Hacking Hardware Picofly - a HWFLY switch modchip

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
update on this, I'm somewhat relieved
Inoticed everytime i write back the original or even donor boot0, when when picofly starts, the led flashes WHITE longer than usual, I would assume, white is emmc WRITE

anyway,
I slapped in a normal modchip with hwfly fw 072
booted hekate,
loaded sysnand cfw - said something about warmboot (usually boot0 mismatch causes this)
decrypted pkg2 and it booted into hos

so I guess, the picofly fw 2.1 with potentially screw up and make your boot0 dirty

I will try to do this later

1. dump boot0, boot1, rawnand with modchip
2. install picofly (and it will write its own thing on boot0)
3. restore boot0, boot1, rawnand (which were dumped from the modchip)
4. try to boot hos again
We haven't yet seen "picofly" cause a brick, so this is definitely a unique situation so far- and may be something we need to keep an eye on if others' consoles have this problem in the future.
 

leerz

Well-Known Member
Member
Joined
Jan 11, 2015
Messages
754
Trophies
0
Age
36
Location
Makati
Website
leerz25.sitesled.com
XP
2,189
Country
We haven't yet seen "picofly" cause a brick, so this is definitely a unique situation so far- and may be something we need to keep an eye on if others' consoles have this problem in the future.
yes, that's why i have brought it to attention, i have modded plenty of switches from eristas to latest oled aula, so i pretty much know what i'm doing installation hardware and software wise,

i don't mean to fear monger, i'm not making false information so do not worry about reliability if i somehow made a booboo accidentally contaminated my data and mixing up the backups, i'm pretty positive picofly caused the softbrick.

nonetheless, any other tester should do their diligence in saving their switch guinea pigs data, esp the anon uf2 files are flying out of nowhere.


additional info, the nosd screen seem to be from a recent build of hwflynx
 
  • Like
Reactions: Adran_Marit

Mansi

Well-Known Member
Newcomer
Joined
Jan 14, 2023
Messages
70
Trophies
0
Age
30
XP
331
Country
Belarus
This is an interesting idea. It would be ideal to check this after reading the EMMC dump.
First make the original dump, then install rp2040 and make comparisons.
Then write the original dump back and put the hwfly and do the comparison again.

So we can find out what is being patched. I checked this on my erista model and the patched boot0 matched the pieces of code from firmware.bin, which I took from the github repository.

To do this, you need to reball emmc + programmer)
 

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
additional info, the nosd screen seem to be from a recent build of hwflynx
The payload is a modified version of HWFLY's with some additional code to overwrite the keyslots before chainloading a secondary payload.
This is an interesting idea. It would be ideal to check this after reading the EMMC dump.
First make the original dump, then install rp2040 and make comparisons.
Then write the original dump back and put the hwfly and do the comparison again.

So we can find out what is being patched. I checked this on my erista model and the patched boot0 matched the pieces of code from firmware.bin, which I took from the github repository.

To do this, you need to reball emmc + programmer)
That's really quite unnecessary. These comparisons could be done on a V2 console so its eMMC could be connected to an adapter without risking damage from doing repeated and unneeded BGA soldering. OR, it could be done but just using an RP2040 to dump the contents of boot0 over UART. We really don't need to do that though, we know exactly which blocks are modified, what those blocks are used for normally, and what the chips are using them for. It's a total replacement of the primary boot control table for one that will load our payload from a spare section of the b0 partition. This payload could be anything, as long as it is signed using the key stored in the BCT. BCT just tells the boot processor what it should do.
 
  • Like
Reactions: binkinator

Magnus Hydra

It’s rare for me to be here.
Member
Joined
Dec 12, 2011
Messages
172
Trophies
1
XP
618
Country
United States
the "no SD" screen IS the payload, if it isn't launching (ie you have a black screen) you cannot bypass the chip by pressing the volume buttons. How would that even work? The volume buttons aren't connected to the Pico in any way, unlike on Trinket chips. The only way for that to work is to have code- the sdloader payload- running on the Switch to detect the button presses.
Post automatically merged:


because it will be soon? Plus, it IS useful for Ubuntu/Lakka.
"you cannot bypass the chip by pressing the volume buttons. How would that even work? You see my video above showing how it normally works with a mod chip? The coding in the payload if u hit both volumes on the "no SD screen" it will boot stock. bypassing\disabling the chip.... I want to know have u tried with the pico....
 

TheSynthax

Well-Known Member
Member
Joined
Apr 29, 2018
Messages
220
Trophies
0
XP
509
Country
United States
"you cannot bypass the chip by pressing the volume buttons. How would that even work? You see my video above showing how it normally works with a mod chip? The coding in the payload if u hit both volumes on the "no SD screen" it will boot stock. bypassing\disabling the chip.... I want to know have u tried with the pico....
If you're getting the "no SD" screen then yes, you can boot stock using the volume buttons.
 
  • Like
Reactions: Magnus Hydra

Lamcza

Typ tego typu.
Member
Joined
Nov 23, 2022
Messages
584
Trophies
0
Age
33
XP
765
Country
Poland
do i understand this 80 pages correctly so, for now, it is proven to be a working solution but it can't boot Hekate because of some restrictions in its firmware.
 

Piorjade

Well-Known Member
Member
Joined
Nov 8, 2015
Messages
142
Trophies
0
XP
407
Country
Gambia, The
do i understand this 80 pages correctly so, for now, it is proven to be a working solution but it can't boot Hekate because of some restrictions in its firmware.
correct Incorrect, it can boot Hekate and thus Ubuntu and stuff, it just can't boot Atmosphere due to the custom sdloader with some restrictions
Post automatically merged:

additional info, the nosd screen seem to be from a recent build of hwflynx
At least considering the raw sdloader binary data, the sdloader is custom-made.

Newest ubuntu fw:

1678027733455.png

HWFLY-NX sdloader:

1678027772112.png
 
Last edited by Piorjade,

rcpd

Well-Known Member
Member
Joined
Jan 31, 2023
Messages
617
Trophies
0
Age
55
XP
1,385
Country
United States
do i understand this 80 pages correctly so, for now, it is proven to be a working solution but it can't boot Hekate because of some restrictions in its firmware.

This is incorrect. It can boot Hekate. It cannot boot Atmosphere CFW. Through Hekate you can also boot Android and L4T Ubuntu. You can also boot stock Horizon.
 

rehius

Well-Known Member
Member
Joined
Feb 6, 2023
Messages
377
Trophies
1
Age
34
XP
1,790
Country
Canada
yes, I understand this from reading all the 78 pages :)
i wish mena/phenom could dropby this thread also


also forewarning, anyone attempting to try this.

backup your nand first, boot0,boot1 from a normal chip (hwfly or sx)
I did some stuff earlier and switch won't boot hos even with the pico is not connected

1. first install success, can get to hekate, get boot hos by pressing reboot to ofw
2. dumped boot0, boot1 with picofly
3. restored a mariko (lite) boot0, boot1 i had from a donor
4. picofly took a few seconds longer to glitch and call hekate
5. tried to reboot to ofw (normally it would start ofw) but now it is = BLUESCREEN
6. restored boot0, boot1 that i dumped from pico, no more bluescreen BUT
7. switch will boot hekate fine, but will blackscreen when restart to ofw, or even if the chip /picofly is removed
will put back a hwfly chip and restore boot0, boot1 from there maybe it will be fixed

i'm calling it softbrick for now, boots hekate, but no longer boots ofw even if the chip is removed.
so again, warning to all, do not trust the boot0/boot1 dump or any other dump made from picofly , will install a hwfly chip tomorrow (it's 11PM here +PST)
fixed v2.5
 

Piorjade

Well-Known Member
Member
Joined
Nov 8, 2015
Messages
142
Trophies
0
XP
407
Country
Gambia, The
It can be "no piracy" like "I will not add support of Atmosphere launching" and like "I will block Atmosphere launching". Not the same.
I think it's pretty clear that the sole reason why he used a custom sdloader / bct was to block Atmosphere.
But I'm relieved, it seems like he isn't just another HWFLY competitor trying to make money
 

rcpd

Well-Known Member
Member
Joined
Jan 31, 2023
Messages
617
Trophies
0
Age
55
XP
1,385
Country
United States
I’m alright with it as is. I have two unpatched Switches so I’m not in any need for Atmosphere on it. I have plenty of legit games to play and now we can boot into Android/L4T Ubuntu on it.

Might get a Switch Lite just for a dedicated handheld. You can get one pretty cheap on eBay. A dedicated Lakka handheld device does sound enticing. Plus both of my unpatched Switches are banned, so this helps me not be banned on that one too for doing or forgetting to to something dumb.
 
  • Like
Reactions: binkinator

Magnus Hydra

It’s rare for me to be here.
Member
Joined
Dec 12, 2011
Messages
172
Trophies
1
XP
618
Country
United States
Thank you to everyone and all ur hard work. There are a few insider memes in the video, so over look somethings. Now I can play raid shadow legends on my OLED!:rofl2:

Screenshot 2023-03-07 12-53-09.png
 
Last edited by Magnus Hydra,

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    K3Nv2 @ K3Nv2: Lmao that sold out fast