Switch OLED teardown V1/V2

Mena

Well-Known Member
Member
Joined
Oct 5, 2020
Messages
128
Trophies
0
Age
27
XP
558
Country
United States
Red will likely be your DAT0. Even without a screen installed you will get a green light. If you get red you have an install issue. I would fix that before continuing
 

Mena

Well-Known Member
Member
Joined
Oct 5, 2020
Messages
128
Trophies
0
Age
27
XP
558
Country
United States
https://github.com/Pheeeeenom/payloadchecker/releases/tag/1.0 Made this really simple app to check the payload that's written to your boot0. This will tell you if the chip that's currently installed is a hwfly with spacecraft v1 or v2 payload. Simply open it press the button and select your boot0

If you're testing multiple chips be sure to connect the USB cable and press E on PuTTy or other equivalent Serial COM application.
 

FR0ZN

Well-Known Member
Member
Joined
Nov 2, 2013
Messages
1,228
Trophies
0
Age
35
XP
2,610
Country
United States
https://github.com/Pheeeeenom/payloadchecker/releases/tag/1.0 Made this really simple app to check the payload that's written to your boot0. This will tell you if the chip that's currently installed is a hwfly with spacecraft v1 or v2 payload. Simply open it press the button and select your boot0

If you're testing multiple chips be sure to connect the USB cable and press E on PuTTy or other equivalent Serial COM application.

You say "written to your boot0", does this mean that the DAT0 connection is actually used only once to write the modified boot0 to the eMMC? Or is a DAT0 connection necessary for every boot?

I always thought that the chip injects a modified BCT at boot over DAT0 and then again I always wondered why it's not written permanently to the eMMC.
 

Mena

Well-Known Member
Member
Joined
Oct 5, 2020
Messages
128
Trophies
0
Age
27
XP
558
Country
United States
You say "written to your boot0", does this mean that the DAT0 connection is actually used only once to write the modified boot0 to the eMMC? Or is a DAT0 connection necessary for every boot?

I always thought that the chip injects a modified BCT at boot over DAT0 and then again I always wondered why it's not written permanently to the eMMC.
You need it for every boot.
 
  • Like
Reactions: FR0ZN

ZachyCatGames

Well-Known Member
Member
Joined
Jun 19, 2018
Messages
3,369
Trophies
1
Location
Hell
XP
3,718
Country
United States
Can you explain what the hack actually does?
My understanding was that it glitches the signature check of BCT.

But it seems that there is more involved, if boot0 is altered as well 🤔
They write a custom bct and bootloader to boot0 then glitch the bootrom's pubkey hash check to make the bootrom think a custom pubkey in the custom bct is correct/valid.

I'd guess they flash it on each boot because the OS attempts to restore stuff at some points, or maybe they reflash the original package1 for compatibility on each boot after glitching, idk.
 

Mulanzo

Member
Newcomer
Joined
Apr 19, 2019
Messages
23
Trophies
0
Age
54
XP
64
Country
Canada
https://github.com/Pheeeeenom/payloadchecker/releases/tag/1.0 Made this really simple app to check the payload that's written to your boot0. This will tell you if the chip that's currently installed is a hwfly with spacecraft v1 or v2 payload. Simply open it press the button and select your boot0

If you're testing multiple chips be sure to connect the USB cable and press E on PuTTy or other equivalent Serial COM application.
I’m interested in trying this out. Once I connect the USB cable do I have to power the chip somehow? Or does the USB port power the chip? Also, do I need an application for the computer to recognize the chip or driver or is your app enough?
 

doom95

Well-Known Member
Member
Joined
Aug 12, 2019
Messages
228
Trophies
0
Age
22
XP
412
Country
Netherlands
No, you dump BOOT0/BOOT1 to SD card using Hekate, then load BOOT0 from your computer into the application.
 

heinrich_frei

Active Member
Newcomer
Joined
Dec 5, 2021
Messages
27
Trophies
0
Age
21
XP
197
Country
Russia
Hello there, maybe someone will help in this topic. After installing modchip SX Lite in switch oled, the fan stopped spinning, joycons do not charge. Switch works fine. Joycons are detected and work without bluetooth. On switch V1-V2, pu chip was responsible for charging the joycons and the fan, but I can't find it on switch oled.
 

Mena

Well-Known Member
Member
Joined
Oct 5, 2020
Messages
128
Trophies
0
Age
27
XP
558
Country
United States
Hello there, maybe someone will help in this topic. After installing modchip SX Lite in switch oled, the fan stopped spinning, joycons do not charge. Switch works fine. Joycons are detected and work without bluetooth. On switch V1-V2, pu chip was responsible for charging the joycons and the fan, but I can't find it on switch oled.
your fan doesn't work and your joycons don't charge? they likely don't detect either. i would do voltage injection on the fan circuit.
 

TheUnknownOne

Well-Known Member
Newcomer
Joined
May 29, 2021
Messages
78
Trophies
0
Age
35
XP
196
Country
United States
your fan doesn't work and your joycons don't charge? they likely don't detect either. i would do voltage injection on the fan circuit.

I ordered an oled specific chip, I'm hearing that we shouldn't use the 3.3v off of bridging the 2 capacitors. Why is this? And if it's true what point should we use?
 

heinrich_frei

Active Member
Newcomer
Joined
Dec 5, 2021
Messages
27
Trophies
0
Age
21
XP
197
Country
Russia
your fan doesn't work and your joycons don't charge? they likely don't detect either. i would do voltage injection on the fan circuit.
Joycons are detected and work as usual, but are not charged. The power supply is 0v in the fan circuit, but there is no short circuit to the ground
 

CompSciOrBust

¯\_(ツ)_/¯
Member
Joined
Sep 9, 2019
Messages
673
Trophies
0
Location
Switch scene
Website
github.com
XP
1,823
Country
Korea, North
They write a custom bct and bootloader to boot0 then glitch the bootrom's pubkey hash check to make the bootrom think a custom pubkey in the custom bct is correct/valid.

I'd guess they flash it on each boot because the OS attempts to restore stuff at some points, or maybe they reflash the original package1 for compatibility on each boot after glitching, idk.
Don't the chips sniff DAT0 to synchronize the timing since Mariko has the random delays?
 

SmallBoss

New Member
Newbie
Joined
Jan 5, 2022
Messages
3
Trophies
0
Age
37
XP
3
Country
Canada
I ordered an oled specific chip, I'm hearing that we shouldn't use the 3.3v off of bridging the 2 capacitors. Why is this? And if it's true what point should we use?
yes, if anyone has an explanation to this , i also want to know. some tap off from the 2 caps for 3.3v, some tap off from the cap near EMMC for 3.3v , whats the difference?
 
General chit-chat
Help Users
  • No one is chatting at the moment.
    Veho @ Veho: Corporation is the new corporation.