Hacking Hardware Picofly - a HWFLY switch modchip

[roxzii]

Can you at least screenshot what you have?
Are you mounting GPP with ums-loader?

Yes, mounting GPP with ums-loader! I can post the error with boot0/1 in a bit, doing a user partition backup and it's taking a while.
In the background it's possible to see the contents of GPP, and in the other screenshot there's all the contents of GPP (except user.bin which is still doing).

Thanks for the response!

EDIT: Just tried mounting boot0/1 through HacDiskMount on my unpatched switch, same error, says it's not a full eMMC backup and confirms to open, and then throws an error. So I guess this still isn't an indication of dat0/1 short.

 

[jkyoho]

Yes, mounting GPP with ums-loader! I can post the error with boot0/1 in a bit, doing a user partition backup and it's taking a while.
In the background it's possible to see the contents of GPP, and in the other screenshot there's all the contents of GPP (except user.bin which is still doing).

Thanks for the response!

Have you dumped your own prod.key and rebuild your boot0/1 and rest partition?

 

[roxzii]

Have you dumped your own prod.key and rebuild your boot0/1 and rest partition?

For that I would need to launch Lockpick right? Or am I completely lost here? Btw I have edited the other post with more info.

 

[jkyoho]

For that I would need to launch Lockpick right?

Yes, rename Lockpick to payload and see if you could run

Post automatically merged: Jul 12, 2023

Just tried mounting boot0/1 through HacDiskMount on my unpatched switch, same error, says it's not a full eMMC backup and confirms to open, and then throws an error

No, I dont think boot0/1 can be mount on those software,I confirm error is normal.

Post automatically merged: Jul 12, 2023

https://switch.homebrew.guide/usingcfw/manualchoiupgrade.html

this guide here show how etcher can overwire Boot0/1, you just skip the hekate part and do the ums-loader way to mount the partition you want to rebuild

 

[roxzii]

Yes, rename Lockpick to payload and see if you could run

Yes, rename Lockpick to payload and see if you could run

Post automatically merged: Jul 12, 2023

No, I dont think boot0/1 can be mount on those software,I confirm error is normal.

Post automatically merged: Jul 12, 2023

https://switch.homebrew.guide/usingcfw/manualchoiupgrade.html

this guide here show how etcher can overwire Boot0/1, you just skip the hekate part and do the ums-loader way to mount the partition you want to rebuild

Yeah, but I never made a boot0/1 backup since I never got to hekate. And besides, how can I know the blue screen is caused by a corrupt boot0/1. Since GPP is good doesn't it mean the dat0/1 are not shorting?

 

[Dee87]

Okay, small update, the switch is back from the dead and I have display. I used HacDiskMount instead of DiskGenius, but I got GPP to mount and made a copy of all files just to be sure. Boot0/1 won't mount though. Is that an indication of Dat0/1 short?

I'm basically back to square one, no sd card screen appears, the only payload that I can launch is UMS-Loader. Trying OFW still gives blue screen and trying hekate either doesn't work or gives black screen. Checked all the traces between APU and DRAM and as far as I can see there's nothing wrong there.

Sorry to tag you, but @Dee87, @abal1000x, @Takezo-San, any ideas what I should test? Really out of ideas here, all help appreciated.

srry cant help u there , i also have a oled laying around with the same issue basicly the same issue as u have i got it from a customer , could do an further investigation since i havent found any hardware issues yet.

i was also thinking it boot0/1 issue but i talked with a few people they said its probally a ram issue orso. i can also use ums loader but nothing else


i did order a stencil for the ram so i could reball one from another switch and see if that helps but my stencil never arrived and went with my 100€ order back to aliexpress, still fighting for the chargebacks so i guess that was my last ali order

 

[vulp_vibes]

dat0 running through that alignment indicator circle is a very convenient visual marker. though, being in between other lines makes me a little wary of potential damage to the surrounding traces. I looked at the board scans and found that the dat0 line also comes out into a via pad beneath two ground layers near the cmd resistor, with fewer small traces surrounding it. would be interesting to see if this point is possible as well

View attachment 382849

can officially say I modded my first oled the hard way

 

[Dee87]

can officially say I modded my first oled the hard way

View attachment 383013




View attachment 383008

Why That Poor Board :-(

 

[jkyoho]

Why That Poor Board :-(

SEEED XIAO Board with giant LED

Post automatically merged: Jul 12, 2023

can officially say I modded my first oled the hard way

View attachment 383013




View attachment 383008

what size drill bit you use?

 

[Dee87]

SEEED XIAO Board with giant LED

I meant the Poor Oled Board Xd

 

[Takezo-San]

srry cant help u there , i also have a oled laying around with the same issue basicly the same issue as u have i got it from a customer , could do an further investigation since i havent found any hardware issues yet.

i was also thinking it boot0/1 issue but i talked with a few people they said its probally a ram issue orso. i can also use ums loader but nothing else


i did order a stencil for the ram so i could reball one from another switch and see if that helps but my stencil never arrived and went with my 100€ order back to aliexpress, still fighting for the chargebacks so i guess that was my last ali order

@roxzi yep same issue here with my Lite. I had to call it and use it now as a donor board. Was either an emmc corruption or something else but way over my head because I too didn't get far enough to make a back up of the nand yet.

 

[roxzii]

@roxzi yep same issue here with my Lite. I had to call it and use it now as a donor board. Was either an emmc corruption or something else but way over my head because I too didn't get far enough to make a back up of the nand yet.

About the emmc corruption, @abal1000x seems the most knowledgeable in emmc stuff (sorry if I'm wrong, haven't been active here for long).
Even with dat0/1 short shouldn't hekate boot? I have the bad adapter, is it even worth it to remove it and cut the lobe from the dat1 side like you suggest if I have constant sucessful glitch? I can mount GPP, not sure if there's any way to verify if there's boot0/1 corruption using ums-loader.
Btw I'm using @floxcap version of ums-loader that has some changes to the code to test emmc and it says my mmc is ok.

Is there any way to test DRAM? Any way to just confirm that it is the problem?

@floxcap did you ever made the changes to ums-loader to test DRAM read/write?
@HackMan37 any luck modding ums-loader?

Thanks in advance!

 

[chronoss]

can officially say I modded my first oled the hard way

View attachment 383013




View attachment 383008

Without DAT0 adaptator ?

 

[LuigiGad]

If anyone wonder what the hell is this stupid mod talking about

so many memories... I unlocked so many, but there was the only way, with OLED is fine for educational purposes but in the work of unlocking many consoles I do not see a viable way ...

 

[abal1000x]

I bought the nintendo switch solely because of this thread.
I am not too fond with gaming.

But i love embedded device. I've known nvidia jetson for so long.
The problem is the price. Its the best portable embedded device for an ai project.
Its only 10 watt, and you could run yolo, and do some realtime object recognition.

And luckily the mass production of ns made the nvidia tegra price goes low.
Using modded nintendo switch, you could run Ubuntu and do lot of embedded project better than raspberry pi, you could run android, and if you bored, you could run hos to play games.

With the price of new raspberry pi, i could get 2nd hand nintendo switch. With the bonus of nfc, lot of button, alc (audio system) + headphone + double speaker, ir camera, bluetooth, wifi, usb otg, lcd/oled + touchscreen, hdmi capability, cheap sparepart and good availability, good battery, easy to repair, no lock on emmc, ram or whatever, you could upgrade any hardware component as you wish. Good documentation from nvidia tegra. You could take it off the board, and make a robot, a drone, name it.

In ubuntu all peripheral are supported except the nfc. How good it is.

We could also stream the playstation game to the modded ns. The Q sony new device is useless, since i could do the same thing using NS.

 

[[Truth]]

Whats the purpose of the warmboot_mariko folder in the root of my SD card?
And what application created it?

 

[floxcap]

About the emmc corruption, @abal1000x seems the most knowledgeable in emmc stuff (sorry if I'm wrong, haven't been active here for long).
Even with dat0/1 short shouldn't hekate boot? I have the bad adapter, is it even worth it to remove it and cut the lobe from the dat1 side like you suggest if I have constant sucessful glitch? I can mount GPP, not sure if there's any way to verify if there's boot0/1 corruption using ums-loader.
Btw I'm using @floxcap version of ums-loader that has some changes to the code to test emmc and it says my mmc is ok.

Is there any way to test DRAM? Any way to just confirm that it is the problem?

@floxcap did you ever made the changes to ums-loader to test DRAM read/write?
@HackMan37 any luck modding ums-loader?

Thanks in advance!

Nice to hear that someone is able to make use of my update to ums-loader.

For me - a DRAM check proved pointless - I started tinkering with other payloads to see if I could get the keys for my broken lite and any time I tried to do anything with DRAM it crashed - so I concluded it wasn't going to work.

In the meantime lessons learnt - have now done two lites successfully and two V2s successfully (i.e. no more broken devices)...

And - I believe I found the issue for my dead lite - it has a cracked MAX77812 - so I'm waiting on new chips to arrive to replace and see how that goes.

It seems that power supply issues can cause a device to be able to semi-boot but have issues running.

 

[chronoss]

Whats the purpose of the warmboot_mariko folder in the root of my SD card?

Picofly

 

[[Truth]]

Picofly

And...?

 

[abal1000x]

Whats the purpose of the warmboot_mariko folder in the root of my SD card?
And what application created it?

Search on github, its hekate whose created it.

Theres also on atmosphere -> fusee