Hacking Hardware Picofly - a HWFLY switch modchip

[QuiTim]

Ok, I`ll use shield as ground point. Thanks.


I can´t see any purple lines on the image I`ve attached. You mean same as Bad and Abal? Using APU shield as ground point?

BTW, Can I use APU shield too soldering the GND point of RP2040? In the past I modded one Lite and the ground point at the capacitor scares me a little bit hahaha

The image did not attach :/ (check now) but yes same as Bad and Abal said, just choose another gnd point somewhere close.

 

[TheBad]

Ok, I`ll use shield as ground point. Thanks.


I can´t see any purple lines on the image I`ve attached. You mean same as Bad and Abal? Using APU shield as ground point?

BTW, Can I use APU shield too soldering the GND point of RP2040? In the past I modded one Lite and the ground point at the capacitor scares me a little bit hahaha

You can reference this, this is example work of mine.

Sent from my iPhone using Tapatalk

 

[angelC992]

Yes you can use APU shield as ground point. You can also use TYPE-C connector on Lite console.


Sent from my iPhone using Tapatalk

You can reference this, this is example work of mine.

Sent from my iPhone using Tapatalk

Yes you can use APU shield as ground point. You can also use TYPE-C connector on Lite console.


Sent from my iPhone using Tapatalk

Thank you so much. I´m waiting on UV Mask and B7000 glue to mod another two lites. I prefer flex mode in APU but using mosfets is cheaper and needs more patience (and I prefer it haha)

 

[missskk]

The chip does not wake the console. This is a well known RTC auto power on after shutdown used by N system. Every Switch console automatically turns on after poweroff from the Horizon OS, even the unmodded ones.
The picofly firmware detects that and automatically shuts the system down after the successful glitch.

ok

 

[SorataVP69]

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot
v2.6 + software update, xiao & itsy support
v2.61 + Instinct-NX sdloader, bug fixes
v2.62 + Make 16.0.1 happy (fix OFW boot)
v2.63 + roll back some 2.62 boot speed tricks
v2.64 + enable back the board detection
v2.65 + RP Pico support, double reset removed
v2.66 + Bypass to OFW after update for proper fuse burning
v2.67 + Don't bypass to OFW on first install
v2.70 + new LED indication, i2c undervoltage hack
v2.71 + support for SQc open-source board
v2.72 + disable CLK check, it's unstable
v2.73 + add LED signal on success
v2.74 + 300 mhz precision

Spoiler: LED indication

= is long pulse, * is short pulse:

= USB flashing done

** RST is not connected
*= CMD is not connected
=* D0 is not connected
== CLK is not connected

*** No eMMC CMD1 responce (bad eMMC?)
**= No eMMC block 1 read (should not happen)
*=* No eMMC block 0 read (eMMC init failure?)
*== No eMMC CMD1 request (poor wiring, or dead CPU)

=** eMMC init failure during glitch process
=*= CPU never reach BCT check, should not happen
==* CPU always reach BCT check (no glitch reaction, check mosfet)
=== Glitch attempt limit reached, cannot glitch

=*** eMMC init failure
=**= eMMC write failure - comparison failed
=*=* eMMC write failure - write failed
=*== eMMC test failure - read failed
==** eMMC read failed during firmware update
==*= BCT copy failed - write failure
===* BCT copy failed - comparison failure
==== BCT copy failed - read failure

Spoiler: i2c undervoltage hack

If your glitch is unstable (==* error), and the proper boot happens only when you press Reset after joycon logo, you can add two more wires to make glitch much better.

board pins:
Waveshare rp2040: SDA=12, SCL=13
Pi Pico: SDA = 19, SCL = 20
XIAO 2040: SDA=3, SCL=4
ItsyBitsy 2040: SDA = 18, SCL = 19

NS points (v2, Lite, OLED):
View attachment 372191
View attachment 372192
View attachment 372193

Spoiler: Diagrams + by Dee87

View attachment 357132
View attachment 363821
View attachment 364242
View attachment 364990
View attachment 357133
View attachment 357135
View attachment 357134
View attachment 357136

Spoiler: Solder example

View attachment 357137
View attachment 357138
View attachment 360187
View attachment 363817
View attachment 357139
View attachment 357140
View attachment 360186
View attachment 364818

Spoiler: Issues, questions

Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: rp2040 boards support
A: WaveShare 2040-zero/one, xiao-rp2040, adafruit itsybitsy (Pi Pico is not supported for now)

Q: GREEN, but instant reset
A: Clean flux near the RST point

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot (sysNAND data can be damaged).

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: https://github.com/rehius

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

Spoiler: Reboot to OFW / Vol+ & Vol- doesn't work, blue/black screen

v2.5 firmware had a bug with BOOT0 corruption. To recover it:
- boot "Full Stock" using hekate
- update to the latest official firmware over Wi-Fi

Spoiler: Sleep mode does not work

- boot "Full Stock" using hekate
- perform a full system reset

Spoiler: Toolbox 0.2 features

- show firmware information
- update firmware from SD card (place update.bin into the root folder)
- rollback to the backup firmware slot
- reset learning statistics
- dump / write sdloader

Spoiler: RGB LED explanation by lightninjay

if you have an rp2040-zero from waveshare/ali then it has a neopixel. It is used for diagnosing proper firmware flashes as well as console glitching. If you plug it in, and flash the uf2 firmware to it and immediately see a red light after flashing (this is not the same as flashing, then unplugging and replugging), then no rgb jumper needs to be made. If on the other hand, you get one quick green flashing light, then you need to bridge the jumper pads indicated to swap the LED colors for proper diagnoses capability.

hello, after the chip will work (thanks to the forum for helping me) I have problems starting sysnand, purple screen and error in hekate, do you think that placing the 2 resistors in Dat0 and CMD can solve it or just damage my Emmc permanently? before placing the chip the Emmc worked correctly.

Post automatically merged: May 30, 2023

hello, after the chip will work (thanks to the forum for helping me) I have problems starting sysnand, purple screen and error in hekate, do you think that placing the 2 resistors in Dat0 and CMD can solve it or just damage my Emmc permanently? before placing the chip the Emmc worked correctly.

Hello, a little update, I put the 2 resistors in Dat0 0 and CMD, I reset the chip and there was a change in the information displayed and I even dared to try to create the emunand but in the end it said the same thing "Emmc slowmode" or something like that. burn my emmc?

 

[Takezo-San]

hello, after the chip will work (thanks to the forum for helping me) I have problems starting sysnand, purple screen and error in hekate, do you think that placing the 2 resistors in Dat0 and CMD can solve it or just damage my Emmc permanently? before placing the chip the Emmc worked correctly.

Post automatically merged: May 30, 2023

Hello, a little update, I put the 2 resistors in Dat0 0 and CMD, I reset the chip and there was a change in the information displayed and I even dared to try to create the emunand but in the end it said the same thing "Emmc slowmode" or something like that. burn my emmc?

Replace your cmd resistor. 4k7.

 

[SorataVP69]

Replace your cmd resistor. 4k7.

hello, thanks for your answer, I replaced the resistor set although it was correct, in the measurement it marked 47ohms the same as those of clk and dat0, I replaced the one that was set with 2 of 47ohms and I obtained the results that you see in the answer in my post , a bit of info on the emmc although still with errors

 

[Takezo-San]

hello, thanks for your answer, I replaced the resistor set although it was correct, in the measurement it marked 47ohms the same as those of clk and dat0, I replaced the one that was set with 2 of 47ohms and I obtained the results that you see in the answer in my post , a bit of info on the emmc although still with errors

I hope we mean the same resistor. I'm talking about the cmd resistor located on the motherboard. The one that causes pink screen on oleds. If you don't know where it is, go a few pages back.

Did you use flex cable or mosfets?

 

[SorataVP69]

I hope we mean the same resistor. I'm talking about the cmd resistor located on the motherboard. The one that causes pink screen on oleds. If you don't know where it is, go a few pages back.

Thank you, I hadn't understood, but I understand it now, you mean this resistor in the photo, I'm going to look for a replacement and I'll tell you if it works

 

[Takezo-San]

Thank you, I hadn't understood, but I understand it now, you mean this resistor in the photo, I'm going to look for a replacement and I'll tell you if it works

That's the pleb. I've read that bad resistor can cause pink screen but also slow emmc issues too (on Oleds).

Hope it helps.

 

[QuiTim]

Thank you, I hadn't understood, but I understand it now, you mean this resistor in the photo, I'm going to look for a replacement and I'll tell you if it works

@Takezo-San already wrote it above but just in case so you dont swap the values...you know....like some RST and cpu points

 

[Phantomas77]

The one in the link by QuiTim or this:
https://a.aliexpress.com/_mLn5n3q

@jmmc I hope you did not follow my advice and bought from a different store... I just received a second batch from that seller, they're selling the shitty "OATO" adapters without changing the original advertisement. First batch was good, this one goes directly into trash.

 

[Takezo-San]

@jmmc I hope you did not follow my advice and bought from a different store... I just received a second batch from that seller, they're selling the shitty "OATO" adapters without changing the original advertisement. First batch was good, this one goes directly into trash.

And this is why hwfly and other Chinese based Mods are dying. We're sick of the lies and disengenuous money hungry crap. This story makes me want to invest in emmc stencils and be done with adaptors all together.

 

[jmmc]

@jmmc I hope you did not follow my advice and bought from a different store... I just received a second batch from that seller, they're selling the shitty "OATO" adapters without changing the original advertisement. First batch was good, this one goes directly into trash.

I didn't buy from that seller, I was going to buy some next week... Have you found another "legit" adapters?

 

[POPOLO]

Led code: * = *Exists?

In summary: I turn on the OLED, long blinks blue, blinks fast yellow, long blink yellow and at the end fast blink yellow.

After repeating the cycle twice, the rp2040 does not turn on. Maybe a faulty pico?

Edit: attached video.

oLED I2C SDA SCL connection can be improved

 

[Mr Skinner]

oLED I2C SDA SCL connection can be improved

What exactly is the advantage of these connections? Just gain in boot speed?

 

[SorataVP69]

@Takezo-San already wrote it above but just in case so you dont swap the values...you know....like some RST and cpu points

thanks, I'll be more attentive this time

 

[Phantomas77]

And this is why hwfly and other Chinese based Mods are dying. We're sick of the lies and disengenuous money hungry crap. This story makes me want to invest in emmc stencils and be done with adaptors all together.

Totally agree, waiting for this one to arrive.

I didn't buy from that seller, I was going to buy some next week... Have you found another "legit" adapters?

Actually no, I was thinking of the "black" version, I imagine it should be similar to the old "corner" adapter. If so, it has a good contact, but I haven't tested them personally.

There should be as well good adapters from "official HWfly stores", but it's over 10 EUR each, so stencil + hot air is the way.

 

[axlcat]

Hello, a little update, I put the 2 resistors in Dat0 0 and CMD, I reset the chip and there was a change in the information displayed and I even dared to try to create the emunand but in the end it said the same thing "Emmc slowmode" or something like that. burn my emmc?

What are the measurements at the points in diode mode on the raspberry?

 

[NooBziN]

hello, after the chip will work (thanks to the forum for helping me) I have problems starting sysnand, purple screen and error in hekate, do you think that placing the 2 resistors in Dat0 and CMD can solve it or just damage my Emmc permanently? before placing the chip the Emmc worked correctly.

Post automatically merged: May 30, 2023

Hello, a little update, I put the 2 resistors in Dat0 0 and CMD, I reset the chip and there was a change in the information displayed and I even dared to try to create the emunand but in the end it said the same thing "Emmc slowmode" or something like that. burn my emmc?

you don't need to put more than 1 resistor even more CMD does not help at all only 1 in each necessary if you have a slowness problem redo the solder cleaning
honestly where did you see this guide lol