Hacking Hardware Picofly - a HWFLY switch modchip

[nerirififi]

You should be able to do a continuity test using the legs of the mosfet, no?

similar to the pics for V1 and V2 in this post:

https://gbatemp.net/threads/pikofly-a-probably-fake-hwfly-modchips-or-not.622701/post-10066639

View attachment 352216
V1


View attachment 352215
V2

Yes you are right, I will update my pictures if I am wrong.

 

[Tafty]

Yes, but is I go with hwfly, I only need to solder the flex. Not to complicated as pico.

yes, mariko hwfly installs are super easy, solder the single cpu flex and job done!

 

[Piorjade]

To the guys with electrical knowledge: Do you think that soldering the MOSFET not directly on the capacitors but for example via 0.1mm - 0.25mm wires with let's say 1-2cm length will introduce significant delays (important for the voltage glitch)? I don't have a HWFLY CPU cable but I have loose MOSFETs, of course they're tiny as hell but I think it's easier to later disconnect them from the Switch when using wires if I choose to.

Post automatically merged: Feb 9, 2023

By the way, as I said I already have a prototype for the eMMC sniffing part (untested) and the next goal is the eMMC writing/reading part (to write the BCTs and payload to the eMMC). Turns out that I've finally found suitable Pico code for it:
https://github.com/carlk3/no-OS-Fat...sdio/FatFs_SPI/sd_driver/SDIO/rp2040_sdio.pio

It's for the SD card SDIO mode, which is in itself pretty much identical to the eMMC native mode. I'll try to modify it so that it only needs one DAT line (the code above uses 4 DAT lines on the SD card) and then I'll try to port the command flow of HWFLY-NX over.

I have an SD card breakout board hooked up and I hope that the SDIO mode supports the same command set of eMMCs, otherwise I'll have to hook the test setup up to my Switch but then I'll only test the read commands, I don't want to break my Switch lmao.

 

[szubiennica]

To the guys with electrical knowledge: Do you think that soldering the MOSFET not directly on the capacitors but for example via 0.1mm - 0.25mm wires with let's say 1-2cm length will introduce significant delays?

No, it won't

 

[Tafty]

To the guys with electrical knowledge: Do you think that soldering the MOSFET not directly on the capacitors but for example via 0.1mm - 0.25mm wires with let's say 1-2cm length will introduce significant delays (important for the voltage glitch)? I don't have a HWFLY CPU cable but I have loose MOSFETs, of course they're tiny as hell but I think it's easier to later disconnect them from the Switch when using wires if I choose to.

Post automatically merged: Feb 9, 2023

By the way, as I said I already have a prototype for the eMMC sniffing part (untested) and the next goal is the eMMC writing/reading part (to write the BCTs and payload to the eMMC). Turns out that I've finally found suitable Pico code for it:
https://github.com/carlk3/no-OS-Fat...sdio/FatFs_SPI/sd_driver/SDIO/rp2040_sdio.pio

It's for the SD card SDIO mode, which is in itself pretty much identical to the eMMC native mode. I'll try to modify it so that it only needs one DAT line (the code above uses 4 DAT lines on the SD card) and then I'll try to port the command flow of HWFLY-NX over.

I have an SD card breakout board hooked up and I hope that the SDIO mode supports the same command set of eMMCs, otherwise I'll have to hook the test setup up to my Switch but then I'll only test the read commands, I don't want to break my Switch lmao.

i think this should be fine, the mosfets on the flex are about 1cm away from the point anyway....the only way to really tell is to test

 

[Raugo]

@Tafty The picture of the switch lite with the rpi2040 installed is yours? If that is the case, Did you tried to dump de boot0 with hekate to see if the chip do something wrong there to not launch HOS?

Would be interesting to see the differences between boot0 of the same console with hwfly and picofile

 

[RexSonic]

For Switch lite

 

[rulles]

For Switch lite

Someone have this schema but for switch V2 ( marico)?

The MOSFETs you are talking is that components with "450"?!

 

[szubiennica]

Someone have this schema but for switch V2 ( marico)?

The MOSFETs you are talking is that components with "450"?!

mosfet is on flex cable

 

[Tafty]

Someone have this schema but for switch V2 ( marico)?

The MOSFETs you are talking is that components with "450"?!

There the resistors and you need 3 47 ohm....

The mosfets for this diagram are on the flex.

 

[brecht6]

Has there been much progress on the firmware?

 

[RexSonic]

Has there been much progress on the firmware?

It seems to work just can’t boot into HOS

 

[nerirififi]

It seems to work just can’t boot into HOS

you can boot in official mode, it s strange no one test to apply the patch on Boot0 that hwfly of sx core do the Emmc.
Maybe it s the fix for boot in CFW mode.

 

[Piorjade]

you can boot in official mode, it s strange no one test to apply the patch on Boot0 that hwfly of sx core do the Emmc.
Maybe it s the fix for boot in CFW mode.

We can't because the firmware overrides it on every boot, well, if the firmware behaves like HWFLY, which it probably does.

HWFLY checks on every boot if the BCTs are different, if yes, it overrides them.

 

[Raugo]

We can't because the firmware overrides it on every boot, well, if the firmware behaves like HWFLY, which it probably does.

HWFLY checks on every boot if the BCTs are different, if yes, it overrides them.

It's possible to do it in hekate, would be a temporary fix but at least if works we wild now what is the problem.

 

[Piorjade]

It's possible to do it in hekate, would be a temporary fix but at least if works we wild now what is the problem.

You can write BCTs and the payload in hekate?

 

[Raugo]

You can write BCTs and the payload in hekate?

The BCT and the boot firm is inside of the boot0 https://switchbrew.org/wiki/Flash_Filesystem

 

[nerirififi]

You can write BCTs and the payload in hekate?

it s not payload, it s a patch with some data on partition BOOT0
So you just need to dump the BOOT0, patch in the computer, and flash with hekate.
Then test the boot, and see what's happen.

I will test on unpatched unit, I will dump boot0 before installing the modchip and see if picofly flash this part.
I am pretty sure he don't flash the BOOT0

 

[Tafty]

it s not payload, it s a patch with some data on partition BOOT0
So you just need to dump the BOOT0, patch in the computer, and flash with hekate.
Then test the boot, and see what's happen.

I will test on unpatched unit, I will dump boot0 before installing the modchip and see if picofly flash this part.
I am pretty sure he don't flash the BOOT0

i can dump boot0 from this lite i have if you want to test this theory

 

[scd]

From what I gather the picofly is 100% real.
I hope the original Russian dev gets the credit for making this.

Zecoxao most likely just dumped the firmware from the rp2040 which Matthew77 discovered on the Russian craigslist type site.
He is now probably rewriting the FW and improving it to take all the credit.
I have checked the site myself and can't find any more of these, otherwise I would have also purchased one myself.

There are many reasons to be excited about this.

iolo57 already designed a pcb for the rp2040 for easy soldering

does this PCB replace the HWFLY cables?