Hacking Hardware Picofly - a HWFLY switch modchip

[Hayato213]

I have a couple Switch Lite's around with broken EMMC IC's. Would a Emunand be able to be installed on these? They won't boot to Sysnand currently.

You can't create an emummc without a working sysnand.

 

[SQc04]

Looks awesome, it might be a good idea to put all the components on the top layer so the board can be more easily attached with double sided tape

It may not fit all the components, because this PCB is too small, I'll give it a try

 

[Dee87]

Not my video XD

 

[SQc04]

gnd vcc are both solid even measured when it booted

wire is not brocken or cold solderd i will send a picture of the rapsberry son my wife is on the phone at the moment...
how would i install a second mosfet?
tried rebooring several times didnt work

how do u mean probe vcc/gnd with the right capacitor?

I think that FETs with currents greater than 10A can be used, and the reason for using IRFHS8342 may be because of its small package

Post automatically merged: Mar 23, 2023

I think that FETs with currents greater than 10A can be used, and the reason for using IRFHS8342 may be because of its small package

Because the power supply capacity of the CPU is about 1V 10A, the FET short-circuit power supply makes the CPU power supply unstable

 

[leerz]

I made a smaller RP2040 board, which is still being revised

would be great to integrate the mosfet onto the chip, so we can just use a plain flex cable or even jumper wire to it, avoids dangling flex


also my aula install

 

[Kid4life79]

you can use the mod on the last page where that temper replaced the USB port by a ribbon connector, then solder the conector to a ribbon cable. or you can just put a temporary connector soldering the only 4 cables needed, +5v, GND, D+ & D-

Is this correct? Trace 6, 7 and 11 from left to right?

 

[Morricorne]

I hear on rp2040 one this mod can be done. Is that right?

 

[Saliciae]

would be great to integrate the mosfet onto the chip, so we can just use a plain flex cable or even jumper wire to it, avoids dangling flex


also my aula install

I'm integrating mosfet into the mcfly, but honestly no idea if it will work, I dont think it will tbh, but i've been wrong before

If someones got a working install and is willing to try things for the sake of science, what happens if you relocate the mosfet remotely and connect it using long wires? you'll definitely want reasonably thick wires for it, magnet wire etc wont do the job.

 

[Nagaa]

Post automatically merged: Mar 23, 2023

I'm trying to do the installation on my OLED but I get a blue light right after a white one and the device starts in the original cfw, does anyone know what it could be?

Use HWFLY NX sdloader, or wait 2.6 update rehius should fix this

 

[leo20230323]

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

Spoiler: LED indication

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success

Spoiler: Diagrams

View attachment 357132
View attachment 357133
View attachment 357135
View attachment 357134
View attachment 357136

Spoiler: Solder example

View attachment 357137
View attachment 357138
View attachment 360187
View attachment 357139
View attachment 357140
View attachment 360186

Spoiler: Issues, questions

Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

Spoiler: Atmosphere unlock

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card do not use, bugged.

Spoiler: Reboot to OFW / Vol+ & Vol- doesn't work, blue/black screen

Boot into Full Stock and perform a full system reset.

I have never been clear about the relationship between the v2.5 and unlock

 

[linuxares]

Anyone got a modchip on a OLED installed and a multimeter (and possibily the courage to do some scratching of soldermask?).

RED = DAT0, the image moves so I think it's the 2nd bottom.
GREEN = possible area it leads to.
BLUE, PURPLE, PINK = Areas that needs to be probed. Since they seem to go to the CPU after their transistor.

 

[ghjfdtg]

Mcfly
Minifly
NXfly
Flybye
Z-fly

+1 for Flybye. RIP hwfly. You won't be missed.

 

[impeeza]

Is there a way to use boot0/boot1 from another oled?

There is a guide to repair sysnand damaged by SXOS recreating BOOT0/BOOT1 from scratch, I really do not remember the URL but you can find easily on the search at top of page.

I made a smaller RP2040 board, which is still being revised

Wow is an absolute mindblow gadget, there is there a RGB LED?

would be great to integrate the mosfet onto the chip, so we can just use a plain flex cable or even jumper wire to it, avoids dangling flex


also my aula install

Is a good idea but for the glitch be stable you need to have the MOSFET closes as you can to the capacitors for avoid "Eddy-currents" and timing issues. That´s why even the hflw have a separated flex cable to the CPU.

 

[3CP-andres-N]

colleagues, the rp2040-one can be used to install and do the whole procedure, the size doesn't matter to me???

 

[rehius]

Anyone got a modchip on a OLED installed and a multimeter (and possibily the courage to do some scratching of soldermask?).

RED = DAT0, the image moves so I think it's the 2nd bottom.
GREEN = possible area it leads to.
BLUE, PURPLE, PINK = Areas that needs to be probed. Since they seem to go to the CPU after their transistor.
View attachment 360890View attachment 360891
View attachment 360892

man, there are no alt points, all DAT traces go inside the PCB, the best you can do is drilling in two places, the best of which I have posted earlier.

 

[impeeza]

Is this correct? Trace 6, 7 and 11 from left to right?

I don´t really know but hope some other temper on the thread can confirm it.

 

[jkyoho]

Switch lite, mosfet direct solder to SP1 cap(sp2 not touch). I got RED led and NINTENDO LOGO SHOWS, any thought?
FYI, SK HYNIX emmc
ordering IRFHS8342, incase the MOSFET took off from v1 flex is giving me all hassles

 

[linuxares]

man, there are no alt points, all DAT traces go inside the PCB, the best you can do is drilling in two places, the best of which I have posted earlier.

You sure? Since I checked here and followed it - https://balika011.hu/switch/oled/

 

[rehius]

There is a guide to repair sysnand damaged by SXOS recreating BOOT0/BOOT1 from scratch, I really do not remember the URL but you can find easily on the search at top of page.


Wow is an absolute mindblow gadget, there is there a RGB LED?



Is a good idea but for the glitch be stable you need to have the MOSFET closes as you can to the capacitors for avoid "Eddy-currents" and timing issues. That´s why even the hflw have a separated flex cable to the CPU.

I have imagined the best picofly custom board as 0.4-0.5mm thin (flex, or not) PCB that is soldered directly onto the CPU caps (somehow compatible with both v1/v2) and rp2040/flash/quartz on the back side hiding within CPU / RAM free space. Of course with solder points on the top side in the place where CPU / RAM cover has a vertical hole.

here you would have a single, universal board that fits everywhere, perfectly hiding all the hardware under the heatsink

Post automatically merged: Mar 23, 2023

You sure? Since I checked here and followed it - https://balika011.hu/switch/oled/

I had checked this few months ago. the traces go directly to the CPU balls, drilling only.

 

[linuxares]

I had checked this few months ago. the traces go directly to the CPU balls, drilling only.

Rats! Aight... any safer place for drilling? xD