Hacking Hardware Picofly - a HWFLY switch modchip

[bvang913]

If you got a stray wire connected to a mosfet on the back of the board, better to remove it. Its drawing power so last thing you want is months down the line a messy recall. When it comes to the FPC Screen connector that can break, I always douse it with IPA and the remove the ribbon cable. It slips in and out better and when putting it back in, screw in the motherboard so its lower down and secure. That way when you resit the connector and ribbon, no pins get whacked around from any upward/downward/diagonal awkward angles.
Good stuff, goes to show its better to go official with the chips than cheaper ones.

Got it fixed. Took out the motherboard and turns out the wire for the CPU had come off the mosfet. Fixed that and it's working fine.

 

[Takezo-San]

Got it fixed. Took out the motherboard and turns out the wire for the CPU had come off the mosfet. Fixed that and it's working fine.

Result haha the odds

 

[rr8400]

I managed to get it working! I resoldered everything and changed the wires I was using. But I accidentally broke two resistors. I believe they're the ones responsible for the - and + volume buttons. Does anyone know the value of these resistors?

 

[bvang913]

Result haha the odds

Fixed that for the guy, then just finished modding his v2 switch.

 

[thesjaakspoiler]

Thank you for your detailed reply, it makes a lot of sense and gives me great pointers. I have backed up my EMMC and prod keys, no issues on backing EMMC but I actually got errors when trying to backup the keys, see image (unsure if it did it successfully).

Maybe the previous owner blanked out the PRODINFO serial numbers in order to avoid a ban.
As far as I know, the OFW won't boot in case the PRODINFO has been cleared out.
That leaves you only with playing offline on the emummc then.

I also get an "Your EMMC is initialized in slowed mode, this might mean hardware issues" warning on Hekate when creating the EMUNAND.

That means that 1 or more datalines to your emmc is disconnected.
emmc's can operate with 1 data line but it will be 8 times as slow as with 8 datalines.
Unless you can reball an emmc, have it done by someone, the only option is to play with your emummc.
Do keep the backup of the NAND safely in case the emmc breaks down completely.
Even with an emummc, you need BOOT0 and BOOT1 to boot the emummc afaik.

 

[MAI87]

Hello everyone. I received an Oled Switch with a bad installation and with several problems. It is missing several components, including the capacitor, which is close to the 3.3V that I show in the image with the red circle. Could someone tell me what its capacity is? I thank you in advance. Greetings.

 

[Takezo-San]

Got it fixed. Took out the motherboard and turns out the wire for the CPU had come off the mosfet. Fixed that and it's working fine.

Though a wire was loose? What type of solder do you use? Was it an initial cold sodler?

 

[SorataVP69]

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot
v2.6 + software update, xiao & itsy support
v2.61 + Instinct-NX sdloader, bug fixes
v2.62 + Make 16.0.1 happy (fix OFW boot)
v2.63 + roll back some 2.62 boot speed tricks
v2.64 + enable back the board detection
v2.65 + RP Pico support, double reset removed
v2.66 + Bypass to OFW after update for proper fuse burning
v2.67 + Don't bypass to OFW on first install
v2.70 + new LED indication, i2c undervoltage hack
v2.71 + support for SQc open-source board
v2.72 + disable CLK check, it's unstable
v2.73 + add LED signal on success
v2.74 + 300 mhz precision rp2040 may be not stable at 300mhz
v2.75 + back to 200mhz, remove SRAM powerdown

Spoiler: LED indication

= is long pulse, * is short pulse:

= USB flashing done

** RST is not connected
*= CMD is not connected
=* D0 is not connected
== CLK is not connected

*** No eMMC CMD1 responce (bad eMMC?)
**= No eMMC block 1 read (should not happen)
*=* No eMMC block 0 read (eMMC init failure?)
*== No eMMC CMD1 request (poor wiring, or dead CPU)

=** eMMC init failure during glitch process
=*= CPU never reach BCT check, should not happen
==* CPU always reach BCT check (no glitch reaction, check mosfet)
=== Glitch attempt limit reached, cannot glitch

=*** eMMC init failure
=**= eMMC write failure - comparison failed
=*=* eMMC write failure - write failed
=*== eMMC test failure - read failed
==** eMMC read failed during firmware update
==*= BCT copy failed - write failure
===* BCT copy failed - comparison failure
==== BCT copy failed - read failure

Spoiler: i2c undervoltage hack

If your glitch is unstable (==* error), and the proper boot happens only when you press Reset after joycon logo, you can add two more wires to make glitch much better.

board pins:
Waveshare rp2040: SDA=12, SCL=13
Pi Pico: SDA = 19, SCL = 20
XIAO 2040: SDA=3, SCL=4
ItsyBitsy 2040: SDA = 18, SCL = 19

NS points (v2, Lite, OLED):
View attachment 372191
View attachment 372192
View attachment 372193

Spoiler: Diagrams + by Dee87

View attachment 357132
View attachment 363821
View attachment 364242
View attachment 364990
View attachment 357133
View attachment 357135
View attachment 357134
View attachment 357136

Spoiler: Solder example

View attachment 357137
View attachment 357138
View attachment 360187
View attachment 363817
View attachment 357139
View attachment 357140
View attachment 360186
View attachment 364818

Spoiler: Issues, questions

Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: rp2040 boards support
A: WaveShare 2040-zero/one, xiao-rp2040, adafruit itsybitsy (Pi Pico is not supported for now)

Q: GREEN, but instant reset
A: Clean flux near the RST point

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot (sysNAND data can be damaged).

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: https://github.com/rehius

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

Spoiler: Reboot to OFW / Vol+ & Vol- doesn't work, blue/black screen

v2.5 firmware had a bug with BOOT0 corruption. To recover it:
- boot "Full Stock" using hekate
- update to the latest official firmware over Wi-Fi

Spoiler: Sleep mode does not work

- boot "Full Stock" using hekate
- perform a full system reset

Spoiler: Toolbox 0.2 features

- show firmware information
- update firmware from SD card (place update.bin into the root folder)
- rollback to the backup firmware slot
- reset learning statistics
- dump / write sdloader

Spoiler: RGB LED explanation by lightninjay

if you have an rp2040-zero from waveshare/ali then it has a neopixel. It is used for diagnosing proper firmware flashes as well as console glitching. If you plug it in, and flash the uf2 firmware to it and immediately see a red light after flashing (this is not the same as flashing, then unplugging and replugging), then no rgb jumper needs to be made. If on the other hand, you get one quick green flashing light, then you need to bridge the jumper pads indicated to swap the LED colors for proper diagnoses capability.

Hi, do you know if it is possible to do the "i2c undervolt hack" with this picofly chip?

 

[bvang913]

Though a wire was loose? What type of solder do you use? Was it an initial cold sodler?

Using 63/37 leaded solder. I'm not sure what could've happened. Haven't had any issues at all. My only guess is when I had the board out the first time maybe I messed it up already? And then it must've broke loose after that? Resoldered the wire and then covered it up with some tape. I'm hoping there's nothing else with this OLED. Gave it back to the guy last night and it's operational and he's a happy customer.

 

[impeeza]

Hi, do you know if it is possible to do the "i2c undervolt hack" with this picofly chip?

Its supposed picofly is the pi pico:

 

[SorataVP69]

Yes, just as you say it should be possible but I don't know where to connect the cables since this type of "prepared and ready to work" chip does not have the indications of the other rp2040 or pi pico chips.

 

[impeeza]

Yes, just as you say it should be possible but I don't know where to connect the cables since this type of "prepared and ready to work" chip does not have the indications of the other rp2040 or pi pico chips.

You have to trace the SDA and SCL (GPIO14 pin 17 and GPIO15 pin 18) of the chip to see if there is a pad where you can put the cables. or solder directly to the chip pins.

 

[SorataVP69]

You have to trace the SDA and SCL (GPIO14 pin 17 and GPIO15 pin 18) of the chip to see if there is a pad where you can put the cables. or solder directly to the chip pins.

View attachment 450854

Thank you very much my friend, now I understand better how the Pi Pico and the chip's processor itself work, this will help me experiment using the Flex v1 on a V2 console that would normally be unstable if it weren't for the i2c undervolt hack

 

[TankedThomas]

I hate to be a pain but I'd really like to fix my Switch Lite. Don't want to just make random new threads (there are enough of those) but since it appears that it's probably repairable, I'm totally fine paying a professional to have a look at it because my electronics skills are at their limit.
Just not sure if there's anyone here who does professional jobs. Only problem is I'd have to take the battery out if I ship it outside of New Zealand.
I can post a new thread to ask if necessary. Not really bothered by price at this point. Just want my saves back (and preferably a working, modded Switch Lite).

On-topic: I got one of those Picofly/hwfly kits from AliExpress for my V2. Gonna wait until I have another Switch again before installing it so I can transfer my stuff across, but it looks quite simple to install compared to RP2040 setups. Should I change capacitors as mentioned above before trying to install it, or just try it as-is first?

Anyone...? Maybe a pro with a good rep in this thread who wants a payday?

 

[Viktorsilva]

Getting short short ** error when booting console which means RST not connected. But it is. Here are screenshots.

Hi. Have you tryed to use the upper side motherboard RST point? Also, you are not using ipa to clean the flux residue after your solder job.

Post automatically merged: Aug 4, 2024

Thank you very much my friend, now I understand better how the Pi Pico and the chip's processor itself work, this will help me experiment using the Flex v1 on a V2 console that would normally be unstable if it weren't for the i2c undervolt hack

Why are you using SDA and SCL? Most of the Modchips with latest firmware can do instant boots if correctly installed.

Post automatically merged: Aug 4, 2024

Hi!, I got someone with experience to install a picofly on switch OLED, at the time he asked me if I wanted the switch to always go directly into emuNAND on boot, I thought he meant something like AutoRCM so I said yes, thinking I could always switch it back later in a config file.

Once I got the switch back, as it turned out, what he meant was that I was never going to be able to boot into sysNAND, I asked if we could change it back so that I could jump between emuNAND and sysNAND, his response was that this "configuration" was now essentially embedded in the picofly board, which meant he would have to desolder the board and solder a new one entirely to do so. I was willing to pay again to re-do it so I could gain access to sysNAND, but he said he did not recommend doing so as re-soldering the picofly had risk of damaging the switch motherboard.

I've looked and read around but the only info I've been able to find as to why someone wouldn't be able to boot into sysNAND is if you used a different kind of resistors, he said he did used the right values, he appears experienced as he runs a shop for videogames hardware mod, which leaves me a bit stuck about going back to him.

Am I'm forever locked out of sysNAND? or would someone know if there is something I can still do to boot back into sysNAND?, Perhaps updating the picofly board firmware or with picofly toolbox?, I'd love to learn more about this picofly "permanent boot directly into emuNAND" configuration, but not sure where to look. Would really appreciate if anyone has any pointers or info to direct me on this.

This is a very common error when you are not using the right resistor values on Dat0,CMD and CLK. The best configuration is (on the same order) - 100R, 100R and 47. Have you checked power the console and press both volume - & volume + ?

 

[LuigiGad]

Thank you very much my friend, now I understand better how the Pi Pico and the chip's processor itself work, this will help me experiment using the Flex v1 on a V2 console that would normally be unstable if it weren't for the i2c undervolt hack

I have used about a hundred advanced Flex v1s from the old SX Cores on all models without any problems and have never used the Under Volt in my career. so what you said doesn't work for me.

 

[thesjaakspoiler]

and have never used the Under Volt in my career. so what you said doesn't work for me.

As far as I was able to look into this feature, it bumps up the current limit in the power management IC.
Maybe it was meant for one particular model or maybe some particular mosfet.

 

[Viktorsilva]

Greetings colleagues. A few days ago they brought me a new OLED switch bought in China for 220e. My surprise was to find a Toshiba nand and the nand committed suicide under the heat gun doing reballing to install the adapter. In the image you can see the difference in thickness between a Toshiba nand and a Samsung one. They discarded it for a reason, they are made of paper. Weighing risks and benefits, I return to the kamikaze method because there is no need to risk putting a heat gun in a new and functional device.

Post automatically merged: Jul 19, 2024

And here we go

Post automatically merged: Jul 19, 2024

Dat0 test point

This is a good solution but still demand for the motherboard to be removed for the installation mod. I’ve done more then 40 Oled’s with kamikaze mod on the upper side of the motherboard and don’t see any advantage of doing it by any other way. It take me about 4 or 5 min to reach the Dat0 point and mask all the surround contacts. It’s just a matter of doing it very precisely and slowly with a mat grinder.

 

[Danook28]

The size and value for capacitor small under mosfet...

 

[impeeza]

The size and value for capacitor small under mosfet...
View attachment 451275

Question? Affirmation? bragging?