Hacking Hardware Picofly - a HWFLY switch modchip

nerirififi

Well-Known Member
Member
Joined
Nov 18, 2015
Messages
160
Trophies
0
Age
43
XP
607
Country
France
  • Like
Reactions: binkinator

Piorjade

Well-Known Member
Member
Joined
Nov 8, 2015
Messages
142
Trophies
0
XP
407
Country
Gambia, The
To the guys with electrical knowledge: Do you think that soldering the MOSFET not directly on the capacitors but for example via 0.1mm - 0.25mm wires with let's say 1-2cm length will introduce significant delays (important for the voltage glitch)? I don't have a HWFLY CPU cable but I have loose MOSFETs, of course they're tiny as hell but I think it's easier to later disconnect them from the Switch when using wires if I choose to.
Post automatically merged:

By the way, as I said I already have a prototype for the eMMC sniffing part (untested) and the next goal is the eMMC writing/reading part (to write the BCTs and payload to the eMMC). Turns out that I've finally found suitable Pico code for it:
https://github.com/carlk3/no-OS-Fat...sdio/FatFs_SPI/sd_driver/SDIO/rp2040_sdio.pio

It's for the SD card SDIO mode, which is in itself pretty much identical to the eMMC native mode. I'll try to modify it so that it only needs one DAT line (the code above uses 4 DAT lines on the SD card) and then I'll try to port the command flow of HWFLY-NX over.

I have an SD card breakout board hooked up and I hope that the SDIO mode supports the same command set of eMMCs, otherwise I'll have to hook the test setup up to my Switch but then I'll only test the read commands, I don't want to break my Switch lmao.
 
Last edited by Piorjade,

Tafty

Well-Known Member
Member
Joined
Sep 23, 2016
Messages
116
Trophies
0
Age
36
XP
923
Country
To the guys with electrical knowledge: Do you think that soldering the MOSFET not directly on the capacitors but for example via 0.1mm - 0.25mm wires with let's say 1-2cm length will introduce significant delays (important for the voltage glitch)? I don't have a HWFLY CPU cable but I have loose MOSFETs, of course they're tiny as hell but I think it's easier to later disconnect them from the Switch when using wires if I choose to.
Post automatically merged:

By the way, as I said I already have a prototype for the eMMC sniffing part (untested) and the next goal is the eMMC writing/reading part (to write the BCTs and payload to the eMMC). Turns out that I've finally found suitable Pico code for it:
https://github.com/carlk3/no-OS-Fat...sdio/FatFs_SPI/sd_driver/SDIO/rp2040_sdio.pio

It's for the SD card SDIO mode, which is in itself pretty much identical to the eMMC native mode. I'll try to modify it so that it only needs one DAT line (the code above uses 4 DAT lines on the SD card) and then I'll try to port the command flow of HWFLY-NX over.

I have an SD card breakout board hooked up and I hope that the SDIO mode supports the same command set of eMMCs, otherwise I'll have to hook the test setup up to my Switch but then I'll only test the read commands, I don't want to break my Switch lmao.
i think this should be fine, the mosfets on the flex are about 1cm away from the point anyway....the only way to really tell is to test
 
  • Like
Reactions: binkinator

Raugo

Well-Known Member
Member
Joined
Nov 22, 2014
Messages
630
Trophies
0
XP
2,451
Country
Spain
@Tafty The picture of the switch lite with the rpi2040 installed is yours? If that is the case, Did you tried to dump de boot0 with hekate to see if the chip do something wrong there to not launch HOS?

Would be interesting to see the differences between boot0 of the same console with hwfly and picofile
 
  • Like
Reactions: Tafty

Piorjade

Well-Known Member
Member
Joined
Nov 8, 2015
Messages
142
Trophies
0
XP
407
Country
Gambia, The
you can boot in official mode, it s strange no one test to apply the patch on Boot0 that hwfly of sx core do the Emmc.
Maybe it s the fix for boot in CFW mode.
We can't because the firmware overrides it on every boot, well, if the firmware behaves like HWFLY, which it probably does.

HWFLY checks on every boot if the BCTs are different, if yes, it overrides them.
 

Raugo

Well-Known Member
Member
Joined
Nov 22, 2014
Messages
630
Trophies
0
XP
2,451
Country
Spain
We can't because the firmware overrides it on every boot, well, if the firmware behaves like HWFLY, which it probably does.

HWFLY checks on every boot if the BCTs are different, if yes, it overrides them.

It's possible to do it in hekate, would be a temporary fix but at least if works we wild now what is the problem.
 

nerirififi

Well-Known Member
Member
Joined
Nov 18, 2015
Messages
160
Trophies
0
Age
43
XP
607
Country
France
You can write BCTs and the payload in hekate?
it s not payload, it s a patch with some data on partition BOOT0
So you just need to dump the BOOT0, patch in the computer, and flash with hekate.
Then test the boot, and see what's happen.

I will test on unpatched unit, I will dump boot0 before installing the modchip and see if picofly flash this part.
I am pretty sure he don't flash the BOOT0
 

Tafty

Well-Known Member
Member
Joined
Sep 23, 2016
Messages
116
Trophies
0
Age
36
XP
923
Country
it s not payload, it s a patch with some data on partition BOOT0
So you just need to dump the BOOT0, patch in the computer, and flash with hekate.
Then test the boot, and see what's happen.

I will test on unpatched unit, I will dump boot0 before installing the modchip and see if picofly flash this part.
I am pretty sure he don't flash the BOOT0
i can dump boot0 from this lite i have if you want to test this theory
 

scd

Member
Newcomer
Joined
Jun 13, 2021
Messages
9
Trophies
0
Age
19
XP
99
Country
Canada
From what I gather the picofly is 100% real.
I hope the original Russian dev gets the credit for making this.

Zecoxao most likely just dumped the firmware from the rp2040 which Matthew77 discovered on the Russian craigslist type site.
He is now probably rewriting the FW and improving it to take all the credit.
I have checked the site myself and can't find any more of these, otherwise I would have also purchased one myself.

There are many reasons to be excited about this.

iolo57 already designed a pcb for the rp2040 for easy soldering :)
does this PCB replace the HWFLY cables?
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • BigOnYa @ BigOnYa:
    They help you delete some incriminating videos?
  • K3Nv2 @ K3Nv2:
    No you asked for proof that your wife was finally leaving
    +1
  • BigOnYa @ BigOnYa:
    Nuh I had her chipped, I always know where she is.
  • K3Nv2 @ K3Nv2:
    I found where it was
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    If I could halucinAte this is what I imagine it would look like?
  • K3Nv2 @ K3Nv2:
    Featuring Taylor swift
    +1
  • BakerMan @ BakerMan:
    guys, pubg should've never blown up
  • BigOnYa @ BigOnYa:
    Wut do you mean? Pubg is alright, I play it with a few buddies online.
  • BakerMan @ BakerMan:
    the game itself is ok, but it's influence is the problem
  • K3Nv2 @ K3Nv2:
    Call of duty is a good Fortnite skin
  • BakerMan @ BakerMan:
    call of duty and fortnite, ex-fucking-actly
  • BakerMan @ BakerMan:
    without pubg popping off, fortnite wouldn't add battle royale, and call of duty wouldn't go even shittier than it did before because of blackout, warzone and dmz
  • Psionic Roshambo @ Psionic Roshambo:
    Make a porn based spoof of it, Pube G
  • BigOnYa @ BigOnYa:
    Just play My Pony online. Its better than Fortnight or COD.
  • Psionic Roshambo @ Psionic Roshambo:
    FPS porn games sound fun lol
    +1
  • K3Nv2 @ K3Nv2:
    Call of duty got close with that by using Nikkie Minaj
  • BigOnYa @ BigOnYa:
    -Bonus- Faceshot
  • K3Nv2 @ K3Nv2:
    5 killstreak call in the gangbang
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    Still enjoying Bad Ass Babes lol
  • Psionic Roshambo @ Psionic Roshambo:
    Legit a super solid beat em up
  • Psionic Roshambo @ Psionic Roshambo:
    The special moves are hilarious
  • BigOnYa @ BigOnYa:
    Introducing the most anticipated 1p v 4p game of the year - COCC (Call of couch casting)
  • RetroNerdGamer @ RetroNerdGamer:
    isnt that just gal gun
    RetroNerdGamer @ RetroNerdGamer: isnt that just gal gun