Hacking Hardware Picofly - a HWFLY switch modchip

[thesjaakspoiler]

Does anybody have info about what SP1 and SP2 actually are for? I know they're capacitors but idk what they do/control.

Usually capacitors on CPU's are there to avoid glitches in the power rails.
My guess was that the original tx modchip used ap1 and sp2 to just get all the required voltages from 1 place easily.

 

[FruithatMods]

We have no acces to the reset line.
And it's not needed.
Ground CMD, CLK or Dat0 and SOC has no access to the emmc and goes do RCM.
Chip can write payload.
=> Done
Reset soc whit =>
Start fancy glitch power.
Right @doom95 ?

What are you talking about? Of course we have access to the reset line. Isn't the reset line the one labeled as reset on sthetix schematics?

 

[FruithatMods]

No one claimed to be from China.

 

[evil_santa]

What are you talking about? Of course we have access to the reset line. Isn't the reset line the one labeled as reset on sthetix schematics?

Yep it's nonsense, sorry about that.

 

[Piorjade]

Usually capacitors on CPU's are there to avoid glitches in the power rails.
My guess was that the original tx modchip used ap1 and sp2 to just get all the required voltages from 1 place easily.

Sorry, I phrased my question poorly. What I meant is if anybody knows on what line(s) SP1 and SP2 actually sit on.
I.e. is SP1 sitting on the voltage rail for the BPMP processor? And what is the other rail/line then, GND or reset?

The voltage rail for the BPMP processor is the one that needs to be glitched, so I guess either SP1 or SP2 is the one.

Post automatically merged: Feb 3, 2023

What are you talking about? Of course we have access to the reset line. Isn't the reset line the one labeled as reset on sthetix schematics?

Do you mean the leaked schematics of the SX Core from a couple of years back?

 

[FruithatMods]

I would guess that the cap is connected to many components inside the cpu.

Post automatically merged: Feb 3, 2023

Sorry, I phrased my question poorly. What I meant is if anybody knows on what line(s) SP1 and SP2 actually sit on.
I.e. is SP1 sitting on the voltage rail for the BPMP processor? And what is the other rail/line then, GND or reset?

The voltage rail for the BPMP processor is the one that needs to be glitched, so I guess either SP1 or SP2 is the one.

Post automatically merged: Feb 3, 2023

Do you mean the leaked schematics of the SX Core from a couple of years back?

The B point on hwfly is reset.

Post automatically merged: Feb 3, 2023

Sorry, I phrased my question poorly. What I meant is if anybody knows on what line(s) SP1 and SP2 actually sit on.
I.e. is SP1 sitting on the voltage rail for the BPMP processor? And what is the other rail/line then, GND or reset?

The voltage rail for the BPMP processor is the one that needs to be glitched, so I guess either SP1 or SP2 is the one.

Post automatically merged: Feb 3, 2023

Do you mean the leaked schematics of the SX Core from a couple of years back?

I mean the HWfly oled connection pinouts. Sthetix has a github repo with all the solder points. Search for hwfly oled schematics sthetix.

 

[brecht6]

Is the firmware out now?
Is this legit?

 

[vittorio]

Is the firmware out now?
Is this legit?

https://www.mediafire.com/file/vkhs84clvihonht/PicoFly.zip/file link

 

[firke_the_one]

https://www.mediafire.com/file/vkhs84clvihonht/PicoFly.zip/file link

idk if you should be sharing sketchy links here, nothing's confirmed

 

[Doodka]

https://www.mediafire.com/file/vkhs84clvihonht/PicoFly.zip/file link

files are identical to the encrypted dumps from the beginning of the thread, so it looks more like stuffing

 

[FruithatMods]

Who here has actually tried the original leak on their switch?

 

[vittorio]

files don't look encrypted

 

[Doodka]

Who here has actually tried the original leak on their switch?

https://gbatemp.net/goto/post?id=10057982
i think he tryed, but he didnt answer me about how he upload files

 

[impeeza]

we should merge the two threads this one and https://gbatemp.net/threads/scene-d...s-a-raspberry-pi.623082/page-25#post-10064175, the post on both are duplicated.

 

[AntonIX]

I wanted to buy rpi to solder and test, but hwfly cpu cable costs more than rpi. Is there any way to solder it directly to rpi and do not use hwfly cable?

 

[Tafty]

https://gbatemp.net/goto/post?id=10057982
i think he tryed, but he didnt answer me about how he upload files

yeh that was me, sorry i didnt see your question i just used the uf2 provided.

 

[FruithatMods]

Never mind. Both files are in the zip.

 

[Tafty]

The only download link which is sketchy is the one on the youtube video which makes you click on ads.

Do you have the bin file also?
Can you upload it?

yeh i have the files, let me try uploading the bin and see what happens, i will check in a couple of hours not in front of the console to test at the minute

 

[Mansi]

It's called hype.
A person saw an encrypted firmware here, published it and is waiting for donations)
Also added a bunch of ads. he is strange

 

[duyluu123]

I love the way you guys research and try with passion, even if it fails, I admire you all