Hacking Hardware Picofly - a HWFLY switch modchip

[NooBziN]

i have this issue

Hekate not suport dock mode

 

[kronicd]

View attachment 364497View attachment 364498
I made an RP2040 small board,
I hope it can be used

Will you be sharing the design files? That looks amazing.

 

[SQc04]

Will you be sharing the design files? That looks amazing.

yes

 

[lightninjay]

My latest revision (v.3) of the PicoFly install guide has been uploaded here on gbatemp

https://gbatemp.net/download/a-definitive-picofly-install-guide.37968/

 

[CarlZH]

May I ask everyone, when the picofly v2.64 is first powered on, the LED will flash for a long time before displaying "NO SD CARD". What is picofly doing at this time? Has any data been written to NAND? If so, how can it be recovered? And is this step the same for all models?

 

[lightninjay]

May I ask everyone, when the picofly v2.64 is first powered on, the LED will flash for a long time before displaying "NO SD CARD". What is picofly doing at this time? Has any data been written to NAND? If so, how can it be recovered? And is this step the same for all models?

You're essentially asking for the "secret sauce" that makes the glitch happen. That is what this entire thread has been devoted to, and what Rehius has ultimately released to us as the PicoFly firmware.

While they have been kind enough to share it with us and update it, they have not (and are under no obligation to) released their firmware as opensource to the public.

The generalized concept though, is that the RP2040 is glitching the CPU repeatedly to try and convince it to load an unsigned portion of code. This unsigned portion of code necessarily gets loaded into BOOT0 and is known as the SD Loader. It allows us to put a payload.bin file (and any supporting files) onto an SD card and load it from this SD Loader portion. This is what the "NO SD CARD" screen is, a portion of the BOOT0 which is holding our temporary sideloader.

@rehius or anyone else, please feel free to correct me if I am incorrect, this is just my understanding of RGH style CPU hacks in general.

 

[abal1000x]

.

 

[cliffkhew]

Just to confirm, it's okay to bridge these points?

No prob at all,these 2 pts already connected.

 

[lightninjay]

If you follow the forum message, you will understand the pio is already given. So the glitch is actually not a secret.

I already save the pio code, the method of reverse engineer the fw using emulator (its clever one using zig), its all interesting which i might learn when i have spare time.

Yes, I've been following the thread for quite some time as well. I only meant to say that code written out in assembly language written for the RP2040 is hardly easy for a lay-person to recognize what is happening (often times even with the comments being written right into the code, as the PIO for this glitch hack had)

If they just wanted an overview, that's what I was trying to provide.

 

[Adran_Marit]

Also any files relating have been cloned and uploaded around

 

[Tom8823]

It appears to only apply to lite, although there are alternate 3.3v points on Mariko and Erista as well.

Can I please have alternative 3.3v point for mariko? The cap point from guide seems hard to do

 

[R-Couto]

Good evening everyone, does the 2.6x version contain the unlock in a single file?

 

[impeeza]

Good evening everyone, does the 2.6x version contain the unlock in a single file?

as stated before, yes.

 

[lightninjay]

Can I please have alternative 3.3v point for mariko? The cap point from guide seems hard to do

This graphic is available in the AIO thread. It denotes a 3.3v spot on the EMMC board.

 

[runfo75]

Get flex cable, it's easier than the fets

Hi, where is possibile to buy Flex cable? I have V2 marico console not oled serial xkj2

 

[impeeza]

Hi, where is possibile to buy Flex cable? I have V2 marico console not oled serial xkj2

as stated several times before, the best source today is Aliexpress.

 

[runfo75]

Get flex cable, it's easier than the fets

Hi, where is possible to buy the Flex cable?
I have V2 mariko switch not oled serial XKJ

 

[impeeza]

Hi, where is possible to buy the Flex cable?
I have V2 mariko switch not oled serial XKJ

your question answered exactly on the post above yours.

 

[lightninjay]

Hi, where is possibile to buy Flex cable? I have V2 marico console not oled serial xkj2

Hi, where is possible to buy the Flex cable?
I have V2 mariko switch not oled serial XKJ

Is there an echo in here?

 

[abal1000x]

.