Hacking Hardware Picofly - a HWFLY switch modchip

[linuxares]

IMO, this is just another revision of hwfly and nothing new: same fpga, same mcu, just different PCB to decrease cost and gain a little more profit. So it is not related to any pico here.

But the chip looks cool in white imho

 

[doom95]

Yeah, I think it's just a "minor" upgrade but using the same mcu and schematic with previous version.

it's not called upgradeable so that remains to be seen, no idea if it'll work with the community fw

 

[Adran_Marit]

But the chip looks cool in white imho

Cool and also very cool IYKWIM

 

[impeeza]

IMO, this is just another revision of hwfly and nothing new: same fpga, same mcu, just different PCB to decrease cost and gain a little more profit. So it is not related to any pico here.

yeah, you have to love their braveness:

is a totally changed hwfly, could be you latter couldn't even upgrade it to another firmware nor boot any payload they don't want you to load.

 

[Adran_Marit]

yeah, you have to love their braveness:

View attachment 359459


is a totally changed hwfly, could be you latter couldn't even upgrade it to another firmware nor boot any payload they don't want you to load.

Upgradable, as listed on page, so it might be a "hwfly store" but is it actually them making it? or someone else using the brand name

 

[qgywibczozfvvl]

Upgradable, as listed on page, so it might be a "hwfly store" but is it actually them making it? or someone else using the brand name

Spider point meme

 

[Incantation]

Well any chip is possible but do they have the software to boot up?

 

[kimitoboku101]

View attachment 359435


has anyone analyzed this part with ghidra? the static id could be here in two byte pairs

how to convert file from uf2 to bin ???

 

[linuxares]

how to convert file from uf2 to bin ???

Don't you convert the bin to uf2? Since uf2 is more open?

 

[BigHorse420]

how to convert file from uf2 to bin ???

Use picotool to load to rp2040 as uf2 and then save it to your pc as bin

 

[vittorio]

however it is possible to rewrite the firmware, we need to figure out how to write to emmc but it should be similar to sd, then we have the payload and the bct

https://raw.githubusercontent.com/hwfly-nx/firmware/master/firmware/src/payload.h
https://raw.githubusercontent.com/hwfly-nx/firmware/master/firmware/src/mariko_bct.h

Post automatically merged: Mar 16, 2023

payload is sdloader

 

[qgywibczozfvvl]

however it is possible to rewrite the firmware, we need to figure out how to write to emmc but it should be similar to sd, then we have the payload and the bct

https://raw.githubusercontent.com/hwfly-nx/firmware/master/firmware/src/payload.h
https://raw.githubusercontent.com/hwfly-nx/firmware/master/firmware/src/mariko_bct.h

Post automatically merged: Mar 16, 2023

payload is sdloader

0x69 noice

 

[impeeza]

how to convert file from uf2 to bin ???

Bin is a image of the flash, uf2 is the program section data of the chip.

Post automatically merged: Mar 16, 2023

also there is a set of converting tool but is really no need to convert a UF2 to a bin. By example, picotools (https://github.com/arduino/rp2040tools/releases) UF2Utils (https://github.com/microsoft/uf2/), bin2UF2 (https://github.com/xinabox/bin2uf2/releases) and the very same PicoTool (https://github.com/raspberrypi/picotool)

you can write the bin directly to the flash or use the UF2 to program the chip on bootloader mode. is the same

 

[doom95]

however it is possible to rewrite the firmware, we need to figure out how to write to emmc but it should be similar to sd, then we have the payload and the bct

pikofly picks up on when the loader is modified and reverts it immediately

 

[Piorjade]

however it is possible to rewrite the firmware, we need to figure out how to write to emmc but it should be similar to sd, then we have the payload and the bct

https://raw.githubusercontent.com/hwfly-nx/firmware/master/firmware/src/payload.h
https://raw.githubusercontent.com/hwfly-nx/firmware/master/firmware/src/mariko_bct.h

Post automatically merged: Mar 16, 2023

payload is sdloader

No offense but this has been probably talked about 20 times by now

 

[froggestspirit]

No offense but this has been probably talked about 20 times by now

Probably because it gets lost in the sea of "how do I install this" or "look at the stuff I bought for when it works"
Anyways, if I have this correct, we have 2 uf2's, one from the actual picofly that doesn't boot due to the ID being unique to the pico, and one that boots, but only non-hos payloads?
For anyone that's looked at this in ghidra, have we found the section where the pio is? That's going to most likely be the main communication, since it would effectively allow the pico to bitbang upwards of 100mhz+. I've more or less emulated the gameboy's APU on a pico with heavy pio usage for the audio output. I wouldn't say I'm a pro, but I know how to work with it to an extent.
Lastly, is there any documentation on how this works on the switch side? even if it's at a high level?

 

[qgywibczozfvvl]

View attachment 359435


has anyone analyzed this part with ghidra? the static id could be here in two byte pairs

Asking his progress might help ?

 

[Adran_Marit]

Probably because it gets lost in the sea of "how do I install this" or "look at the stuff I bought for when it works"
Anyways, if I have this correct, we have 2 uf2's, one from the actual picofly that doesn't boot due to the ID being unique to the pico, and one that boots, but only non-hos payloads?
For anyone that's looked at this in ghidra, have we found the section where the pio is? That's going to most likely be the main communication, since it would effectively allow the pico to bitbang upwards of 100mhz+. I've more or less emulated the gameboy's APU on a pico with heavy pio usage for the audio output. I wouldn't say I'm a pro, but I know how to work with it to an extent.
Lastly, is there any documentation on how this works on the switch side? even if it's at a high level?

Maybe scattered in this thread

 

[ppeach]

There is nothing that can be expected from something that can't even start hos before atmo.

 

[brecht6]

There is nothing that can be expected from something that can't even start hos before atmo.

But there are rumors that there is a private build of the firmware which can boot atmosphere