Hacking Hardware Picofly - a HWFLY switch modchip

[Adran_Marit]

Github page is removed for the lock_pick rcm. Is product key important to restore and if we have the full nand backup and boot0/boot1 backup or it both require the product key to restore from backup?

To backup/restore a backup you don´t need keys, Hekate make all extractions.

you dont need the keys to restore, no, you do need the keys if you ever need to access your pc or rebuild your nand from scratch...

 

[RiotRetroGaming]

Hi all,

Could somebody give me some pointers?
I have done a shed load of lites, v1, v2 and oleds without issue using APU flex cables... however, tonight I thought I would have a stab at the mosfet thing on a V2 on 16.0.3...

It glitched and went white, then blue, the the usual green.
This time it just booted OFW???

It does the same thing everytime, no 'NO SD CARD' prompt at all.
Odd? Included photos...

I have followed the following diagram too...



Thanks,
Ant

 

[lightninjay]

Hi all,

Could somebody give me some pointers?
I have done a shed load of lites, v1, v2 and oleds without issue using APU flex cables... however, tonight I thought I would have a stab at the mosfet thing on a V2 on 16.0.3...

It glitched and went white, then blue, the the usual green.
This time it just booted OFW???

It does the same thing everytime, no 'NO SD CARD' prompt at all.
Odd? Included photos...

I have followed the following diagram too...



Thanks,
Ant

It is likely Cyan underneath the kapton (instead of green), but if you have a spare rp2040-zero, or can attach wires to that pico to reflash it, you could try Rehius' most latest 2.7 firmware that would help you diagnose your issue with long and short flashes.

A bit of new features in the test version 2.70

- now it's only 3 colours: blue (glitching), white (flashing), yellow (error code). This was made to make possible pi pico debugging + get rid of RGB/GRB issues
Error codes list (= is long pulse, * is short pulse):

= USB flashing done

** RST is not connected
*= CMD is not connected
=* D0 is not connected
== CLK is not connected

=** eMMC init failure during glitch process
=*= CPU never reach BCT check, should not happen
==* CPU always reach BCT check (no glitch reaction, check mosfet)
=== Glitch attempt limit reached, cannot glitch

=*** eMMC init failure
=**= eMMC write failure - comparison failed
=*=* eMMC write failure - write failed
=*== eMMC test failure - read failed
==** eMMC read failed during firmware update
==*= BCT copy failed - write failure
===* BCT copy failed - comparison failure
==== BCT copy failed - read failure

The second major feature is CPU downvoltage. This might be useful when your MOSFET (or the wire) is not strong enough for the glitch. (do you remember the case where you press "RESET" on the rp2040 when joycon logo appears to make it working? that's it, system lowers CPU voltage)
Therefore you can solder two additional wires to the chip so it could lower the CPU voltage making the glitch easier. This is optional! only if you really need.

Waveshare rp2040: SDA=12, SCL=13
Pi Pico: SDA = 19, SCL = 20
XIAO 2040: SDA=3, SCL=4
ItayBitsy 2040: SDA = 18, SCL = 19

pinout for Mariko v2 board:
View attachment 371698

I have pinouts for Lite & OLED, but haven't tested it yet. You can easily track the i2c wires by yourself using board views here http://balika011.hu/switch/ (OLED here)

The firmware is in alpha stage, so use at your own risk

 

[naldo29]

anyone know how to get rid of solder mask? or is it just a matter of scraping it until its gone

 

[lightninjay]

anyone know how to get rid of solder mask? or is it just a matter of scraping it until its gone

We talkin solder mask that you've added to something, or the soldermask that is already existing on the board from the factory?

 

[naldo29]

We talkin solder mask that you've added to something, or the soldermask that is already existing on the board from the factory?

that i added

 

[lightninjay]

that i added

 

[QuiTim]

Hi all,

Could somebody give me some pointers?
I have done a shed load of lites, v1, v2 and oleds without issue using APU flex cables... however, tonight I thought I would have a stab at the mosfet thing on a V2 on 16.0.3...

It glitched and went white, then blue, the the usual green.
This time it just booted OFW???

It does the same thing everytime, no 'NO SD CARD' prompt at all.
Odd? Included photos...

I have followed the following diagram too...



Thanks,
Ant

Try using different 3v3 and GND (it worked in 2 cases)
Use thicker wire for 3v3 and GND.
Shorten all your wires (if possible)

 

[deeps]

Any link on aliexpress. I need that cap

https://www.aliexpress.com/item/32965092877.html

just select 1uf in the list
the voltage of a capacitor is just a maximum rating, as long as it's the same or higher than what you are replacing you are golden.

 

[QuiTim]

So, in the name of science (and mostly fun) I disassembled my Lite to try some other mosfet that I got today and to celebrate the release of fw2.7
The hard part (this time) was removing the previously installed SX Lite chip.
After removal and some cleaning I installed a single AON7506 mosfet which looks like it has the perfect package size (3x3) for these installations.
This time I used this new transparent (3 second curing) solder mask and it works as advertised.
I encountered a small hiccup while disassembling my picofly when I accidently wicked away a small capacitor on the bottom side of Pico.
Luckily I was able to retrieve it and solder it back (not very proud of that solder job but still…)
Also, the capacitor on top of the SDcard is damaged, but that was from my SX installation more than 3yrs ago. I don’t know what that cap does but I never had any issues with Switch, and even after removing the old chip and installing Pico everything works.
In the end everything worked out great so I didn’t get a chance to test the new “pulsing” error codes.
There are a couple of videos and photos attached where you can see flashing, first boot/glitch, 5th boot (after assembly), and also the assembled shield with Pico underneath (perfect fit).
Cheers

 

[Mena]

.

 

[rsilveira1991]

I have a pictures lite.
What to check when the micro card does not work?
Before picofly running, i create emunand. But next day, picofly not working and lite only run OFW.

View attachment 370865View attachment 370866
View attachment 370867
Today, i remove pico but fault microsd still showing error.

looks like you dropped uv mask on the sd/p2 card plug

 

[detilmalala]

i2c pinout for lite and oled

hello, I don't understand what is the advantage of connecting these 2 extra cables to the chip, would it help all the installations work with a single mosfet?

 

[FlowerFire]

A bit of new features in the test version 2.70

- now it's only 3 colours: blue (glitching), white (flashing), yellow (error code). This was made to make possible pi pico debugging + get rid of RGB/GRB issues
Error codes list (= is long pulse, * is short pulse):

= USB flashing done

** RST is not connected
*= CMD is not connected
=* D0 is not connected
== CLK is not connected

=** eMMC init failure during glitch process
=*= CPU never reach BCT check, should not happen
==* CPU always reach BCT check (no glitch reaction, check mosfet)
=== Glitch attempt limit reached, cannot glitch

=*** eMMC init failure
=**= eMMC write failure - comparison failed
=*=* eMMC write failure - write failed
=*== eMMC test failure - read failed
==** eMMC read failed during firmware update
==*= BCT copy failed - write failure
===* BCT copy failed - comparison failure
==== BCT copy failed - read failure

The second major feature is CPU downvoltage. This might be useful when your MOSFET (or the wire) is not strong enough for the glitch. (do you remember the case where you press "RESET" on the rp2040 when joycon logo appears to make it working? that's it, system lowers CPU voltage)
Therefore you can solder two additional wires to the chip so it could lower the CPU voltage making the glitch easier. This is optional! only if you really need.

Waveshare rp2040: SDA=12, SCL=13
Pi Pico: SDA = 19, SCL = 20
XIAO 2040: SDA=3, SCL=4
ItayBitsy 2040: SDA = 18, SCL = 19

pinout for Mariko v2 board:
View attachment 371698

I have pinouts for Lite & OLED, but haven't tested it yet. You can easily track the i2c wires by yourself using board views here http://balika011.hu/switch/ (OLED here)

The firmware is in alpha stage, so use at your own risk

I installed picofly on a v1 and a v2 Switch and the v2 is a little bit slower when glitching (it never fails, though).
Can soldering the two optional wires help and make it faster or is this just for those who have problems with making it work at all?

 

[abal1000x]

A bit of new features in the test version 2.70

- now it's only 3 colours: blue (glitching), white (flashing), yellow (error code). This was made to make possible pi pico debugging + get rid of RGB/GRB issues
Error codes list (= is long pulse, * is short pulse):

= USB flashing done

** RST is not connected
*= CMD is not connected
=* D0 is not connected
== CLK is not connected

=** eMMC init failure during glitch process
=*= CPU never reach BCT check, should not happen
==* CPU always reach BCT check (no glitch reaction, check mosfet)
=== Glitch attempt limit reached, cannot glitch

=*** eMMC init failure
=**= eMMC write failure - comparison failed
=*=* eMMC write failure - write failed
=*== eMMC test failure - read failed
==** eMMC read failed during firmware update
==*= BCT copy failed - write failure
===* BCT copy failed - comparison failure
==== BCT copy failed - read failure

The second major feature is CPU downvoltage. This might be useful when your MOSFET (or the wire) is not strong enough for the glitch. (do you remember the case where you press "RESET" on the rp2040 when joycon logo appears to make it working? that's it, system lowers CPU voltage)
Therefore you can solder two additional wires to the chip so it could lower the CPU voltage making the glitch easier. This is optional! only if you really need.

Waveshare rp2040: SDA=12, SCL=13
Pi Pico: SDA = 19, SCL = 20
XIAO 2040: SDA=3, SCL=4
ItayBitsy 2040: SDA = 18, SCL = 19

pinout for Mariko v2 board:
View attachment 371698

I have pinouts for Lite & OLED, but haven't tested it yet. You can easily track the i2c wires by yourself using board views here http://balika011.hu/switch/ (OLED here)

The firmware is in alpha stage, so use at your own risk

I really love current feature.
Color code is difficult to differentiate. Different people different perception.
By changing the error code to pulse, its easier to recognize, and remove the misunderstanding between people.

I get this error
==* CPU always reach BCT check (no glitch reaction, check mosfet)

Then push reset while the joycon shows, the glitch worked, shows nosd.
Connecting the sda and scl using this reference point

And connecting to xiao rp2040 with sda goes to pin 3 and scl goes to pin4 using this reference:

And it didn't work. I still need to push the reset button when the joycon logo shows. Did i mistakes on some step?

 

[bilalhassan341]

So, in the name of science (and mostly fun) I disassembled my Lite to try some other mosfet that I got today and to celebrate the release of fw2.7
The hard part (this time) was removing the previously installed SX Lite chip.
After removal and some cleaning I installed a single AON7506 mosfet which looks like it has the perfect package size (3x3) for these installations.
This time I used this new transparent (3 second curing) solder mask and it works as advertised.
I encountered a small hiccup while disassembling my picofly when I accidently wicked away a small capacitor on the bottom side of Pico.
Luckily I was able to retrieve it and solder it back (not very proud of that solder job but still…)
Also, the capacitor on top of the SDcard is damaged, but that was from my SX installation more than 3yrs ago. I don’t know what that cap does but I never had any issues with Switch, and even after removing the old chip and installing Pico everything works.
In the end everything worked out great so I didn’t get a chance to test the new “pulsing” error codes.
There are a couple of videos and photos attached where you can see flashing, first boot/glitch, 5th boot (after assembly), and also the assembled shield with Pico underneath (perfect fit).
Cheers

Is this the same mosfet which you used or not?. I want to order this because it is bigger and will be easy to handle while soldering.

 

[QuiTim]

Is this the same mosfet which you used or not?. I want to order this because it is bigger and will be easy to handle while soldering.

Yes, this is the one

 

[cgtchy0412]

I really love current feature.
Color code is difficult to differentiate. Different people different perception.
By changing the error code to pulse, its easier to recognize, and remove the misunderstanding between people.

I get this error
==* CPU always reach BCT check (no glitch reaction, check mosfet)

Then push reset while the joycon shows, the glitch worked, shows nosd.
Connecting the sda and scl using this reference point
View attachment 371828

And connecting to xiao rp2040 with sda goes to pin 3 and scl goes to pin4 using this reference:
View attachment 371827

And it didn't work. I still need to push the reset button when the joycon logo shows. Did i mistakes on some step?

This is specific for this rp board or what ?, coz in pi pico there is no reset button.

 

[abal1000x]

This is specific for this rp board or what ?, coz in pi pico there is no reset button.

Lot of board have reset.

For pico you simply short the RUN pin to GND.
But i not yet confirmed it, just read from others.

 

[agus]

can i get a preview of the hekate image on the picofly chip? I see on YouTube there are people who install picofly. but the initial view is hekate. not a pico image