Hacking Hardware Picofly - a HWFLY switch modchip

[Hayato213]

boot0 is the same for switches with same firmware version, so you can get kown your firmware version form fuse,and restore a same version boot0 .

Actually boot0 is console specific.

 

[master_0123]

Actually boot0 is console specific.

But this will work , right?

 

[khuong]

I have no simple way to confirm the start of the flash ID; I tried compiling the example, both as is and modified for USB output, and got nowhere.

https://forums.raspberrypi.com/viewtopic.php?t=302147

 

[Hayato213]

But this will work , right?

It should work if it the same console boot0, since boot0 has some console specific data.

https://gbatemp.net/threads/is-boot0-1-console-specific.522415/

 

[darviral]

did you cut the signal tracks under the Dat0 adapter?

No i didn't

 

[Adran_Marit]

i mean everybody should know that but its better to remind them


Oh true That was u , well i mean u live and learn right , i bet everyone hase destroyed something in the name of science Xd

That's it.

Doing an rgh3 on an Xbox 360 is a cheap starter solder project. If you can connect to the c5r35 via, this switch mod looks very doable.

Oled clk is 1/4 the size of a slim 360 pll point.

Also I've seen plenty of failed rgh3 attempts, people dont have the right equiment or are impatient and mess up... short a wire they shouldn't etc etc.

Just cause a mod is cheap doesn't make it easy.

 

[Gadorach]

usually that happens when you have much flux around RST
but in the very rare cases you have to add a resistor to the RST point (up to 20K)

Hey, finally had time to resolder all the points and clean everything up from flux. I had removed the USB port, but I bodged in a USB cable and bootsel button for now to reflash the chip and verify everything. Same issue as before. Video attached.



Is there any chance it's looking for a specific sector size on the SD card? Special setup of FAT32? Very specific payload.bin? I'm a bit lost after reflashing both with the individual firmware and then unlock.bin, as well as trying to reflash with just the 2.5 firmware+unlock.bin. Any thoughts? I tried 22k on RST, which just prevented the console from booting, and then 47ohms, which changed nothing compared to having no resistor. If I disconnect VCC from the RP2040, it starts up just fine though into retail HOS.

 

[dkabot]

https://forums.raspberrypi.com/viewtopic.php?t=302147

Trying three different ways of making machine.unique_id() legible hex in MicroPython all gave me the same result of DE 62, or if it's somehow backward, 2C 6E.
Safe to say the 4MB flash is of the 'wrong' starting portion.

 

[JackFrostSMT]

Trying three different ways of making machine.unique_id() legible hex in MicroPython all gave me the same result of DE 62, or if it's somehow backward, 2C 6E.
Safe to say the 4MB flash is of the 'wrong' starting portion.

Also, using the attached file you can get your RP-2040-Zero unique Flash ID.
Connect rp-2040-zero to the PC. Look at the COM port of the chip in the device manager.
Just drug-and-drop .uf2 to your chip and then connect to the COM port using PuTTY or KiTTY (or whatever you use). Strings with a Flash ID of your chip will appear in the console (Flash ID: XX XX XX XX XX XX XX XX).

Could also use this instead of trying to build it

 

[dkabot]

Could also use this instead of trying to build it

Pray forgive that even with search tools it's difficult to find things in a thread this large.
Confirms the suspicions, DE 62.

 

[impeeza]

But this will work , right?

There is a tutorial here on gbatemp for creating a boot0 from scratch you don't get a full functional but one which works

 

[HenryMin]

Actually boot0 is console specific.

Nop, it's not console sepcific, especially on mariko.

Erista has console specific part named 'keyblob' or 'EKS', but it is unused on fw 7.0.0 or higher.

 

[LogicalMadness]

I could have sworn I saw someone post pictures of the pinout for the USB port on the PZeros, but I can't find it searching this thread. All I could find was @Warbeast asking w\o answers.

Am I missing something?

 

[Girtana1]

Hey, finally had time to resolder all the points and clean everything up from flux. I had removed the USB port, but I bodged in a USB cable and bootsel button for now to reflash the chip and verify everything. Same issue as before. Video attached.



Is there any chance it's looking for a specific sector size on the SD card? Special setup of FAT32? Very specific payload.bin? I'm a bit lost after reflashing both with the individual firmware and then unlock.bin, as well as trying to reflash with just the 2.5 firmware+unlock.bin. Any thoughts? I tried 22k on RST, which just prevented the console from booting, and then 47ohms, which changed nothing compared to having no resistor. If I disconnect VCC from the RP2040, it starts up just fine though into retail HOS.

you are using the cap above the SD slot, not sure if I've seen anyone confirm this works for Pico

https://gbatemp.net/threads/tutoria...oint-for-switch-lite-modchip-installs.610654/

 

[Warbeast]

I could have sworn I saw someone post pictures of the pinout for the USB port on the PZeros, but I can't find it searching this thread. All I could find was @Warbeast asking w\o answers.

Am I missing something?

You just need d+ d- vcc gnd then connect boot button wire to ground will enable it

 

[handsom_tomato]

I am truly grateful to those who have answered many of my questions! With my naked eye, beginner-level soldering skills, and patience, I was finally able to boot Hekate on my V2 Mariko. I was so happy that it could be started even with such rough soldering! Pikofly is amazing!

 

[Arakon]

I am truly grateful to those who have answered many of my questions! With my naked eye, beginner-level soldering skills, and patience, I was finally able to boot Hekate on my V2 Mariko. I was so happy that it could be started even with such rough soldering! Pikofly is amazing!

I'd recommend shortening the blank ends so that only the blank part is actually on the solder spot, especially on the pico. Otherwise they can snap off and also cause short circuits. Only remove as much insulation as you actually need.

 

[handsom_tomato]

特にピコでは、ブランク部分だけが実際にはんだスポットにくるように、ブランクの端を短くすることをお勧めします。そうしないと、それらが折れたり、ショートしたりする可能性があります。実際に必要なだけ断熱材を取り除きます。

For now, I didn't worry about the length of the wires because I wanted to immediately backup things like NAND and boot0. I plan to adjust the length later on!

 

[Gadorach]

you are using the cap above the SD slot, not sure if I've seen anyone confirm this works for Pico

https://gbatemp.net/threads/tutoria...oint-for-switch-lite-modchip-installs.610654/

Wowwwwwwwwww

That was literally it. VCC must have been switching at that point, or maybe it was interrupting the 3.3V input to the SD card. That cap is way too damn small to be using as a permanent point though, going to have to find another option.

Thanks a bunch!

 

[darviral]

Testing Picofly OLED w/ Mosfet 😊