Hacking Hardware Picofly - a HWFLY switch modchip

nerirififi

Well-Known Member
Member
Joined
Nov 18, 2015
Messages
160
Trophies
0
Age
43
XP
607
Country
France
  • Like
Reactions: binkinator

Piorjade

Well-Known Member
Member
Joined
Nov 8, 2015
Messages
142
Trophies
0
XP
407
Country
Gambia, The
To the guys with electrical knowledge: Do you think that soldering the MOSFET not directly on the capacitors but for example via 0.1mm - 0.25mm wires with let's say 1-2cm length will introduce significant delays (important for the voltage glitch)? I don't have a HWFLY CPU cable but I have loose MOSFETs, of course they're tiny as hell but I think it's easier to later disconnect them from the Switch when using wires if I choose to.
Post automatically merged:

By the way, as I said I already have a prototype for the eMMC sniffing part (untested) and the next goal is the eMMC writing/reading part (to write the BCTs and payload to the eMMC). Turns out that I've finally found suitable Pico code for it:
https://github.com/carlk3/no-OS-Fat...sdio/FatFs_SPI/sd_driver/SDIO/rp2040_sdio.pio

It's for the SD card SDIO mode, which is in itself pretty much identical to the eMMC native mode. I'll try to modify it so that it only needs one DAT line (the code above uses 4 DAT lines on the SD card) and then I'll try to port the command flow of HWFLY-NX over.

I have an SD card breakout board hooked up and I hope that the SDIO mode supports the same command set of eMMCs, otherwise I'll have to hook the test setup up to my Switch but then I'll only test the read commands, I don't want to break my Switch lmao.
 
Last edited by Piorjade,

Tafty

Well-Known Member
Member
Joined
Sep 23, 2016
Messages
116
Trophies
0
Age
36
XP
923
Country
To the guys with electrical knowledge: Do you think that soldering the MOSFET not directly on the capacitors but for example via 0.1mm - 0.25mm wires with let's say 1-2cm length will introduce significant delays (important for the voltage glitch)? I don't have a HWFLY CPU cable but I have loose MOSFETs, of course they're tiny as hell but I think it's easier to later disconnect them from the Switch when using wires if I choose to.
Post automatically merged:

By the way, as I said I already have a prototype for the eMMC sniffing part (untested) and the next goal is the eMMC writing/reading part (to write the BCTs and payload to the eMMC). Turns out that I've finally found suitable Pico code for it:
https://github.com/carlk3/no-OS-Fat...sdio/FatFs_SPI/sd_driver/SDIO/rp2040_sdio.pio

It's for the SD card SDIO mode, which is in itself pretty much identical to the eMMC native mode. I'll try to modify it so that it only needs one DAT line (the code above uses 4 DAT lines on the SD card) and then I'll try to port the command flow of HWFLY-NX over.

I have an SD card breakout board hooked up and I hope that the SDIO mode supports the same command set of eMMCs, otherwise I'll have to hook the test setup up to my Switch but then I'll only test the read commands, I don't want to break my Switch lmao.
i think this should be fine, the mosfets on the flex are about 1cm away from the point anyway....the only way to really tell is to test
 
  • Like
Reactions: binkinator

Raugo

Well-Known Member
Member
Joined
Nov 22, 2014
Messages
630
Trophies
0
XP
2,451
Country
Spain
@Tafty The picture of the switch lite with the rpi2040 installed is yours? If that is the case, Did you tried to dump de boot0 with hekate to see if the chip do something wrong there to not launch HOS?

Would be interesting to see the differences between boot0 of the same console with hwfly and picofile
 
  • Like
Reactions: Tafty

Piorjade

Well-Known Member
Member
Joined
Nov 8, 2015
Messages
142
Trophies
0
XP
407
Country
Gambia, The
you can boot in official mode, it s strange no one test to apply the patch on Boot0 that hwfly of sx core do the Emmc.
Maybe it s the fix for boot in CFW mode.
We can't because the firmware overrides it on every boot, well, if the firmware behaves like HWFLY, which it probably does.

HWFLY checks on every boot if the BCTs are different, if yes, it overrides them.
 

Raugo

Well-Known Member
Member
Joined
Nov 22, 2014
Messages
630
Trophies
0
XP
2,451
Country
Spain
We can't because the firmware overrides it on every boot, well, if the firmware behaves like HWFLY, which it probably does.

HWFLY checks on every boot if the BCTs are different, if yes, it overrides them.

It's possible to do it in hekate, would be a temporary fix but at least if works we wild now what is the problem.
 

nerirififi

Well-Known Member
Member
Joined
Nov 18, 2015
Messages
160
Trophies
0
Age
43
XP
607
Country
France
You can write BCTs and the payload in hekate?
it s not payload, it s a patch with some data on partition BOOT0
So you just need to dump the BOOT0, patch in the computer, and flash with hekate.
Then test the boot, and see what's happen.

I will test on unpatched unit, I will dump boot0 before installing the modchip and see if picofly flash this part.
I am pretty sure he don't flash the BOOT0
 

Tafty

Well-Known Member
Member
Joined
Sep 23, 2016
Messages
116
Trophies
0
Age
36
XP
923
Country
it s not payload, it s a patch with some data on partition BOOT0
So you just need to dump the BOOT0, patch in the computer, and flash with hekate.
Then test the boot, and see what's happen.

I will test on unpatched unit, I will dump boot0 before installing the modchip and see if picofly flash this part.
I am pretty sure he don't flash the BOOT0
i can dump boot0 from this lite i have if you want to test this theory
 

scd

Member
Newcomer
Joined
Jun 13, 2021
Messages
9
Trophies
0
Age
19
XP
99
Country
Canada
From what I gather the picofly is 100% real.
I hope the original Russian dev gets the credit for making this.

Zecoxao most likely just dumped the firmware from the rp2040 which Matthew77 discovered on the Russian craigslist type site.
He is now probably rewriting the FW and improving it to take all the credit.
I have checked the site myself and can't find any more of these, otherwise I would have also purchased one myself.

There are many reasons to be excited about this.

iolo57 already designed a pcb for the rp2040 for easy soldering :)
does this PCB replace the HWFLY cables?
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
    Veho @ Veho: Has he had seizures before?