Hacking [QUESTION] Are there any resources on the functionality of SX / HWFLY?

[EnigmaExodus]

The process of creating a custom FPGA firmware is supposedly easy (I haven't done it myself) but anyone who is capable of doing it isn't willing to open themselves to legal trouble by sharing it. You can't just dump the FPGA firmware from the SX Core because it is protected.

Publishing FPGA bitstream source and PCB schematics is probably ok if it does not include copyrighted Nintendo content (because piracy). Probably best to publish anonymously so big boys kind of give up the prospect of retaliation. Same thing kind of happened with the 360 and RGH.

More likely reason some are hush-hush is because of the profit motive of HWFLY and friends.

 

[kirbstomp]

Publishing FPGA bitstream source and PCB schematics is probably ok if it does not include copyrighted Nintendo content (because piracy). Probably best to publish anonymously so big boys kind of give up the prospect of retaliation. Same thing kind of happened with the 360 and RGH.

More likely reason some are hush-hush is because of the profit motive of HWFLY and friends.

I definitely could be wrong, but I think protected=encrypted/obscured, not in the legal sense per se.

Please correct me if I am wrong though

 

[EnigmaExodus]

I definitely could be wrong, but I think protected=encrypted/obscured, not in the legal sense per se.

Please correct me if I am wrong though

Of course. Someone either needs to reverse-engineer the bitstream used by the FPGA to a state where it can be used without the encryption being at issue or to derive its functionality and create a new implementation from scratch.

 

[randy_w]

Since we are talking about fpga, can anyone explain why those chips with QFN packaged fpga are flashable, but BGA packaged aren't? Aren't spacecraft-nx just updating the firmware on the gd32 microcontroller?

 

[Piorjade]

Since we are talking about fpga, can anyone explain why those chips with QFN packaged fpga are flashable, but BGA packaged aren't? Aren't spacecraft-nx just updating the firmware on the gd32 microcontroller?

I'm kind of wondering about that aswell

 

[Mena]

@randy_w @Piorjade

Because of the GD32. The chips that use the QFN based FPGA have no protection on the MCU. You can overwrite it with anything you want. Obviously, to get it working with the FPGA bitstream they use you'd need to read the firmware first then RE it enough to understand how it interacts with the MCU as they use a modified version of spacecraft. The ones without the QFN based FPGA that aren't "real" SX chips use readout protection level 2. RDP2 on the MCU/GD32 is exceptionally secure. It's impossible to just read the MCU's contents without invasive modding. RDP2 makes it so you cannot overwrite the contents, read it out by normal means or even via the SWD (serial wire debug) interface. Even if you set the BOOT0 pin high (putting 3v3 into it) it still disables the debugging interface. The only way to read out the contents of a GD32 with RDP2 on it is to glitch QSPI address lines on the MCU during startup. Not exactly a trivial thing to do.

Even if you were to do that, you'd need to RE that version of spacecraft as well, as it differs from the one on the "flashable" QFN-based FPGA modchips.

Anyways, that's why.

 

[parjolik]

Can my chip be flashed? What kind of chip version is this? And how to flash this chip

 

[evil_santa]

Yes the FPGA is a qfn chip.
why do you want to flash it? for an OLED switch?

Flash this first then
https://github.com/Spacecraft-NX/firmware
This
https://github.com/hwfly-nx/