Hacking Hardware Picofly - a HWFLY switch modchip

  • Thread starter Thread starter mathew77
  • Start date Start date
  • Views Views 3,674,027
  • Replies Replies 17,052
  • Likes Likes 15
lockpick_rcm.png

I have successfully dumped the key after flashing the unlock.uf2 file !!
But, the secure boot key value remains unchanged at ffff. Could you please explain to me if installing Piko would overwrite the secure boot key to ffff regardless of whether the unlock.uf2 file is flashed or not? Also, are there any potential negative effects of this? I would appreciate your guidance.
 
View attachment 362519
I have successfully dumped the key after flashing the unlock.uf2 file !!
But, the secure boot key value remains unchanged at ffff. Could you please explain to me if installing Piko would overwrite the secure boot key to ffff regardless of whether the unlock.uf2 file is flashed or not? Also, are there any potential negative effects of this? I would appreciate your guidance.
It's normal that hekate shows sbk as FFF... on mariko.
You need to use 'partial overwrite attack' to dump sbk on mariko, but no reason to do that.
 
Hey im really sorry if this is the wrong place to ask but i have an OLED switch that ofc cant be hacked with fusee gelee. Is this mod chip ready to go or should i wait a bit longer. Also is this chip independant of firmware version (im guessing that it is but its a good idea to check).
 
Hey im really sorry if this is the wrong place to ask but i have an OLED switch that ofc cant be hacked with fusee gelee. Is this mod chip ready to go or should i wait a bit longer. Also is this chip independant of firmware version (im guessing that it is but its a good idea to check).
It's ready to go. But OLED is the hardest/most annoying to mod since you need an ankor or reballing of the eMMC. The Firmware doesn't matter since it's the bootloader that is being abused to inject custom code.
V2.6 that is being developed seem to be a big upgrade so if you don't have to mod it right now, wait a bit.
 
It's ready to go. But OLED is the hardest/most annoying to mod since you need an ankor or reballing of the eMMC. The Firmware doesn't matter since it's the bootloader that is being abused to inject custom code.
V2.6 that is being developed seem to be a big upgrade so if you don't have to mod it right now, wait a bit.
Ahh alr, ty for the help. Btw is there like a github for the firmware and what parts do you need for the mod.
 
  • Like
Reactions: khuong and Ricky_25
If this is your first soldering job. It isn't for you.

Here is a summary page that try to collect all info and make it easier to find - https://gbatemp.net/threads/picofly-aio-thread.628951/
Ty and yeah after seeing everything here im defo gonna actually learn how to solder before doing this.
Post automatically merged:

If this is your first soldering job. It isn't for you.

Here is a summary page that try to collect all info and make it easier to find - https://gbatemp.net/threads/picofly-aio-thread.628951/
Hey i just had a look at this thread and saw that it was recomended to get it done by a professional, would this mean sending my switch somewhere or would a high street repair place be able to do it.
 
Last edited by tactical-waffle,
  • Like
Reactions: impeeza
Use points not on emmc as its safer (The points on diagram has 2 points and they are already connected so a bridge is fine)
Use toshiba fix then use unlock all on pc first
47ohm some boot ofw some dont but you get slow mode so use it for sure
Are there any other soldering points besides the emmc chip on patched erista and big mariko switches? I've seen it somewhere, but I don't remember where.
 
Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success



Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card do not use, bugged.

Boot into Full Stock and perform a full system reset.
Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success



Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card do not use, bugged.

Boot into Full Stock and perform a full system reset.
Has any information come out about the scheme of the welding points for the Rp2040 Pi Pico? (the version that is a little larger than the zero) in the Pi pico version some names change and I would like to know their equivalence. Thank you
Post automatically merged:

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success



Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card do not use, bugged.

Boot into Full Stock and perform a full system reset.


Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card do not use, bugged.

Boot into Full Stock and perform a full system reset.
[/QUOTE]
Has any information come out about the scheme of the welding points for the Rp2040 Pi peak? (the version that is a little larger than the zero) in the Pi pico version some names change and I would like to know their equivalence. Thank you
Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success



Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: GREEN, but instant reset
A: Check your soldering, clean flux. If does not help = add 20K-30K to RST

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot.

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

By using the Atmosphere unlock tool you agree to use it for homebrew only.

Way 1 (USB): flash the unlock.uf2 into chip by USB
Way 2 (no USB): run picofly_tb from Hekate, need unlock.bin on the SD card do not use, bugged.

Boot into Full Stock and perform a full system reset.
Has any information come out about the scheme of the welding points for the Rp2040 Pi Pico? (the version that is a little larger than the zero) in the Pi pico version some names change and I would like to know their equivalence. Thank you
 
Has any information come out about the scheme of the welding points for the Rp2040 Pi Pico? (the version that is a little larger than the zero) in the Pi pico version some names change and I would like to know their equivalence. Thank you
for pico u need to wait for the 2.6 fw release i think it added the pico to it not sure though
no one knows when it will be released u have to wait till its done hes doing this in his free time for free so just be patiant and wait :-)
Post automatically merged:

@everyonesweird, it's been partially answered before

- multi-board support (RPi, xiao, zero, one) within the single fw
- OFW support fixes
- brick-proof firmware update through hekate
- sdloader power fixes, should also improve glitch
- maybe some glitch algo improvements
well maybo not so

the pico is to big anyways just try to ur hand one of these chips
xiao, zero, one
 
Oof was the Switch dusty? I noticed the cotton tops or was it just the thermal paste being like black?
Yes, just cleaning up thermal paste on other switch jobs.
I like to get rid of factory. Using Thermal-grizzly paste to replace.

I will try and explain about getting the chip to sit low.
Take the top APU/RAM shield, cut the RAM side of it off.
Then cut off where the RAM shield (you just cut away) would clip onto the metal to Switch's board (the thin metal piece left over).

The chip should then find a home in that area and almost sit in between the other chips.
Just dont forget to insulate the bottom of the Picofly.

I then used the same pair of sharp small scissors to cut out the big main metal shield that screws onto the back of the Switch.
The area where the chip is now sitting.

Insulate the top of the chip with kapton tape in-case the shielding touches the top of the Picofly chip once that big main shield goes back on top.


Ant
 
for pico u need to wait for the 2.6 fw release i think it added the pico to it not sure though
no one knows when it will be released u have to wait till its done hes doing this in his free time for free so just be patiant and wait :-)
Post automatically merged:


well maybo not so

the pico is to big anyways just try to ur hand one of these chips
Pico is on the 2.6 support list:lol:

@everyonesweird, it's been partially answered before

- multi-board support (RPi, xiao, zero, one) within the single fw
- OFW support fixes
- brick-proof firmware update through hekate
- sdloader power fixes, should also improve glitch
- maybe some glitch algo improvements
Post automatically merged:


they are the same mosfets. third letter means its origin (manufacture)
 
  • Like
Reactions: Dee87

Site & Scene News

Popular threads in this forum