Hacking SAMD Fusee Payload Launcher V2

[linuxares]

I hope you are not offended when I say this. I`m not insulting your intelligence, really I am not!

But... You are double-pressing reset while it is plugged in to PC right?

Sorry if its bloody obvious! Just covering all bases.

--------------------- MERGED ---------------------------

@electronrancher

Try this...

I`m assuming your device is compatible with Trinket UF2`s
Go to my Github https://github.com/mattytrog/SAMD-ShaXLauncher/tree/master/UF2 Files
and put your chosen UF2 on there...

I`ve attached a zip called datsandpayloads. In there are some files. Extract to root of SD, drag UF2 over

You can run any payload without converting it.

First one is called payload.bin
2 - payloa2.bin
3 - payloa3.bin
4 - payloa4.bin
...
...

etc

up to 8 payloads.

No conversion necessary, just drag and drop. Rename too as above or it won`t work.
Any good?

I feel like a complete idiot with these boards, and running Línux doesn't seem to help compile the sourcecode if needed. I'm with you about different payloads on the same dongle (ShaXLauncher). That's really something I'm looking for. So with this release you got here. Do I just copy the files over and the dongle updates itself? Then I can use for example ReiNX, Hekate and SXOS on the same device?

 

[mattytrog]

I feel like a complete idiot with these boards, and running Línux doesn't seem to help compile the sourcecode if needed. I'm with you about different payloads on the same dongle (ShaXLauncher). That's really something I'm looking for. So with this release you got here. Do I just copy the files over and the dongle updates itself? Then I can use for example ReiNX, Hekate and SXOS on the same device?

Yes you can.

Just dump the datsandpayloads folder to root of SD, so you have 0001.dat, 0002.dat etc etc

Once you have that, you can put your payloads unconverted on your SD. Name them as I said in OP.

 

[linuxares]

Yes you can.

Just dump the datsandpayloads folder to root of SD, so you have 0001.dat, 0002.dat etc etc

Once you have that, you can put your payloads unconverted on your SD. Name them as I said in OP.

So no need to flash a new firmware or such then? This will update the bootloader to use your launcher instead?

 

[mattytrog]

So no need to flash a new firmware or such then? This will update the bootloader to use your launcher instead?

If you have ShaXlauncher flashed on, then no. No need to reflash.

Unless you want to change the code switches to enable/disable bits and pieces.

 

[linuxares]

If you have ShaXlauncher flashed on, then no. No need to reflash.

Unless you want to change the code switches to enable/disable bits and pieces.

Do I just need to follow your guide in this topic: https://gbatemp.net/threads/interna...ybitsy-m0-express-guide-files-support.508068/
Download the same zip file and extract to my SD Card for the Switch.
then download the UF2 file from here: https://github.com/mattytrog/SAMD-ShaXLauncher/blob/master/UF2 Files/Trinket M0 - Method 1/CURRENT.UF2?raw=true

Then plugin the device to my PC, copy over the UF2 to inbuilt "sd card" and it's of to the races?

EDIT: I'm still waiting for my Devices but I like to be ready

 

[mattytrog]

Do I just need to follow your guide in this topic: https://gbatemp.net/threads/interna...ybitsy-m0-express-guide-files-support.508068/
Download the same zip file and extract to my SD Card for the Switch.
then download the UF2 file from here: https://github.com/mattytrog/SAMD-ShaXLauncher/blob/master/UF2 Files/Trinket M0 - Method 1/CURRENT.UF2?raw=true

Then plugin the device to my PC, copy over the UF2 to inbuilt "sd card" and it's of to the races?

Correct. Drag and drop ShaxLauncher UF2 over
Dump datsandpayloads to SD.
Drag payloads over, rename.

Done.

If you don't have 8 payloads, you could build your own from the Ardudildo IDE. Easy to do! Or I can build you one if you tell me what settings you want. Only take 5 mins

 

[linuxares]

Correct. Drag and drop ShaxLauncher UF2 over
Dump datsandpayloads to SD.
Drag payloads over, rename.

Done.

If you don't have 8 payloads, you could build your own from the Ardudildo IDE. Easy to do! Or I can build you one if you tell me what settings you want. Only take 5 mins

Nah 8 payloads will be MORE than enough. I will probably just stick to ReiNX and SXOS (well I do already have a dongle for that but...) And maybe some other just incase it's a toolbox, dumper etc.

Can you switch between them btw? I never quite understood that.

 

[mattytrog]

Yes.

How it works, is when switch is off, you turn it on, modchip/trinket tries to send payload straight away.

If it finds rcm and send the payload, the payload counter will not increase.

If you are in horizon for example, press reset, you count how many blinks you see before it starts flashing fast. This is the payload that is about to be sent. If it fails (which it will do as you are in horizon at this time) the counter will increase by one. A new sequence will blink. This is the payload that will be sent at the next attempt (either at restart or power off whatever).

This is wrote to flash on the samd so it survives power off and resets etc.

Hope I clear enough

 

[electronrancher]

Yes.

How it works, is when switch is off, you turn it on, modchip/trinket tries to send payload straight away.

If it finds rcm and send the payload, the payload counter will not increase.

If you are in horizon for example, press reset, you count how many blinks you see before it starts flashing fast. This is the payload that is about to be sent. If it fails (which it will do as you are in horizon at this time) the counter will increase by one. A new sequence will blink. This is the payload that will be sent at the next attempt (either at restart or power off whatever).

This is wrote to flash on the samd so it survives power off and resets etc.

Hope I clear enough

Morning, folks!

With the ShaXLauncher firmware I recommend the following RCM sequence.
1) Power down switch
2) Insert RCM jig in right joycon slot
3) Hold Volume +, Tap power. Screen will stay black but it's in RCM mode
4) Insert dongle into USB C port and switch the dongle on
5) Enjoy!

I have found its better to go into RCM first, because otherwise I'm sometimes too slow to start up the switch before the search time expires and it advances to the next payload.

If I want to advance the payload, I power up the dongle without connecting to switch. Upon startup, it first blinks the current payload number and then fast blinks while searching.
If nothing is found, fast blinks stop, the payload is incremented and a new set of slow blinks shows the new payload number before it goes to sleep.
Next time it starts up, it will blink out the new payload number before searching again.

 

[linuxares]

Good morning! Yes that seems a lot easier if it's in RCM mode. Dumb question nr. 376.
Will lets' say Payload 3 always be the default then if you switch it with ShaX? Why I wanna go with ShaX it's because it just seem easier.
Best would be if the payload even could look in a "ShaXLauncher" folder so it's less clutter in the root.

 

[mattytrog]

Good morning! Yes that seems a lot easier if it's in RCM mode. Dumb question nr. 376.
Will lets' say Payload 3 always be the default then if you switch it with ShaX? Why I wanna go with ShaX it's because it just seem easier.
Best would be if the payload even could look in a "ShaXLauncher" folder so it's less clutter in the root.

I know. I'm working on that. As soon as I find the keys to fully decrypt SX gear that its based off, I'll change it.

Just set your payload and forget it.

Or you can gave your payloads set up on a button and not autoincreasing. I have made an unreleased version for itsy that lets you increase and decrease payload and has support for a oled display too. To much time on my hands

 

[electronrancher]

Good morning! Yes that seems a lot easier if it's in RCM mode. Dumb question nr. 376.
Will lets' say Payload 3 always be the default then if you switch it with ShaX? Why I wanna go with ShaX it's because it just seem easier.
Best would be if the payload even could look in a "ShaXLauncher" folder so it's less clutter in the root.

Well it's true that if you only want one payload, such as ReiNX, then it's probably better to flash the dedicated firmware for that payload.

But if you're switching the payload frequently it really is convenient to have it all done offline by the dongle.

As far as looking in a folder, we would need matty to weigh in as I'm not quite sure how the SD card access works

 

[mattytrog]

Well it's true that if you only want one payload, such as ReiNX, then it's probably better to flash the dedicated firmware for that payload.

But if you're switching the payload frequently it really is convenient to have it all done offline by the dongle.

As far as looking in a folder, we would need matty to weigh in as I'm not quite sure how the SD card access works

How it works, is by a modified version of SXGear, duplicated 8 times, all of them looking for different payloads.

Now, the SAMD cannot understand payloads as-is, so they need converting to a c byte array.

There is a set sequence for this...

In the UF2, there are 8 different c byte arrays of SX loader, edited to look for 0001.dat, 0002.dat etc rather than boot.dat

The actual "boot.dat" it is looking for, was a version of SX gear. With the payload file name changed, sha256s in the file updated and the "checksum" for the whole boot.dat changed.

So for example, dongle requests payload 2...

Loaderv2 as fuseebin in UF2 is selected...

This loads 0002.dat, which looks for "payloa2.bin" and launches it.

That's all there is to it. Took a bit of sussing sorting the SXGear as to my knowledge, nobody has done it. With the help of CTCaers converter tool, I sussed the offsets and what they should be.

It is simple. I'm just making it sound harder than it is

 

[mattytrog]

There is an update coming. All ShaXLauncher dats going in their own folder that I`ve cunningly called "0" to tidy things up a bit. So, as long as the "0" folder is there, just forget about dats and other nonsense. Just put your bins straight onto SD.

Check my thread later. Working on it now. @linuxares

 

[electronrancher]

There is an update coming. All ShaXLauncher dats going in their own folder that I`ve cunningly called "0" to tidy things up a bit. So, as long as the "0" folder is there, just forget about dats and other nonsense. Just put your bins straight onto SD.

Check my thread later. Working on it now. @linuxares

Nice, that sounds great! I too have a lot of files in the root dir - it's workable but it would be great to have these bins nicely organized in their own folder.

Looking forward to it!

 

[mattytrog]

Right... Knackered so not built any UF2 yet. TESTING ONLY!!!

https://github.com/mattytrog/SAMD-ShaXLauncher-Test

But just pushed this. You will need Arduino to build it. Trinket only for tonight. Others tomorrow. In Trinket M0 / main folder.

New changeable bits: Copied and pasted from my sketch. Sketch is called "main.ino" for those learning about ArmouredDildo. HAVE A LOOK WHAT THEY DO!

//CHANGEABLE VALUES!!! CHANGE THE VALUES BELOW TO YOUR LIKING
#define AMOUNT_OF_PAYLOADS 8 //set number of payloads required. 1 - 8.
#define AUTO_INCREASE_PAYLOAD_on 0 //Automatic increase payload when send fails. 1 = on, 0 = off
#define AUTO_SEND_ON_PAYLOAD_INCREASE_PIN 1 // Automatic send when payload pin is activated. 1 = on, 0 = off
#define FLASH_BEFORE_SEND_on 0 // flash payload number before attempting to send. 1 = on, 0 = off
#define FLASH_AFTER_SEND_on 1 // flash payload number after send/attempted. Will show same payload number(if autoincrease is off, or next payload number) 1 = on, 0 = off
#define LOOK_FOR_TEGRA_SECONDS 5 // how long to look for Tegra for & flash LED in search phase. Time in seconds
#define LOOK_FOR_TEGRA_LED_SPEED 300 // how fast to blink when searching.

Switches changed. More customisable.

There is a zip in this repo. In it, there is a "0" folder. Place on SD.

No need to convert payloads... Just place on SD root and name as follows...

payload.bin
payloa2.bin
payloa3.bin
payloa4.bin
...
...
etc

Nighty night. Will do rest tomorrow

PS don`t set Tegra_LED_Speed under 100 or it won`t find APX (RCM) mode fast enough.
Oh yeah... To manually increase payload, short pin 1 on trinket to GND as usual.

 

[electronrancher]

Holy crap it's every option I've ever wanted! Must.. Build...

 

[mattytrog]

Just try it. Probably be bugs. Though shouldn't be.

Tested with sxos, Hekate4 and Rajnx

There are other options I forgot to document.

Namely how fast the payload blinks. Time in seconds. Yes I could have done it in milliseconds. In fact it is in milliseconds in code i just converted it to seconds so everyone knew where they are with it. Think it's set on 0.2 seconds on, 0.4 seconds off or something.

White LED indicates a write to flash btw.

 

[electronrancher]

Ok, ok - running a bit behind on the build and testing. As you may have noticed, I have un-crapified my product pictures at the request of Dolly - thank you, sir! As well as made long-overdue updates to the firmwares available on hackaday.io.

@bundat, I have posted your splicer tool to the hackaday.io project page here. Hope it's cool, please let me know if you'd rather not have it up there.

 

[Bakuryu42]

So I am getting mine tomorrow, right now all I want to do is the efuseless update. Do I need any of these tools that are listed here or on the hackaday.io site to accomplish this? In the future if I want to do cfw payloads will I just be able to drag them onto the dongle like it says in the description, if so what are the tool here meant for?

 

[electronrancher]

So I am getting mine tomorrow, right now all I want to do is the efuseless update. Do I need any of these tools that are listed here or on the hackaday.io site to accomplish this? In the future if I want to do cfw payloads will I just be able to drag them onto the dongle like it says in the description, if so what are the tool here meant for?

No, you do not need any of the tools listed here unless you want to modify the actual payload.

And yes, if you want to update the dongle to send a new payload all you need is one of the UF2 files. Connect the dongle to PC via USB and double click the reset button with a pen. A drive will pop up, called FIRMWARE. Just drop the UF2 file onto that drive and you're all set!

As far as the tools go:
Mattytrog's ShaXLoader is a multi-loader firmware that can launch one of many payloads that are stored on the switch SD card.
Bundat's UF2 Splicer is a way to make a new UF2 firmware by dropping a .bin payload onto his batch file. For example, if hekate 4.1 just came out and you want to flash your dongle with it, you would download the hekate 4.1 bin file and drop it onto the UF2 splicer batch file. It will make a UF2 firmware that contains hekate 4.1, and you can now drop the UF2 onto the dongle's FIRMWARE drive to update the payload. Previously, a new UF2 file had to be made using arduino and is a little more complicated.

 

[electronrancher]

Here is the link to the hackaday.io page where you can download all the files. I'll also update the first page post

https://hackaday.io/project/160187-samd-v2-fusee-payload-injector

 

[electronrancher]

Thursday's and Friday's orders have all gone out. Ran out of blue LEDs and digikey shipment came a day late on the reup. All good now, a nice pile of completed boards here waiting for their cases to print.