Hacking Hardware Picofly - a HWFLY switch modchip

[Takezo-San]

I completely removed the home button LED; it was originally on the two pads on the right side of where the RP2040's status LED is now. the top pad is constant 3.3V, which is convenient as the status LED needs that as well. the bottom pad is a switched ground to control the original home button LED; I repurposed this to break out and connect the data line of the status LED. I then manually ran a ground wire directly to the status LED. in the extremely unlikely event that nintendo further utilizes the notification feature and the home button LED "turns on" with my status LED in place, no ill should happen, as it would only be grounding the data in pin while the status LED is not in use.

So I wanted to try the Lite LED home button mod but I need help to go over some unsure things I had regarding the mod. Wondering if anyone knows if my theoretical knowledge of what's going is correct before I go in for the practical go ahead.
So @vulp_vibes used a Seeed Xiao RP2040 board and removed the LED from it. Then looking at the schematics, he ran a wire from pin 4 (vcc/3.3v) of the seeed board to the back of the switch board where he soldered the other end too the following point:

I don't know what this point actually is and in diode mode it gives no reaction. Nonetheless that is wired from the seeed xiao board. Ok great. The wire point to the left on that component is measured to be ground. Great. So @vulp_vibes wires that to, i think it looks like, the bottom pad of the board!? Or is that connected to the DIN (point 3 of the Seeed's LED)? Bottom right of the seeed's led is ground so thats connected to the bottom pad of the switch and the top pad of the switch is connected to Dout (pin 1). Is that all correct? Are there 3 connections on the repuroposed LED here or is that ground wire going straight to the ground pad so theres only 2 connections on this LED? Thank you in advance and forgive my lack of knowledge and/or ignorance.

Post automatically merged: Jul 21, 2023

Check this: https://gbatemp.net/threads/switch-unbricking-guide-for-dead-or-replaced-emmc-consoles.609891/
It might have some info for the restore/fix of the emmc.
Here as well: https://gbatemp.net/threads/switch-unbricking-guide-prodinfo-fix-pikafix.578026/

thanks will check this out
edit - can't use that because I don't have the keys. no backup of the emmc was made in my case and thats a pre-requisite for the process. I've gotten use out of that board anyway as a donor. its all good.

 

[Dee87]

How? I thought if the emmc is corrupt, the switch is done!?

Well its not done just can't use it for Nintendo services anymore cause u don't have the key .
There are a few guides online , ur probably gonna have to take the emmc out and reball it though

 

[Blakejansen]

I am sure you're mistaken. Wire simply conductor. You will get the same value on each point in the line, except your wire problematic.

Tried turning on the switch but it didn't work

Well its not done just can't use it for Nintendo services anymore cause u don't have the key .
There are a few guides online , ur probably gonna have to take the emmc out and reball it though

How do I check continuity where I scratched the traces? I can't fit both the black and the red on the same line since the space is so reduced.

Switch is no longer turning on.

Post automatically merged: Jul 21, 2023

I am sure you're mistaken. Wire simply conductor. You will get the same value on each point in the line, except your wire problematic.

You are right. I went back and checked and the dat point now shows both 350 on both sides. This wasn't happening before.

Is my switch still fixable?

 

[Takezo-San]

Not mistaken. One end of the wire gives me 650 and the other only 350. Using 38 AWG enameled wire.

Post automatically merged: Jul 21, 2023

Tried turning on the switch but it didn't work


How do I check continuity where I scratched the traces? I can't fit both the black and the red on the same line since the space is so reduced.

Switch is no longer turning on.

Post automatically merged: Jul 21, 2023

You are right. I went back and checked and the dat point now shows both 350 on both sides. This wasn't happening before.

Is my switch still fixable?

Continuity meaning diode mode. Put the black probe on a ground somewhere (metal shield or usb) and the red on the broken trace.

 

[Blakejansen]

Continuity meaning diode mode. Put the black probe on a ground somewhere (metal shield or usb) and the red on the broken trace.

OK. I turned my switch on before doing this. One trace reads at 450 and the other isn't getting a reading. I am trying to fix the trace without the reading.

 

[MicroRepairRX]

Been trying to glitch the Zelda TOK OLED for days. First tried multiple hwfly version, then finally tried PicoFly and get this led pattern:

=*== eMMC test failure - read failed

It then boots to OFW and works fine.

I've already replaced the emmc and the results are the same.
Tried different flex cable as well and same results.

EMMC is Samsung

Don't think it's the dat0 b/c didn't use the adapter. If you grind the pcb 3 layers down between the cpu/ram shield border and the A point you can solder a 40 awg enamel wire to that exposed trace. Done this technique for a while with no issues.

The board revision is HEG-CPU-10

Any ideas?

 

[Dee87]

Been trying to glitch the Zelda TOK OLED for days. First tried multiple hwfly version, then finally tried PicoFly and get this led pattern:

=*== eMMC test failure - read failed

It then boots to OFW and works fine.

I've already replaced the emmc and the results are the same.
Tried different flex cable as well and same results.

EMMC is Samsung

Don't think it's the dat0 b/c didn't use the adapter. If you grind the pcb 3 layers down between the cpu/ram shield border and the A point you can solder a 40 awg enamel wire to that exposed trace. Done this technique for a while with no issues.

The board revision is HEG-CPU-10

Any ideas?

Well I guess ur drilling didnt work this time, maybe u did more damage then u wanted to.
why would u try to replace the emmc ?
Just cause u couldn't get a emmc reading?
Then u check ur dat0 adaptor or in ur case ur drilling method.
But just replacing the emmc and hoping everything works is not the case

 

[Blakejansen]

Well I guess ur drilling didnt work this time, maybe u did more damage then u wanted to.
why would u try to replace the emmc ?
Just cause u couldn't get a emmc reading?
Then u check ur dat0 adaptor or in ur case ur drilling method.
But just replacing the emmc and hoping everything works is not the case

All my points measure at 350 as well as the top trace that a slightly scratched. Bottom trace is at 0.

Will repairing my traces get my switch working again?

Should I use a conductive pen or wire?

 

[MicroRepairRX]

Well I guess ur drilling didnt work this time, maybe u did more damage then u wanted to.
why would u try to replace the emmc ?
Just cause u couldn't get a emmc reading?
Then u check ur dat0 adaptor or in ur case ur drilling method.
But just replacing the emmc and hoping everything works is not the case

If damage was done with the grinding, I'd think the console wouldn't boot into OFW and work fine.

Replaced emmc b/c I heard someone else had the same issue, but they probably used the dat0 adapter.

Diode reaching with red prob to ground for Dat0 is 0.421 and similar for CMD and CLK readings.

I'll double check the dat0 point and see.

 

[Takezo-San]

All my points measure at 350 as well as the top trace that a slightly scratched. Bottom trace is at 0.

Will repairing my traces get my switch working again?

Should I use a conductive pen or wire?

So you get a beep sound when you measure the bottom trace, yes? If so, yep, that trace needs mending/jumping. I've never done this sort of repair before but basically using thin wire to join the trace at the split. I'd do more research on this before attempting this sort of repair but my advice is to be patient and take it slow. Last thing you want is to chase your own tail.

 

[Blakejansen]

So you get a beep sound when you measure the bottom trace, yes? If so, yep, that trace needs mending/jumping. I've never done this sort of repair before but basically using thin wire to join the trace at the split. I'd do more research on this before attempting this sort of repair but my advice is to be patient and take it slow. Last thing you want is to chase your own tail.

It was a big fuck up. The soldering was good enough all I had to do was not severe the fucking trace.

Trace repair is 100x harder than the mod...

I decided to cut the shield to give me more room to work with. Scratched a line tined it and have to tin the other point.

 

[Dee87]

All my points measure at 350 as well as the top trace that a slightly scratched. Bottom trace is at 0.

Will repairing my traces get my switch working again?

Should I use a conductive pen or wire?

if u trace is broken sure ushould repair it if u want ur switched fixxed

u can use wire, repair pads or whatever u feel like its up to u

Post automatically merged: Jul 21, 2023

If damage was done with the grinding, I'd think the console wouldn't boot into OFW and work fine.

Replaced emmc b/c I heard someone else had the same issue, but they probably used the dat0 adapter.

Diode reaching with red prob to ground for Dat0 is 0.421 and similar for CMD and CLK readings.

I'll double check the dat0 point and see.

well if its still booting to ofw then yeah that grinding didnt do any damage , u should only replace the emmc if u have destroyed the emmc. and ur only gonna get it fully recovered if u got the keys.which in ur case i guess u dont have. u can still get it runing but no nintendo services afaik.

most people replace the emmc cause they think it will be magiclly fixxed after they use those dat0 adapters they bridge dat0/1 which corrupt the emmc when the pico is trying to glitch.
but just replacing the emmc doesnt really help u need backups otherwise u wont get the switch runing fully(with nintendo services)

all u need to do is repair u emmc (afaik Boot0/1)


i dont use diode reading on my installs , i install the chip and see if it works or not.when i do my install i use a microscope and i see if something is bridging or not, so theres no need for me to use diode reading or anything else only if i have a issue but till now i never had a issue with any of my installs.

also i dont drill any holes cause i wont take the risk destroying the cusotmers board its still there board and not mine.
i Only install with permanent dat0 points.

in my opinion if i send my board to a modder and he drilles a hole in my board then thats the last time my board or anyone i know goes to that modder, cause ur damaging there board to save a few minutes instead of doing it properly.
and the only proper way to do it is by installing a perm Dat0.

it doesnt matter how often u have done it succesfully or not u still dont drill unneeded wholes in peoples property.


dat0 has afaik 500-900 depending on the emmc.

Post automatically merged: Jul 21, 2023

It was a big fuck up. The soldering was good enough all I had to do was not severe the fucking trace.

Trace repair is 100x harder than the mod...

I decided to cut the shield to give me more room to work with. Scratched a line tined it and have to tin the other point.

well i dont see the reason anyway why u remove that much from the shield its not needed , now u see what u get from it if its ur board do whatever u want with it if its a customers board then u should do the least damage to the board to get the mod done period.

trace repair is not harder then doing the mod, if that kinda trace repair is harder then doing the mod then u should stop doing mods and learn how to repair traces properly if u try making money with modding.


but all this that im saying is just my opinion.

All i gotta say is stop practicing on customers board if u cant properly solder/mod they are are still paying u guys to do these mods properly and not using there boards as a guinine pig.

if its ur boards ur doing installs in do what ever u want to do

 

[Takezo-San]

if u trace is broken sure ushould repair it if u want ur switched fixxed

u can use wire, repair pads or whatever u feel like its up to u

Post automatically merged: Jul 21, 2023

well if its still booting to ofw then yeah that grinding didnt do any damage , u should only replace the emmc if u have destroyed the emmc. and ur only gonna get it fully recovered if u got the keys.which in ur case i guess u dont have. u can still get it runing but no nintendo services afaik.

most people replace the emmc cause they think it will be magiclly fixxed after they use those dat0 adapters they bridge dat0/1 which corrupt the emmc when the pico is trying to glitch.
but just replacing the emmc doesnt really help u need backups otherwise u wont get the switch runing fully(with nintendo services)

all u need to do is repair u emmc (afaik Boot0/1)


i dont use diode reading on my installs , i install the chip and see if it works or not.when i do my install i use a microscope and i see if something is bridging or not, so theres no need for me to use diode reading or anything else only if i have a issue but till now i never had a issue with any of my installs.

also i dont drill any holes cause i wont take the risk destroying the cusotmers board its still there board and not mine.
i Only install with permanent dat0 points.

in my opinion if i send my board to a modder and he drilles a hole in my board then thats the last time my board or anyone i know goes to that modder, cause ur damaging there board to save a few minutes instead of doing it properly.
and the only proper way to do it is by installing a perm Dat0.

it doesnt matter how often u have done it succesfully or not u still dont drill unneeded wholes in peoples property.


dat0 has afaik 500-900 depending on the emmc.

Post automatically merged: Jul 21, 2023

well i dont see the reason anyway why u remove that much from the shield its not needed , now u see what u get from it if its ur board do whatever u want with it if its a customers board then u should do the least damage to the board to get the mod done period.

trace repair is not harder then doing the mod, if that kinda trace repair is harder then doing the mod then u should stop doing mods and learn how to repair traces properly if u try making money with modding.


but all this that im saying is just my opinion.

All i gotta say is stop practicing on customers board if u cant properly solder/mod they are are still paying u guys to do these mods properly and not using there boards as a guinine pig.

if its ur boards ur doing installs in do what ever u want to do

Well said

 

[Weird-Parking356]

i install the 2040 in sw lite ,but now the console only start when i plug the usb ,the power button isn t working, whe the console start i can see the picofly logo, any idea what could be?

 

[Dee87]

i install the 2040 in sw lite ,but now the console only start when i plug the usb ,the power button isn t working, whe the console start i can see the picofly logo, any idea what could be?

well then u have an issue with ur power button i would say check if the flex from the power and volume button is sitting properly

 

[Weird-Parking356]

well then u have an issue with ur power button i would say check if the fley from the power and volume button is sitting properly

ok ,great I was afraid It was something related to the instalaltion

Post automatically merged: Jul 21, 2023

by the way , any updated tutorial of how to prepare the sd after the mod

 

[Dee87]

ok ,great I was afraid It was something related to the instalaltion

Post automatically merged: Jul 21, 2023

by the way , any updated tutorial of how to prepare the sd after the mod

well i mean thats the first logical thing u would check when u see it boots from usb and not power button.

check the second link in my discription theres everything u need to know

 

[Takezo-San]

ok ,great I was afraid It was something related to the instalaltion

Post automatically merged: Jul 21, 2023

by the way , any updated tutorial of how to prepare the sd

I mean...uhhh....a guide must be around....here....somewhere......uhhum

 

[Dee87]

Sthetix youtube has it all for you

comeone man dont make it to easy for someone who isnt trying to find things on his own...............

 

[Takezo-San]

comeone man dont make it to easy for someone who isnt trying to find things on his own...............

Lol my bad