thanks for the great job btw

Post automatically merged: Mar 21, 2023

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

Spoiler: LED indication

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success

Spoiler: Diagrams

View attachment 357132
View attachment 357133
View attachment 357135
View attachment 357134
View attachment 357136

Spoiler: Solder example

View attachment 357137
View attachment 357138
View attachment 360187
View attachment 357139
View attachment 357140
View attachment 360186

Spoiler: Issues, questions

Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

Spoiler: Atmosphere unlock

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card

Spoiler: Reboot to OFW / Vol+ & Vol- doesn't work, blue/black screen

Boot into Full Stock and perform a full system reset.

hello, if I have the flex cables of the hwfly for the V2, Lite or Oled, should I still solder "irfsh8342" and the resistors? Thanks for the great job

 

[everyonesweird]

Hold the bootsel button and copy the uf2 file

Thanks. I have everything ready only need to flash the files to rp2040. I have 3 UF2 Files. 2.5+Unlock.uf2 , FW2.5NW.uf2 and Unlock.uf2. I guess ill have to copy only 2.5+unlock.uf2 right?

 

[DankBreak270]

I once spent about an hour trying to figure out why my wifi wouldn't connect and the switch would crash trying to connect to my wifi, then I remembered I'd changed the DNS settings - doh!

When the switch came out and I was still like 12 I left airplane mode on didn’t know I couldn’t connect for a week

 

[Phantomas77]

hello, if I have the flex cables of the hwfly for the V2, Lite or Oled, should I still solder "irfsh8342" and the resistors? thanks for the great job btw

Post automatically merged: Mar 21, 2023

hello, if I have the flex cables of the hwfly for the V2, Lite or Oled, should I still solder "irfsh8342" and the resistors? Thanks for the great job

The MOSFETs are already present in the cable, you should be just good to go with it only.
The resistors are necessary for filtering signal interference and for booting into SYSMMC, more info just few pages ago.

 

[marhalloweenvt]

has anyone seen seeed XIAO rp2040, is this chip also compatible? - Seems it’s hard to buy RP2040-Zero in UK unless anyone has any best places to buy from?

For the current fw, Xiao is not supported due to lack of pin out:
- Pin 25 for setting RGB/GRB led mode (important for debugging)
- Pin 15 for CPU data line (important for glitching)

 

[Adran_Marit]

Thanks. I have everything ready only need to flash the files to rp2040. I have 3 UF2 Files. 2.5+Unlock.uf2 , FW2.5NW.uf2 and Unlock.uf2. I guess ill have to copy only 2.5+unlock.uf2 right?

That seems correct to me, yes

 

[malgamer]

For those trying to save space and not wanting to remove buttons or the usb port - This should also work,

Pimoroni PGA2040
https://shop.pimoroni.com/products/pga2040
https://coolcomponents.co.uk/products/pga2040-an-rp2040-breakout-board

amazing bro , good shared

 

[linuxares]

Amazing work!

 

[peteruk]

another youtube videos posted 13 hours ago.

Very very clever, wearing gloves to hide those finger nails

(They're clearly following our thread)

 

[linuxares]

Very very clever, wearing gloves to hide those finger nails

(They're clearly following our thread)

No its to protect the finger prints from ninjas

 

[mrdude]

No its to protect the finger prints from ninjas

It's because the sweat and grease on your fingers is acidic and causes corrosion over time. You should wear latex gloves or finger cots really when dealing with electronics.

 

[linuxares]

It's because the sweat and grease on your fingers is acidic and causes corrosion over time. You should wear latex gloves or finger cots really when dealing with electronics.

I know... I tried to be funny

 

[vittorio]

on mariko the mosfet is mounted like this?

 

[everyonesweird]

i need to find RST(B) point in this V1 Patched Motherboard. Please help im down to 1 wire only.

 

[Dee87]

i need to find RST(B) point in this V1 Patched Motherboard. Please help im down to 1 wire only.

it is also on the emmc Board bottum side

 

[Donnie-Burger]

i need to find RST(B) point in this V1 Patched Motherboard. Please help im down to 1 wire only.