Hacking Hardware Picofly - a HWFLY switch modchip

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
So how do you explain the non flashable hwfly booting to a black screen on an oled switch with a skhynix emmc instead of the no sd screen?

The same modchip boots fine with a Samsung emmc. The only difference is the emmc manufacturer.

Which emmc chip does @Nagaa 's switch use?
Nagaa's is a Samsung
Post automatically merged:

Can anyone test with their install removing a single line at a time and see if they get these error LED colors using the Ubuntu firmware?
 

Attachments

  • pinout diagram.jpg
    pinout diagram.jpg
    111.3 KB · Views: 69

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
Other people have said that they tried to boot into hekate with the pico using the leaked ubuntu firmware and were not able to do so, but as soon as they tried an hwfly it worked. I do think their soldering skills are sufficient too. Bad solder joints shouldn't be the issue here.

We also know that the rp2040 can successfully glitch switches with the right coding.
Post automatically merged:

@achm3t Can you please check your emmc memory chip. Which company manufactured the chip?
 

Raugo

Well-Known Member
Member
Joined
Nov 22, 2014
Messages
630
Trophies
0
XP
2,451
Country
Spain
The dat0 is used for glitching or is only needed to modify the emmc? If its the second what would happend if we edit the boot0 with the bootloader of hwfly and then remove the dat0 from the chip?
 
  • Like
Reactions: FruithatMods

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
The dat0 is used for glitching or is only needed to modify the emmc? If its the second what would happend if we edit the boot0 with the bootloader of hwfly and then remove the dat0 from the chip?
It *might* work, but it might also be using DAT0 to sniff the SDMMC bus, hard to say without source code. Might be using CMD for that though.
 

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
The dat0 is used for glitching or is only needed to modify the emmc? If its the second what would happend if we edit the boot0 with the bootloader of hwfly and then remove the dat0 from the chip?
That's a great idea! It isn't a permanent solution because you will still need to rewrite boot0 when HOS is updated, but this would actually mak it a great test!
If the pico firmware doesn't use dat0 as one of the timing anchors ,which I don't think it does, I don't see a reason why it shouldn't work!
Post automatically merged:

If this test fails we will know if the current firmware uses dat0 as one of the timing anchors.
There is no harm in trying that!
 
Last edited by FruithatMods,

achm3t

Member
Newcomer
Joined
Apr 10, 2022
Messages
15
Trophies
0
Age
38
Location
Nursultan
XP
350
Country
Kazakhstan
Other people have said that they tried to boot into hekate with the pico using the leaked ubuntu firmware and were not able to do so, but as soon as they tried an hwfly it worked. I do think their soldering skills are sufficient too. Bad solder joints shouldn't be the issue here.

We also know that the rp2040 can successfully glitch switches with the right coding.
Post automatically merged:

@achm3t Can you please check your emmc memory chip. Which company manufactured the chip?
Ok. Will be able to check in 12 hours from now. But 90% sure it was Samsung emmc there.
Anyway, I have several V2 and lite switches in stock, will try to find one with Hynix emmc. Also I have many oleds, but just don’t want to mess with oled rp2040 installation :), it would be better to test with easier ones.
 
Last edited by achm3t,
  • Love
Reactions: FruithatMods

Piorjade

Well-Known Member
Member
Joined
Nov 8, 2015
Messages
142
Trophies
0
XP
407
Country
Gambia, The
Ok. Will be able to check in 12 hours from now. But 90% sure it was Samsung emmc there.
Anyway, I have several V2 and lite switches in stock, will try to find one with Hynix emmc. Also I have many oleds, but just don’t want to mess with oled rp2040 installation :), it would be better to test with easier ones.
It would be interesting to see it on a Kioxia, on Tafty‘s skhynix both my test code an the ubuntu fw work

TheSynthax has a Kioxia and there both mine and the ubuntu fw don‘t work.
 

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
It would be interesting to see it on a Kioxia, on Tafty‘s skhynix both my test code an the ubuntu fw work

TheSynthax has a Kioxia and there both mine and the ubuntu fw don‘t work.
Guess I gotta bite the bullet and hook up an SD card reader, hope it doesn't brick this Switch
 
  • Like
Reactions: peteruk

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
Last edited by FruithatMods,

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
https://github.com/ignasurba/mmcblkNX/issues/1
Post automatically merged:

Alternatively you can use an SD card reader with the low voltage adapter. You will be restricted to 1 bit mode so the SD card reader will need to support that. SD card readers that support 1 bit Mode are quite rare but they do exist.
I have two readers that support 1-bit mode, and an exploitee.rs low voltage adapter.
 
  • Love
Reactions: FruithatMods

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
I have two readers that support 1-bit mode, and an exploitee.rs low voltage adapter.
Would you mind sharing which adapters you use that support 1bit mode so others can buy one if they need it.

The small black transcend SD card reader which is recommended on Exploitee.rs doesn't support 1 bit mode these days. Only the new revision with a different chipset is available on amazon.
 

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
Would you mind sharing which adapters you use that support 1bit mode so others can buy one if they need it.

The small black transcend SD card reader which is recommended on Exploitee.rs doesn't support 1 bit mode these days. Only the new revision with a different chipset is available on amazon.
I've got that very same card reader, they definitely don't support 1-bit mode anymore. This is the exact one I use for reading my car's eMMC in 1-bit mode, this rather obscure adapter- https://www.walmart.com/ip/onn-SD-micro-SD-Card-Reader/339922305 no idea where I got it, I definitely didn't get it at Walmart and it's not in my Amazon history.
 

evil_santa

Well-Known Member
Member
Joined
Jan 15, 2020
Messages
380
Trophies
1
Age
39
XP
1,847
Country
Germany
  • Like
Reactions: binkinator

binkinator

Garfield’s Fitness Coach
Member
GBAtemp Patron
Joined
Mar 29, 2021
Messages
6,511
Trophies
2
XP
6,155
Country
United States

FruithatMods

Well-Known Member
Member
Joined
Dec 16, 2018
Messages
128
Trophies
0
Age
34
XP
450
Country
Germany
SD card readers which show up as mass storage devices can't be used to access boot0/boot1 AFAIK.

Unfortunately I don't actually have any adapter or card reader that can access boot0 over 1bit mode. If such a thing exists do say so.

FT232H with postal looks promising but it only works in Windows. It would be nice if we had a Linux equivalent which could access the partitions natively without having to clone them.

The adapter which uses a realtek chip is great but it can't be used in 1 bit mode. This one: https://www.tindie.com/products/ignas/emmc-reader-for-hac-emmc/

Using an rp2040 for this is actually a brilliant idea!
Post automatically merged:

On second thought it might not be very convenient to use the rp2040 as a usb emmc reader either. Wouldn't we be limited to the usb 1 speeds of the rp2040? 26kBs isn't a lot of fun when interfacing a lot of data.
Post automatically merged:

It looks like FT232H could be used in Linux with mmc-utils: https://github.com/mhei/mmc-utils
 
Last edited by FruithatMods,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    ZeroT21 @ ZeroT21: only ps5 updated to latest firmware can go on psn, jailbroken ones just don't use psn or they...