Hacking Hardware Picofly - a HWFLY switch modchip

aahli

Member
Newcomer
Joined
Jul 21, 2018
Messages
19
Trophies
0
Age
34
XP
166
Country
Taiwan
The ultra-thin rp2040 pico board everything is working properly,Open source link
2.jpg
lite fly.jpg
 

Phantomas77

Well-Known Member
Member
Joined
Dec 19, 2022
Messages
200
Trophies
0
XP
380
Country
Italy

aahli

Member
Newcomer
Joined
Jul 21, 2018
Messages
19
Trophies
0
Age
34
XP
166
Country
Taiwan
Very cool! Thanks for sharing.

Quick questions:
- what's the total thickness of the board? Nevermind this, just saw it's 1.5mm.
- for USB flashing we just need to solder the 4 wires, right? So I presume that the LDO for converting from +5 to +3V3 is present.
Yes, the LDO comes with the circuit board. Just need to solder four wires
 
  • Like
Reactions: Phantomas77

Kiuxn

Active Member
Newcomer
Joined
Mar 18, 2023
Messages
41
Trophies
0
Age
26
XP
74
Country
China
How to solve this?
Post automatically merged:

How to solve this?
 

Attachments

  • F0BDA4CF-76EE-4517-AA10-F0A78EBF3221.jpeg
    F0BDA4CF-76EE-4517-AA10-F0A78EBF3221.jpeg
    1.3 MB · Views: 7
  • Like
Reactions: Danook28

fox87

Member
Newcomer
Joined
Apr 27, 2023
Messages
6
Trophies
0
Age
122
XP
15
Country
Denmark
Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot
v2.6 + software update, xiao & itsy support
v2.61 + Instinct-NX sdloader, bug fixes
v2.62 + Make 16.0.1 happy (fix OFW boot)
v2.63 + roll back some 2.62 boot speed tricks
v2.64 + enable back the board detection
v2.65 + RP Pico support, double reset removed
v2.66 + Bypass to OFW after update for proper fuse burning
v2.67 + Don't bypass to OFW on first install

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
PINK = NS eMMC init fails, inoperative eMMC ?
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success



Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: rp2040 boards support
A: WaveShare 2040-zero/one, xiao-rp2040, adafruit itsybitsy (Pi Pico is not supported for now)

Q: GREEN, but instant reset
A: Clean flux near the RST point

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot (sysNAND data can be damaged).

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

v2.5 firmware had a bug with BOOT0 corruption. To recover it:
- boot "Full Stock" using hekate
- update to the latest official firmware over Wi-Fi

- boot "Full Stock" using hekate
- perform a full system reset

- show firmware information
- update firmware from SD card (place update.bin into the root folder)
- rollback to the backup firmware slot
- reset learning statistics
- dump / write sdloader

if you have an rp2040-zero from waveshare/ali then it has a neopixel. It is used for diagnosing proper firmware flashes as well as console glitching. If you plug it in, and flash the uf2 firmware to it and immediately see a red light after flashing (this is not the same as flashing, then unplugging and replugging), then no rgb jumper needs to be made. If on the other hand, you get one quick green flashing light, then you need to bridge the jumper pads indicated to swap the LED colors for proper diagnoses capability.
Hello guys,
Whats the meaning of the detection pins on the xiao-rp2040?
Is there an LED detecting if flashing worked correctly and if all the pins work in order like on the waveshare zero?

Thanks in advance :)
 

QuiTim

Well-Known Member
Member
Joined
Mar 30, 2023
Messages
187
Trophies
0
XP
210
Country
Albania
There is no definitive answer to this issue. Could be soldering issue, maybe a bridge somewhere, maybe didn't clean the flux, maybe the wires are to long.
You can try to add second 47r (so 94r in total per line) resistor to CMD and dat0 lines (but not on the CLK).
The best way to go about it is as lightninjay suggested, read the guide and go through this thread, your answer is most likely hiding here :)
 

Priller190

Member
Newcomer
Joined
Nov 14, 2018
Messages
8
Trophies
0
Age
26
XP
97
Country
Chile
Reporting my RP pico successfully glitching after being cut as per @rehius and @Dee87's diagram.

Looks nice for a proof-of-concept. I came to notice that the Dat0 point on RP Pico is very fragile so I engraved a trace right next to the RP's chip, this made me keep the other side of pins that would have been otherwise cut, but I needed the ground on that side to not make it messy next to all the resistors, not to say it doesn't look messy anyways lol.
View attachment 367122
Thank you @rehius and @Dee87. You guys have been very helpful and responsive.
Can you tell me please if you solder the 3.3v wire to the EMMC or to the M92T36 resistor?
Post automatically merged:

Also, I would suggest you take the 3.3v from this point.
It depends on your soldering skills, but I had some trouble trying to solder to the original 3.3v (top of the capacitor). I almost damaged the cap, so i used the one on the emmc board.
Amazing! i will do the same
 
General chit-chat
Help Users
  • No one is chatting at the moment.
    Skelletonike @ Skelletonike: No idea what that is tbh, is that like the iso or something?