Hacking Hardware Picofly - a HWFLY switch modchip

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,062
Trophies
0
XP
1,369
Country
Gaza Strip
replicate @deeps magic mod



Before closing emmc cap.
photo_6336803124160870835_y.jpg
 

Kumarkanabisa

New Member
Newbie
Joined
Apr 7, 2023
Messages
2
Trophies
0
Age
39
XP
115
Country
Russia
Hi all. Rp 2040 firmware 2.67 flashes blue for a long time, then lights up white/blue and red. On firmware 2.73 there is also a long indication with a reset and at the end it looks like =** (eMMC init failure during glitch process). I tried different Chips and added resistors, but it didn’t help. hynix memory. Tell me how to fix it. Switch lite is working fine, loading into stock.
Post automatically merged:

Hi all. Rp 2040 firmware 2.67 flashes blue for a long time, then lights up white/blue and red. On firmware 2.73 there is also a long indication with a reset and at the end it looks like =** (eMMC init failure during glitch process). I tried different Chips and added resistors, but it didn’t help. hynix memory. Tell me how to fix it. Switch lite is working fine, loading into stock.
 

cgtchy0412

Well-Known Member
Member
Joined
Apr 26, 2023
Messages
287
Trophies
0
Age
41
XP
433
Country
Indonesia
Hi all. Rp 2040 firmware 2.67 flashes blue for a long time, then lights up white/blue and red. On firmware 2.73 there is also a long indication with a reset and at the end it looks like =** (eMMC init failure during glitch process). I tried different Chips and added resistors, but it didn’t help. hynix memory. Tell me how to fix it. Switch lite is working fine, loading into stock.
Post automatically merged:

Hi all. Rp 2040 firmware 2.67 flashes blue for a long time, then lights up white/blue and red. On firmware 2.73 there is also a long indication with a reset and at the end it looks like =** (eMMC init failure during glitch process). I tried different Chips and added resistors, but it didn’t help. hynix memory. Tell me how to fix it. Switch lite is working fine, loading into stock.
Post some pictures please
 

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,062
Trophies
0
XP
1,369
Country
Gaza Strip
Hi all. Rp 2040 firmware 2.67 flashes blue for a long time, then lights up white/blue and red. On firmware 2.73 there is also a long indication with a reset and at the end it looks like =** (eMMC init failure during glitch process). I tried different Chips and added resistors, but it didn’t help. hynix memory. Tell me how to fix it. Switch lite is working fine, loading into stock.
Post automatically merged:

Hi all. Rp 2040 firmware 2.67 flashes blue for a long time, then lights up white/blue and red. On firmware 2.73 there is also a long indication with a reset and at the end it looks like =** (eMMC init failure during glitch process). I tried different Chips and added resistors, but it didn’t help. hynix memory. Tell me how to fix it. Switch lite is working fine, loading into stock.
If you got =** while the switch could go to ofw (until goes inside the hos, not blackscreen), then its you're cmd/clk line is not solid. Need to check it.

So in simplicity, the firmware will sniff the cmd line, if there are no byte that showing its initialized, than throws that error. Since you could boot normally to ofw, then the emmc definitely initialized. So the picofly cannot sniff the cmd line. So the suspect is the cmd line which the firmware sniff on, or the clk line, where the firmware use to synchronize the pulse on the cmd line.
 

FreeLander

Well-Known Member
Member
Joined
Apr 6, 2023
Messages
350
Trophies
0
Age
35
XP
467
Country
United States
Nice! but why are you removing the fan?
Thank you. The "power on" ribbon cable struggles to be put on and off with the fan being too close. It just became a habit to remove it during disassembly. I learned that from a great YouTuber I like to watch named Tvpartsworld.
 
  • Like
Reactions: deeps

LogicalMadness

Well-Known Member
Member
Joined
Nov 3, 2014
Messages
287
Trophies
0
Age
41
XP
690
Country
United States
Thank you. The "power on" ribbon cable struggles to be put on and off with the fan being too close. It just became a habit to remove it during disassembly. I learned that from a great YouTuber I like to watch named Tvpartsworld.
If you insert the cable AS you're putting the MB down in the case (move screen\fan\controller ribbons out of the way) you can avoid the fan removal. Just 'another way'.
 

cgtchy0412

Well-Known Member
Member
Joined
Apr 26, 2023
Messages
287
Trophies
0
Age
41
XP
433
Country
Indonesia
Hi @abal1000x ,
I've found an OLED which sometimes can glitch and sometimes cannot .. using an DAT0 adapter.. Continuity is good, but still throws dat0 error code.
Just want to know your opinion regarding bellow voltages and ranges test. Can we check it directly on the switch unit to know this specific unit values ? also how safe it will be if we modify these values in the firmware.

1694492301049.png
 

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,062
Trophies
0
XP
1,369
Country
Gaza Strip
Hi @abal1000x ,
I've found an OLED which sometimes can glitch and sometimes cannot .. using an DAT0 adapter.. Continuity is good, but still throws dat0 error code.
Just want to know your opinion regarding bellow voltages and ranges test.
From datasheet:
a.png

Dat0 works on push-pull mode, means,
d.png

e.png

b.png

c.png

When theres no signal (high level) it should be between Voh to Vdd.
Theres two table i assume the emmc could use 2 mode of voltage.

Vccq = Vdd = 1.70 ~ 1.95

Table 30:
Vdat0 = 0.75Vdd ~ Vdd
= 1.275 ~ 1.95
Table 31:
Vdat0 = Vccq - 0.45 ~ Vdd
= 1.25 ~ 1.95

So based on the datasheet it should be around 1.25V to 1.95V.
Or using the code style it should be 1.6V +- 0,35V
Can we check it directly on the switch unit to know this specific unit values ?
You can, when its powered on. Its pulled up, so the low bit is high voltage.
also how safe it will be if we modify these values in the firmware.

View attachment 393390
Its safe if you know what you're doing.
Those fault detection is for safety.
For example if the dat0 is in the wrong voltage, then theres something wrong with the installation.
What if you switch the dat0 with the 3.3v for example.
Post automatically merged:

Hi @abal1000x ,
I've found an OLED which sometimes can glitch and sometimes cannot .. using an DAT0 adapter.
Logically speaking, the glitch is not affected directly by the dat0.

I assume,
The dat0 line is needed to inject (write) the loader to the emmc (the whitelight in the first time powered on).
And checked (read) that the loader is indeed in the emmc, everytime picofly powered on.

So if the 'white light on first installation' workings then the dat0 line is working.

But indeed the glitch operation use the CMD line to compare data, to check whether the glitch works or not. Or to get the time reference of when the glitch will be executed. So the CMD line is very important on the glitch (Also the CLK line to sync the signal).

But remember that CMD/CLK/Dat0 is in one package of emmc. So it doesn't remove the possibility that wrongdoing in Dat0 might interfere the CMD line. For the its illogical, and have a lesser probability.
If glitch problematic, the number one suspect is mosfet and the gate line, second is the cmd/clk line.
 
Last edited by abal1000x,

rogras

Well-Known Member
Newcomer
Joined
Apr 2, 2009
Messages
80
Trophies
1
Age
113
Location
TR
XP
531
Country
No, a hardware fault can be ruled out. I installed the chip as usual and the device had also started and I entered into Hekate. However, it got stuck after about 20 minutes when creating the Nand backup. The screen was full of graphic artifacts. I know that this happens when the DAT0 is not seated correctly, but after changing the DAT0 template, I got CFW = Blackscreen and OFW = Bluescreen.

Unfortunately, I also started the OFW before I changed the template. I therefore assume that the Nand is corrupted.

Did someone know how i can get my biskeys over IRAM ?
CFW (Hekate) = Blackscreen and OFW = Bluescreen.
Ums-loader via IRAM = Works (and I can also dump Nand.)

Firmware 2.75 maybe fix this issue too:
it got stuck after about 20 minutes when creating the Nand backup. The screen was full of graphic artifacts after this I got Black/Blue Screen. DAT0 Adapter was used.
 

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,062
Trophies
0
XP
1,369
Country
Gaza Strip
Did someone know how i can get my biskeys over IRAM ?
CFW (Hekate) = Blackscreen and OFW = Bluescreen.
Ums-loader via IRAM = Works (and I can also dump Nand.)

Firmware 2.75 maybe fix this issue too:
About your issue.
Since you could goes to hekate, then i think the dram connection should be okay.
I remember someone whose dram trace got disconnected, cannot even goes to hekate.

Have you tried to reball the emmc, or use the permanent method?
If you are not confident, dont do it.
Reball, indeed need basic skill and appropriate tool to safely executed.
 

karatefeet

Well-Known Member
Newcomer
Joined
May 18, 2023
Messages
89
Trophies
0
XP
453
Country
Canada
Question on reballing the eMMC, what temps and air settings are you guys using? I've been using 380 @ 50% and go nice and slow. I've heard the eMMC can be damaged by heat so didn't want to go too hot.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    BakerMan @ BakerMan: ... that's rough buddy