Hacking Hardware Picofly - a HWFLY switch modchip

[abal1000x]

In hekate i choose reboot -> ofw, it reboot then blank screen and back to hekate again.
i also try turn on then press vol+ and vol-, it tries to boot then back to hekate.
Is it normal?

Post automatically merged: Apr 10, 2023

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot
v2.6 + software update, xiao & itsy support
v2.61 + Instinct-NX sdloader, bug fixes

Spoiler: LED indication

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
PINK = NS eMMC init fails, inoperative eMMC ?
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success

Spoiler: Diagrams by Dee87

View attachment 357132
View attachment 363821
View attachment 363822
View attachment 357133
View attachment 357135
View attachment 357134
View attachment 357136

Spoiler: Solder example

View attachment 357137
View attachment 357138
View attachment 360187
View attachment 363817
View attachment 357139
View attachment 357140
View attachment 360186

Spoiler: Issues, questions

Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: rp2040 boards support
A: WaveShare 2040-zero/one, xiao-rp2040, adafruit itsybitsy (Pi Pico is not supported for now)

Q: GREEN, but instant reset
A: Clean flux near the RST point

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot (sysNAND data can be damaged).

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

Spoiler: Reboot to OFW / Vol+ & Vol- doesn't work, blue/black screen

v2.5 firmware had a bug with BOOT0 corruption. To recover it:
- boot "Full Stock" using hekate
- update to the latest official firmware over Wi-Fi

Spoiler: Sleep mode does not work

- boot "Full Stock" using hekate
- perform a full system reset

Spoiler: Toolbox 0.2 features

- show firmware information
- update firmware from SD card (place update.bin into the root folder)
- rollback to the backup firmware slot
- reset learning statistics
- dump / write sdloader

Spoiler: RGB LED explanation by lightninjay

if you have an rp2040-zero from waveshare/ali then it has a neopixel. It is used for diagnosing proper firmware flashes as well as console glitching. If you plug it in, and flash the uf2 firmware to it and immediately see a red light after flashing (this is not the same as flashing, then unplugging and replugging), then no rgb jumper needs to be made. If on the other hand, you get one quick green flashing light, then you need to bridge the jumper pads indicated to swap the LED colors for proper diagnoses capability.

I cannot reboot to OFW (black screen).
Never used fw2.5 (because of different pico sn), only 2.6 alpha and 2.61.

How to do "Full Stock" using hekate ?
(I already at latest firmware 16.0.1, so cant do update)

 

[realtimesave]

u think the hwfly is gonna make a difference if u dont get a rst connection it also needs it :-)

Post automatically merged: Apr 9, 2023

check for continuity between the D0 cables....
and make sure there are no bridges

it will because the RST still goes through the motherboard into the slot for the EMMC. It's just going to work. The RST that got broke off is on the EMMC, not the entire pin going to the motherboard.

 

[Dandan0404]

if you guys have a problem using the cables, you don't actually need to solder on the ffc contacts at the end (pad 3&4)
instead, use the resistor on the underside of the metal backing. it's actually easier and more secure.

if you use the flex cable instead of soldering to the middle pins you can solder to the resistor under the mosfet section

Any pictures or videos?

 

[ChiefSZ13]

u think the hwfly is gonna make a difference if u dont get a rst connection it also needs it :-)

Post automatically merged: Apr 9, 2023

check for continuity between the D0 cables....
and make sure there are no bridges

I think I bridged 3.3v and the rst pins on the eMMC connector…
It interferes the rst and gets a yellow led I guess?

(Also the console is just black without booting into OFW, after disconnecting CLK the console would just boot normally)

 

[rehius]

In hekate i choose reboot -> ofw, it reboot then blank screen and back to hekate again.
i also try turn on then press vol+ and vol-, it tries to boot then back to hekate.
Is it normal?

Post automatically merged: Apr 10, 2023

I cannot reboot to OFW (black screen).
Never used fw2.5 (because of different pico sn), only 2.6 alpha and 2.61.

How to do "Full Stock" using hekate ?
(I already at latest firmware 16.0.1, so cant do update)

In some CFW packs it's under "More configs" option.
Pretty strange, could you please send me your BOOT0 backup in PM?

OFW boot also breaks if you:
- apply system update in Atmosphere mode
- use daybreak instead of the official update way

 

[Adran_Marit]

Any pictures or videos?

not fo yet that I've seen

 

[Phantomas77]

OFW boot also breaks if you:
- apply system update in Atmosphere mode
- use daybreak instead of the official update way

Just want to ask some details, so what will be the best way to update the OFW (SysNAND) and EmuNAND?

• OFW - by booting to OFW and updating directly via Ninty servers? Should be ok if I didn't mess with homebrew on the SysNAND, right?
• EmuNAND - I only used Daybreak in the past, which are the alternatives for updating and not corrupting the BOOT0 with Pico?

 

[demonfish]

Looked white to me, but of course I was panicking a the time and I may not remember correctly
A good ending would be if it was only some residual fresh flux getting burnt, but I don't think that the temperature could be THAT hot

Post automatically merged: Apr 9, 2023

Of course I triple checked the flex cable and both SP1 and SP2, but there's no obvious short or bad soldering. And everything just works, so I'm pretty confused but feels a bit scary to just close everything after that

Really don`t worry Mate, if it works OK and as you said you not 100% sure where the smoke came from? and after triple checking all joints , you can`t see anything wrong.. Then just be done with it and move on, Be happy it`s working,
If you keep [email protected]@king with something that`s working.....Then it surely will break

 

[FreeLander]

I’ve got a cheap Amazon hot air. I do 350c at 40% air and removed everything perfectly. Added low melt to all points


Sent from my iPhone using Tapatalk

Thanks. Tried that and worked smoothly, the melting solder was the secret sauce.

 

[rehius]

Just want to ask some details, so what will be the best way to update the OFW (SysNAND) and EmuNAND?

• OFW - by booting to OFW and updating directly via Ninty servers? Should be ok if I didn't mess with homebrew on the SysNAND, right?
• EmuNAND - I only used Daybreak in the past, which are the alternatives for updating and not corrupting the BOOT0 with Pico?

OFW - update from the OFW (true OFW boot using Vol+/Vol-) or Full Stock mode (no atmo patches applied) using WiFi
EmuNAND - any method is fine, when you are in EmuNAND, real BOOTs should not be touched.

 

[naize]

Can I install the mosfet at 2 points as shown? I saw 1 video on youtube doing so, it will be easier for me to solder instead of 2 points soldering outside but i dont know if it works? Thank you very much

 

[Dee87]

I think I bridged 3.3v and the rst pins on the eMMC connector…
It interferes the rst and gets a yellow led I guess?

(Also the console is just black without booting into OFW, after disconnecting CLK the console would just boot normally)

U guess or u know?

well get rid of that bridge and see if it works now Xd

Post automatically merged: Apr 10, 2023

Can I install the mosfet at 2 points as shown? I saw 1 video on youtube doing so, it will be easier for me to solder instead of 2 points soldering outside but i dont know if it works? Thank you very muchView attachment 364044

sure

 

[tigermark2020]

so, installed picofly into an oled today, with fw2.5_nw_toshiba - works great no issues, boot atmoshphere, boot ofw, etc.
when i install 2.61 it wont boot ofw - hangs after nintendo logo. revert to 2.5 and it works again? any idea what could be causing this?

 

[rehius]

so, installed picofly into an oled today, with fw2.5_nw_toshiba - works great no issues, boot atmoshphere, boot ofw, etc.
when i install 2.61 it wont boot ofw - hangs after nintendo logo. revert to 2.5 and it works again? any idea what could be causing this?

that is very strange. what happens on v2.6?

 

[tigermark2020]

that is very strange. what happens on v2.6?

also hangs after nintendo screen.
its worth noting i had the same issue on a mariko v2 console - rp2040 - zero - on the mariko i replaced with a hwfly chip asi assumed maybe i did something wrong but the hwfly chip worked fine, (using same cables and mosfet)
i tried today with a different rp2040 zero board and a fresh install in an oled, same behaviour as before,
works fine on 2.5_nw_toshiba_fix
but 2.6a and 2.61hangs after nintendo logo everytime on boot ofw (just pressing vol+/- on no sd screen, and also in hekate reboot, ofw)

 

[rehius]

ok, I have 3 mariko boards (v2, OLED, Lite), will test all of them.
once reproduced it should be easy to fix

 

[tigermark2020]

ok, I have 3 mariko boards (v2, OLED, Lite), will test all of them.
once reproduced it should be easy to fix

also,(just wondering if i can just leave it on this firmware and close up the console or wait for a fix) is the boot 0 bug present in fw_2.5_nw_toshiba_fix.uf2 or was that only in the previous 2.5? thanks for your time i appreciate all your effort and help.

 

[rehius]

also,(just wondering if i can just leave it on this firmware and close up the console or wait for a fix) is the boot 0 bug present in fw_2.5_nw_toshiba_fix.uf2 or was that only in the previous 2.5? thanks for your time i appreciate all your effort and help.

toshiba fix is the same as 2.5. the bug was in the software unlock thingy. it won't trigger unless you use unlock via the toolbox

 

[AJun]

May I know the resistance value of point A resistor

 

[tigermark2020]

toshiba fix is the same as 2.5. the bug was in the software unlock thingy. it won't trigger unless you use unlock via the toolbox

Thanks, I used the unlock Uf2 file so that should be fine.