Hacking Hardware Picofly - a HWFLY switch modchip

[binkinator]

View attachment 349725difficult to read?) delete it is not a pity.
and you are bald, I will not give the firmware)))

i thought we already had the firmware. Is yours different?

https://gbatemp.net/threads/pikofly-a-probably-fake-hwfly-modchips-or-not.622701/post-10049937

 

[hippy dave]

View attachment 349725difficult to read?) delete it is not a pity.
and you are bald, I will not give the firmware)))

I have a full head of hair, can I have the firmware?

 

[AntonIX]

The original id is just a 64bit number and it is retrieved from the flash chip.
The RP2040 does not have an internal id in the cpu itself (according to the documentation) :
https://raspberrypi.github.io/pico-sdk-doxygen/group__pico__unique__id.html
I don't know if the dump is just a raw dump of the flash chip?
If so, then it should be there.

If not, someone will be able to hack it.
Just speculating here but the firmware is probably the same as for the hwfly.
So we know the decoding algorithm. Then it is just a matter of trying all keys and comparing the output.
With a 64bit key, that will be peanuts for a normal cpu.
I'm sure there are smart kids here who can break this encryption on a Sunday afternoon.

I messaged one guy from 4pda and he gave me contacts of guy who got this dump. This guy said that he bought this picofly on platform like ebay. He said it costs about 50$. And also as I get in, it is just his dump and not complete flash solution. Read command somewhere, like ""some tool" dump all".

 

[Tafty]

We have a dump of firmware from another one, but I've allready flashed that and it isn't working, so obviously a step is missing etc.

 

[impeeza]

I messaged one guy from 4pda and he gave me contacts of guy who got this dump. This guy said that he bought this picofly on platform like ebay. He said it costs about 50$. And also as I get in, it is just his dump and not complete flash solution. Read command somewhere, like ""some tool" dump all".

yeah, "PicoToll save --all" is the command.

 

[AntonIX]

I have thoughts about he is dev, because he ignores any asks about seller and answer parically. He said that it is starting in different time. Can start immediately or takes much more than hwfly.

 

[IgraBIT1]

i thought we already had the firmware. Is yours different?

Yes,

We have a dump of firmware from another one, but I've allready flashed that and it isn't working, so obviously a step is missing etc.

Of course it doesn't work lol. there is a binding by id. on your flash another id
other

 

[AntonIX]

We have a dump of firmware from another one, but I've allready flashed that and it isn't working, so obviously a step is missing etc.

I mean if you know how to get ID and dump from one chip, it is possible.

 

[IgraBIT1]

I mean if you know how to get ID and dump from one chip, it is possible.

getting the id of your flash is not a problem.

 

[Doodka]

I messaged one guy from 4pda and he gave me contacts of guy who got this dump. This guy said that he bought this picofly on platform like ebay. He said it costs about 50$. And also as I get in, it is just his dump and not complete flash solution. Read command somewhere, like ""some tool" dump all".

i think thats the same guy, who drop firmware here
u can install picotool from github and compare it with this dump in hxd

 

[AntonIX]

getting the id of your flash is not a problem.

We can compare bytecode of two different dumps.

Post automatically merged: Jan 27, 2023

i think thats the same guy, who drop firmware here
u can install picotool from github and compare it with this dump in hxd

Yes it is.

 

[Doodka]

We can compare bytecode of two different dumps.

and this will put an end to the question, is there protection by id or not

 

[saladus]

well we'd need a second dump wouldn't we?

 

[AntonIX]

well we'd need a second dump wouldn't we?

Just checked both dumps, md5 is different. Possibly this is dumps from different chips. Uf2 is the same

Post automatically merged: Jan 27, 2023

View attachment 349725difficult to read?) delete it is not a pity.
and you are bald, I will not give the firmware)))

Can you share your firmware too? Or you dont have it?

 

[vittorio]

does the latest payload work?

 

[AntonIX]

does the latest payload work?

I dont have mariko and chip to test. Or what you are talking about?

 

[FruithatMods]

My best friend's sister's boyfriend's brother's girlfriend heard from this guy who knows this kid who is able to crack these sort of ID checks.

That kid would need a legit firmware dump though for him to do his magic. Can anyone fill me in on the firmware? Do we have any binaries? Is the posted blob a single program or are those a bunch of binaries?

 

[Doodka]

My best friend's sister's boyfriend's brother's girlfriend heard from this guy who knows this kid who is able to crack these sort of ID checks.

That kid would need a legit firmware dump though for him to do his magic. Can anyone fill me in on the firmware? Do we have any binaries? Is the posted blob a single program or are those a bunch of binaries?

a little higher in the subject there is an archive with a firmware dump

Just checked both dumps, md5 is different. Possibly this is dumps from different chips. Uf2 is the same

bins same too, its just cleared of empty blocks, so md5 must be identical

 

[SylverReZ]

a little higher in the subject there is an archive with a firmware dump

bins same too, its just cleared of empty blocks, so md5 must be identical

The dump is the same as this guy's dump here: https://gbatemp.net/threads/pikofly...y-modchips-or-not.622701/page-8#post-10049937

They just added extra padding to the dump to make it more convincing. You ain't fooling nobody, kiddo.

 

[Doodka]

View attachment 349725difficult to read?) delete it is not a pity.
and you are bald, I will not give the firmware)))

so, is it works? can you upload video? and can you upload dump?

Post automatically merged: Jan 28, 2023

Little update on this...after posting I thought I better go and check I had soldered in the flex's correctly so took the rp out and wired up a sx core manually using the same wires i was using for the rp(dont have any lites currently) and it wouldn't glitch...turns out I hadn't soldered dat 0 correctly.

fixed that issue and confirmed my wiring was good with the sx, rewired the RP back in but unfortunately getting the same result. blue light then red light...BUT now im NOT getting into OFW like I was before, this is similar to what happens when you have soldered a sx/hw chip in incorrectly(again I confirmed this wasn't the case)

removing 3.3v does allow the console to then boot OFW like normal(expected behaviour)

so IMO at this point its trying to do something and failing...maybe this is to do with the ID encryption I read a few pages back...maybe its missing something but im now in a position where I can test anything hardware side. so please let me know.

also ive tested the install with and without resistors as the picture on page 1 clearly doesn't have them installed. so not sure why schematic a few pages ago does

how did you upload uf2? by using usb or picotool?

Post automatically merged: Jan 28, 2023

The dump is the same as this guy's dump here: https://gbatemp.net/threads/pikofly...y-modchips-or-not.622701/page-8#post-10049937

They just added extra padding to the dump to make it more convincing. You ain't fooling nobody, kiddo.

View attachment 349743

he said that he received the file from the 4PDA user, most likely this is the same guy who threw off the first dump