Hacking Hardware Picofly - a HWFLY switch modchip

[LuigiGad]

This is a good solution but still demand for the motherboard to be removed for the installation mod. I’ve done more then 40 Oled’s with kamikaze mod on the upper side of the motherboard and don’t see any advantage of doing it by any other way. It take me about 4 or 5 min to reach the Dat0 point and mask all the surround contacts. It’s just a matter of doing it very precisely and slowly with a mat grinder.

I am about ten kamikaze. I found it convenient for me to make a larger hole so I avoid masking and once welded I drown with epoxy glue

 

[linuxares]

I am about ten kamikaze. I found it convenient for me to make a larger hole so I avoid masking and once welded I drown with epoxy glue

Oh thats smart! "Snot" glue is easy to remove if you need to access it again

 

[Danook28]

Question? Affirmation? bragging?

Ask yes.. I desolder this capacitor and not find it any where bro..

 

[Pae]

Hi, I recently updated Picofly fw to the latest, now OFW reads "Pkg2 read failed! Failed to launch HOS! Press any key..." Can someone help?

P. S. Rebooting to OFW in Lockpick gives a purple screen, help!

 

[gst0]

Maybe the previous owner blanked out the PRODINFO serial numbers in order to avoid a ban.
As far as I know, the OFW won't boot in case the PRODINFO has been cleared out.
That leaves you only with playing offline on the emummc then.

That means that 1 or more datalines to your emmc is disconnected.
emmc's can operate with 1 data line but it will be 8 times as slow as with 8 datalines.
Unless you can reball an emmc, have it done by someone, the only option is to play with your emummc.
Do keep the backup of the NAND safely in case the emmc breaks down completely.
Even with an emummc, you need BOOT0 and BOOT1 to boot the emummc afaik.

This is a very common error when you are not using the right resistor values on Dat0,CMD and CLK. The best configuration is (on the same order) - 100R, 100R and 47. Have you checked power the console and press both volume - & volume + ?

Thanks the help!

There was no previous owner, I had this switch since new and the only person that meddle with it was the guy who installed the picofly.

From everything that you've told me I can only infer that:

1. He flat out lied when I asked him if he did not use the right resistor values (first answer I came in my research when I looked at this issue), the weird thing is that even though I offered to pay him more to get my sysnand access back he refused to saying it'd be riskier to the switch board, seems like he could'va make a quick buck if that was his interest.

2. He removed PRODINFO from my switch (and took to use himself as a donor in other devices?), I keep getting "unable to read" errors when I try to backup my sysnand PRODINFO on both Lockpick or Tegraexplorer.

- Would you know if the resistor value issue could cause the sysnand PRODINFO not to be readable?
- The thing I still can't seem to figure out is why I can't seem to configure new emunands from scratch in new SD cards. Every time I configure a new SD card (following Rentry guide) and try to launch emunand I get a "unknown pkg1 version" error. I've tried multiple times, but the odd thing is that 1 time out of all those tries it actually worked and launched the freshly made emunand. I don't recall doing anything differently but now I can't seem to replicate that. The only SD card that works so far is the one that this guy created when he installed the picofly

 

[jkyoho]

Thanks the help!

There was no previous owner, I had this switch since new and the only person that meddle with it was the guy who installed the picofly.

From everything that you've told me I can only infer that:

1. He flat out lied when I asked him if he did not use the right resistor values (first answer I came in my research when I looked at this issue), the weird thing is that even though I offered to pay him more to get my sysnand access back he refused to saying it'd be riskier to the switch board, seems like he could'va make a quick buck if that was his interest.

2. He removed PRODINFO from my switch (and took to use himself as a donor in other devices?), I keep getting "unable to read" errors when I try to backup my sysnand PRODINFO on both Lockpick or Tegraexplorer.

- Would you know if the resistor value issue could cause the sysnand PRODINFO not to be readable?
- The thing I still can't seem to figure out is why I can't seem to configure new emunands from scratch in new SD cards. Every time I configure a new SD card (following Rentry guide) and try to launch emunand I get a "unknown pkg1 version" error. I've tried multiple times, but the odd thing is that 1 time out of all those tries it actually worked and launched the freshly made emunand. I don't recall doing anything differently but now I can't seem to replicate that. The only SD card that works so far is the one that this guy created when he installed the picofly

WOW, such a scam

 

[malgamer]

Hi, I recently updated Picofly fw to the latest, now OFW reads "Pkg2 read failed! Failed to launch HOS! Press any key..." Can someone help?

P. S. Rebooting to OFW in Lockpick gives a purple screen, help!

replace resistor A point 4.7k

 

[Pae]

replace resistor A point 4.7k

any way to not open the console for that
EDIT: ok i know im retarded just pls im sorry

 

[impeeza]

any way to not open the console for that

NO

 

[Pae]

NO

ok sorry

 

[abal1000x]

Thank you for your detailed reply, it makes a lot of sense and gives me great pointers. I have backed up my EMMC and prod keys, no issues on backing EMMC but I actually got errors when trying to backup the keys, see image (unsure if it did it successfully). I also get an "Your EMMC is initialized in slowed mode, this might mean hardware issues" warning on Hekate when creating the EMUNAND.

The 'slow mode', its almost always about resistor configuration. Every one has their own 'recipe' for this Dat0/CMD/CLK resistor.

Post automatically merged: Aug 6, 2024

As per your suggestion and after seeing those errors, it kinda seems like it is a corruption with HOS and EMMC?. I have again created an entire SD and EMUNAND from scratch but still failing to boot into OFW, it just freezes in black screen after the Nintendo logo. This time around however it did manage to boot into EMUNAND with a completely fresh SD, does this means the EMMC is not corrupted since I was able to create the EMUNAND in Hekate from the system EMMC ?

That was a lot of progress, thank you for you help

Seeing your SS, i think the problem lay on that.
Your keys are gone or corrupted.
I think this is the source problem you could not go to OFW.

Some of example of the various device i modded before:
View attachment 451339View attachment 451340
View attachment 451341View attachment 451342

Post automatically merged: Aug 6, 2024

That was a lot of progress, thank you for you help

Unfortunately modding is like a 'trust' operation.

If you give your device on the modder, they could backup your key or whatever, and can abuse it actually.

I backup all the past device just for 'in case' something happened. I actually have some v1 and lite keys which is not banned. Its from broken devices. Have no time to playing around about it. In theory someone could use it to unbanned their device, but i've no time on experimenting it.

 

[jkyoho]

The 'slow mode', its almost always about resistor configuration. Every one has their own 'recipe' for this Dat0/CMD/CLK resistor.

Post automatically merged: Aug 6, 2024

Seeing your SS, i think the problem lay on that.
Your keys are gone or corrupted.
I think this is the source problem you could not go to OFW.

Some of example of the various device i modded before:
View attachment 451339View attachment 451340
View attachment 451341View attachment 451342

Post automatically merged: Aug 6, 2024

Unfortunately modding is like a 'trust' operation.

If you give your device on the modder, they could backup your key or whatever, and can abuse it actually.

I backup all the past device just for 'in case' something happened. I actually have some v1 and lite keys which is not banned. Its from broken devices. Have no time to playing around about it. In theory someone could use it to unbanned their device, but i've no time on experimenting it.

I had some one came with such missing/corrupted keys modded device, do you remember what happened/lead to key/prodinfo corrupted?

 

[abal1000x]

I had some one came with such missing/corrupted keys modded device, do you remember what happened/lead to key/prodinfo corrupted?

When mod with a bad emmc connection (CMD/CLK/Dat0).
Especially the Dat0, its the line that supply the data to Read/Write.

That is why, the first time when hekate is installed, backup the raw emmc and the key.

https://switchbrew.org/wiki/Calibration

 

[malgamer]

any way to not open the console for that

yes,send it to people who can do it for u

 

[thesjaakspoiler]

- Would you know if the resistor value issue could cause the sysnand PRODINFO not to be readable?

There is no such a thing as 1 resistor value that only makes prodinfo unreadable.
prodinfo is just some info that is read from the emmc.
Your entire emmc would have troubles if the resistor value was incorrect, most likely not booting anyway.
The value of the resistor depends on the manufacturer of the emmc.
Just search this thread for your model emmc (Samsung, Hynix, Toshiba, etc).

Have a look at the root of your SD card. If you're lucky then there should be a backup called 'prodinfo.bin' with your unique prodinfo settings.

- The thing I still can't seem to figure out is why I can't seem to configure new emunands from scratch in new SD cards. Every time I configure a new SD card (following Rentry guide) and try to launch emunand I get a "unknown pkg1 version" error. I've tried multiple times, but the odd thing is that 1 time out of all those tries it actually worked and launched the freshly made emunand. I don't recall doing anything differently but now I can't seem to replicate that. The only SD card that works so far is the one that this guy created when he installed the picofly

In most cases that unknown pkg1 version error is due to old hekate/atmosphere files.
In some rare case you got yourself a corrupted/fake SD card.
If you're using a Mac then note that sometimes the mac marks all folders are archived.
Hekate as a utility to fix that.

 

[CarlosCruz]

 

[gst0]

The 'slow mode', its almost always about resistor configuration. Every one has their own 'recipe' for this Dat0/CMD/CLK resistor.

Seeing your SS, i think the problem lay on that.
Your keys are gone or corrupted.
I think this is the source problem you could not go to OFW.

Unfortunately modding is like a 'trust' operation.
If you give your device on the modder, they could backup your key or whatever, and can abuse it actually.

I backup all the past device just for 'in case' something happened. I actually have some v1 and lite keys which is not banned. Its from broken devices. Have no time to playing around about it. In theory someone could use it to unbanned their device, but i've no time on experimenting it.

There is no such a thing as 1 resistor value that only makes prodinfo unreadable.
prodinfo is just some info that is read from the emmc.
Your entire emmc would have troubles if the resistor value was incorrect, most likely not booting anyway.
The value of the resistor depends on the manufacturer of the emmc.
Just search this thread for your model emmc (Samsung, Hynix, Toshiba, etc).

Have a look at the root of your SD card. If you're lucky then there should be a backup called 'prodinfo.bin' with your unique prodinfo settings.

In most cases that unknown pkg1 version error is due to old hekate/atmosphere files.
In some rare case you got yourself a corrupted/fake SD card.
If you're using a Mac then note that sometimes the mac marks all folders are archived.
Hekate as a utility to fix that.

Really appreciate the help, so it indeed kinda sounds like the issue is; 1. bad EMMC connection, and 2. corrupted or missing PRODINFO which may have been caused by the emmc connection issue, or purposely tampered with by the guy who installed picofly.

The pkg1 error is weird since I've been trying a lot of different configurations unsuccessfully, different SD cards, new files, I've used Rentry, HATS, always download and copy up-to-date files, always fix the bit archive, and used different SD cards which work with other switches, I have a V1 switch and have been hacking it since fusee came out, so I'm not completely unfamiliar (although I do lack a lot of deeper knowledge).
I will keep trying to at least successfully build the SD with emunand from scratch (already succeed once but couldn't replicate it).

Unfortunately the guy that installed the picofly did not create a backup for me, I should've demanded a backup at the time, but I dropped the ball there, was a bit nervous since the whole picofly process was new to me, additionally I trusted him since he came recommended from someone I knew.

The only backups that are in the SD he created are a couple files that I didn't know of (attached image). In the SD card there is however the "automatic backups" PRODINFO bin file from atmosphere. Not sure if this one could work, but I'll keep researching, maybe I could use it to restore the corrupted file. Will keep digging.

Thanks again!

 

[LuigiGad]

In the SD card there is however the "automatic backups" PRODINFO bin file from atmosphere.

Thanks again!

you have the prodinfo

 

[linkref]

Does someone has a diagram for using this chip on an OLED please ?

 

[dehydrated_lemur]

@psycho-neon I'm gonna do a batch of tiny-fly. Is the top flex connector used for all your typical apu flexes or is there something you used specifically?