Hacking Hardware Picofly - a HWFLY switch modchip

[mian_85_]

the resistor should be ok now. remove the dat0 cable from pico and lets see what error code you get

I disconnected the dat0 cable and I received a " =* D0 is not connected " error in the picofly.

I'm guessing that I used one of the "bad" dat0 adapters from aliexpress. I have these spare ones but I'm not trusting any of them at all. Any recommendation?



Thank you in advance.

 

[abal1000x]

What one of this test points You recomend ? . Any issue if i conect to the 2 test points for solid conection ?

I usually connect both.

 

[AceCuba]

I usually connect both.
View attachment 378669

Ando no issues . I Made a similar install ando sometimes the pico says reset line it's nota conected

 

[QuiTim]

I disconnected the dat0 cable and I received a " =* D0 is not connected " error in the picofly.

I'm guessing that I used one of the "bad" dat0 adapters from aliexpress. I have these spare ones but I'm not trusting any of them at all. Any recommendation?

View attachment 378667

Thank you in advance.

The first one on the left is very bad, the second one could be used with some modification (see abal100x post about that) and the small black one is OK, you just need to use some solder mask to secure it in place but the contact point under emmc is ok

 

[AceCuba]

Well i'm talking abouth that Lite fw 2.74

Ando no issues . I Made a similar install ando sometimes the pico says reset line it's nota conected

 

[abal1000x]

Well i'm talking abouth that Lite fw 2.74

No issues. I have install it last hour. And its working, blue and white. Now i am installing the mosfet.

 

[detilmalala]

Hello, does anyone know the value of that capacitor? The one inside the white circle

Post automatically merged: Jun 18, 2023

the capacitor inside the white circle, in an oled switch, is gone and the console turns off after a few minutes, does anyone know the value of that component?

 

[axlcat]

What one of this test points You recomend ? . Any issue if i conect to the 2 test points for solid conection ?

I always connect the two and no issues

 

[Uberfish]

I was wondering is there any documentation on how the picofly actually glitches the console and loads hekate? I've tried searching but can't dig up a single source. As far as I know, the basic glitch is that the pico interrupts the tegra's secure boot using MOSFET wizardry and then takes advantage of the CPU's vulnerable state by sending some code to the emmc, which boots hekate. I'm more specifically looking for which pins on the pico are used when and what they do, so I can help troubleshoot my own issues.

3.3v/Gnd = power
CMD ~ not sure.
CLK = to enable timing of the glitch/data t/x
RST ~ not sure.
DAT0 = dump to EMMC
SDA/SCL = literally no idea

Thanks!

 

[POPOLO]

I was wondering is there any documentation on how the picofly actually glitches the console and loads hekate? I've tried searching but can't dig up a single source. As far as I know, the basic glitch is that the pico interrupts the tegra's secure boot using MOSFET wizardry and then takes advantage of the CPU's vulnerable state by sending some code to the emmc, which boots hekate. I'm more specifically looking for which pins on the pico are used when and what they do, so I can help troubleshoot my own issues.

3.3v/Gnd = power
CMD ~ not sure.
CLK = to enable timing of the glitch/data t/x
RST ~ not sure.
DAT0 = dump to EMMC
SDA/SCL = literally no idea

Thanks!

The principle is very simple
dat0~3+ CLK+ CMD is equal to EMMC
Power on Priority unlock Obtain BOOT authority
If it fails, it will be remade and it will be RST
The MOSFET is to pull down the CPU voltage VCC 1.1V and pull down 0.9V
NEW CPU 0.9V pull down 0.8V
User S cable is too thin to effectively pull down voltage steadily (unstable MOSFET quality mount)

 

[Adran_Marit]

I was wondering is there any documentation on how the picofly actually glitches the console and loads hekate? I've tried searching but can't dig up a single source. As far as I know, the basic glitch is that the pico interrupts the tegra's secure boot using MOSFET wizardry and then takes advantage of the CPU's vulnerable state by sending some code to the emmc, which boots hekate. I'm more specifically looking for which pins on the pico are used when and what they do, so I can help troubleshoot my own issues.

3.3v/Gnd = power
CMD ~ not sure.
CLK = to enable timing of the glitch/data t/x
RST ~ not sure.
DAT0 = dump to EMMC
SDA/SCL = literally no idea

Thanks!

you can also read the sourcecode on github

 

[Uberfish]

The principle is very simple
dat0~3+ CLK+ CMD is equal to EMMC
Power on Priority unlock Obtain BOOT authority
If it fails, it will be remade and it will be RST
The MOSFET is to pull down the CPU voltage VCC 1.1V and pull down 0.9V
NEW CPU 0.9V pull down 0.8V
User S cable is too thin to effectively pull down voltage steadily (unstable MOSFET quality mount)

Thanks for the info. I'm having a problem with === error on my pico. It stays in blue flash state for 45 seconds, flashes white, then goes back to blue flash for about a minute ending with ===. CMD/CLK are for sure fine. I just tried resoldering RST and added SDA SCL connections but still the same result. I've checked the DAT0 by wiggling it and looking for variations in the diode value (around 700) but still seems fine. The flex cable on the CPU had an error which I think I solved (14ohm on one side of the caps, <0.1 ohm on the other).

Kind of at a loss what could be causing the issue now...

 

[bilalhassan341]

...nope, blackscreen also...

I think you have a corrupted backup also. try to follow the Sthetix level 1 unbricking guide. It mostly covered the system partition side. If the user is also not showning follow the level 2 or 3. But first try the level 1 first it is easy just follow the steps.

Edit: This method helped me with my switch with same the issue.

 

[Switxh]

Thanks for the info. I'm having a problem with === error on my pico. It stays in blue flash state for 45 seconds, flashes white, then goes back to blue flash for about a minute ending with ===. CMD/CLK are for sure fine. I just tried resoldering RST and added SDA SCL connections but still the same result. I've checked the DAT0 by wiggling it and looking for variations in the diode value (around 700) but still seems fine. The flex cable on the CPU had an error which I think I solved (14ohm on one side of the caps, <0.1 ohm on the other).

Kind of at a loss what could be causing the issue now...

14ohm on one side and 0.1~ on other side of each cap doesn't sound out of the ordinary to me. Mine always measure around 0 ohms on one side and then around 20 ohms on the other side of each cap. I find that the side showing resistance shows more resistance depending on what color probe you put on ground. I usually put black probe on ground

 

[jkyoho]

I found my rp2040-zero doesn't like the 1k ohm resistor between Gate and Source on tpn8r903nl MOSFET. It will do ==* with 1k ohm resistor and boots into OFW just like glitching disappeared.(I had rp2040zero initial setup without any pull down resistor)
Then I tried 10k ohm and 33kohm both works, will make couple cold start glitching training and see which setup works best.

 

[abal1000x]

I was wondering is there any documentation on how the picofly actually glitches the console and loads hekate? I've tried searching but can't dig up a single source. As far as I know, the basic glitch is that the pico interrupts the tegra's secure boot using MOSFET wizardry and then takes advantage of the CPU's vulnerable state by sending some code to the emmc, which boots hekate. I'm more specifically looking for which pins on the pico are used when and what they do, so I can help troubleshoot my own issues.

3.3v/Gnd = power
CMD ~ not sure.
CLK = to enable timing of the glitch/data t/x
RST ~ not sure.
DAT0 = dump to EMMC
SDA/SCL = literally no idea

Thanks!

CMD/CLK/Dat0 is for emmc.
You could read datasheet from the emmc.

3.3V, Gnd to power up pico.

Mosfet G to control the mosfet. The mosfet function as a switch on/off based on the G signal given by pico.

RST to reset the cpu

SDA/SCL to give instruction (i2c) to the power ic to goes undervoltage.

 

[cgtchy0412]

No issues. I have install it last hour. And its working, blue and white. Now i am installing the mosfet.

To each their own i guess , as i ussually instal mosfet first as its the easiest for me.

 

[abal1000x]

To each their own i guess , as i ussually instal mosfet first as its the easiest for me.

Yeah its preferential subjective things. For me the mosfet is the most dangerous part so its the last.

1. First check, firmware flashed. then power off, power on. Should be blue and yellow **
2. Connect the 3.3V and GND, turn on the switch should be blue and yellow **
3. Connect the CMD/CLK/Dat0 + RST, should be blue and long white. (then yellow some error).
4. Connect the mosfet, should be blue and short yellow. done.

 

[kronicd]

I've got a v2 switch here that I'm fixing for a customer, after a failed install the switch no longer boots, it looks like they toasted the D0 line.

I *think* that via is still ok, but if it isn't is there another point I run a wire from that trace to?

 

[Uberfish]

CMD/CLK/Dat0 is for emmc.
You could read datasheet from the emmc.

3.3V, Gnd to power up pico.

Mosfet G to control the mosfet. The mosfet function as a switch on/off based on the G signal given by pico.

RST to reset the cpu

SDA/SCL to give instruction (i2c) to the power ic to goes undervoltage.

Thanks! So given the state of the pico, like you said it writes the packet with the white flash and the packet should be executed by the CPU when it is undervolted. But in my switch, the signal to undervolt is being sent to the mosfets, but for some reason the undervolt isn't happening. If I'm not wrong, this points to a fault with the flex cable install.

Faulty mosfets? Bad flex cable? Wire to the flex cable poor quality? Is it worth using larger gauge wire or attempting to replace the flex cable with my spare? I'm a little worried about removing caps if I attempt it