Hacking Hardware Picofly - a HWFLY switch modchip

H3xxCat

Member
Newcomer
Joined
May 19, 2023
Messages
18
Trophies
0
XP
57
Country
United States
This is definitely one of the hardest welds I've tried to make. and I don't have a 0.2mm cable to make it, only 0.1mm and this one is 30awg.
what is the problem of doing only 1 mosfet?
You can use a single mosfet, 2 makes makes it a bit more stable, based on discussions in this thread. You may also get better luck if you tried without insulation and have the copper strands twisted for more rigidity.
 

voidz9

Member
Newcomer
Joined
May 6, 2023
Messages
20
Trophies
0
XP
75
Country
Macedonia, The Former Yugoslav Republic of
i see,but i dont have the skills for use that picotool,i need can update then via usb BEFORE, install,and thats right,for use tolbox the chip must be installed,thats the problem,i need update then before install in the switch,just like my old chips,the chip in the picture works perfect,never have any single problem,they conect to pc perfect without problems,but suplier say factory is no make then anymore,now they fabric the hwflyrp2040 instead
1. The hwfly rp2040 is officially for sale on hwfly aliexpress storefront now

2. the chip comes with 2.61 firmware. Its not relatively old firmware, why bother updating it first?
 
  • Like
Reactions: EAGLE-1

ThiagoDaruma

Well-Known Member
Newcomer
Joined
May 12, 2020
Messages
45
Trophies
0
Age
33
XP
122
Country
Brazil
You can use a single mosfet, 2 makes makes it a bit more stable, based on discussions in this thread. You may also get better luck if you tried without insulation and have the copper strands twisted for more rigidity.
I think now I've had a success.
Imagem do WhatsApp de 2023-05-20 à(s) 01.12.22.jpg
 

FreeLander

Well-Known Member
Member
Joined
Apr 6, 2023
Messages
350
Trophies
0
Age
35
XP
467
Country
United States
You are welcome.
As for capacitor I would suggest,
- Weller RTP 001 solder tip (you can get a custom pen for these tips if you don't want to buy the whole station, let me know if you need the link) or
- JBC C115118 tip (you can pair these with alot of chinese stations)
You can cheap out on station but the tip has to be genuine
- Good flux (it makes a difference)
- Sn63/Pb37 or preferably Sn62Pb36Ag2 solder
Soldering iron to 370-400, tin the mosfet wire then add flux to cap and add some solder to the tip of the iron and just slightly touch the side of the cap and boom you added some low melt solder to cap. Now pres the tinned wire to cap and again just a slight touch (2sec max) and there you have it.
I guarantee that you will nail it :D
Now don't get me wrong, there are people here that can solder this with their left foot holding a fork heated over stove but I'm not one of those guys so having the right tools (in this case read expensive) puts you closer to the pro league
Thank you for the time you spend writing this. A good way for me to start is changing the tip like you recommended.
Regarding MOSFETs, Would you guys recommend I solder directly into the cap or remove it entirely and solder directly to the pad?
 
  • Like
Reactions: QuiTim

EAGLE-1

Well-Known Member
Newcomer
Joined
May 30, 2020
Messages
75
Trophies
0
Age
47
XP
172
Country
Costa Rica
1. The hwfly rp2040 is officially for sale on hwfly aliexpress storefront now

2. the chip comes with 2.61 firmware. Its not relatively old firmware, why bother updating it first?
here in many post say very clear about update to the most newer firmware,i do that in the old hwfly before every install
 

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,066
Trophies
0
XP
1,387
Country
Gaza Strip
1. The hwfly rp2040 is officially for sale on hwfly aliexpress storefront now

2. the chip comes with 2.61 firmware. Its not relatively old firmware, why bother updating it first?
Can you give a link?
As far as i know, hwfly official store is gone since the accident of the totk leak
 

FreeLander

Well-Known Member
Member
Joined
Apr 6, 2023
Messages
350
Trophies
0
Age
35
XP
467
Country
United States
I think I managed to make the mosfets, is there any way to test with the multimeter? I did the diode test, with the mosfet without the wires and with the wires, the red wire, continuity with the green one? is correct ?

View attachment 372567View attachment 372568
That's a good question that I couldn't find an answer for. When doing a flex cable, I get a 0.5-0.9v on the third wire, but when using mosfet, nothing. Zero. How can I check my MOSFET work before booting it?
 
  • Like
Reactions: ThiagoDaruma

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,066
Trophies
0
XP
1,387
Country
Gaza Strip
@rehius
I've read the `glitch_try_offset` function.
I might be wrong understanding it. But shouldn't be the variable `edges` added to the `offset` parameter?

```
int gres = do_glitch(offset, *width, 300, 6);
```
should be
```
int gres = do_glitch(offset + edges, *width, 300, 6);
```

I have read the code and its beautiful. Thanks again for sharing.
 

rehius

Well-Known Member
Member
Joined
Feb 6, 2023
Messages
377
Trophies
1
Age
34
XP
1,790
Country
Canada
I might be wrong understanding it. But shouldn't be the variable `edges` added to the `offset` parameter?
No, the glitch_try_offset is a single attempt for the specific offset. There we try that offset several times.
The second glitch parameter - width - should be on the very edge of "timeout" (when the glitch is too strong, CPU halts) and "failure" (when the glitch is too weak, and CPU had no reaction).
There we are varying width back and forth to swing around that point. Number of "edges" is amount of times we pass through the optimal glitch positions, as I found, that is a good point of reference for amounts of tries for the specific offset.

Since each offset should be tried many many times, there are tons of tricks for attempt time reduction (to speed up the whole process)
 
  • Like
Reactions: abal1000x

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,066
Trophies
0
XP
1,387
Country
Gaza Strip
No, the glitch_try_offset is a single attempt for the specific offset. There we try that offset several times.
The second glitch parameter - width - should be on the very edge of "timeout" (when the glitch is too strong, CPU halts) and "failure" (when the glitch is too weak, and CPU had no reaction).
There we are varying width back and forth to swing around that point. Number of "edges" is amount of times we pass through the optimal glitch positions, as I found, that is a good point of reference for amounts of tries for the specific offset.

Since each offset should be tried many many times, there are tons of tricks for attempt time reduction (to speed up the whole process)
Thanks for the reply. Now I understand.

Because i read from the `prepare_random_array()` that the offset are generated from 6200-6900 with 10 step (6200, 6210, 6220...)

I thought maybe when the `step` (to find the proper `width`) already precised (step = 1) then the code will make a fine step on the offset (6200, 6201, 6203). I also guess, if the offset change, maybe the width should also need to be 'searched' again. :lol:
 

Dee87

Well-Known Member
Member
Joined
Mar 19, 2023
Messages
1,139
Trophies
1
XP
1,578
Country
Germany
It is thin enough to fit under the shield without any bulge. The green adapter comes pre-balled on both sides so there's no reballing needed.
The installation process is:
- Detach emmc (add flux around it, then heat 160c 1 minute, 260c 1 minute, 360c 1 minute, then 400c for a few seconds until it detaches if it hasn't already)
- Clean emmc pads on the motherboard with solder wick
- Clean emmc with solder wick
- Add flux to the emmc pads on the motherboard and align green adapter on top. heat 160c 1 minute, 260c 1 minute, 360c 1 minute. Then it should be nicely attached.
- add flux on emmc pads on top of the green adapter and align emmc on top. heat 160c 1 minute, 260c 1 minute, 360c 1 minute. Then it should be nicely attached.
- solder dat0, clk, cmd wires on the nice, large solder pads of the green adapter.
Post automatically merged:

The Picofly RP2040 board in hwfly-style are available from the "main" hwfly sales store on aliexpress now. https://www.aliexpress.com/item/1005005591152539.html
okay well that good then.

i Know the process but thank u :-)

yeah i still will always prefer the perm dat = without the green adapter just cause of the delivery time B-)
 
  • Like
Reactions: Danook28

trixter

New Member
Newbie
Joined
Jun 25, 2022
Messages
4
Trophies
0
Age
24
Location
Frankfurt
XP
70
Country
Germany
Two long debug pulses. CLK is connected properly. What could be a problem? How do i check if mosfets connected?
P.S. Yeah, i know, it's messy. But everything connected properly.
 

Attachments

  • photo1684571054 (3).jpeg
    photo1684571054 (3).jpeg
    236.7 KB · Views: 35
  • photo1684571054 (4).jpeg
    photo1684571054 (4).jpeg
    195.4 KB · Views: 32
  • photo1684571054 (6).jpeg
    photo1684571054 (6).jpeg
    193.1 KB · Views: 30
  • photo1684571054.jpeg
    photo1684571054.jpeg
    213.4 KB · Views: 28
  • Like
Reactions: Danook28

Dee87

Well-Known Member
Member
Joined
Mar 19, 2023
Messages
1,139
Trophies
1
XP
1,578
Country
Germany
Two long debug pulses. CLK is connected properly. What could be a problem? How do i check if mosfets connected?
P.S. Yeah, i know, it's messy. But everything connected properly.
first of all clean ur flux after soldering

second use shorter wires for ur mosfet , what wire diameter is that ? looks like 0.1mm if thats the case u need atleast 0.2mm wire

also u can use 0.1mm wire for 3,3v specially if u use 0.1mm for ground then also use the same wire thinkess for 3v
 
Last edited by Dee87,
  • Like
Reactions: QuiTim and trixter

Nephiel

Artificer
Member
Joined
Nov 3, 2002
Messages
279
Trophies
2
XP
850
Country
Hi, is this dat0 position fine? The diode value is .62v
This doesn't really answer your question, but those "OATO" adapters have been mentioned in this thread before. The point of contact with the ball under the IC seems to be too wide and/or poorly cut, potentially causing shorts with the ones next to it.

The so-called "four anchor" adapters, or even the "corner style" adapters, are generally preferred. I guess that (and the obvious misspell of "DAT0") is why the "OATO" is so much cheaper than the others.

FWIW, I have the "OATO" adapters on hand, along with everything else to perform this mod right now, and yet I'm waiting for a shipment of the "four anchor" adapters before attempting it. Just my 2¢.
 

QuiTim

Well-Known Member
Member
Joined
Mar 30, 2023
Messages
756
Trophies
0
XP
1,170
Country
Albania
I think now I've had a success.
View attachment 372572
Looks much better now.
You could also do just one mosfet in the future, and if it does not work then you add edhe second one.
So 1 mosfet but both capacitors.
Post automatically merged:

Thank you for the time you spend writing this. A good way for me to start is changing the tip like you recommended.
Regarding MOSFETs, Would you guys recommend I solder directly into the cap or remove it entirely and solder directly to the pad?
This has been mentioned earlier if I remember correctly and it was recommended to keep the cap if possible since it's better for the apu in the long run especially if you play high resource demanding games
Post automatically merged:

I'm getting a yellow color when flashing rp2040. Even after bridging. Is that new?
I got green on 2.7. I dont know if this changed in 2.72. There should be a changelog on page 78
*Edit: lightninjay already anwered this, yellow is OK now in the new firmware.
Hi, is this dat0 position fine? The diode value is .62v

View attachment 372589View attachment 372588View attachment 372587
I second @Nephiel opinion. The reading is correct but those adapters are not good.
I had an Oled where I spent 3 days trying to figure out what was happening and turns out dat0 was giving some short under emmc.
Maybe it's the photo but I can already see some deformation on the upper left side of the adapter.
 
Last edited by QuiTim,

Makc16384

Member
Newcomer
Joined
Apr 19, 2023
Messages
24
Trophies
0
Age
39
XP
156
Country
Germany
Good afternoon I ran into an interesting problem.
Switch OLED (FW 2.67). DAT0 adapter, the contact is well soldered. Diode test value 0.800v. Same value when pin is already soldered to rp2040 Zero (wire 0.1mm).
Approximately once a week at the next reboot of the switch, I get the yellow color of the LED and it loads only in OFW.
I check the contact to the ground in the DAT0 diode mode and I already get about 1.500v. Strange.
I just unplug the DAT0 wire from rp2040 and immediately solder it back. Immediately a diode test shows the correct 0.800v. Everything works fine again until the next similar event.

I tried to change the wire from the adapter to rp2040 to a thinner one, I also changed the resistor (the correct one is 47Ohm), but the problem repeats regularly.

Some kind of mysticism, any ideas why this happens and how I could avoid this in the future? Can I replace the rp2040 board?
 

QuiTim

Well-Known Member
Member
Joined
Mar 30, 2023
Messages
756
Trophies
0
XP
1,170
Country
Albania
Good afternoon I ran into an interesting problem.
Switch OLED (FW 2.67). DAT0 adapter, the contact is well soldered. Diode test value 0.800v. Same value when pin is already soldered to rp2040 Zero (wire 0.1mm).
Approximately once a week at the next reboot of the switch, I get the yellow color of the LED and it loads only in OFW.
I check the contact to the ground in the DAT0 diode mode and I already get about 1.500v. Strange.
I just unplug the DAT0 wire from rp2040 and immediately solder it back. Immediately a diode test shows the correct 0.800v. Everything works fine again until the next similar event.

I tried to change the wire from the adapter to rp2040 to a thinner one, I also changed the resistor (the correct one is 47Ohm), but the problem repeats regularly.

Some kind of mysticism, any ideas why this happens and how I could avoid this in the future? Can I replace the rp2040 board?
I don't know it this a variation of the same issue but a similar one was fixed with the new firmware so maybe you should try to update to 2.72 first.
 
Last edited by QuiTim,
  • Like
Reactions: Makc16384

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • BakerMan
    I rather enjoy a life of taking it easy. I haven't reached that life yet though.
    BakerMan @ BakerMan: @K3Nv2