Hacking Raspberry PI Pico Dongle?

[mrdude]

These are cheap as anything, and they have USB host and device capabilities as well as 2mb onboard flash - they can run micro python, Have an onboard boost/buck convertor so can easily be run by a rechargeable lipo battery. They should theoretically be able to be used as a cheap payload pusher for those that want a nice cheap dongle. Has anyone made any code for one yet to do that? I would imagine that being able to write the code in python, it should be fairly easy to do that. I've just ordered 3 as they are only about £3 each (and I want some for other projects). Just wondering if anyone has had a tinker yet?

 

[thesjaakspoiler]

There once was a project called 'fusée (à la) framboise', not to be confused with 'omelette du fromage'.
A French dude created an image that would turn your Raspberry Pi into a payload injector.
But he seems to have disappeared from Github but there are several other github pages with similar projects.
I'm not sure if I can post those links here so please Google yourself.

 

[mrdude]

Pico can run micro python and has usb host/device - and here's a python script that could probably be modded to work.

https://github.com/Qyriad/fusee-launcher/blob/master/fusee-launcher.py

 

[Maou_SET]

I do not have the required skill to modify this script. I would like to request a modification. Maybe tiny USB can be used to push the payload. Unfortunately I have no clue about programming.

 

[oranga]

I started working on this with kaluma js for pico but got stuck because the Hekate payload size is bigger than the SRAM on the pico [github com omijh PicoFusee] {<- replace spaces with .then /}

If anyone knows a way to stream the payload someway so it doesn't fill the ram would help. It's possible since trinket m0 & other Arduino boards had a lot less ram to work with.

 

[mrdude]

I started working on this with kaluma js for pico but got stuck because the Hekate payload size is bigger than the SRAM on the pico [github com omijh PicoFusee] {<- replace spaces with .then /}

If anyone knows a way to stream the payload someway so it doesn't fill the ram would help. It's possible since trinket m0 & other Arduino boards had a lot less ram to work with.

Have you tried sending an alternative payload that's smaller - such as atmosphere or sxos payloads? You also have argon-nx payload which you can use to then launch other payloads such as hekate from sd card.

 

[oranga]

Have you tried sending an alternative payload that's smaller - such as atmosphere or sxos payloads? You also have argon-nx payload which you can use to then launch other payloads such as hekate from sd card.

wow!! I didn't know that was possible ill try it out next
Thanks!!

 

[mrdude]

wow!! I didn't know that was possible ill try it out next
Thanks!!

You can use this:

https://github.com/Guillem96/argon-nx

Rename hekate payload to payload.bin and put it in the root of your sd card inside a folder called argon. When you launch argon-nx it will look for this automatically and if found it will launch hekate.

 

[oranga]

I tried argon-nx payload(65kb file when extracted takes ~200kb), it's around 200kb small but still too big to be read in one blob, ill look for another way.
Pico returns null if it's too big so I'll have to try to stream it

 

[hippy dave]

Here's a payload that just chain loads another payload from SD: https://gbatemp.net/threads/dragonboot-for-atmosphere-generic-rcm-tools.581600/

 

[oranga]

I tried this dragonboot payload & the bin file is still too big, I tried to rebuild the payload injector since the source code was available, it uses the Arduino USB host library which is still incompatible with rp2040. As soon as this library or similar library is available for rp2040 it will be possible to build a uf2 image directly for raspberry pi pico.
The intermezzo bin works since it's really tiny in bytes hope I can find a way or please let me know if there's a smaller payload injector. just to trigger the payload from the sd card is enough no need for gui and stuff

 

[weatMod]

I tried this dragonboot payload & the bin file is still too big, I tried to rebuild the payload injector since the source code was available, it uses the Arduino USB host library which is still incompatible with rp2040. As soon as this library or similar library is available for rp2040 it will be possible to build a uf2 image directly for raspberry pi pico.
The intermezzo bin works since it's really tiny in bytes hope I can find a way or please let me know if there's a smaller payload injector. just to trigger the payload from the sd card is enough no need for gui and stuff

what abut this board
i's smaller and it says it has more flash
https://www.microcenter.com/product/637858/pimoroni-tiny-2040

"While we love the Raspberry Pi Pico we also wanted something smaller and with a bunch more flash on board. Introducing the Tiny 2040 - a teeny tiny powerhouse with the chops to realize truly ambitious projects. Powered and programmable via USB-C, Tiny 2040 comes with 8MB of QSPI (XiP) flash on board so it can handle projects small and large with ease."

not sure if that helps, the larger flash I mean

 

[mrdude]

I tried argon-nx payload(65kb file when extracted takes ~200kb), it's around 200kb small but still too big to be read in one blob, ill look for another way.
Pico returns null if it's too big so I'll have to try to stream it

You could store it on FRAM - and stream it from that.

https://learn.adafruit.com/adafruit-i2c-fram-breakout/wiring-and-test

 

[oranga]

The problem is with the lack of ram unable to load the entire bin in the memory tiny2040 has 8 mb flash storage which is enough in the pico

 

[OrGoN3]

I tried argon-nx payload(65kb file when extracted takes ~200kb), it's around 200kb small but still too big to be read in one blob, ill look for another way.
Pico returns null if it's too big so I'll have to try to stream it

What size does it need to be? SRAM is 256kb.

 

[oranga]

What size does it need to be? SRAM is 256kb.

currently, if you see run my code from [github com omijh PicoFusee] {<- replace spaces with .then /}
I have pushed the compressed payload for dragon boot which too is too big if you remove about half of it and print with console.log with just the include, you will notice the log being printed, more bits and it just returns null. the intermezzo Uint8Array loads just fine.
Ideally, I should have made it in Arduino ide instead of kaluma js but unfortunately, i am not very good with c and the USB host library was lacking for pico so I couldn't just port the trinketm0 to pico.
the problem with js is that I need to read the entire payload to the ram to upload the payload but if it fails it simply returns null.

 

[mrdude]

Couldn't you just store the payload in flash, you check it's size(length), then push it to the switch one byte at a time, when the size equal the number of bytes pushed to the switch you can then execute the payload. That way you just need to store the size of the payload as a variable and the ram only needs to be filled with the byte that's being pushed.

 

[oranga]

Couldn't you just store the payload in flash, you check it's size(length), then push it to the switch one byte at a time, when the size equal the number of bytes pushed to the switch you can then execute the payload. That way you just need to store the size of the payload as a variable and the ram only needs to be filled with the byte that's being pushed.

That's a nice idea I'll try to implement this,
But if you could find an example of the same in javascript it would be helpful either way ill just try it out
Thanks!!

 

[mrdude]

That's a nice idea I'll try to implement this,
But if you could find an example of the same in javascript it would be helpful either way ill just try it out
Thanks!!

I only know how to do it in c++ and c# using stream copy.

Basically it boils down to this:
1: Get the file location - read the file size from the file stored in flash and store that as an int or long int (depending on the size).
2: Make a while loop and start at offset 0 - copy 1 byte from the file and then set the start address from 0 to 1.
3: inside the loop push the byte from the file in flash to the switch at x address.
4: keep looping until the bytes pushed is equal to the file size.

If you want to test you can try just copying a small portion of the payload to a new file in flash and see if it copied the correct bytes.

There's probably loads of info for stream copy equivalent for java on the net - probably you should try looking to see how large files are copied in a stream.

There's a java example here:
https://stackoverflow.com/questions/66706794/copying-binary-data

 

[oranga]

I only know how to do it in c++ and c# using stream copy.

Basically it boils down to this:
1: Get the file location - read the file size from the file stored in flash and store that as an int or long int (depending on the size).
2: Make a while loop and start at offset 0 - copy 1 byte from the file and then set the start address from 0 to 1.
3: inside the loop push the byte from the file in flash to the switch at x address.
4: keep looping until the bytes pushed is equal to the file size.

If you want to test you can try just copying a small portion of the payload to a new file in flash and see if it copied the correct bytes.

There's probably loads of info for stream copy equivalent for java on the net - probably you should try looking to see how large files are copied in a stream.

There's a java example here:
https://stackoverflow.com/questions/66706794/copying-binary-data

The amount of flash storage available is 16kb in total and 253 bytes per block. unfortunately, even the smallest payload is around 65kb[bin compressed]

source: https://kalumajs.org/docs/boards/rp2