Hacking Hardware Picofly - a HWFLY switch modchip

[BlueBeans]

Could you please share several photos of your work on the dat0?
Thank you.

I didn’t take any but I have another one to do today and I will take some photos.

 

[terminalshort]

Hi guys,
I have installed this modchip in a Nintendo Switch OLED:

It boots into Hekate, I could create the emuMMC and then boot Atmosphere.
However, I can't boot Atmosphere using the sysNAND or stock firmware. I also can't cold boot into stock.

OFW version=18.1.0, the CFW is updated to the last version. I have checked DAT0 with diode mode and seems OK (0.74V).

I have read here that DAT0 is problematic and using a 50ohm resistor could fix the issue. Any ideas? Could this be the case here?

 

[jkyoho]

Hi guys,
I have installed this modchip in a Nintendo Switch OLED:

View attachment 449746

It boots into Hekate, I could create the emuMMC and then boot Atmosphere.
However, I can't boot Atmosphere using the sysNAND or stock firmware. I also can't cold boot into stock.

OFW version=18.1.0, the CFW is updated to the last version. I have checked DAT0 with diode mode and seems OK (0.74V).

I have read here that DAT0 is problematic and using a 50ohm resistor could fix the issue. Any ideas? Could this be the case here?

what resistor you have on the chip for dat0 and rst/B point?

 

[rull_bull]

Hi guys,
I have installed this modchip in a Nintendo Switch OLED:

View attachment 449746

It boots into Hekate, I could create the emuMMC and then boot Atmosphere.
However, I can't boot Atmosphere using the sysNAND or stock firmware. I also can't cold boot into stock.

OFW version=18.1.0, the CFW is updated to the last version. I have checked DAT0 with diode mode and seems OK (0.74V).

I have read here that DAT0 is problematic and using a 50ohm resistor could fix the issue. Any ideas? Could this be the case here?

Check post #158 here: https://gbatemp.net/threads/hwfly-shaped-picofly-boards-start-shipping-in-china.632179/page-8

It’s the A and C resistors on your chip you should measure.

 

[terminalshort]

what resistor you have on the chip for dat0 and rst/B point?

Check post #158 here: https://gbatemp.net/threads/hwfly-shaped-picofly-boards-start-shipping-in-china.632179/page-8

It’s the A and C resistors on your chip you should measure.

A - 48 ohm
B - No resistor
C - 240 ohm
D - 48 ohm


Edit: I have tried replacing C resistor with 47 and 100 ohm, but the problem persists.

 

[rull_bull]

A - 48 ohm
B - No resistor
C - 240 ohm
D - 48 ohm


Edit: I have tried replacing C resistor with 47 and 100 ohm, but the problem persists.

Replace A with 100 ohm also, standard is 100/100/50ohm as the guide says

 

[terminalshort]

Replace A with 100 ohm also, standard is 100/100/50ohm as the guide says

Current setup:
A - 100 ohm
B - No resistor
C - 100 ohm
D - 48 ohm

Still no luck.
Why is it that the eMMC benchmark returns good results but the NAND can't be read to start stock/or sysnand CFW?

When trying to cold boot I get two short plus a long yellow flash.


Edit:
I have tried disconnecting just point C/DATA0 and the switch automatically boots OFW. The other points are still connected

 

[Takezo-San]

Had a question for Y'all.

If when doing the Kamikaze method, you expose the DAT0 point, should the switch still be able to boot as normal (before proceeding to the mod chip installation?).

I ask because I had a switch oled that I recovered, reballed and used flux off post reball. It was very good and booted. So I thought (me and my bright ideas) lets kamikaze this one! Yay! Did the front side kamikaze and it all looked good. Though I did rush a bit and got the Dat0 point. Checked it for diode and got healthy 0.740v reading. Masked everything else up and was about to wire the point but then wanted to check if the switch still boots. Black Screen with faint buzzing coming from the SOC.

Looked online and found others with the same problem. Might have grinded too deep and quickly that might have caused a short between two layers. I should have possibly done what I usually do which is take my time and take it layer by layer. I went back in and done my best to separate out the layers but then still nothing. Short somewhere and the touch up made things worse. Lesson learned. Take your time, layer by layer and from now on I will stick to the rear side for the kamkikaze as I have better success with that. Maybe theres too many sensitive lines at the front and the rear is only 2 layers oppose to the 3 of the front.

Thoughts!?

 

[thesjaakspoiler]

If when doing the Kamikaze method, you expose the DAT0 point, should the switch still be able to boot as normal (before proceeding to the mod chip installation?).

Yes of course it should boot as normal.
The only thing you're doing is creating an alternative location to connect to the DAT0.

I don't know of anything that can remove the mask except some strong acid maybe.
But to test your theory, just take a look at the layers to see what might be causing a short.
Most of those layers are just power and ground layers.

 

[jkyoho]

Had a question for Y'all.

If when doing the Kamikaze method, you expose the DAT0 point, should the switch still be able to boot as normal (before proceeding to the mod chip installation?).

I ask because I had a switch oled that I recovered, reballed and used flux off post reball. It was very good and booted. So I thought (me and my bright ideas) lets kamikaze this one! Yay! Did the front side kamikaze and it all looked good. Though I did rush a bit and got the Dat0 point. Checked it for diode and got healthy 0.740v reading. Masked everything else up and was about to wire the point but then wanted to check if the switch still boots. Black Screen with faint buzzing coming from the SOC.

Looked online and found others with the same problem. Might have grinded too deep and quickly that might have caused a short between two layers. I should have possibly done what I usually do which is take my time and take it layer by layer. I went back in and done my best to separate out the layers but then still nothing. Short somewhere and the touch up made things worse. Lesson learned. Take your time, layer by layer and from now on I will stick to the rear side for the kamkikaze as I have better success with that. Maybe theres too many sensitive lines at the front and the rear is only 2 layers oppose to the 3 of the front.

Thoughts!?

Yes, exposing dat0 front side wont stop console boot up, and thats what I been doing, test if it still boots up normal after your grinding.

Check with usb cable if your console now stuck on RCM mode.(if dat0 broken trace)
FYI, GND right next to dat0 via on 3rd layer, make sure you grind to the right place

 

[Takezo-San]

Thanks for the input. I think its done. I read somewhere that it could have been a layer too deep or less or something like that. So I made a real hash of it and now its.... a donor. Just a big ol expensive donor board. Though that board was an SkHynix and it had gone through about 6 reballs and the pads were all shot too. Still worked but I bet it was a ticking time bomb anyway. Better now then later I suppose. Though still, very strange though because I had all the lines in tact with the Kamikaze and good signals too. Though I did make a big square in the grind template area. Either way, I'm sticking to the back of the board dat0 point because its in a less 'high traffic' area. All good. Will get another working board and swap it in and master this method one way or another. Thanks guys again for the input.

 

[BlueBeans]

So my second Kamakazi was a bust. Think I was a little too confident and went right through dat0. Get a black screen now. Anyway to remedy it and use the original dat0 point?

 

[snaker]

Current setup:
A - 100 ohm
B - No resistor
C - 100 ohm
D - 48 ohm

Still no luck.
Why is it that the eMMC benchmark returns good results but the NAND can't be read to start stock/or sysnand CFW?

When trying to cold boot I get two short plus a long yellow flash.


Edit:
I have tried disconnecting just point C/DATA0 and the switch automatically boots OFW. The other points are still connected

If you used the flex cable that came with the kit disgard it and use wires to the chip points. You must pass the c point wire through a specific route in order to avoid interference (when using the flex) and boot to ofw and i don't have a picture right now to show you.

 

[Danook28]

Yes, exposing dat0 front side wont stop console boot up, and thats what I been doing, test if it still boots up normal after your grinding.

Check with usb cable if your console now stuck on RCM mode.(if dat0 broken trace)
FYI, GND right next to dat0 via on 3rd layer, make sure you grind to the right place
View attachment 449813

What is that line next dat0 line?? After i grider the point i see is The next red dat0 point what that point do???

 

[Takezo-San]

So my second Kamakazi was a bust. Think I was a little too confident and went right through dat0. Get a black screen now. Anyway to remedy it and use the original dat0 point?

Heeeeeeey you and me both now haha
We both underestimated the method and got cocky. I've read it's super difficult to repair so I'd take it as a learning experience for next time and me personally, I think I'm sticking to the back side dat0 kamikaze. Let's say, 1 down and never again. My best kamikaze took me an hour but it was clean. Will aim for that sort of level of care next time.

 

[jkyoho]

What is that line next dat0 line?? After i grider the point i see is The next red dat0 point what that point do???

which one, left of dat0 or right of dat0?

 

[terminalshort]

If you used the flex cable that came with the kit disgard it and use wires to the chip points. You must pass the c point wire through a specific route in order to avoid interference (when using the flex) and boot to ofw and i don't have a picture right now to show you.

Thanks, I will try to route the cable in that way. I have seen a video where the guy routes it from inside the CPU socket. Maybe that is what you mean?

 

[Danook28]

which one, left of dat0 or right of dat0?

Left.. Not gnd

 

[jkyoho]

Left.. Not gnd

dat2, if I remember correctly

 

[LuigiGad]

Had a question for Y'all.

If when doing the Kamikaze method, you expose the DAT0 point, should the switch still be able to boot as normal (before proceeding to the mod chip installation?).

I ask because I had a switch oled that I recovered, reballed and used flux off post reball. It was very good and booted. So I thought (me and my bright ideas) lets kamikaze this one! Yay! Did the front side kamikaze and it all looked good. Though I did rush a bit and got the Dat0 point. Checked it for diode and got healthy 0.740v reading. Masked everything else up and was about to wire the point but then wanted to check if the switch still boots. Black Screen with faint buzzing coming from the SOC.

Looked online and found others with the same problem. Might have grinded too deep and quickly that might have caused a short between two layers. I should have possibly done what I usually do which is take my time and take it layer by layer. I went back in and done my best to separate out the layers but then still nothing. Short somewhere and the touch up made things worse. Lesson learned. Take your time, layer by layer and from now on I will stick to the rear side for the kamkikaze as I have better success with that. Maybe theres too many sensitive lines at the front and the rear is only 2 layers oppose to the 3 of the front.

Thoughts!?

So my second Kamakazi was a bust. Think I was a little too confident and went right through dat0. Get a black screen now. Anyway to remedy it and use the original dat0 point?

I'm sorry to read this, unfortunately it's always a lottery after all. if you have a black screen you probably interrupted the track. even if the tester continues to give you the correct value, if you don't fix the track it won't start