Hacking Hardware Picofly - a HWFLY switch modchip

[RatchetRussian]

I have either a === or *** error. Not sure as I don't have a frame of reference of what is a long flash vs a short flash. Does anyone know?

(please lord say long, long long)

This happens after about 3 mins of glitch attempts so that tells me it is long,long,long. Could this be a faulty mosfet install? I was a little shakey on this particular install.

The alternative is short,short,short which is a corrupted emmc. How do I check if I can boot into OFW? Can I just desolder the 3.3v wire or do I need to rip everything out?

 

[abal1000x]

I have either a === or *** error. Not sure as I don't have a frame of reference of what is a long flash vs a short flash. Does anyone know?

(please lord say long, long long)

This happens after about 3 mins of glitch attempts so that tells me it is long,long,long. Could this be a faulty mosfet install? I was a little shakey on this particular install.

The alternative is short,short,short which is a corrupted emmc. How do I check if I can boot into OFW? Can I just desolder the 3.3v wire or do I need to rip everything out?

issue on dat0.
Have you checked the diode value before connecting it ti the pico?

 

[detilmalala]

HELP i cant find the error codes

==*

 

[RatchetRussian]

issue on dat0.
Have you checked the diode value before connecting it ti the pico?

Hi, thank you for responding.

So those are 3 short flashes?

Yes I checked and it was about 780. same as most of the other connections. Only point I was really not confident in was my CPU point and from my understanding it cannot be checked with diode mode.

edit: After comparing to another video of someone else's error codes, I think they are 3 long flashes which is just the generic "could not glitch" error. Is this always a dat0 issue? Doesn't dat0 have more unique error codes on the list as well such as:

*** No eMMC CMD1 responce (bad eMMC?)
**= No eMMC block 1 read (should not happen)
*=* No eMMC block 0 read (eMMC init failure?)
*== No eMMC CMD1 request (poor wiring, or dead CPU)
=** eMMC init failure during glitch process

I would like to test if I corrupted/killed my emmc. Best way to do that is just to desolder everything and try OFW?

 

[detilmalala]

I NEED HELP i cant find the error codes

==*

 

[Mgt]

I NEED HELP i cant find the error codes

==*

==* CPU always reach BCT check (no glitch reaction, check mosfet)

 

[POPOLO]

I have either a === or *** error. Not sure as I don't have a frame of reference of what is a long flash vs a short flash. Does anyone know?

(please lord say long, long long)

This happens after about 3 mins of glitch attempts so that tells me it is long,long,long. Could this be a faulty mosfet install? I was a little shakey on this particular install.

The alternative is short,short,short which is a corrupted emmc. How do I check if I can boot into OFW? Can I just desolder the 3.3v wire or do I need to rip everything out?

Step 1: Short-circuit RP2040 first PIN: 0+1 Turn on SWITCH Power LED: Blue -> White Disconnect PIN 0+1 to turn on the machine. Then please add PIN13 PIN12 I2C cable. If it is still yellow light, please connect the meter (resistance gear). Connect the red pen of the meter to GND and the black pen to DAT0. Adjust to 0.4XX~0.586 MΩ.

 

[RatchetRussian]

Step 1: Short-circuit RP2040 first PIN: 0+1 Turn on SWITCH Power LED: Blue -> White Disconnect PIN 0+1 to turn on the machine. Then please add PIN13 PIN12 I2C cable. If it is still yellow light, please connect the meter (resistance gear). Connect the red pen of the meter to GND and the black pen to DAT0. Adjust to 0.4XX~0.586 MΩ.

Hi, thank you for lending a hand.

The guide says to only do i2c if the glitch is unstable. I cannot glitch at all. Can you link to the post you are referencing so I can research more?

 

[vittorio]

does this dat0 work well?

 

[Relon]

Non standard for sure. It should have a "claws" to make a solid contact with emmc ball/pin. I dont see it on the picture, only some tinned area.

 

[Danook28]

does this dat0 work well?

From where????

 

[QuiTim]

does this dat0 work well?

Did you try to tin the emmc contact point?
It should not look like that.
The good one should look like the one in the photo

 

[vittorio]

Did you try to tin the emmc contact point?
It should not look like that.
The good one should look like the one in the photo

where can i order it

 

[Adran_Marit]

i bet with u its just "our" firmware they put on there

IF ti is that would be swell but I wouldn't put it past china to change the pinout on us though XD

 

[lightninjay]

I NEED HELP i cant find the error codes

==*

Download the latest guide from my signature, it has all the LED error codes.

 

[QuiTim]

where can i order it

The ordering process is a mess right now, no one can know for sure. I ordered some more then one month ago and I received good ones but another guy here ordered from same shop one week after me a got the bad ones. So even if i recommend a store there is no guarantee that you will receive the same one as they show in photo

 

[FreeLander]

I'd like to take a moment to thank this great community, Namely, @rehius @Dee87 @lightninjay and @deeps.
This is a great time to be around the Switch modding scene. Great stuff everyday. I can't get used to the euphoric feeling when I successfully glitch a Switch, it's just amazing.

This is my record:

Failed Glitches:
Five OLEDs
Two Lites
One V1

Successful Glitches:
Ten OLEDS
Four Normal (two V1s, two V2s)
One Lite

Loving it.

 

[deeps]

I can't get used to the euphoric feeling when I successfully glitch a Switch, it's just amazing.

+1 on this. especially when you know you've potentially damaged something, but you won't really know until two hours of work later

 

[FreeLander]

I might have asked this before but I'm still making a mess of doing it, that is, cutting the shield before closing the switch. The sessions and knife I use are no clean way of doing it. I have a complete mini drill tools with all kinds of bits. Tried a few but were no good. Could someone point out the best bit for this kind of job for me?

 

[cgtchy0412]

I have either a === or *** error. Not sure as I don't have a frame of reference of what is a long flash vs a short flash. Does anyone know?

(please lord say long, long long)

This happens after about 3 mins of glitch attempts so that tells me it is long,long,long. Could this be a faulty mosfet install? I was a little shakey on this particular install.

The alternative is short,short,short which is a corrupted emmc. How do I check if I can boot into OFW? Can I just desolder the 3.3v wire or do I need to rip everything out?

If you detach Dat0 wire from pico then it will boot into ofw, assuming wires instalation is correct.