Hacking Hardware Picofly - a HWFLY switch modchip

Kingdedede

Member
Newcomer
Joined
Jan 28, 2023
Messages
24
Trophies
0
Age
48
XP
128
Country
Italy
I understand what your saying now about other chips.

this was a completely virgin firmware, i installed the rp2040 BEFORE we had the ubuntu firmware, when the original firmware wouldn't load i thought it was a good idea to check that i had installed it correctly...this is when i manually soldered up an sxcore i had lying around(flashed with hwfly) the console wouldn't train, which is when i worked out that i had messed up dat0. i fixed that, booted into Hekate then turned off and put the rp back in.

am i right in thinking you believe using the hwfly to boot has made a change to boot0 which is making my rp2040 launch...while you guys are having issues.

@Kingdedede was your install fresh..or did it have a modchip in before so we can rule this out
I opened the console which was virgin, installed rp2040 directly and immediately worked with hekate......the problem is not in the screens it is in the installation....but we are getting lost in futile things....the problem is the firmware..... it takes experience to do certain jobs that's all
 
  • Like
Reactions: szubiennica

brecht6

Active Member
Newcomer
Joined
Jan 31, 2023
Messages
33
Trophies
0
XP
118
Country
Belgium
- Rewrite an open-source version completely from scratch, I myself don't believe to be able to do that so I only look into this whole thing for fun. I don't know anyone who actually does something in that direction.
Has anyone started some sort of git repository. If so, I would like to take a look at it.
 

Tafty

Well-Known Member
Member
Joined
Sep 23, 2016
Messages
116
Trophies
0
Age
35
XP
857
Country
It is actually quite possible that the rp2040 pico is bad at filtering out noise and interference on the SD wires since those are high speed signals. Much shorter and thicker wires will give a clue if that is a problem.

Another possibility is the SD card itself.
Perhaps the content of the SD card is wrong? Does anyone have a copy of the SD Card image @Tafty is using?
That way we can at least rule out the SD card data being bad.
It is also possible that the SD card driver is only accepting certain size cards or cards from certain manufacturers.
im using stock Hekate.....and stock atmosphere for reference.. and the sd card is a 128gb Sandisk Extreme Pro.
i will check another card shortly just incase
Post automatically merged:

I opened the console which was virgin, installed rp2040 directly and immediately worked with hekate......the problem is not in the screens it is in the installation....but we are getting lost in futile things....the problem is the firmware..... it takes experience to do certain jobs that's all
originally i would of agreed with you BUT now we have a user who has sx/hwfly working but not pico....so there is something that is obviously a miss. im still not 100% convinced its not a bad install but we need to get to the bottom of this before everyone and there mom's start trying to install these and fail.....
Post automatically merged:

Well, I’ve already made that on my first try to install rp2040. I had lite with Sx lite. Wired the rp2040 to the solder points as it was on diagram, used already installed cpu flex (Sx orig) - nothing. -> several diode mode readings, resoldering, getting rid of Sx smal upper flex (for emmc and rst points) - nothing. -> just soldered back Sx lite (on wires) - boots like a charm. I thought that may be sx chip is bringing some TX shit code to boot0, and swapped chip to hwfly 4.2 with latest firmware - boots like a charm (with the same wires as it was on rp2040 install). Next I thought that may be I need a virgin console, unsoldered hwfly and updated sysnand to latest firmware (15.0.1). -> soldered rp2040 - nothing. Tested with V2 hwfly flex - nothing. Tested with bare mosfet (from hwfly flex) soldered by wires without removing vertical cap as it was on diagram - nothing. Took another rp2040 - same result… and that was the point were I decided to give up and try later :).
P.S. Again, the only thing that I believe could have affected this install is thin and relatively long 36awg wires on cpu mosfet controlling point.
can i see a picture of the install.

and can you give me diode readings for all the points? including cpu

and can i confirm you used 47 ohm resistors on the RP itself?
 
Last edited by Tafty,

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
214
Trophies
0
Age
24
XP
476
Country
United States
im using stock Hekate.....and stock atmosphere for reference.. and the sd card is a 128gb Sandisk Extreme Pro.
i will check another card shortly just incase
Post automatically merged:


originally i would of agreed with you BUT now we have a user who has sx/hwfly working but not pico....so there is something that is obviously a miss. im still not 100% convinced its not a bad install but we need to get to the bottom of this before everyone and there mom's start trying to install these and fail.....
Post automatically merged:


can i see a picture of the install.

and can you give me diode readings for all the points? including cpu

and can i confirm you used 47 ohm resistors on the RP itself?
Perhaps the firmware uses a fixed or narrow timing window and isn't able to calibrate timings for consoles that aren't close to the one the original dev was working with. That would mean CPU point's wire type and length would greatly influence success.
 
  • Like
Reactions: FruithatMods

Tafty

Well-Known Member
Member
Joined
Sep 23, 2016
Messages
116
Trophies
0
Age
35
XP
857
Country
Perhaps the firmware uses a fixed or narrow timing window and isn't able to calibrate timings for consoles that aren't close to the one the original dev was working with.
this also makes sense aswell to me aswell. i think until we know what the original or ubuntu firmware is doing we wont be able to acctually tell.
 
  • Like
Reactions: FruithatMods

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
214
Trophies
0
Age
24
XP
476
Country
United States
this also makes sense aswell to me aswell. i think until we know what the original or ubuntu firmware is doing we wont be able to acctually tell.
I recall the Xbox 360 RGH chips had a fixed timing and they were *very* sensitive to wire length, the Xecuter QSB had a handful of pads for calibrating glitch line length.
 
  • Like
Reactions: FruithatMods

Tafty

Well-Known Member
Member
Joined
Sep 23, 2016
Messages
116
Trophies
0
Age
35
XP
857
Country
I recall the Xbox 360 RGH chips had a fixed timing and they were *very* sensitive to wire length, the Xecuter QSB had a handful of pads for calibrating glitch line length.
My wire length isn't as short as it could be... But it's much shorter then it was when I originally installed, I'm using kynar aswell
 
Last edited by Tafty,
  • Haha
Reactions: juanvlc

renoob

Active Member
Newcomer
Joined
Feb 6, 2023
Messages
42
Trophies
0
XP
147
Country
France
Maybe unrelated to this issue you guys are trying to figure out but if rp2040 was flashed couple of times with different firmware try to nuke it it first (erase whole flash). There is uf2 called flash_nuke.uf2 on official pico site. I've seen flash memory not being completely erased when flashing stuff, lots of left over garbage in the memory from previous flashes.

https://github.com/dwelch67/raspberrypi-pico/blob/main/flash_nuke.uf2

Maybe it doesn't matter at all just a heads up
 
Last edited by renoob,

Piorjade

Well-Known Member
Member
Joined
Nov 8, 2015
Messages
141
Trophies
0
XP
383
Country
Gambia, The
It can‘t be that Tafty‘s SX chip magically allowed his rp2040 to boot Hekate because the sdloader that I found on his boot0 is completely different from HWFLY‘s sdloader, even the public key on the BCT is custom

The unlocked fw *has* to have written it itself.


EDIT: I believe it‘s possible that the unlocked firmware has a bad training algorithm and just can‘t find the proper glitch timing for the other guy‘s Switch..
 

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
214
Trophies
0
Age
24
XP
476
Country
United States
Welp, it's definitely not because my wires are too long :)
 

Attachments

  • IMG_0115.jpeg
    IMG_0115.jpeg
    648.2 KB · Views: 39

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
214
Trophies
0
Age
24
XP
476
Country
United States
If we knew exactly what's supposed to be happening during each step the LED colors represent, this would be so much easier to debug. *sigh* guess the easiest way to really know is to actually connect up an eMMC/SD reader and dump the contents of my BOOT0.
 

Piorjade

Well-Known Member
Member
Joined
Nov 8, 2015
Messages
141
Trophies
0
XP
383
Country
Gambia, The
If we knew exactly what's supposed to be happening during each step the LED colors represent, this would be so much easier to debug. *sigh* guess the easiest way to really know is to actually connect up an eMMC/SD reader and dump the contents of my BOOT0.
Sorry I didn‘t read all the replies of today, why do you guys want to read the emmc?
 

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
214
Trophies
0
Age
24
XP
476
Country
United States
Sorry I didn‘t read all the replies of today, why do you guys want to read the emmc?
To know for certain if it's actually writing to it, it seems that for some of us it's failing on some stage
Post automatically merged:

Oh shit wait, wait wait wait, didn't the HWFLY at some point run into an issue where it didn't support one of the eMMC models used in some consoles?? What if this only supports *one* eMMC (and those that the same driver would work on)
 
  • Wow
Reactions: Latif

Piorjade

Well-Known Member
Member
Joined
Nov 8, 2015
Messages
141
Trophies
0
XP
383
Country
Gambia, The
To know for certain if it's actually writing to it, it seems that for some of us it's failing on some stage
Aah I see, yeah that‘s probably the only way unless we write a firmware that just dumps the boot0 content over the UART interface on the rp2040
Post automatically merged:

To know for certain if it's actually writing to it, it seems that for some of us it's failing on some stage
Post automatically merged:

Oh shit wait, wait wait wait, didn't the HWFLY at some point run into an issue where it didn't support one of the eMMC models used in some consoles??
that would be extremely weird because all eMMCs use a standardized protocol
Post automatically merged:

well unless the unlocked fw uses a high clk frequency that only one of the Switch eMMCs support, though I highly doubt it because that would be extremely stupid
 

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
214
Trophies
0
Age
24
XP
476
Country
United States
Aah I see, yeah that‘s probably the only way unless we write a firmware that just dumps the boot0 content over the UART interface on the rp2040
Post automatically merged:


that would be extremely weird because all eMMCs use a standardized protocol
The protocol is the same, but sometimes there are differences. There might be some oddity stopping it from supporting certain eMMCs, they are all a tiny bit different and have their own quirks, though communication and pinout is supposed to be the same.

I coulda sworn I had read something at some point about this issue, but perhaps not, as I can't find it now. I'll keep looking.
 
General chit-chat
Help Users
  • No one is chatting at the moment.
    Skelletonike @ Skelletonike: 1H left, such a slow week.