Hacking Hardware Picofly - a HWFLY switch modchip

[Maxmixmux]

Hi All,
I successfully exposed DAT0 using the Kamikaze method. However, I'm having trouble soldering the tin onto the track. I've tried 4 times but still haven't succeeded. I've used Magma C210 001 and 900M soldering iron tips, and Relife RL-401 tin paste, but to no avail. Do you have any advice on soldering techniques? Or something wrong what i do? Thanks

 

[lightautodark]

Hi All,
I successfully exposed DAT0 using the Kamikaze method. However, I'm having trouble soldering the tin onto the track. I've tried 4 times but still haven't succeeded. I've used Magma C210 001 and 900M soldering iron tips, and Relife RL-401 tin paste, but to no avail. Do you have any advice on soldering techniques? Or something wrong what i do? Thanks

flux, and leave your tip there longer if you're not using a quality tip. it's tricky because low quality c210 cartridge doesn't heat up the tip of the iron properly but the body of the soldering iron will get hot and that will burn the flux, with enough practice you can still do it.

 

[Maxmixmux]

flux, and leave your tip there longer if you're not using a quality tip. it's tricky because low quality c210 cartridge doesn't heat up the tip of the iron properly but the body of the soldering iron will get hot and that will burn the flux, with enough practice you can still do it.

Thank you for your input. I've applied flux before solder paste, using Amtech 559. If I use a temperature of 300 degrees Celsius, what is the maximum time in seconds I can hold before overheating and damaging the DAT0 track?

 

[nigopal88]

I’ve done this mod so many times that it muscle memory at this point I’ve genuinely looked around the board to see if i could see any chip cracks or any caps shorted and nothing, the console is stuck at 0.4 amps and does not power on. When everything was set and done i turned it on and nothing happened the chip didn't light up. I looked around the areas where i couldve ruined a trace and couldnt find anything. Any tips on what i should try next? Thank you!

Maybe you cut the dat0 or another line on the kamikaze process

 

[naldo29]

Maybe you cut the dat0 or another line on the kamikaze process

dat0 is reporting the the same range of values as it should. Its also not bridged

Post automatically merged: Jan 29, 2025

Maybe you cut the dat0 or another line on the kamikaze process

Double checked, seems fine

Post automatically merged: Jan 29, 2025

dat0 is reporting the the same range of values as it should. Its also not bridged

Post automatically merged: Jan 29, 2025

Double checked, seems fine

are there any diagnostics that i could do to start checking where it couldve gone wrong? Ive tried probing around and everything seems fine, checked for cut traces and have found nothing. Ive looked verywhere and everything seems to tell me that its normal, so why isnt it turning on.

 

[nigopal88]

dat0 is reporting the the same range of values as it should. Its also not bridged

Post automatically merged: Jan 29, 2025

View attachment 483279
Double checked, seems fine

Post automatically merged: Jan 29, 2025

are there any diagnostics that i could do to start checking where it couldve gone wrong? Ive tried probing around and everything seems fine, checked for cut traces and have found nothing. Ive looked verywhere and everything seems to tell me that its normal, so why isnt it turning on.

Check that line it looks cutted

 

[naldo29]

Check that line it looks cutted

I wish

 

[MoeXzl]

Any tips on what i should try next?

First you should clean the board thoroughly!
Have you measured the individual points to see if they have the correct values? CLK check whether there is actually a connection. Perhaps you interrupted the trace.
If all this doesn't help, you have to look for short circuits.

 

[abal1000x]

I’ve done this mod so many times that it muscle memory at this point I’ve genuinely looked around the board to see if i could see any chip cracks or any caps shorted and nothing, the console is stuck at 0.4 amps and does not power on. When everything was set and done i turned it on and nothing happened the chip didn't light up. I looked around the areas where i couldve ruined a trace and couldnt find anything. Any tips on what i should try next? Thank you!

Have you measured the voltage of the 3.3v volt supplied to the picofly. Its come from the PowerManagement IC. If its short then you might look the trace from the pcb what component might short it. The worst case scenario, the PMIC itself broke.

https://www.retrosix.wiki/33v-regulator-checks
https://www.retrosix.wiki/bq24193-battery-charger
https://www.retrosix.wiki/diagnostics-power-draws-nintendo-switch
https://www.retrosix.wiki/first-stage-boot-short-checks
https://www.retrosix.wiki/dead-short-checks-nintendo-switch
https://www.retrosix.wiki/emmc-booting
https://www.retrosix.wiki/full-boot-from-bench-power
https://www.retrosix.wiki/max77620-cpu-regulator

 

[lightautodark]

Thank you for your input. I've applied flux before solder paste, using Amtech 559. If I use a temperature of 300 degrees Celsius, what is the maximum time in seconds I can hold before overheating and damaging the DAT0 track?

you should be able to see the solder paste is forming a connection to the exposed dat0 point if you tilt your soldering iron a little. How long you should leave it depends on your equipment. Minimum amount of solder paste, if you use too much, the paste will adhere to your soldering tip instead.

 

[Maxmixmux]

you should be able to see the solder paste is forming a connection to the exposed dat0 point if you tilt your soldering iron a little. How long you should leave it depends on your equipment. Minimum amount of solder paste, if you use too much, the paste will adhere to your soldering tip instead.

Thank you very much. I'll try again another device. For now, I'm afraid to continue the experiment, as I feel I've already tried several times. I'm worried that the DAT0 track is no longer reliable. I'll use the classic method, a DAT0 adapter.

 

[naldo29]

Have you measured the voltage of the 3.3v volt supplied to the picofly. Its come from the PowerManagement IC. If its short then you might look the trace from the pcb what component might short it. The worst case scenario, the PMIC itself broke.

https://www.retrosix.wiki/33v-regulator-checks
https://www.retrosix.wiki/bq24193-battery-charger
https://www.retrosix.wiki/diagnostics-power-draws-nintendo-switch
https://www.retrosix.wiki/first-stage-boot-short-checks
https://www.retrosix.wiki/dead-short-checks-nintendo-switch
https://www.retrosix.wiki/emmc-booting
https://www.retrosix.wiki/full-boot-from-bench-power
https://www.retrosix.wiki/max77620-cpu-regulator

welp, i can say one thing. its the 3.3v. It was giving me 0.05v when i was reading it. i tried the alcohol trick to see if any components get hot but none did. Do you have any suggestions on how i can find where the short could be in?

 

[abal1000x]

welp, i can say one thing. its the 3.3v. It was giving me 0.05v when i was reading it. i tried the alcohol trick to see if any components get hot but none did. Do you have any suggestions on how i can find where the short could be in?

Read the link i gave, its high quality article.

I forgot whether its the BQ chip or the max chip, that supply the 3.3V.
Use the pcb data from xzz, someone have successfully decrypt and made the board view.
Just search in gba. Using the boardview, track the line of 3.3V its connected to what component.
See the line whether its not shorted, by aluminum case or whatever, and make sure each component connected doesn't have physical mark of burning, or something similar.
I know its spartan way of tracking. But without obvious sign, we need to track each one by one.

 

[naldo29]

Read the link i gave, its high quality article.

I forgot whether its the BQ chip or the max chip, that supply the 3.3V.
Use the pcb data from xzz, someone have successfully decrypt and made the board view.
Just search in gba. Using the boardview, track the line of 3.3V its connected to what component.
See the line whether its not shorted, by aluminum case or whatever, and make sure each component connected doesn't have physical mark of burning, or something similar.
I know its spartan way of tracking. But without obvious sign, we need to track each one by one.

i know this might be a dumb question but when you say shorted, you mean to put the black probe on ground and put the red probe on 3.3v on continutity right?

 

[thesjaakspoiler]

I’ve done this mod so many times that it muscle memory at this point I’ve genuinely looked around the board to see if i could see any chip cracks or any caps shorted and nothing, the console is stuck at 0.4 amps and does not power on. When everything was set and done i turned it on and nothing happened the chip didn't light up. I looked around the areas where i couldve ruined a trace and couldnt find anything. Any tips on what i should try next? Thank you!

Maybe a case of some static electricity frying something.
I still remember wrecking my SuperNintendo. =/
Time to get out a multimeter :
https://www.retrosix.wiki/full-boot-from-bench-power

 

[naldo29]

Read the link i gave, its high quality article.

I forgot whether its the BQ chip or the max chip, that supply the 3.3V.
Use the pcb data from xzz, someone have successfully decrypt and made the board view.
Just search in gba. Using the boardview, track the line of 3.3V its connected to what component.
See the line whether its not shorted, by aluminum case or whatever, and make sure each component connected doesn't have physical mark of burning, or something similar.
I know its spartan way of tracking. But without obvious sign, we need to track each one by one.

found the issue, 1ewp :/. but its strange since its not heating up when being turned on

 

[PessimusGrime]

I recently swapped a Picofly (Ali clone) to a V6S, and now back to Picofly again.

The Picofly works ok, but it shows the Instinct-NX "No SD card" screen, not the Raspberry one
Does this mean the screen is stored on the Switch?

Not complaining, just curious how this works

 

[lightninjay]

I recently swapped a Picofly (Ali clone) to a V6S, and now back to Picofly again.

The Picofly works ok, but it shows the Instinct-NX "No SD card" screen, not the Raspberry one
Does this mean the screen is stored on the Switch?

Not complaining, just curious how this works

That graphic is part of the SDloader component that is loaded into an area of the eMMC and booted from to access the pre-bootloader unsecurely and things like Hekate afterward. Rehius modified the graphic for the picofly when it injects a new sdloader, but the picofly just checks to see if it has written an sdloader or not, not whether or not the sdloader component was generated by picofly. If I have any of this wrong, someone can feel free to correct me. You may be able to reset the picofly by reflashing it, or by using picofly toolbox on the switch and have it re-inject a new sdloader in place of the Instinct screen.

 

[psycho-neon]

3rd batch of tinyfly came.

 

[JaRocker]

3rd batch of tinyfly came.

View attachment 483979View attachment 483980

Nice work! Would you be able to add a spot for a CC0201KRX5R7BB393 to the DIN for the RGB mod, or do you already have something in place that fixes the disconnecting and pairing issues with that modification?