Hacking Hardware Picofly - a HWFLY switch modchip

[busmanl30]

CYAN = no reaction to the glitch. Check your mosfet soldering. It must be a 0.2mm wire to both caps, no cold joints. (you can post a photo here). With bad setup it can partially work, but not on the whole range of tested offsets.re

CYAN = no reaction to the glitch. Check your mosfet soldering. It must be a 0.2mm wire to both caps, no cold joints. (you can post a photo here). With bad setup it can partially work, but not on the whole range of tested offsets.

Reflashed to 2.65 and reset bug was gone, I’m using an HWFLY APU cable, I no longer have issues, just had to solder some wire to a usb and short out the boot button

 

[mvmiranda]

v2.65 - added RP Pico support. might be cut after flashing to fit:

View attachment 364817

you can attach a ws2812 RGB LED to pin 16 for debug.
a default RP Pico LED also works (before you cut the board), but only in the ON / OFF mode

P.S. sure this soldering sucks, I don't care. you get the firmware and the diagram, that's it

@rehius I cannot find fw_2.56 to download but fw_2.65_l.
Are they the same?

 

[lightninjay]

@rehius I cannot find fw_2.56 to download but fw_2.65_l.
Are they the same?

Re-read Rehius's post, there is no such thing as "fw_2.56"

2.65 should be the latest at the moment.

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot
v2.6 + software update, xiao & itsy support
v2.61 + Instinct-NX sdloader, bug fixes
v2.62 + Make 16.0.1 happy (fix OFW boot)
v2.63 + roll back some 2.62 boot speed tricks
v2.64 + enable back the board detection
v2.65 + RP Pico support, double reset removed

 

[mvmiranda]

Re-read Rehius's post, there is no such thing as "fw_2.56"

2.65 should be the latest at the moment.

It was a typo.
I'm, looking for fw_2.65

 

[lightninjay]

It was a typo.
I'm, looking for fw_2.65

Check the Important posts tab at the top of the page for the only tab called "Firmwares". Alternatively, you can click the redirect button on the quote from Rehius that I edited to my previous post and it will take you to the same page.

 

[mvmiranda]

Check the Important posts tab at the top of the page for the only tab called "Firmwares". Alternatively, you can click the redirect button on the quote from Rehius that I edited to my previous post and it will take you to the same page.

Found it!
Page 78!
Thx for the tip!

 

[Smiles]

Where else can I run source from?

 

[lightninjay]

Where else can I run source from?

Am I correct in assuming you are asking about wiring the MOSFET?

If so, Source from the mosfet just needs to go to ground of the Switch motherboard. Theoretically any ground point should work.

 

[morcha3]

thank you very much from the heart for the hard work REHIUS. its your help I will never have achieved this feat

 

[akim14]

no

Post automatically merged: Apr 14, 2023

From the photo it also looks like cold joint for the S wire

Hello, its me again. And with your test fw it can be glitched only manually. Any idea why?

 

[Smiles]

Am I correct in assuming you are asking about wiring the MOSFET?

If so, Source from the mosfet just needs to go to ground of the Switch motherboard. Theoretically any ground point should work.

Thank you, I had to add a second mosfet and now it is booting to picofly. I want to add if anyone else is thinking of doing this. This was one of the most finicky and butt clenching soldering jobs I have ever done. There were a few moments where I thought I fried my switch. I was able to get my wifi working. I never did use a cap from the pico. I just bridged those connections as soldering that grain of sand sized cap just was not going to work for me. Thank you to those who wrote the code and all those that gave great advice here on the process.

 

[lightninjay]

Thank you, I had to add a second mosfet and now it is booting to picofly. I want to add if anyone else is thinking of doing this. This was one of the most finicky and butt clenching soldering jobs I have ever done. There were a few moments where I thought I fried my switch. I was able to get my wifi working. I never did use a cap from the pico. I just bridged those connections as soldering that grain of sand sized cap just was not going to work for me. Thank you to those who wrote the code and all those that gave great advice here on the process.

I'm right there with you on the butt clenching! Except I actually DID have to resolder BOTH of those grains of sand capacitors. Was it necessary? Likely not. But I learned I am capable of micro soldering

 

[Phantomas77]

i havent open my lite, so soon i should seen them by myself. number 2 look great if didnt neet to cut the shield, but also im ok if need cut the shield little bit just around the rp2040 location... . yeah ive prepare my kapton tape... for everything .


are those cover 1&2 has the same high/height/tall
View attachment 365250

from image number 2 kinda look lower than no.1
but idk is just illusion ? maybe im wrong.....

Just opened my Lite and moved the Pico from #1 to #2, and can confirm that on the #2 position it's a perfect fit, no need to cut the shield and has enough room to fit everything without extra pressure. Just make sure to insulate nicely the Pico (top, bottom and sides) with Kapton tape.
The only thing that I don't like about #2 position, are the longer wires for GND and +3.3V, but it works good anyway.

 

[ecko4711]

Guys i just installed Picofly but when I boot, I get a blue yellow light and then it just boots normal to the OFW. Anyone can tell me what i should check? I am also using the 471 ohm transistors. Maybe thats the reason?

 

[lightninjay]

Guys i just installed Picofly but when I boot, I get a blue yellow light and then it just boots normal to the OFW. Anyone can tell me what i should check? I am also using the 471 ohm transistors. Maybe thats the reason?

If you didn't just typo, and you actually put 471 ohm resistors on, you need to change them all out for 47 Ohm resistors (with a coincident label of 470 on them)

Other than that, a flashing yellow/orange light would indicate you should check your Dat0 solder points.

 

[ecko4711]

No typo. Its the 471 written on the resistors saw it somewhere and bought it. Seems like its the wrong one them? I resoldered Dat0. Couldnt find the issue there

If you didn't just typo, and you actually put 471 ohm resistors on, you need to change them all out for 47 Ohm resistors (with a coincident label of 470 on them)

Other than that, a flashing yellow/orange light would indicate you should check your Dat0 solder points.

 

[lightninjay]

No typo. Its the 471 written on the resistors saw it somewhere and bought it. Seems like its the wrong one them? I resoldered Dat0. Couldnt find the issue there

Definitely wrong, by a factor of 10 in fact. Please replace with the correct resistors, you could potentially corrupt your NAND.

 

[cowboy619]

Just opened my Lite and moved the Pico from #1 to #2, and can confirm that on the #2 position it's a perfect fit, no need to cut the shield and has enough room to fit everything without extra pressure. Just make sure to insulate nicely the Pico (top, bottom and sides) with Kapton tape.
The only thing that I don't like about #2 position, are the longer wires for GND and +3.3V, but it works good anyway.

View attachment 365343

Did you remove the regulator as well on the Pico?


Sent from my iPhone using Tapatalk

 

[ecko4711]

Definitely wrong, by a factor of 10 in fact. Please replace with the correct resistors, you could potentially corrupt your NAND.

I bought these:https://de.aliexpress.com/item/3275...index.0.0.580376c7xt3MTT&gatewayAdapt=glo2deu

Shit. Thanks for the quick help.

 

[Dee87]

I bought these:https://de.aliexpress.com/item/3275...index.0.0.580376c7xt3MTT&gatewayAdapt=glo2deu

Shit. Thanks for the quick help.

theres a set on amazon
ClickMe