Hacking Hardware Picofly - a HWFLY switch modchip

[JaRocker]

Where can this be found on the RP2040 Micro

 

[abal1000x]

Where can this be found on the RP2040 Micro

https://www.waveshare.com/wiki/RP2040-Tiny

 

[unchil]

What does *=* blink mean? I cant find info about it. My switch doesnt start with or without chip right now. Black screen.

 

[abal1000x]

What does *=* blink mean? I cant find info about it. My switch doesnt start with or without chip right now. Black screen.

Seems your switch is oled right?

 

[lightninjay]

What does *=* blink mean? I cant find info about it. My switch doesnt start with or without chip right now. Black screen.

Check Rehius' post for LED indication.

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot
v2.6 + software update, xiao & itsy support
v2.61 + Instinct-NX sdloader, bug fixes
v2.62 + Make 16.0.1 happy (fix OFW boot)
v2.63 + roll back some 2.62 boot speed tricks
v2.64 + enable back the board detection
v2.65 + RP Pico support, double reset removed
v2.66 + Bypass to OFW after update for proper fuse burning
v2.67 + Don't bypass to OFW on first install
v2.70 + new LED indication, i2c undervoltage hack
v2.71 + support for SQc open-source board
v2.72 + disable CLK check, it's unstable
v2.73 + add LED signal on success
v2.74 + 300 mhz precision rp2040 may be not stable at 300mhz

Spoiler: LED indication

= is long pulse, * is short pulse:

= USB flashing done

** RST is not connected
*= CMD is not connected
=* D0 is not connected
== CLK is not connected

*** No eMMC CMD1 responce (bad eMMC?)
**= No eMMC block 1 read (should not happen)
*=* No eMMC block 0 read (eMMC init failure?)
*== No eMMC CMD1 request (poor wiring, or dead CPU)

=** eMMC init failure during glitch process
=*= CPU never reach BCT check, should not happen
==* CPU always reach BCT check (no glitch reaction, check mosfet)
=== Glitch attempt limit reached, cannot glitch

=*** eMMC init failure
=**= eMMC write failure - comparison failed
=*=* eMMC write failure - write failed
=*== eMMC test failure - read failed
==** eMMC read failed during firmware update
==*= BCT copy failed - write failure
===* BCT copy failed - comparison failure
==== BCT copy failed - read failure

Spoiler: i2c undervoltage hack

If your glitch is unstable (==* error), and the proper boot happens only when you press Reset after joycon logo, you can add two more wires to make glitch much better.

board pins:
Waveshare rp2040: SDA=12, SCL=13
Pi Pico: SDA = 19, SCL = 20
XIAO 2040: SDA=3, SCL=4
ItsyBitsy 2040: SDA = 18, SCL = 19

NS points (v2, Lite, OLED):
View attachment 372191
View attachment 372192
View attachment 372193

Spoiler: Diagrams + by Dee87

View attachment 357132
View attachment 363821
View attachment 364242
View attachment 364990
View attachment 357133
View attachment 357135
View attachment 357134
View attachment 357136

Spoiler: Solder example

View attachment 357137
View attachment 357138
View attachment 360187
View attachment 363817
View attachment 357139
View attachment 357140
View attachment 360186
View attachment 364818

Spoiler: Issues, questions

Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: rp2040 boards support
A: WaveShare 2040-zero/one, xiao-rp2040, adafruit itsybitsy (Pi Pico is not supported for now)

Q: GREEN, but instant reset
A: Clean flux near the RST point

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot (sysNAND data can be damaged).

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: https://github.com/rehius

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

Spoiler: Reboot to OFW / Vol+ & Vol- doesn't work, blue/black screen

v2.5 firmware had a bug with BOOT0 corruption. To recover it:
- boot "Full Stock" using hekate
- update to the latest official firmware over Wi-Fi

Spoiler: Sleep mode does not work

- boot "Full Stock" using hekate
- perform a full system reset

Spoiler: Toolbox 0.2 features

- show firmware information
- update firmware from SD card (place update.bin into the root folder)
- rollback to the backup firmware slot
- reset learning statistics
- dump / write sdloader

Spoiler: RGB LED explanation by lightninjay

if you have an rp2040-zero from waveshare/ali then it has a neopixel. It is used for diagnosing proper firmware flashes as well as console glitching. If you plug it in, and flash the uf2 firmware to it and immediately see a red light after flashing (this is not the same as flashing, then unplugging and replugging), then no rgb jumper needs to be made. If on the other hand, you get one quick green flashing light, then you need to bridge the jumper pads indicated to swap the LED colors for proper diagnoses capability.

 

[unchil]

Seems your switch is oled right?

no, its v1

*=* No eMMC block 0 read (eMMC init failure?)

So it looks like my eMMC is fckd? Can I buy it from aliexpress (whole module with connector) and try to restore it?

EDIT:

I menaged to fix a broken trace and console boots to hekate. I tried to restore it usig the lvl 1 sthetix guide but I`m still getiing black screen trying to boot the system.

EDIT 2:
I created emuemmc. When I`m trying to boot emu I`m getting en error:
"error while loading fss0:
atmosphere/packeage3
wrong ini cfg ir missing/corrupt files"

EDIT 3:
And now black screen trying to boot both

black screen after "booting"

 

[Dee87]

Need some help guys. Just got this message from someone who picked up from me yesterday.

The fan speed issue I would say the fan is not plugged in correct and the signal pin has no connection.
For joycon and wires I would say the cables are not set properly , get the switch back and check ur work.

If that's not the case there are some resistors next to the apu that could've been damaged while u took of the apu shield , happend to me a while ago also

It sucks but sometimes things like that happen

 

[chronoss]

As the comment is. Check the mosfet.

The emmc stage is good, the glitch executed via 'cpu pin', but theres no response.

Check the mosfet, maybe the 'cpu pin' connection with the G of mosfet is disconnected. Or maybe the D of mosfet is not connected. Check the resistance between the D and GND, the good value is around 10-60ohms.

Post automatically merged: Jun 26, 2023

I suspect theres some short in somewhere.

I faced this error very often. This issue is also related to your install also or weak mosfet or mosfet not working. it is mostly fixed by the SDA And SCL wires because I'm too lazy to check. But it is also related to mosfet. Just first place the SDA and SCL to see if it post or not, or you can press the reset button on RP2040 when joycon logo shows to see. If SDA and SCL wires and reset button method don't work then check mosfet.

1 or 2 MOSFETs ? If one install a second
What wires from MOSFET to apu if 0.1 use 0.2
Otherwise check ur soldering

So sorry everyone, the error is " *=* No eMMC block 0 read (eMMC init failure?)"
i make a mistake with the first puls, it's a sort not a long puls so, it's a *=*

It worked after install but when i took back the apu shield, i have this error but i don't see any resistors damaged , it's a Lite model

 

[Dee87]

So sorry everyone, the error is " *=* No eMMC block 0 read (eMMC init failure?)"
i make a mistake with the first puls, it's a sort not a long puls so, it's a *=*

It worked after install but when i took back the apu shield, i have this error but i don't see any resistors damaged , it's a Lite model

Then check and make sure all cables connected and nothing is grounded
Specially dat0 cmd and clk

 

[chronoss]

Then check and make sure all cables connected and nothing is grounded
Specially dat0 cmd and clk

Ok thanks, i will check...

 

[karatefeet]

Resistance to cpu pin is 800 ohms.

I think it is just a bad picofly chip. It's the only conclusion I was able to come to after testing.

When I desolder the rst wire from the picofly, the rst voltage goes to the correct 1.9v so I think something on the picofly is causing it to be 0.9v.

I tried testing by desoldering 1 wire at a time. The switch will boot to OFW successfully unless either dat0 or cmd are connected to the picofly.

All of it makes no sense to me. I will just try a new picofly and see if it works. I am just glad the switch is okay.

edit: IT WORKS! It was a bad picofly indeed. Maybe I killed it when desoldering the type c connector. I did not see any shorts on the picofly itself though.

Does the picofly light up at all? I had a bad one and it turned out to be a bad crystal oscillator. Picofly didn't light up at all in my case.

 

[BlueBeans]

The fan speed issue I would say the fan is not plugged in correct and the signal pin has no connection.
For joycon and wires I would say the cables are not set properly , get the switch back and check ur work.

If that's not the case there are some resistors next to the apu that could've been damaged while u took of the apu shield , happend to me a while ago also

It sucks but sometimes things like that happen

Ok. He’s going to bring it back when I get back into town. He linked me to this page actually so I was thinking maybe I damaged this somehow because I have a picture of my work and those resistors still seem to be in tact.

https://gbatemp.net/threads/fan-con...-off-then-turns-off-when-switch-is-on.607945/

 

[aleciobr]

hello everyone, I would like to know if you have another cmd point?

 

[BlueBeans]

Struggling with this oled here. It booted up normally before putting it into the case and now it’s saying that DAT0 is not connected. Shows correct voltage on the adapter but not at the RP2040 zero. Swapped adapters and wires.

 

[jkyoho]

hello everyone, I would like to know if you have another cmd point?
View attachment 380397

CMD point goes directly into CPU from the via(2-pad-joint) you damaged.

 

[giovany86]

hello everyone, I would like to know if you have another cmd point?
View attachment 380397

Please, stay away from that board and send it to someone with enough skill and tools to fix it before it's dead

 

[morganno]

Hi, I have the same error code ( " *=* No eMMC block 0 read (eMMC init failure?)" ) with several OLEDs! I thought it was my wiring, the picofly (2.74) and the mosft cable that was messed up. I soldered a HWFly v5 core the console starts without problem?

I have to tell you, I only boot on the original fw with the pico installed

 

[Elpoep]

Check Rehius' post for LED indication.

Where is the latest firmware? I've visited the pinned Rehius post and there is no link to firmware.

 

[MegaDeKay]

Where is the latest firmware? I've visited the pinned Rehius post and there is no link to firmware.

Seriously???

 

[Elpoep]

Seriously???

View attachment 380409

Seriously... I get an error "

Seriously???

View attachment 380409

Seriously... I get an error "failed to load PDF document"

Post automatically merged: Jun 27, 2023

Seriously???

View attachment 380409

Seriously... I get an error "failed to load PDF document"