Hacking Hardware Picofly - a HWFLY switch modchip

[Cait_Sith]

no need to remove, you can flash any firmware over another one

Thank you so much for the update 2.64. I guess I'll just update using the toolbox then.

 

[Adran_Marit]

@rehius got a firmware changelog

 

[abal1000x]

.

 

[rehius]

Already good with fw 2.62.

actually that is 2.62 where I forgot to enable it, so please update

 

[abal1000x]

.

 

[detilmalala]

I need advice, I have tried to solder the 8342 mosfet and I can't, there must be some way but I can't think of a functional way to do it, I thank you in advance

 

[Adran_Marit]

I need advice, I have tried to solder the 8342 mosfet and I can't, there must be some way but I can't think of a functional way to do it, I thank you in advance

View attachment 364265

Get flex cable, it's easier than the fets

 

[abal1000x]

.

 

[rehius]

@rehius, after reboot couple of time suddenly the glitch doesn't work

what LED indication?

 

[abal1000x]

.

 

[rehius]

I don't know, still not yet opening it.

you can usually see the light through the speaker / USB holes

 

[abal1000x]

.

 

[rr8400]

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot
v2.6 + software update, xiao & itsy support
v2.61 + Instinct-NX sdloader, bug fixes
v2.62 + Make 16.0.1 happy (fix OFW boot)
v2.63 + roll back some 2.62 boot speed tricks
v2.64 + enable back the board detection

Spoiler: LED indication

must be RED after USB write. if you see green, set "RGB mode" jumper

WHITE = eMMC write
BLUE = glitch
PURPLE = eMMC boot failure, check CMD / CLK
PINK = NS eMMC init fails, inoperative eMMC ?
YELLOW = eMMC write failure, check D0 / unsupported eMMC
CYAN = no reaction to glitch, check mosfet wire
GREEN = success

Spoiler: Diagrams by Dee87

View attachment 357132
View attachment 363821
View attachment 364242
View attachment 357133
View attachment 357135
View attachment 357134
View attachment 357136

Spoiler: Solder example

View attachment 357137
View attachment 357138
View attachment 360187
View attachment 363817
View attachment 357139
View attachment 357140
View attachment 360186

Spoiler: Issues, questions

Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: rp2040 boards support
A: WaveShare 2040-zero/one, xiao-rp2040, adafruit itsybitsy (Pi Pico is not supported for now)

Q: GREEN, but instant reset
A: Clean flux near the RST point

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot (sysNAND data can be damaged).

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: no

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

Spoiler: Reboot to OFW / Vol+ & Vol- doesn't work, blue/black screen

v2.5 firmware had a bug with BOOT0 corruption. To recover it:
- boot "Full Stock" using hekate
- update to the latest official firmware over Wi-Fi

Spoiler: Sleep mode does not work

- boot "Full Stock" using hekate
- perform a full system reset

Spoiler: Toolbox 0.2 features

- show firmware information
- update firmware from SD card (place update.bin into the root folder)
- rollback to the backup firmware slot
- reset learning statistics
- dump / write sdloader

Spoiler: RGB LED explanation by lightninjay

if you have an rp2040-zero from waveshare/ali then it has a neopixel. It is used for diagnosing proper firmware flashes as well as console glitching. If you plug it in, and flash the uf2 firmware to it and immediately see a red light after flashing (this is not the same as flashing, then unplugging and replugging), then no rgb jumper needs to be made. If on the other hand, you get one quick green flashing light, then you need to bridge the jumper pads indicated to swap the LED colors for proper diagnoses capability.

Am I supposed to flash all these 3 files + the unlock one? I'll upgrade from 2.5 to 2.64

Post automatically merged: Apr 11, 2023

Yes that's normal
What color die the led flash after dropping the files Ind the raspi

It flashed blue and then purple if I remember correctly

Post automatically merged: Apr 11, 2023

Yes, that is normal behavior, after you flash it the window will disappear and you will never see the file there.

Thank you so much for taking your time to help me btw. I really appreciate it!

 

[rehius]

Am I supposed to flash all these 3 files

only the fw .uf2 file

 

[brecht6]

Is the rpi pico supported now?

 

[rr8400]

only the fw .uf2 file

That and the unlock.uf2? Or is it just the fw.uf2 file?

 

[Phantomas77]

That and the unlock.uf2? Or is it just the fw.uf2 file?

only the fw .uf2 file

 

[rehius]

Is the rpi pico supported now?

officially - no. I need to make a special version with LED blinking instead of RGB.

however you can desolder the thermal sensor and use the waveshare GPIO pinout (15/26/27/28/29) on RPi pico

 

[detilmalala]

Get flex cable, it's easier than the fets

ok, I'm going to use the cpu flex v1, because it's erista, my question is, does anyone have a photo of the track where you have to solder the cable that goes to pin 15 of the chip?

 

[abal1000x]

.