Hacking Hardware Picofly - a HWFLY switch modchip

[darrin41]

Well, all the same, people will call it pikofly when the firmware is finished and will work.

Post automatically merged: Feb 8, 2023

I would wait... but last time when I waited, sx was closed and there were no chips or they cost a million :/ so now the situation is different but...

Where can you buy these chips from . Thanks in advance

 

[binkinator]

Where can you buy these chips from . Thanks in advance

https://www.aliexpress.us/item/3256804090654134.html

 

[mrdude]

Where can you buy these chips from . Thanks in advance

You are probably better waiting for this to be cracked, then a new board will be released with resistors + flex cable points added. Once all the testing is completed and this thing is able to run homebrew properly, it's easy to make a modded board or even a board addon to include those extra components needed to make life easier.

 

[icantfly]

already ordered couple mosfets from ebay, hope we can use original rpi pico instead of rp2040 mini

 

[Piorjade]

already ordered couple mosfets from ebay, hope we can use original rpi pico instead of rp2040 mini

Should work aswell, same hardware and pins. But the size of the Pico is a concern.

 

[pixxel13]

You are probably better waiting for this to be cracked, then a new board will be released with resistors + flex cable points added. Once all the testing is completed and this thing is able to run homebrew properly, it's easy to make a modded board or even a board addon to include those extra components needed to make life easier.

what resistors are we using? and where can I buy those resistors and the flex cable?

 

[saladus]

In this FW chip id is stored in 0x200259c8 address:

is 200259c8 the first byte?

 

[Tafty]

what resistors are we using? and where can I buy those resistors and the flex cable?

47 ohm you need 3, get smd ideally probably 1206 is the best size for this but I haven't acctually checked so don't quote me on that and cpu flex can be ordered from Ali express

 

[renoob]

is 200259c8 the first byte?

Whole thing, by looking at SDK it seems to be an array (address to that array)
There is a function that does a lot :
Overclocks the chip to 333,
Gets unique_id,
and a lot more,
But its never called anywhere from the binary (maybe its in encrypted part), and setting breakpoint to it does do nothing. So I assume (since my rp is not soldered) this thing may be called later when chip is receiving some data ?
Anyway the function is at : 10015f60

 

[vittorio]

on the last fw you can't even see the id

 

[saladus]

@Tafty yeah turns out i didn't make the uf2 right. it now flashes, can you try again please?

 

[renoob]

on the last fw you can't even see the id

You can see the current ID as I've shown but the one stored for encryption cannot be found (at least I did not find anything in the ram). Its probably encrypted with the rest

 

[vittorio]

does the id on the new firmware show it to you?

 

[saladus]

You can see the current ID as I've shown but the one stored for encryption cannot be found (at least I did not find anything in the ram). Its probably encrypted with the rest

i don't think it has one stored for encryption lmao, that'd be counterproductive. fw is already encrypted, it just reads it from memory and passes it to another function (that presumably decrypts it but i have no idea what it does). the bypass i did is so hilariously dumb that i doubt it'll work. also on the talk of encryption, we quite literally have the key

 

[Tafty]

@Tafty yeah turns out i didn't make the uf2 right. it now flashes, can you try again please?

Doesnt work, no lights or anything and boots direct into stock HOS

 

[saladus]

Doesnt work, no lights or anything and boots direct into stock HOS

damn, thanks

 

[vittorio]

in the last fw did you find the id?

 

[renoob]

i don't think it has one stored for encryption lmao, that'd be counterproductive. fw is already encrypted, it just reads it from memory and passes it to another function (that presumably decrypts it but i have no idea what it does). the bypass i did is so hilariously dumb that i doubt it'll work. also on the talk of encryption, we quite literally have the key

Well it has to compare it doesn't it? In one form or another. But anyway yeah the right id is there so just a matter how to inject it

 

[nerirififi]

We knows HWFLY flash BOOT0, anybody test to apply this patch for see wha't s happen with this chip , and if we can boot CFW ?

I have many flex, so for erista motherboard it s the same pin to solder to the flex ? Because this flex on the picture is for Mariko. And I don't have HWFLY LITE for verify myself

 

[pixxel13]

47 ohm you need 3, get smd ideally probably 1206 is the best size for this but I haven't acctually checked so don't quote me on that and cpu flex can be ordered from Ali express

Do you have a link for the cpu flex?