Hacking Hardware Picofly - a HWFLY switch modchip

[BlownUpTurtle]

Yes, you are right.

Until you do the full reset, the "Reset to OFW", boot in "Vol+ & Vol-" and boot without chip would give the blue or black screen due to BCT mismatch

Post automatically merged: Mar 21, 2023

Same place, CPU caps. But I can assure you, pico board should work fine without them

Is this if you use CFW on SysEmmc? Or is it still needed if you update Sysnand via nintendo and EmuEmmc by day break?

 

[Dee87]

Yes, you are right.

Until you do the full reset, the "Reset to OFW", boot in "Vol+ & Vol-" and boot without chip would give the blue or black screen due to BCT mismatch

Post automatically merged: Mar 21, 2023

Same place, CPU caps. But I can assure you, pico board should work fine without them

okay so they are all the same ? i can just use any of them?
another question i had the wires hooked up like in the picture and both side had a connection to ground ist that normal ?
that is the main reason i took the wires back of to see if i had any short and they where still there
the board worked fine bevor i connected the wires
havent started the board yet since im still waiting for parts

 

[vittorio]

I confirm that on a toshiba v1 patched a friend of mine it doesn't go so well @rehius

 

[BlownUpTurtle]

I confirm that on a toshiba v1 patched by a friend of mine it doesn't go so well

Is it all V1's? I've got a Toshiba V2 I was going to do this on, I may just buy a replacement Samsung Emmc and write my toshiba backup to it

 

[vittorio]

try on v2 if it works

 

[rehius]

Is this if you use CFW on SysEmmc? Or is it still needed if you update Sysnand via nintendo and EmuEmmc by day break?

You can do anything you want with EmuEmmc, since this does not impact on the OFW.

But if you want to update the original system + want it booting without chip, please do that in full OFW mode. daybreak / Semi-Stock avoid BOOT0 writes

Post automatically merged: Mar 21, 2023

okay so they are all the same

There is waveshare zero schematics for details. The closest 4 caps around the chip are 100nF

Post automatically merged: Mar 21, 2023

try on v2 if it works

Could be the specific Toshiba model or mfg year matters. Probably the timeouts are the main reason, Toshiba is pretty slow, and picofly has tight timings to be faster

 

[Donnie-Burger]

V1 patched - Samsung emmc - 1tb sandisk - No resistors - Slow mode prompt in hekate - sysnand cfw loads - Seems to be working fine even though hekate saying emmc in slow mode. Wont have resistors in for a few days.

Edit: All 3 load and work - Stock - SYS CFW - EMU CFW (With hekate slow emmc error and no resistors)

 

[vittorio]

You can do anything you want with EmuEmmc, since this does not impact on the OFW.

But if you want to update the original system + want it booting without chip, please do that in full OFW mode. daybreak / Semi-Stock avoid BOOT0 writes

Post automatically merged: Mar 21, 2023

There is waveshare zero schematics for details. The closest 4 caps around the chip are 100nF

Post automatically merged: Mar 21, 2023

Could be the specific Toshiba model or mfg year matters. Probably the timeouts are the main reason, Toshiba is pretty slow, and picofly has tight timings to be faster

probably yes because either it's slow or the glitch doesn't start

 

[binkinator]

Same place, CPU caps. But I can assure you, pico board should work fine without them

Spoken like a man who has fried a cap or two in this process!

 

[Assidefok]

IT would be great, if somone designs a pcb using actual hwfly flex on rp2040. Removing usb and buttons in order to fit everything inside

 

[DawnWorkout]

So the full cost breakdown if you already having a soldering iron, solder, and flux then it comes out right at $30 for everything else. Wire, Flex Cable, the correct kind of double sided tape, 2040 Pico, and resistors.

The price of Pico is cheap, but if the price of hwfly chips goes down, could that be an advantage? If the hwfly chip becomes cheaper.. it is relatively easy to install and there are many guide and information
What about this idea?
Pico $30 and if hwfly down from $60

Amazing！The price of other chips will be reduced

When I asked the official Chinese merchant about the price trend of the hwfly chip
They rather said that the price of hwfly chips goes up. Pico's price is also going up, They said negatively about it
(After talking to them I cancelled 5 hwfly)

 

[Adran_Marit]

IT would be great, if somone designs a pcb using actual hwfly flex on rp2040. Removing usb and buttons in order to fit everything inside

I'm sure there is some smart cookie who can, but then they could sell that chip for $$ if they wanted

 

[Saliciae]

IT would be great, if somone designs a pcb using actual hwfly flex on rp2040. Removing usb and buttons in order to fit everything inside

If someone can get me the pitch of the flex connector on hwfly cpu flex that would be really helpful. I already found pinout but my pcb software wont open the altium format files i found.

 

[Adran_Marit]

If someone can get me the pitch of the flex connector on hwfly cpu flex that would be really helpful. I already found pinout but my pcb software wont open the altium format files i found.

Gimmie a few and I might be able to..

Post automatically merged: Mar 21, 2023

If someone can get me the pitch of the flex connector on hwfly cpu flex that would be really helpful. I already found pinout but my pcb software wont open the altium format files i found.

I can't measure exactly but my (dead) lites seems to be about 0.75mm

 

[Saliciae]

Gimmie a few and I might be able to..

Post automatically merged: Mar 21, 2023

I can't measure exactly but my (dead) lites seems to be about 0.75mm

Center to center on adjacent pins? That's not a common pitch. could it be 0.5mm?

 

[Robmead23]

Thanks so much new to the pi lol @BlownUpTurtle

 

[Adran_Marit]

Center to center on adjacent pins? That's not a common pitch. could it be 0.5mm?

yeah, I can't really measure properly as again it's in my dead lite and I dont have any spares laying around. But its 100% sub 1mm

 

[binkinator]

yeah, I can't really measure properly as again it's in my dead lite and I dont have any spares laying around. But its 100% sub 1mm

I will measure mine. One sec.

Post automatically merged: Mar 21, 2023

I will measure mine. One sec.

I’m gonna go w/ .5mm.

 

[leerz]

As I know, some Toshiba eMMC are still not working, but unfortunately it's hard to do anything without actually having them in hands. You can only wait for new versions for now

ok, i think i have figured out a way for this dang toshiba chips.

from the information you shared before where CMD can get ignored when sent too fast, so my hypothesis is by increasing wire length, it could potentially get delays from noise or even higher resistance (will have to verify more on other units i have here)

verified on: switch lite toshiba

this switch lite will

fail to glitch on hwflyv4 on latest hwfly firmware = infinite glitch

fail to glitch on picofly with 2.5 unlock firmware = infinite glitch

but now it glitches ok, a little slow.
it takes a while to glitch, i will try to let it optimize on its own and play with wire lengths more.



here's what i did. i extended the CMD wire by about 5-6 inches with 30awg wire wrapping, so basically

CMD POINT on board to a 1 inch insulated copper wire to a 5inch of 30 gauge to the resistor

see image.

video

 

[binkinator]

ok, i think i have figured out a way for this dang toshiba chips.

from the information you shared before where CMD can get ignored when sent too fast, so my hypothesis is by increasing wire length, it could potentially get delays from noise or even higher resistance (will have to verify more on other units i have here)

verified on: switch lite toshiba

this switch lite will

fail to glitch on hwflyv4 on latest hwfly firmware = infinite glitch

fail to glitch on picofly with 2.5 unlock firmware = infinite glitch

but now it glitches ok, a little slow.
it takes a while to glitch, i will try to let it optimize on its own and play with wire lengths more.



here's what i did. i extended the CMD wire by about 5-6 inches with 30awg wire wrapping, so basically

CMD POINT on board to a 1 inch insulated copper wire to a 5inch of 30 gauge to the resistor

see image.

video

Crazy intuition. If this turns out to be the issue…THAT is some hardware hacking!