Hacking Hardware Picofly - a HWFLY switch modchip

rehius

Well-Known Member
Member
Joined
Feb 6, 2023
Messages
377
Trophies
1
Age
34
XP
1,790
Country
Canada
Any docs or sources on how to build the payload? I'm referring to the one that's only present in header file payload.h as an array. I'd like to tweak the logo shown on boot when no SD card is inserted, maybe the Vol+ button behavior as well.
For fun, not for profit.

All I've been able to gather is that it's likely derived from sdloader in some way.
(edit: this thread is close but it applies to hwfly rather than Picofly)
Unfortunately its author has decided to keep sources private. I am reversing this loader in my free time. If you have suggestions for the picture, please post them here, currently I'm planning to replace the logo with this one. It takes much effort to properly fit the picture manually by patching the binary, so I'm postponing it somewhere in the future
Post automatically merged:

edit: this thread is close but it applies to hwfly rather than Picofly
oh, yes, it's the same author
 

Attachments

  • _picofl4.1_8bit.png
    _picofl4.1_8bit.png
    2.5 KB · Views: 36

FlowerFire

Well-Known Member
Newcomer
Joined
Mar 10, 2023
Messages
45
Trophies
0
XP
129
Country
United Kingdom
Is it possible that the i2c undervoltage hack actually made the glitch much worse for me?
I've got this v2 that can actually glitch just fine, but sometimes it takes up to 15 seconds to do the job. After soldering in SDA and SCL, it reached about a minute of time.
Am I the only one?
 

rehius

Well-Known Member
Member
Joined
Feb 6, 2023
Messages
377
Trophies
1
Age
34
XP
1,790
Country
Canada
Is it possible that the i2c undervoltage hack actually made the glitch much worse for me?
I've got this v2 that can actually glitch just fine, but sometimes it takes up to 15 seconds to do the job. After soldering in SDA and SCL, it reached about a minute of time.
Am I the only one?
yes, undervoltage makes glitching time worse. that is why it's said to use only when you really need it (weak mosfet, etc)
 

Adran_Marit

Walküre's Hacker
Member
Joined
Oct 3, 2015
Messages
3,781
Trophies
1
Location
42*South
XP
4,563
Country
Australia
In this case bsod happened because of pcb bending. I think that emmc is to far away for it to cause problem all the way to RAM during reflow but APU might be possible. Still, if you are applying heat on top of emmc and manage to break a connection on APU in the process that Emmc chip is probably dead already :D
All good XD dunno how people are bending the boards but not my issue XD
 
  • Like
Reactions: QuiTim

Takezo-San

Well-Known Member
Member
Joined
May 3, 2023
Messages
261
Trophies
0
Age
39
XP
349
Country
Seychelles
@Takezo-San Worth a shot reballiing the RAM. I don't think the max chips cause BLOD, they're more charging or powering-on issues.

Have we seen pics of you install?
Tried the ram reball, still nothing. Heres some pics i salvaged. The mosfet install looks more messier than it is because i literally doused all connections so its hard to see but check for continuity before masking. check it out. Video is the initial install boot + light pattern. Motherboard pic is with mosfet and pico removed + after reballing attempts. Other two are mosfets. At this point I will wait to invest in a thermal cam + voltage injection tool to find out where exactly the short/problem is. Wether its a cap i missed or a chip thats gone. My uneducated suspicion is the APU has done a Houdini.
 

Attachments

  • 20230521_025750_Trim.mp4
    5.3 MB
  • 20230522_153239.jpg
    20230522_153239.jpg
    1.9 MB · Views: 35
  • 20230520_221440.jpg
    20230520_221440.jpg
    981.5 KB · Views: 29
  • 20230520_221432.jpg
    20230520_221432.jpg
    1.3 MB · Views: 34

Nephiel

Artificer
Member
Joined
Nov 3, 2002
Messages
279
Trophies
2
XP
849
Country
Unfortunately its author has decided to keep sources private. I am reversing this loader in my free time.
Also found this repo using an alternative basic sdloader. It does have sources that could be useful, but I've been unable to find their origin.

I'd like to look further into this, I just don't have the time, either. :(
 

LogicalMadness

Well-Known Member
Member
Joined
Nov 3, 2014
Messages
287
Trophies
0
Age
41
XP
690
Country
United States
The only ways I think PFly installs could be creating BSODs (oops, think my PS4 nightmares took over and I've been typing BLOD XD):

V1\2\Lite - Sloppy MOSFET\flex install, stray solder balls under APU\RAM, knocking parts you don't mean\know, using a high-heat iron for too long on the APU, shorting a weird way and somehow frying the APU (idk, I've abused a lot of Switch boards in my time and have recovered most of them), (V1\2 specific) emmc connector\socket jacked up. No BGA work is needed, so the APU balls should never become questionable, IPA-toothbrush cleaning (try to use a 'blower' on it too) will clear stray balls.

OLEDs are all the same PLUS more risk to emmc through reballing\crap-adaptor, and more risk to APU because CLK isn't for the faint of heart AND is close to the APU. My last BSOD actually WAS an OLED-PFly install, but I've been neglecting posting about it because it's such a 'one off'. That OLED went through hell because I kept chasing my tail on little dumb things and continually 'stepping on my own d'k'. Always 1 step fwd, 2 steps back. It all started with using a crap dat0 adapter though, be warned. So, after messing up and fixing nearly everything, seeing a BSOD meant it could have been ANYTHING (funny though, with how much 'no boot' I was getting, I was EXCITED to see anything on screen, even BSOD). I removed the PZero (being sure hanging wires weren't shorting), did my best emmc reball I'd done yet and it was still BSOD. Grabbed a new PZero to use for troubleshooting, got cyan and thought 'guess I should try a reflow', no change though. Swapped the stupid flex cable (that I'm never buying again, LET HWFLY DIE!) with MOSFETs and I was in Hekate! I restored a backup I had been able to make (seriously? There's MORE to this story? Yikes!) and VOILA! No more BSOD!

TLDR, I fixed a BSOD by successfully restoring a backup in Hekate. Maybe the emmc somehow gets corrupted during installs? And, yes, there's actually plenty more to that story, like how mine was actually a 256gb emmc upgrade XD
Post automatically merged:

If you have suggestions for the picture, please post them here

I think it was @deeps that was hoping we could add 'press vol+\- for OFW' to the no sd screen. May I request this to be added?
Post automatically merged:

Tried the ram reball, still nothing. Heres some pics i salvaged. The mosfet install looks more messier than it is because i literally doused all connections so its hard to see but check for continuity before masking. check it out. Video is the initial install boot + light pattern. Motherboard pic is with mosfet and pico removed + after reballing attempts. Other two are mosfets. At this point I will wait to invest in a thermal cam + voltage injection tool to find out where exactly the short/problem is. Wether its a cap i missed or a chip thats gone. My uneducated suspicion is the APU has done a Houdini.

For the video: 2x long pulses should be a CLK issue.

For the picture: The 7x red circles are concerns and the 2x blue circles are 'eh, should be fine but try not to let unconnected wires lay under motherboards ever'
20230522_153239~2.jpg


Red circles from top-down:

1- Missing resistor?
2-4: Lots of mess, hard to be sure what's going on. Recommend trying to get back to factory here.
5. Sign of solder splash\balls? Flux\lighting can throw pics\vids 'off'.
6. Did you pry here? Maybe the caps\traces broke?

Pro tip: use heat to save your liquid damage stickers BEFORE you do work.
 
Last edited by LogicalMadness,

Takezo-San

Well-Known Member
Member
Joined
May 3, 2023
Messages
261
Trophies
0
Age
39
XP
349
Country
Seychelles
The only ways I think PFly installs could be creating BSODs (oops, think my PS4 nightmares took over and I've been typing BLOD XD):

V1\2\Lite - Sloppy MOSFET\flex install, stray solder balls under APU\RAM, knocking parts you don't mean\know, using a high-heat iron for too long on the APU, shorting a weird way and somehow frying the APU (idk, I've abused a lot of Switch boards in my time and have recovered most of them), (V1\2 specific) emmc connector\socket jacked up. No BGA work is needed, so the APU balls should never become questionable, IPA-toothbrush cleaning (try to use a 'blower' on it too) will clear stray balls.

OLEDs are all the same PLUS more risk to emmc through reballing\crap-adaptor, and more risk to APU because CLK isn't for the faint of heart AND is close to the APU. My last BSOD actually WAS an OLED-PFly install, but I've been neglecting posting about it because it's such a 'one off'. That OLED went through hell because I kept chasing my tail on little dumb things and continually 'stepping on my own d'k'. Always 1 step fwd, 2 steps back. It all started with using a crap dat0 adapter though, be warned. So, after messing up and fixing nearly everything, seeing a BSOD meant it could have been ANYTHING (funny though, with how much 'no boot' I was getting, I was EXCITED to see anything on screen, even BSOD). I removed the PZero (being sure hanging wires weren't shorting), did my best emmc reball I'd done yet and it was still BSOD. Grabbed a new PZero to use for troubleshooting, got cyan and thought 'guess I should try a reflow', no change though. Swapped the stupid flex cable (that I'm never buying again, LET HWFLY DIE!) with MOSFETs and I was in Hekate! I restored a backup I had been able to make (seriously? There's MORE to this story? Yikes!) and VOILA! No more BSOD!

TLDR, I fixed a BSOD by successfully restoring a backup in Hekate. Maybe the emmc somehow gets corrupted during installs? And, yes, there's actually plenty more to that story, like how mine was actually a 256gb emmc upgrade XD
Post automatically merged:



I think it was @deeps that was hoping we could add 'press vol+\- for OFW' to the no sd screen. May I request this to be added?
Post automatically merged:



For the video: 2x long pulses should be a CLK issue.

For the picture: The 7x red circles are concerns and the 2x blue circles are 'eh, should be fine but try not to let unconnected wires lay under motherboards ever'
View attachment 373173

Red circles from top-down:

1- Missing resistor?
2-4: Lots of mess, hard to be sure what's going on. Recommend trying to get back to factory here.
5. Sign of solder splash\balls? Flux\lighting can throw pics\vids 'off'.
6. Did you pry here? Maybe the caps\traces broke?

Pro tip: use heat to save your liquid damage stickers BEFORE you do work.
Appreciate the unexpected feedback, very grateful to you for taking the time out of your day. 2-4 (apu caps) Looks messier than it is because it was initially covered/protected in solder mask. At this point I have checked all the caps surrounding the APU and they all give continuity.
Checking back on 5, not sure what that is but its not there anymore (might've been fluff from cleaning off residue after reball)
6 Yes, spotted that yesterday, checked the nearby cap for continuity and it was good. Looked deeper at the 'damage' and luckily no traces ran underneath that.
But 1, now that i did not spot before. hmmmm.
will investigate that asap.
thanks again

Edit - I did though download the firmware off of git when it was maybe 8hrs after the release. And maybe it wasn't a good idea as it might have been still in Alpha. And the changelog was - 'v2.72 + disable CLK check, it's unstable'. Just so happens that the pulses were related to CLK. So my question is, is the EMMC dead? Anyway to revive it or is it just gone gone....
 
Last edited by Takezo-San,

LogicalMadness

Well-Known Member
Member
Joined
Nov 3, 2014
Messages
287
Trophies
0
Age
41
XP
690
Country
United States
Appreciate the unexpected feedback, very grateful to you for taking the time out of your day. 2-4 (apu caps) Looks messier than it is because it was initially covered/protected in solder mask. At this point I have checked all the caps surrounding the APU and they all give continuity.
Checking back on 5, not sure what that is but its not there anymore (might've been fluff from cleaning off residue after reball)
6 Yes, spotted that yesterday, checked the nearby cap for continuity and it was good. Looked deeper at the 'damage' and luckily no traces ran underneath that.
But 1, now that i did not spot before. hmmmm.
will investigate that asap.
thanks again

You're welcome! You're just proof that taking your time in asking, and then also being humble about it, will get more answers ;)

I almost edited to say that I think #1 COULD BE IT. FINGERS CROSSED!
 
  • Like
Reactions: Takezo-San

LogicalMadness

Well-Known Member
Member
Joined
Nov 3, 2014
Messages
287
Trophies
0
Age
41
XP
690
Country
United States
Edit - I did though download the firmware off of git when it was maybe 8hrs after the release. And maybe it wasn't a good idea as it might have been still in Alpha. And the changelog was - 'v2.72 + disable CLK check, it's unstable'. Just so happens that the pulses were related to CLK. So my question is, is the EMMC dead? Anyway to revive it or is it just gone gone....

Did you do any emmc 'work'? Upgrade to bigger size? Emmc should be fine if you didn't touch it.

I'd remove the Pico (solder USB and downgrade to 2.7?), get the system working stock again and then come back to the PFly.
 

nico77

Well-Known Member
Member
Joined
Apr 6, 2023
Messages
160
Trophies
0
Age
33
XP
238
Country
Indonesia
is there video/tutorial
how to remove usb-c port
RP2040 zero ??

without heat gun.:whip:
using iron soldering.

i only have manual iron soldering.

:creep:

rp2040  2023-04-15 213428.png
 

LogicalMadness

Well-Known Member
Member
Joined
Nov 3, 2014
Messages
287
Trophies
0
Age
41
XP
690
Country
United States
There was 2.72 version with mistake, it always failed with CLK issue. please download a new firmware
If you have suggestions for the picture, please post here
I think it was @deeps that was hoping we could add 'press vol+\- for OFW' to the no sd screen. May I request this to be added?

@rehius hates me...
samurai-harakiri.gif

Post automatically merged:

is there video/tutorial
how to remove usb-c port
RP2040 zero ??

without heat gun.:whip:
using iron soldering.

i only have manual iron soldering.

:creep:

View attachment 373180

*CAREFUL, GIANT blobs of solder*

Edit: ugh, I wasn't ready to send...

Solder wick and maybe a flush cutter too. Once I get my next shipment of PZeros, I'll make YouTube shorts on the various ways.
 
Last edited by LogicalMadness,

bilalhassan341

Well-Known Member
Member
Joined
Apr 1, 2023
Messages
138
Trophies
0
XP
271
Country
United States
is there video/tutorial
how to remove usb-c port
RP2040 zero ??

without heat gun.:whip:
using iron soldering.

i only have manual iron soldering.

:creep:

View attachment 373180
I removed it using a soldering iron. And don't ask it is pain in the ass. Add a solder to all four points and start heating it for sec and then move to second. But remove to first upper two points then move to lower points. But I can assure you the port will be remove and buttons as well .But there will be no more pads left😂😂😂. But first check your are using latest firmware.

It will look like this.


Edit: my finger also get a burn a little bit from the port Because I accidentally touched it🥲🥲🥲, it was F hot. But please be carefull. Also, don't laugh at me.
 

Attachments

  • DSC_0237~2.JPG
    DSC_0237~2.JPG
    103.4 KB · Views: 30

nico77

Well-Known Member
Member
Joined
Apr 6, 2023
Messages
160
Trophies
0
Age
33
XP
238
Country
Indonesia
I removed it using a soldering iron. And don't ask it is pain in the ass. Add a solder to all four points and start heating it for sec and then move to second. But remove to first upper two points then move to lower points. But I can assure you the port will be remove and buttons as well .But there will be no more pads left😂😂😂. But first check your are using latest firmware.

It will look like this.


Edit: my finger also get a burn a little bit from the port Because I accidentally touched it🥲🥲🥲, it was F hot. But please be carefull. Also, don't laugh at me.

can those 4 legs
cutted ?

maybe using nail clipper ??

Annotation 2023-05-23 001723.png
 
  • Like
Reactions: LogicalMadness

abal1000x

Well-Known Member
Member
Joined
Jun 5, 2022
Messages
1,066
Trophies
0
XP
1,386
Country
Gaza Strip
is there video/tutorial
how to remove usb-c port
RP2040 zero ??

without heat gun.:whip:
using iron soldering.

i only have manual iron soldering.

:creep:

View attachment 373180
Some cheap hair dryer might have temperature more than normal, you could try to use that.
The working principle is similar. Theres heater near the opening, and the air blows strongly by fan in the back.
 

Takezo-San

Well-Known Member
Member
Joined
May 3, 2023
Messages
261
Trophies
0
Age
39
XP
349
Country
Seychelles
There was 2.72 version with mistake, it always failed with CLK issue. please download a new firmware

Did you do any emmc 'work'? Upgrade to bigger size? Emmc should be fine if you didn't touch it.

I'd remove the Pico (solder USB and downgrade to 2.7?), get the system working stock again and then come back to the PFly.
Didn't touch the emmc what so ever. And from the picture, yes it looks like....SOMEHOW....SOME WAY....I wasn't careful enough and ripped that, what looks like, 0201 resistor which looks like the trace goes directly under the APU. Potentially have a winner here once I can find the value of that resistor to be replaced. In ohms mode it read at 560ohms but can't be 100% sure. I hope this is it. Thank you because this gives me hope that my soldering and mosfet work was good.

Edit - Anyone know a good resource as to where to find a breakdown/diagram of switch caps/resistor values. Googling it for a while feels like taking a pedal-bike on a motorway, getting nowhere fast.
 

Attachments

  • 20230522_180028.jpg
    20230522_180028.jpg
    2.6 MB · Views: 36
Last edited by Takezo-San,

mimi8384

Member
Newcomer
Joined
May 13, 2023
Messages
5
Trophies
0
Age
40
XP
63
Country
Italy
hello guys, I bought a RP2040-Zero and I can't program it, when I connect it to the PC via USB it shows red, green and blue and the PC doesn't see them..
 

lightninjay

Well-Known Member
Member
Joined
Mar 28, 2023
Messages
560
Trophies
0
Age
31
XP
1,384
Country
United States
hello guys, I bought a RP2040-Zero and I can't program it, when I connect it to the PC via USB it shows red, green and blue and the PC doesn't see them..
Re-read the guide a little closer. You can't just plug in the board and expect it to work. There is a specific process to flash a RP2040.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • Psionic Roshambo @ Psionic Roshambo:
    I can get 3Gbps here right now but it's like LOL 300 a month or something
  • K3Nv2 @ K3Nv2:
    $30 for 300Mbps is fine for me
  • Psionic Roshambo @ Psionic Roshambo:
    Free 1Gbps is good enough for me :P lol
  • BigOnYa @ BigOnYa:
    Most universities, school are fiber optic tho, not many residential areas have fiber optic yet
  • K3Nv2 @ K3Nv2:
    I remember me and friends would pirate movies at local libraries
  • Psionic Roshambo @ Psionic Roshambo:
    I am super blessed 2 fiber runs to my house with competing companies lol
    +1
  • BigOnYa @ BigOnYa:
    Lucky, I can't get yet in my hood
  • K3Nv2 @ K3Nv2:
    I got one friend that can't get fiber four houses down because of city lines
  • K3Nv2 @ K3Nv2:
    Would be like $400 for them to install it
  • Psionic Roshambo @ Psionic Roshambo:
    Technically for a month there I had Frontier FIOS 500Mbps and Spectrum 1Gbps (they got me on Spectrum because it was a little cheaper for double the speed)
  • K3Nv2 @ K3Nv2:
    Speedcum
    +1
  • BigOnYa @ BigOnYa:
    I mean what would you really need that fast for tho, 500mb streams 4k fine. 1gb should be fine for 8k eventually. That's what I just switched to Spermrum.
  • Psionic Roshambo @ Psionic Roshambo:
    I was funny to have both networks running lol
  • Psionic Roshambo @ Psionic Roshambo:
    It was cheaper lol
  • Psionic Roshambo @ Psionic Roshambo:
    The only reason I switched was $$$
  • Psionic Roshambo @ Psionic Roshambo:
    Might have only been like 7 bucks but thats like 84 dollars at the end of the year lol
  • Psionic Roshambo @ Psionic Roshambo:
    840 dollars after 10 years
  • K3Nv2 @ K3Nv2:
    I hope I can be rich enough to pay all bills annually someday
    +2
  • Psionic Roshambo @ Psionic Roshambo:
    Not that I will save the money, rather I will just spend it on other crap lol
  • Psionic Roshambo @ Psionic Roshambo:
    lol just do autopay it's as lazy as it gets
  • BigOnYa @ BigOnYa:
    @K3Nv2 tell uremum to start charging, then you keep the money
    +1
  • K3Nv2 @ K3Nv2:
    I charge your wife rent at this point
    +1
  • Psionic Roshambo @ Psionic Roshambo:
    Now serving number E73
    +1
  • BigOnYa @ BigOnYa:
    Good, maybe she will leave me the f alone, now I can drink, smoke, and play my games in peace!
    +1
  • K3Nv2 @ K3Nv2:
    The DMV giving citizens of Detroit empowerment
    K3Nv2 @ K3Nv2: The DMV giving citizens of Detroit empowerment