Hacking Hardware Picofly - a HWFLY switch modchip

[binkinator]

Here

https://gbatemp.net/threads/pikofly-a-probably-fake-hwfly-modchips-or-not.622701/post-10049937

Is this the final or something alpha/beta/???

Follow up question, has anyone gotten it to run a payload?

if you don’t want to answer publicly just blink or grunt or whistle twice.

 

[TheSynthax]

Is this the final or something alpha/beta/???

Follow up question, has anyone gotten it to run a payload?

if you don’t want to answer publicly just blink or grunt or whistle twice.

Got a smashed up Lite on the way to experiment with.

 

[Tafty]

I should have a console to test this on tomorrow aswell, I don't fancy ruining one of my current consoles so brought a lite to test as I allready have some spare flexs for them.

 

[binkinator]

Hadn’t even thought of this excuse to buy a Switch Lite. Hmmmmm

 

[Luckers]

Can we get the uuid of the rp2040 that the payload was dumped from? Thanks.

 

[xldon2lx]

Is this the final or something alpha/beta/???

Follow up question, has anyone gotten it to run a payload?

if you don’t want to answer publicly just blink or grunt or whistle twice.

No idea... The guy simply asked where the leak firmware is. Since it's just in this thread then I simply pointed it to him that's just it nothing much

I'm not one of these new users that provide leaks or have insider info.

 

[Adran_Marit]

No idea... The guy simply asked where the leak firmware is. Since it's just in this thread then I simply pointed it to him that's just it nothing much

I'm not one of these new users that provide leaks or have insider info.

Wait you guys have insider info?

But nah from day when I was hoping for the best but expecting the worst. And that was no release

 

[evil_santa]

Exactly, I'm like "what are these bozos talkin about" lol
Wish there was a better place of discussion for PikoFly that was for people a little more on the 'up n up'

(I thought I recognized your name too, haven't peaked in the server in a while but you're the NAND guy, hope everything's been well )

yes I'm the emmc guy (emmc_santa)
All fine on my end
The server is more ore less dead, selled only 5 emmc's
But I learned much and switched over to hack an fire stick over emmc.
Added also a bigger emmc to my wife's old Huawei.

Maybe in the near future we become a good (and save) place to talk over the picofly.
Matrix/element probably ?

While that's true, before booting in to Hekate a chain loader payload is ran from the NAND first. The chip just glitches the Switch in to running that instead of the official bootloader and then the chain loader runs Hekate. Because the chain loader runs before Hekate it has to do some hardware initialization stuff which can only be done once per boot. If done incorrectly the Linux kernel can't boot. Afaik from what I've been told by people doing hw research on the Switch the current chip firmwares (Spacecraft, HWFly-NX) all initialize the hardware incorrectly so HOS can boot but booting non-HOS firmwares is impossible. This can be fixed by replacing the chain loader on the NAND but then if the chip reflashes the NAND for whatever reason it will revert to being unable to boot Linux. The chip itself needs to contain an updated chain loading payload.

Yes you are absolutely right, but I don't think this is a big problem if the picofly get's reverse engineered.
Maybe a guy whit a working picofly can try to boot l4t Ubuntu?
Maybe the Dev has done really good work and the HW init is perfect?

 

[impeeza]

If someone is interested on the Pico related boards, a must have tool is the PicoTool (https://github.com/raspberrypi/picotool) but the tool needs compilation to use.

Also, Arduino have a repo of precompiled tools, you can find them on https://github.com/arduino/rp2040tools/releases there are tools like:

• elf2uf2.exe
• picotool.exe
• pioasm.exe
• rp2040load.exe

The instructions on page are a bit dry. I found another set of instructions on https://shawnhymel.com/2168/how-to-build-openocd-and-picotool-for-the-raspberry-pi-pico-on-windows/ but they are a little bit scrambled and have unnecessary steps.

Here are the steps I did use to build PicoTool from source using MSYS MinGW:

First you need

Spoiler: Install a MSYS environment

Download the latest version from: https://github.com/msys2/msys2-installer/releases

Install the version corresponding to your Operating System (64 or 32 bits).

Accept the defaults in installation program of MSYS2 once you finish the installation you will have shortcuts for MSYS2, MinGW32 and MinGW64. MSYS2 is used to compiling POSIX binaries for Linux from Windows.

MinGW32 & MinGW64 compile Native Windows binaries using a linux toolchain (gcc, bash, etc.)

Launch MSYS2 shell and execute the command: pacman -Syuu several times until you get the message: "there is nothing to do".

After you have a MSYS environment set up you need to Install Build prerequisites following these steps:

pacman -Syu --noconfirm
pacman -Su --noconfirm
pacman -S --noconfirm git make libtool pkg-config autoconf automake texinfo wget mingw-w64-x86_64-toolchain mingw-w64-x86_64-gcc mingw-w64-x86_64-cmake mingw-w64-x86_64-python mingw-w64-x86_64-libusb

Seems what was upon a time when the libusb of Mingw had a error and you need to install an old version, that can be acomplished using:

Spoiler: Manual version of LibUSB

cd ~
wget https://repo.msys2.org/mingw/x86_64/mingw-w64-x86_64-libusb-1.0.26-1-any.pkg.tar.zst
pacman -U --noconfirm https://repo.msys2.org/mingw/x86_64/mingw-w64-x86_64-libusb-1.0.26-1-any.pkg.tar.zst

Then you need to setup the Pico-SDK and the Pico-Examples needed to successfull compile:

cd ~
git clone -b master https://github.com/raspberrypi/pico-sdk.git
cd pico-sdk
git submodule update --init
cd ..
git clone -b master https://github.com/raspberrypi/pico-examples.git
export PICO_SDK_PATH=~/pico-sdk

You can be sure all is setup to go running these commands:
gcc
Result:

gcc.exe: fatal error: no input files
compilation terminated.

ld
Result:

C:\msys64\mingw64\bin\ld.exe: no input files

make
Result:

make: *** No targets specified and no makefile found.  Stop.

mingw32-make
Result:

mingw32-make: *** No targets specified and no makefile found.  Stop.

echo $PICO_SDK_PATH
Result:

/home/<YOURUSER>/pico-sdk

and now you are ready to start the building process:

cd ~
git clone -b master https://github.com/raspberrypi/picotool.git
cd picotool
mkdir build
cd build
cmake -G "MSYS Makefiles" -DPC_LIBUSB_INCLUDEDIR="/mingw64/include/libusb-1.0" ..
make -j

Thanks to @binkinator, If anyone gets the following error:

$ cmake -G "MSYS Makefiles" -DPC_LIBUSB_INCLUDEDIR="/mingw64/include/libusb-1.0" ..
CMake Error: Could not create named generator MSYS Makefiles
Generators
* Unix Makefiles               = Generates standard UNIX makefiles.
  Ninja                        = Generates build.ninja files.
  Ninja Multi-Config           = Generates build-<Config>.ninja files.
............

Spoiler: You can follow this instructions:

The Error:

$ cmake -G "MSYS Makefiles" -DPC_LIBUSB_INCLUDEDIR="/mingw64/include/libusb-1.0" ..
CMake Error: Could not create named generator MSYS Makefiles
Generators
* Unix Makefiles               = Generates standard UNIX makefiles.
  Ninja                        = Generates build.ninja files.
  Ninja Multi-Config           = Generates build-<Config>.ninja files.
  CodeBlocks - Ninja           = Generates CodeBlocks project files.
  CodeBlocks - Unix Makefiles  = Generates CodeBlocks project files.
  CodeLite - Ninja             = Generates CodeLite project files.
  CodeLite - Unix Makefiles    = Generates CodeLite project files.
  Eclipse CDT4 - Ninja         = Generates Eclipse CDT 4.0 project files.
  Eclipse CDT4 - Unix Makefiles= Generates Eclipse CDT 4.0 project files.
  Kate - Ninja                 = Generates Kate project files.
  Kate - Unix Makefiles        = Generates Kate project files.
  Sublime Text 2 - Ninja       = Generates Sublime Text 2 project files.
  Sublime Text 2 - Unix Makefiles
                               = Generates Sublime Text 2 project files.

It's because regular cmake has priority in your path over the mingw version.

By example if you run:
$ which cmake

you get:
/usr/bin/cmake

So you can try this to fix it:

$ export PATH=/mingw64/bin:$PATH
$ which cmake

and you should get
/mingw64/bin/cmake

Now the command
$ cmake -G "MSYS Makefiles" -DPC_LIBUSB_INCLUDEDIR="/mingw64/include/libusb-1.0" ..
will work as needed

The last step is to copy the needed external libraries to the same folder of the new build executable, you need to take them with the Exe file if you like to use outside the MSYS environment.

cp /mingw64/bin/libusb-1.0.dll .
cp /mingw64/bin/libgcc_s_seh-1.dll .
cp /mingw64/bin/libstdc++-6.dll .
cp /mingw64/bin/libwinpthread-1.dll .
./picotool.exe

If you get a USB deviced don't recognized of the error:


e: and if you get the following...

       $ ./picotool.exe info
No accessible RP2040 devices in BOOTSEL mode were found.

but:

Device at bus 2, address 1 appears to be a RP2040 device in BOOTSEL mode, but picotool was unable to connect.

You may need to install a driver. See "Getting started with Raspberry Pi Pico" (https://github.com/raspberrypi/picotool/issues/20) for more information

In summary you need to use Zadig to create the needed drivers for windows

https://zadig.akeo.ie/

 

[Girtana1]

But I learned much and switched over to hack an fire stick over emmc.

Glad to hear!
I've heavily considered ordering in the past but I've never bit the bullet because idk where I'd store my backups lol

Wait, that's a thing?? I guess I've just never considered it but I have an old 'bricked' Fire Stick myself, I'm really interested in more info on that now lmao

 

[Mansi]

MinGW

srsly?
Use ubuntu in win. MinGW is bad shell)

 

[Doodka]

Ok guys, i put firmware in some disassembler and get THUMB code
I dont relly know, trash it or not, but i post it here

[КОД]
ROM loaded, initializing rp2040
processor state initialized
1c movs r3, #0 ; 0x00
1e ldrh r2, [r0, #0] ; 0x0
20 cmp r2, r3
22 beq.n 2c ; PC + 10
24 ldrh r3, [r0, #2] ; 0x2
26 adds r0, #4 ; 0x04
28 cmp r1, r2
2a bne.n 1c ; PC + -14
2c adds r0, r3, #0 ;0x0
2e bx sp
30 wfi
32 b.n 30
34 mov ip, sp
36 (32-bit)
38 (32-bit)
3a ldr r0, [pc, #632] ; 0x0278
3c movs r1, #0 ; 0x00
3e str r1, [r0, #0] ; 0x0
40 str r1, [r0, #4] ; 0x4
42 mov pc, ip
44 ldr r0, [pc, #624] ; 0x0270
46 movs r1, #0 ; 0x00
48 mvns r1, r1
4a str r1, [r0, #0] ; 0x0
4c str r1, [r0, #4] ; 0x4
4e bx sp
50 add r1, pc, #580
52 lsls r4, r4, #2
54 subs r1, r1, #0 ;0x0
56 nop ; movs r0, r0
58 orrs r0, r5
5a movs r0, #41 ; 0x29
5c adds r0, #50 ; 0x32
5e adds r0, #50 ; 0x32
60 strh r0, [r4, r0]
62 strb r1, [r4, #13]
64 str r0, [r6, #36] ; 0x24 imm5
66 strb r5, [r4, #9]
68 ldrb r2, [r6, #5]
6a str r0, [r4, r0]
6c movs r0, #105 ; 0x69
6e strb r4, [r2, #9]
70 str r1, [r4, #68] ; 0x44
72 ldr r1, [r5, #100] ; 0x64
74 movs r0, #103 ; 0x67
76 ldrb r4, [r1, #17]
78 lsls r4, r4, #1
7a adds r3, #80 ; 0x50
7c lsls r1, r3, #11
7e adds r3, #82 ; 0x52
80 lsls r5, r7, #11
82 adds r3, #76 ; 0x4c
84 lsls r7, r4, #12
86 adds r3, #84 ; 0x54
88 lsls r7, r3, #13
8a strh r5, [r1, r5]
8c movs r6, #221 ; 0xdd
8e adds r4, #83 ; 0x53
90 movs r6, #209 ; 0xd1
92 muls r5, r1[/CODE]

 

[r1vver]

Ладно, ребята, я закинул прошивку в какой-нибудь дизассемблер и получил THUMB код
Не знаю, мусор это или нет, но я выкладываю сюда

Spoiler

ROM loaded, initializing rp2040
processor state initialized
1c movs r3, #0 ; 0x00
1e ldrh r2, [r0, #0] ; 0x0
20 cmp r2, r3
22 beq.n 2c ; PC + 10
24 ldrh r3, [r0, #2] ; 0x2
26 adds r0, #4 ; 0x04
28 cmp r1, r2
2a bne.n 1c ; PC + -14
2c adds r0, r3, #0 ;0x0
2e bx sp
30 wfi
32 b.n 30
34 mov ip, sp
36 (32-bit)
38 (32-bit)
3a ldr r0, [pc, #632] ; 0x0278
3c movs r1, #0 ; 0x00
3e str r1, [r0, #0] ; 0x0
40 str r1, [r0, #4] ; 0x4
42 mov pc, ip
44 ldr r0, [pc, #624] ; 0x0270
46 movs r1, #0 ; 0x00
48 mvns r1, r1
4a str r1, [r0, #0] ; 0x0
4c str r1, [r0, #4] ; 0x4
4e bx sp
50 add r1, pc, #580
52 lsls r4, r4, #2
54 subs r1, r1, #0 ;0x0
56 nop ; movs r0, r0
58 orrs r0, r5
5a movs r0, #41 ; 0x29
5c adds r0, #50 ; 0x32
5e adds r0, #50 ; 0x32
60 strh r0, [r4, r0]
62 strb r1, [r4, #13]
64 str r0, [r6, #36] ; 0x24 imm5
66 strb r5, [r4, #9]
68 ldrb r2, [r6, #5]
6a str r0, [r4, r0]
6c movs r0, #105 ; 0x69
6e strb r4, [r2, #9]
70 str r1, [r4, #68] ; 0x44
72 ldr r1, [r5, #100] ; 0x64
74 movs r0, #103 ; 0x67
76 ldrb r4, [r1, #17]
78 lsls r4, r4, #1
7a adds r3, #80 ; 0x50
7c lsls r1, r3, #11
7e adds r3, #82 ; 0x52
80 lsls r5, r7, #11
82 adds r3, #76 ; 0x4c
84 lsls r7, r4, #12
86 adds r3, #84 ; 0x54
88 lsls r7, r3, #13
8a strh r5, [r1, r5]
8c movs r6, #221 ; 0xdd
8e adds r4, #83 ; 0x53
90 movs r6, #209 ; 0xd1
92 muls r5, r1

write in english, it's official here by the forum rules, and the moderators here are horrible racists, they tear down any non-english texts without even looking

 

[Doodka]

write in english, it's official here by the forum rules, and the moderators here are horrible racists, they tear down any non-english texts without even looking

Sry, Chrome automatic translate it

 

[TheSynthax]

Anyone done a wire install without a CPU flex?

 

[linuxares]

write in english, it's official here by the forum rules, and the moderators here are horrible racists, they tear down any non-english texts without even looking

Language isn't a race, but aight.

 

[saladus]

Anyone done a wire install without a CPU flex?

that sounds unnecessarily hard, especially considering sp1 and sp2

 

[heinrich_frei]

Anyone done a wire install without a CPU flex?

Yes, it works

 

[Tafty]

So then, I've installed one into a switch lite as per the instructions on one of the previous posts..I then used the uf2 from the firmware dump.

When you turn the console on the led goes blue then red and ofw launchs,compared to before I installed where it went pink.

So something is happening now it's wired in

Please ignore the nonsense resistors.. I didn't have any smd 450 so have ordered some to swap those ones out if we can get it working

 

[TheSynthax]

Has anyone tried using one of these after making sure boot0 is flashed with the custom bootloader? Do we even know that this is currently able to write to the eMMC by itself?