Hacking Hardware Picofly - a HWFLY switch modchip

[vittorio]

but is the ubuntu payload already in the uf2 file?

 

[Tafty]

It boots hekate now.

And this is what happens when you try to launch hos

 

[saladus]

it boots hekate??

Post automatically merged: Feb 6, 2023

that's an amazing first step

 

[vittorio]

With pico?

 

[saladus]

With pico?

yes

 

[vittorio]

now let's see why it doesn't start hos, could it be the btc? later check something on uf2

 

[saladus]

not sure it'll work but try running lockpick_rcm

Post automatically merged: Feb 6, 2023

@Adran_Marit any ideas? you seem to be pretty knowledgeable about this stuff

 

[szubiennica]

It boots hekate now.

And this is what happens when you try to launch hos

this is amazing . could it be missing payloads?

 

[Mansi]

HOS won't load due to version mismatch. I can assume for now that boot1 is not fully patched and does not pass key verification. For ubuntu or android, this is not a problem. If the source code were freely available, a lot of people would connect to it. On the other hand, this is already a huge step and the ability to launch a hekate for anyone with rp2040)

 

[FruithatMods]

Check the picture. It’s mosfet. Connecting Sink (4) and Drain (5) but controlled with a Gate (3) from the Pico. That way Pico doesn’t have to supply voltage…it’s using system voltage to do the work. Somebody smarter than me correct if I’m wrong.
View attachment 351560

According to the ccc video which was posted earlier it is actually not supplying voltage to the cpu but taking it away to perform the glitch to "mute" a specific cpu instruction.

Post automatically merged: Feb 6, 2023

"470" would be 47 ohms (47 is the base number, last digit is multiplier)

https://www.utmel.com/tools/smd-resistor-code-calculator?id=33

I wonder what the reason is behind this specific resistor value. I have seen people use 1 kilo ohm resistors instead.

 

[Mansi]

I wonder what the reason is behind this specific resistor value. I have seen people use 1 kilo ohm resistors instead.

to match levels. Or so that the I / O port does not burn)

 

[Piorjade]

It boots hekate now.

And this is what happens when you try to launch hos

Can you show a picture of how you wired things up? Especially the CPU flex cable to the Pico

 

[saladus]

now I'm curious about another thing, would it work with a seeed xiao? bought it cause it was smaller but i wouldn't care too much to spend a bit more and also get a 2040-zero

 

[impeeza]

According to the ccc video which was posted earlier it is actually not supplying voltage to the cpu but taking it away to perform the glitch to "mute" a specific cpu instruction.

Post automatically merged: Feb 6, 2023

I wonder what the reason is behind this specific resistor value. I have seen people use 1 kilo ohm resistors instead.

I always love how the past doc, was able to connect the VHS camcorder to voltage juice using alligator clips which latter become "wireless" the black one felt and all still working fine

Post automatically merged: Feb 6, 2023

now I'm curious about another thing, would it work with a seeed xiao? bought it cause it was smaller but i wouldn't care too much to spend a bit more and also get a 2040-zero

The only difference between both of them is the exposed pins, may be you need a different pinout

 

[szubiennica]

now I'm curious about another thing, would it work with a seeed xiao? bought it cause it was smaller but i wouldn't care too much to spend a bit more and also get a 2040-zero

works even with original rp2040

 

[FruithatMods]

Also the problem with the closed nature of the firmware is that you can't easily change the assigned pin number because there is no source code.

 

[51mmz0rz]

to match levels. Or so that the I / O port does not burn)

For a 47 ohm resistor I would assume they are impedance matching for a 50 ohm output. Just a guess...

 

[saladus]

Also the problem with the closed nature of the firmware is that you can't easily change the assigned pin number because there is no source code.

yeah that's why i was asking

 

[Mansi]

For a 47 ohm resistor I would assume they are impedance matching for a 50 ohm output. Just a guess...

Well, put 10 ohms. Nothing will change.
It uses a PWM signal.

Post automatically merged: Feb 6, 2023

As I wrote earlier, the system version check does not pass, so we get an error PKG1.

    { "20161121183008",  0, 0x1900, 0x3FE0, 0x40014020, 0x8000D000 }, //  1.0.0.
    { "20170210155124",  0, 0x1900, 0x3FE0, 0x4002D000, 0x8000D000 }, //  2.0.0 - 2.3.0.
    { "20170519101410",  1, 0x1A00, 0x3FE0, 0x4002D000, 0x8000D000 }, //  3.0.0.
    { "20170710161758",  2, 0x1A00, 0x3FE0, 0x4002D000, 0x8000D000 }, //  3.0.1 - 3.0.2.
    { "20170921172629",  3, 0x1800, 0x3FE0, 0x4002B000, 0x4003B000 }, //  4.0.0 - 4.1.0.
    { "20180220163747",  4, 0x1900, 0x3FE0, 0x4002B000, 0x4003B000 }, //  5.0.0 - 5.1.0.
    { "20180802162753",  5, 0x1900, 0x3FE0, 0x4002B000, 0x4003D800 }, //  6.0.0 - 6.1.0.
    { "20181107105733",  6, 0x0E00, 0x6FE0, 0x4002B000, 0x4003D800 }, //  6.2.0.
    { "20181218175730",  7, 0x0F00, 0x6FE0, 0x40030000, 0x4003E000 }, //  7.0.0.
    { "20190208150037",  7, 0x0F00, 0x6FE0, 0x40030000, 0x4003E000 }, //  7.0.1.
    { "20190314172056",  7, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, //  8.0.0 - 8.0.1.
    { "20190531152432",  8, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, //  8.1.0 - 8.1.1.
    { "20190809135709",  9, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, //  9.0.0 - 9.0.1.
    { "20191021113848", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, //  9.1.0 - 9.2.0.
    { "20200303104606", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 10.0.0 - 10.2.0.
    { "20201030110855", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 11.0.0 - 11.0.1.
    { "20210129111626", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 12.0.0 - 12.0.1.
    { "20210422145837", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 12.0.2 - 12.0.3.
    { "20210607122020", 11, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 12.1.0.
    { "20210805123730", 12, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 13.0.0 - 13.2.0
    { "20220105094454", 12, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 13.2.1.
    { "20220209100018", 13, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 14.0.0 - 14.1.2.
    { "20220801142548", 14, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 15.0.0+

 

[Piorjade]

Well, put 10 ohms. Nothing will change.
It uses a PWM signal.

Post automatically merged: Feb 6, 2023

As I wrote earlier, the system version check does not pass, so we get an error PKG1.

    { "20161121183008",  0, 0x1900, 0x3FE0, 0x40014020, 0x8000D000 }, //  1.0.0.
    { "20170210155124",  0, 0x1900, 0x3FE0, 0x4002D000, 0x8000D000 }, //  2.0.0 - 2.3.0.
    { "20170519101410",  1, 0x1A00, 0x3FE0, 0x4002D000, 0x8000D000 }, //  3.0.0.
    { "20170710161758",  2, 0x1A00, 0x3FE0, 0x4002D000, 0x8000D000 }, //  3.0.1 - 3.0.2.
    { "20170921172629",  3, 0x1800, 0x3FE0, 0x4002B000, 0x4003B000 }, //  4.0.0 - 4.1.0.
    { "20180220163747",  4, 0x1900, 0x3FE0, 0x4002B000, 0x4003B000 }, //  5.0.0 - 5.1.0.
    { "20180802162753",  5, 0x1900, 0x3FE0, 0x4002B000, 0x4003D800 }, //  6.0.0 - 6.1.0.
    { "20181107105733",  6, 0x0E00, 0x6FE0, 0x4002B000, 0x4003D800 }, //  6.2.0.
    { "20181218175730",  7, 0x0F00, 0x6FE0, 0x40030000, 0x4003E000 }, //  7.0.0.
    { "20190208150037",  7, 0x0F00, 0x6FE0, 0x40030000, 0x4003E000 }, //  7.0.1.
    { "20190314172056",  7, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, //  8.0.0 - 8.0.1.
    { "20190531152432",  8, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, //  8.1.0 - 8.1.1.
    { "20190809135709",  9, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, //  9.0.0 - 9.0.1.
    { "20191021113848", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, //  9.1.0 - 9.2.0.
    { "20200303104606", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 10.0.0 - 10.2.0.
    { "20201030110855", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 11.0.0 - 11.0.1.
    { "20210129111626", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 12.0.0 - 12.0.1.
    { "20210422145837", 10, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 12.0.2 - 12.0.3.
    { "20210607122020", 11, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 12.1.0.
    { "20210805123730", 12, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 13.0.0 - 13.2.0
    { "20220105094454", 12, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 13.2.1.
    { "20220209100018", 13, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 14.0.0 - 14.1.2.
    { "20220801142548", 14, 0x0E00, 0x6FE0, 0x40030000, 0x4003E000 }, // 15.0.0+

Sorry, what do you mean with the system version check?