Hacking Hardware Picofly - a HWFLY switch modchip

[BlueBeans]

So had my picofly installed by a store. The problem is there's always a recurring problem. The long short dat0 is not connected returns. I've had it fixed twice and after a few days, boot rate to CFW is very low. It's usually boots to stock quickly after powering. I usually shake the switch crazily then tried booting (30 times) before leaving the store.

Do you think touching up the 2 solder points related to data0 will fix it or could something else be causing it? Could it be the dat0 adapter is bad?

I use the dat0 adapters almost every day and have never come across this problem. They much be doing something wrong like not anchoring it down.

 

[psycho-neon]

The black dat0 adapters are a bit better and more resistant but if you want a permanent solution reballing is the way.
As for kamikaze, i've seen the people here do it but just seems more dangerous to me.

I've tried the kamikaze, so far it was good. I can't say perfect since I almost cut the cmd line, however it works great. No more failure.

Post automatically merged: Dec 7, 2023

v2 mod chip installed. Im happy with the result.

 

[QuiTim]

I've tried the kamikaze, so far it was good. I can't say perfect since I almost cut the cmd line, however it works great. No more failure.

Post automatically merged: Dec 7, 2023

v2 mod chip installed. Im happy with the result.

Wow, congrats
Which tool did you use? How long did take? Did you make any pictures of the process?
I'm happy it worked out, cheers

 

[psycho-neon]

Wow, congrats
Which tool did you use? How long did take? Did you make any pictures of the process?
I'm happy it worked out, cheers

I used a mini grinding tool MaAnt D1 with a fine tip. Maybe the grinding process took me about 30mins. i wanted it to be as perfect as possible since it is my first time and my own.

I did a practice on a throw away pcb until I got the hang of operating the grinder on microscope and did the job. Unfortunately due to excitement i forgot to take photo.

 

[QuiTim]

Unfortunately due to excitement i forgot to take photo.

Yeah, i've been there
Thanks for the info and I will give it a shot next chance I get, gotta spice things up

 

[LuigiGad]

change your cmd resistor it is 0201 4k7ohm

I solved it by changing the resistance, not having the correct format I made do

 

[SorataVP69]

Latest firmware here

ChangeLog:

v2.0 + Active MMC communication
v2.1 + Toshiba support
v2.2 + Fix Toshiba boot fail
v2.3 + SanDisk support
v2.4 + Faster Toshiba boot
v2.5 + fix OFW boot
v2.6 + software update, xiao & itsy support
v2.61 + Instinct-NX sdloader, bug fixes
v2.62 + Make 16.0.1 happy (fix OFW boot)
v2.63 + roll back some 2.62 boot speed tricks
v2.64 + enable back the board detection
v2.65 + RP Pico support, double reset removed
v2.66 + Bypass to OFW after update for proper fuse burning
v2.67 + Don't bypass to OFW on first install
v2.70 + new LED indication, i2c undervoltage hack
v2.71 + support for SQc open-source board
v2.72 + disable CLK check, it's unstable
v2.73 + add LED signal on success
v2.74 + 300 mhz precision rp2040 may be not stable at 300mhz
v2.75 + back to 200mhz, remove SRAM powerdown

Spoiler: LED indication

= is long pulse, * is short pulse:

= USB flashing done

** RST is not connected
*= CMD is not connected
=* D0 is not connected
== CLK is not connected

*** No eMMC CMD1 responce (bad eMMC?)
**= No eMMC block 1 read (should not happen)
*=* No eMMC block 0 read (eMMC init failure?)
*== No eMMC CMD1 request (poor wiring, or dead CPU)

=** eMMC init failure during glitch process
=*= CPU never reach BCT check, should not happen
==* CPU always reach BCT check (no glitch reaction, check mosfet)
=== Glitch attempt limit reached, cannot glitch

=*** eMMC init failure
=**= eMMC write failure - comparison failed
=*=* eMMC write failure - write failed
=*== eMMC test failure - read failed
==** eMMC read failed during firmware update
==*= BCT copy failed - write failure
===* BCT copy failed - comparison failure
==== BCT copy failed - read failure

Spoiler: i2c undervoltage hack

If your glitch is unstable (==* error), and the proper boot happens only when you press Reset after joycon logo, you can add two more wires to make glitch much better.

board pins:
Waveshare rp2040: SDA=12, SCL=13
Pi Pico: SDA = 19, SCL = 20
XIAO 2040: SDA=3, SCL=4
ItsyBitsy 2040: SDA = 18, SCL = 19

NS points (v2, Lite, OLED):
View attachment 372191
View attachment 372192
View attachment 372193

Spoiler: Diagrams + by Dee87

View attachment 357132
View attachment 363821
View attachment 364242
View attachment 364990
View attachment 357133
View attachment 357135
View attachment 357134
View attachment 357136

Spoiler: Solder example

View attachment 357137
View attachment 357138
View attachment 360187
View attachment 363817
View attachment 357139
View attachment 357140
View attachment 360186
View attachment 364818

Spoiler: Issues, questions

Q: What is supported?
A: Erista (v1), Mariko (v2, Lite, OLED)

Q: eMMC types support?
A: Tested on Hynix, Samsung, Toshiba, SanDisk

Q: rp2040 boards support
A: WaveShare 2040-zero/one, xiao-rp2040, adafruit itsybitsy (Pi Pico is not supported for now)

Q: GREEN, but instant reset
A: Clean flux near the RST point

Q: Do I really need 47 Ohm resistors?
A: You can skip them, however in this case you will have to use emuMMC due to the line interference, sysNAND would not boot (sysNAND data can be damaged).

Q: Does the firmware has learning? How to reset statistics
A: Short pin 0 to either 1 or GND during start for chip reset. The statistics is collected each boot. The more you start it - the better it boots.

Q: open source?
A: https://github.com/rehius

Q: why you made it?
A: to prove it possible!

Q: run Atmosphere?
A: no piracy

Spoiler: Reboot to OFW / Vol+ & Vol- doesn't work, blue/black screen

v2.5 firmware had a bug with BOOT0 corruption. To recover it:
- boot "Full Stock" using hekate
- update to the latest official firmware over Wi-Fi

Spoiler: Sleep mode does not work

- boot "Full Stock" using hekate
- perform a full system reset

Spoiler: Toolbox 0.2 features

- show firmware information
- update firmware from SD card (place update.bin into the root folder)
- rollback to the backup firmware slot
- reset learning statistics
- dump / write sdloader

Spoiler: RGB LED explanation by lightninjay

if you have an rp2040-zero from waveshare/ali then it has a neopixel. It is used for diagnosing proper firmware flashes as well as console glitching. If you plug it in, and flash the uf2 firmware to it and immediately see a red light after flashing (this is not the same as flashing, then unplugging and replugging), then no rgb jumper needs to be made. If on the other hand, you get one quick green flashing light, then you need to bridge the jumper pads indicated to swap the LED colors for proper diagnoses capability.

Hello, I have a problem with this chip, it has the latest firmware available, it turns on a couple of times and then doesn't want to turn on again until I disconnect the battery from the console for a while. I have another spare chip but I would like to know if it is possible to save this chip

 

[ancylow]

Hello, I have a problem with this chip, it has the latest firmware available, it turns on a couple of times and then doesn't want to turn on again until I disconnect the battery from the console for a while. I have another spare chip but I would like to know if it is possible to save this chip

Maybe you're using too thin wires, special for 3.3V and GND points. And must isolate chip from the metal frames, be careful with that.

 

[SorataVP69]

Maybe you're using too thin wires, special for 3.3V and GND points. And must isolate chip from the metal frames, be careful with that.

I'm going to try replacing the cable with a thicker one, I already put double-sided tape under it, it's not making contact with the metal

 

[BlueBeans]

I've tried the kamikaze, so far it was good. I can't say perfect since I almost cut the cmd line, however it works great. No more failure.

Post automatically merged: Dec 7, 2023

v2 mod chip installed. Im happy with the result.

The kamikaze spot is the same on the v2 as it is on the oled?

 

[GPTRPSN]

I successfully upgraded from a 512GB card to a 1TB. By the way this may be unrelated to the topic, but I noticed that, we can see the detailed information of our memory card from the Hakete menu (Even production date of card), but I could not find any software that shows the details of our memory card on Windows. HDTune, Hwinfo, CrystalDiskInfo do not show it. It seemed quite interesting to me.

Also I found that Samsung card was more power hungry than Sandisk Extreme (I dont know how it accurate ofc)

Samsung Evo Plus 512GB

Sandisk Extreme 1TB - 190/130MB model:

 

[SorataVP69]

I'm going to try replacing the cable with a thicker one, I already put double-sided tape under it, it's not making contact with the metal

I already replaced it with a cable twice as thick, I was using 0.10mm now I'm using 0.20mm and it's the same problem, is there anything else I can try?

 

[abal1000x]

Hello, I have a problem with this chip, it has the latest firmware available, it turns on a couple of times and then doesn't want to turn on again until I disconnect the battery from the console for a while. I have another spare chip but I would like to know if it is possible to save this chip

What point do you use for 3.3 and the GND?

 

[SorataVP69]

What point do you use for 3.3 and the GND?

This

 

[QuiTim]

The kamikaze spot is the same on the v2 as it is on the oled?

When he said "v2" I think he is refering to the flex cable he most likely used for the mosfet cpu connection.
You don't need to do kamikaze on V2 Switch since the dat0 is easily accessible.

Post automatically merged: Dec 7, 2023

Hello, I have a problem with this chip, it has the latest firmware available, it turns on a couple of times and then doesn't want to turn on again until I disconnect the battery from the console for a while. I have another spare chip but I would like to know if it is possible to save this chip

Did you try the other rp2040 just to make sure it's the chip?
Couple of suggestions:
-The enamel wire can be tricky, might get scratched and create a short or the insulation might not burn while soldering resulting in a cold joint (it appears to be soldered but it's actually just stuck on solder and not making contact)
-The resistors you are using have a very small contact area so you should check the soldering there aswell.
-If you did not remove the LDO (the little black 5-legged thingy on thr back) it might couse a problem. You should remove it since it's not needed anymore.
-I also had one problem with the crystal (the little shiny thing on the back) but my rp2040 was not working at all so this is unlikely in your scenario.

 

[BlueBeans]

When he said "v2" I think he is refering to the flex cable he most likely used for the mosfet cpu connection.
You don't need to do kamikaze on V2 Switch since the dat0 is easily accessible.

Post automatically merged: Dec 7, 2023

Did you try the other rp2040 just to make sure it's the chip?
Couple of suggestions:
-The enamel wire can be tricky, might get scratched and create a short or the insulation might not burn while soldering resulting in a cold joint (it appears to be soldered but it's actually just stuck on solder and not making contact)
-The resistors you are using have a very small contact area so you should check the soldering there aswell.
-If you did not remove the LDO (the little black 5-legged thingy on thr back) it might couse a problem. You should remove it since it's not needed anymore.
-I also had one problem with the crystal (the little shiny thing on the back) but my rp2040 was not working at all so this is unlikely in your scenario.

Yeah that’s why I was a little confused. Was about to go practice on the v2 parts boards I have lying around.

Post automatically merged: Dec 7, 2023

Has anyone found a way to have these made instead of buying from AliExpress?

 

[m3du54]

same here, I got tiny from waveshare official site and they came with RGB test code out of box. Nuke them and put v2.75 fw on it but no success flash after that. Howevevr, I do have ** code when replugin to PC without holding boot button after fw flashed. So they are good to bang on.
Just make sure you have ** code and you should be good

If in waveshare tiny with 2.75 installed, when you plug usb again gives you one long blue and 3 ** yellow (6 total), is it a good sign? Shall I move on and remove usb port and buttons from the chip?

 

[QuiTim]

Yeah that’s why I was a little confused. Was about to go practice on the v2 parts boards I have lying around.

Post automatically merged: Dec 7, 2023

Has anyone found a way to have these made instead of buying from AliExpress?

If you don't want to buy from ali:
https://munia.io/devices
If you wanna make your own:
https://github.com/Pheeeeenom/BGA153-DAT0-Breakout

 

[jkyoho]

If in waveshare tiny with 2.75 installed, when you plug usb again gives you one long blue and 3 ** yellow (6 total), is it a good sign? Shall I move on and remove usb port and buttons from the chip?

where is the port or button from tiny?
Yes, ** error code 3 times in total. AFAIK, the picofly fw check rst first so you got error code/LED **

 

[BlueBeans]

If you don't want to buy from ali:
https://munia.io/devices
If you wanna make your own:
https://github.com/Pheeeeenom/BGA153-DAT0-Breakout

My hero!

Post automatically merged: Dec 7, 2023

If you don't want to buy from ali:
https://munia.io/devices
If you wanna make your own:
https://github.com/Pheeeeenom/BGA153-DAT0-Breakout

Has someone found a way to make the apu flex cables?

Post automatically merged: Dec 7, 2023

What’s so funny @QuiTim lol