Hacking Hardware Picofly - a HWFLY switch modchip

[Phantomas77]

Trouble in paradise...

I had the thing done, licked, complete. I was booted into CFW on emuNAND and was loading retroarch. I suppose I didn't put enough thermal paste and the console started to overheat and shut itself off into "sleep mode". It turned back on once or twice, but I heard a small pop and then it wouldn't boot into Hekate. It would still attempt to load the IPL hekate asking for an sd card, but if I inserted an sd card, I would get a successful glitch, and then console would reboot/turn off. I could keep getting successful glitches, but the software would never boot. From the SD screen of IPL hekate, I also could not boot into OFW with the VOL +/VOL - button combo, it would reboot/turn off as well.

As of getting home from work today, after leaving the switch on the charger all day, it doesn't even attempt to glitch (no lights on the rp2040, no screen turn on from the switch, and no more IPL hekate). I'm pretty sad here guys, I don't know what to do to fix this, but I presume it is now power circuit related, unless I've just fried my APU.

Any suggestions before I start shopping for a replacement motherboard?

Disconnect the +3.3V wire from Pico, remove the SD card, and see if it boots to OFW.

 

[rr8400]

View attachment 363060View attachment 363059
You should need one of these two setups, since lites are all V2 boards. If you put one mosfet on and have problems with consistently glitching, then it's suggested to put the second mosfet just like the hwfly cable has.

So I'm supposed to connect both gate ports at the CPU pin?

 

[Dee87]

well just set my Permanent dat0 on my Oled
View attachment 2022_0213_083124_009.JPG


and tried my first reballing

what u guys think
@Donnie-Burger
@deeps
@LogicalMadness



View attachment 2022_0213_084351_011.JPG
View attachment 2022_0213_090748_012.JPG
View attachment 2022_0213_090941_014.JPG

View attachment 2022_0213_091004_016.JPG

 

[Donnie-Burger]

There is some videos with people installing picofly on Switch Lite with V2 Flex without any problem.

That is the reason I ordered V2 Flex for my Lite project (and V2 Flex is cheaper than Lite).

I just did a lite with a v2 flex and I like the v2 flex as I put zero on the right side and the lite flex faces the left. Works fine and insta glitch like all pico installs.

 

[rehius]

NOT tested, so NOT putting into the main post (will be updated once I test everything).

no guarantees, use at your own risk.
for those who can't wait

!!!!PINOUT!!!! (resistors / mosfets are still required)

Common GPIO for all boards:
CMD => 28
CLK => 27
RST => 26

Waveshare 2040-zero / 2040-one (default, floating pins 29, 11, 16):
DAT => 29
CPU => 15

Raspberry Pi Pico (detected by thermal sensor on pin 29):
DAT => 22
CPU => 21

XIAO2040 (detected by LED power on pin 11):
DAT => 29
CPU => 6

Adafruit ItsyBitsy (detected by LED power on pin 16):
DAT => 29
CPU => 24

ChangeLog:
- fixed regulator setup
- firmware update feature (+ rollback to backup in case of non-working fw update)
- multiple boards support (no idea if that works, magic, ensure LED blinks after write! that means detection worked fine!!)
- extended OFW support, should not break BOOT0 anymore, OFW BCT is copied into the unused space

P.S. I need some rest.

 

[Dee87]

So I'm supposed to connect both gate ports at the CPU pin?

yes

 

[LogicalMadness]

well just set my Permanent dat0 on my Oled
View attachment 363066


and tried my first reballing

what u guys think
@Donnie-Burger
@deeps
@LogicalMadness



View attachment 363067
View attachment 363068
View attachment 363069

View attachment 363072

Some mighty fine lookin' balls you have there! GREAT JOB!

 

[Donnie-Burger]

Some mighty fine lookin' balls you have there! GREAT JOB!

Looks good!

 

[SQc04]

NOT tested, so NOT putting into the main post (will be updated once I test everything).

no guarantees, use at your own risk.
for those who can't wait

!!!!PINOUT!!!! (resistors / mosfets are still required)

Common GPIO for all boards:
CMD => 28
CLK => 27
RST => 26

Waveshare 2040-zero / 2040-one (default, floating pins 29, 11, 16):
DAT => 29
CPU => 15

Raspberry Pi Pico (detected by thermal sensor on pin 29):
DAT => 22
CPU => 21

XIAO2040 (detected by LED power on pin 11):
DAT => 29
CPU => 6

Adafruit ItsyBitsy (detected by LED power on pin 16):
DAT => 29
CPU => 24

ChangeLog:
- fixed regulator setup
- firmware update feature (+ rollback to backup in case of non-working fw update)
- multiple boards support (no idea if that works, magic, ensure LED blinks after write! that means detection worked fine!!)
- extended OFW support, should not break BOOT0 anymore, OFW BCT is copied into the unused space

P.S. I need some rest.

That's great, it worked!

 

[Spore2]

Just wanted to give an update on my Pokemon Let's Go patched V1. I had to disassemble and reassemble a few times to get everything to fit properly in the case and not ruin the glitching process.

Still had a few loose-ish solder points apparently, as when I went and retouched some areas after checking for continuity, I managed to get the Hekate ipl consistently to load.

Thanks to everyone involved in this project, including all the brave souls willing to be on the front line of testing out the newest hardware mod to the scene.

I would post some photos, but I'm too busy reading all the things about how to load different software on this sucker now, ENDLESS POSSIBILITIES!

EDIT to add photos:
View attachment 362961
I ended up doing the same mod as a few other folks earlier in the forum of installing a ps4 controller flex connector in the stead of the USB C that gets removed. This was my second or third attempt at stripping the flex cable and getting to the pins without bending them. I used a razor blade to scrape the surface away and reveal fresh copper in the flex cable, then tinned them which causes the rest of the flex cable to melt away. Then I tinned the pins on the USB C port and held the flex cable down with some electrical tape and lined up the usb-c with tweezers while hitting the pins with my hot-air station. Once I had a solid connection, I used UV-cure resin to reinforce the solder joint. It is sitting on an American Dime for scale.

View attachment 362962
This is what the CPU wire looks like when attached using 30awg Kynar. Kynar is not LARGE wire by any means, but these components are certainly a little more challenging with 30awg wire wanting to move... we'll get to that in a second. That is the head of a Q-Tip for referenc scale.

View attachment 362969
After seeing where the ground points are, I decided on the easy and sure-fire way out of just ground to the leg of the USB-C port.

View attachment 362970
The 3.3v line was the first tiny spot that I went for, and this was where I learned how valuable uv-cure resin and a UV handheld laserpointer can be to keeping your wires held in place after soldering.

View attachment 362963
These are the Dat0 and Clk pins prior to getting a UV-cure resin treatment to more permanently hold the wire leads down.

View attachment 362968
Here are my RST and CMD lines along with the two previous pins after being cured with resin. There is also a wooden toothpick for scale.

View attachment 362964
This was while things were looking good. I had just gotten the mosfet situated in place on the left cap. As I was feeding the CPU wire through the APU shielding, I jiggled the backend a little too hard and ripped the capacitor clean off the pads, taking the pad closest to the APU completely off, and de-tinning the ground pad... Recovery involved sulking a little, making sure my console still booted to OFW, and then pressing onward to the following...

View attachment 362966
This abomination is layers of resin used to both mask solder joints from bridging, and to prevent my clumsy self from ripping off my last remaining lifeline to glitching this switch. Am I proud of it? Oddly yes, a little. I had to cut part of my APU shield to make sure this doesn't get disturbed, but WORTH IT. It's nearly unrecognizable at this point, but that is the same MOSFET from earlier on in this post.

View attachment 362965
Here was my bodged long-wire setup to prove that the pico would work for me. This is the second rp2040 zero that I installed, which ultimately led me to check every last one of my solder joints again. After confirming I could glitch my switch, I swapped back to my flex-cable modded picofly to be able to fully install it with no bulge, but still be able to easily update it through USB to at least make the jump to 2.6 when it's released. As everyone else is hoping, we'll hopefully be able to remotely update future firmwares through the switch (if even needed).


Thank you again for all the insight, and I hope this can provide even a little inspiration (or even an eye-opener to how small-scale this solder job is) for anyone seeking to do this kind of mod to their own switch. It's a real chore, even if you are good at soldering. Things can and will go wrong, even if you do everything right. Just be prepared to fix things if you mess them up. As others have stated, you can ruin your console if you mess up installing these kinds of mods (and several members have openly mentioned that they have learned from losing consoles as experience) but with careful planning and the right tools, you too can own a picofly modded switch.

So it's "just" that thinner wires are easier to use? Would thicker wire just fit without needing to be rerouted?

safer to use thinner wires IMO. You run the risk of tugging the wire in some installs. With a thicker wire you could rip a terminal or worse a capacitor.

 

[Donnie-Burger]

safer to use thinner wires IMO. You run the risk of tugging the wire in some installs. With a thicker wire you could rip a terminal or worse a capacitor.

I'm using 0.1 enamled wire for all installs but v1 unptached.

 

[rodrigues14]

NOT tested, so NOT putting into the main post (will be updated once I test everything).

no guarantees, use at your own risk.
for those who can't wait

!!!!PINOUT!!!! (resistors / mosfets are still required)

Common GPIO for all boards:
CMD => 28
CLK => 27
RST => 26

Waveshare 2040-zero / 2040-one (default, floating pins 29, 11, 16):
DAT => 29
CPU => 15

Raspberry Pi Pico (detected by thermal sensor on pin 29):
DAT => 22
CPU => 21

XIAO2040 (detected by LED power on pin 11):
DAT => 29
CPU => 6

Adafruit ItsyBitsy (detected by LED power on pin 16):
DAT => 29
CPU => 24

ChangeLog:
- fixed regulator setup
- firmware update feature (+ rollback to backup in case of non-working fw update)
- multiple boards support (no idea if that works, magic, ensure LED blinks after write! that means detection worked fine!!)
- extended OFW support, should not break BOOT0 anymore, OFW BCT is copied into the unused space

P.S. I need some rest.

no update.bin file to update via picofly toolbox?

 

[Dee87]

Some mighty fine lookin' balls you have there! GREAT JOB!

Looks good!

Thanks thanks so should be okay if they look like this to reflow it back to the Oled?

Post automatically merged: Apr 5, 2023

I'm using 0.1 enamled wire for all installs but v1 unptached.

Same here but why not use them on v1 unpatched ?

 

[Jopa777]

Hi, sorry if this isn't the correct thread.

Installed rp2040 zero. All went ok and booted Hekate.

Two issues:

- can't backup keys with lockpick
- can't boot emunand after creating it. I think this one is related to first one

When I try to boot emunand, I receive message "pkg1 decryption failed bek is missing"

Does anyone knows what is wrong?

Consoles boots normally in OFW

Thanks in advance

 

[Dee87]

Hi, sorry if this isn't the correct thread.

Installed rp2040 zero. All went ok and booted Hekate.

Two issues:

- can't backup keys with lockpick
- can't boot emunand after creating it. I think this one is related to first one

When I try to boot emunand, I receive message "pkg1 decryption failed bek is missing"

Does anyone knows what is wrong?

Consoles boots normally in OFW

Thanks in advance

Flash unlock.uf2 should do the trick

 

[cowboy619]

Hi, sorry if this isn't the correct thread.

Installed rp2040 zero. All went ok and booted Hekate.

Two issues:

- can't backup keys with lockpick
- can't boot emunand after creating it. I think this one is related to first one

When I try to boot emunand, I receive message "pkg1 decryption failed bek is missing"

Does anyone knows what is wrong?

Consoles boots normally in OFW

Thanks in advance

You need to run the unlock.bin via hekate but backup Boot0 first


Sent from my iPhone using Tapatalk

 

[NooBziN]

Hi, sorry if this isn't the correct thread.

Installed rp2040 zero. All went ok and booted Hekate.

Two issues:

- can't backup keys with lockpick
- can't boot emunand after creating it. I think this one is related to first one

When I try to boot emunand, I receive message "pkg1 decryption failed bek is missing"

Does anyone knows what is wrong?

Consoles boots normally in OFW

Thanks in advance

unlock.bin or unlock.uf2

Post automatically merged: Apr 5, 2023

You need to run the unlock.bin via hekate but backup Boot0 first


Sent from my iPhone using Tapatalk

unlock.uf2 wtf?
Explain the side effect

 

[khuong]

NOT tested, so NOT putting into the main post (will be updated once I test everything).

no guarantees, use at your own risk.
for those who can't wait

!!!!PINOUT!!!! (resistors / mosfets are still required)

Common GPIO for all boards:
CMD => 28
CLK => 27
RST => 26

Waveshare 2040-zero / 2040-one (default, floating pins 29, 11, 16):
DAT => 29
CPU => 15

Raspberry Pi Pico (detected by thermal sensor on pin 29):
DAT => 22
CPU => 21

XIAO2040 (detected by LED power on pin 11):
DAT => 29
CPU => 6

Adafruit ItsyBitsy (detected by LED power on pin 16):
DAT => 29
CPU => 24

ChangeLog:
- fixed regulator setup
- firmware update feature (+ rollback to backup in case of non-working fw update)
- multiple boards support (no idea if that works, magic, ensure LED blinks after write! that means detection worked fine!!)
- extended OFW support, should not break BOOT0 anymore, OFW BCT is copied into the unused space

P.S. I need some rest.

It'd be fancy if we could inject our own bootimage/logo into the uf2 ;P but amazing work sir.

 

[jkyoho]

Awesome work! @rehius
RP2040-ONE confirmed working on v2.6

 

[Dandan0404]

is this okay for a magnetic reed switch incase for future reset?

Post automatically merged: Apr 5, 2023

fixed regulator setup

what does this mean/do? im gonna remove usbc, both buttons and 3v3 regulator