Hacking Hardware Blue screen of death installing and removing Hwfly Switch v2

[minimanimo]

Hello everyone, I hope to find help here.
Unfortunately my console does not work anymore, when I it turn on I have a full blue screen of death.

I tried to install HwFly V2 but the chip wasn't turning on, so I removed everything and tried to turn the console on but it is currently dead.

I have already tried sending it to maintenance mode with Vol + and - but it has no effect.
Do you have any ideas on how I can try to fix it? I read in the forum about people talking about checking the A CMD or other components by means of a multimeter, however in that case it was a post for the Oled version, while mine is older.

Do you have a page with schematics and values that I could possibly test?
Unfortunately, I do not have the proper instrumentation to do reballing/reflow and would like to first try to see if there is anything I can do.

I've also tried to push a bit on top of CPU and turning on the console, but still BSOD.

Thanks in advance!

 

[randy_w]

HwFly V2

You mean switch v2 (mariko) right? Which hwfly chip are you using? Add a picture if you can.

Blue screen is usually caused by bad emmc/soc/ram. As you tried to install hwfly before, and some hwfly clones (especially v5, and other variants of v5 with green pcb) are known to trash your emmc, I'd say your emmc is wiped/damaged.

Don't think you need to check CMD/CLK/DAT0 anyway since it's a v2 and you don't need to solder to those points. Add a photo of your sp1/sp2 soldering as well, although if you messed up those two points your switch won't boot at all.

Your best bet at the moment, I'd say is to install the chip properly and see if it can glitch and boot to hekate. Then you can make a full backup of your emmc and try to recover prodinfo, then rebuild your emmc.

 

[Blakejansen]

You mean switch v2 (mariko) right? Which hwfly chip are you using? Add a picture if you can.

Blue screen is usually caused by bad emmc/soc/ram. As you tried to install hwfly before, and some hwfly clones (especially v5, and other variants of v5 with green pcb) are known to trash your emmc, I'd say your emmc is wiped/damaged.

Don't think you need to check CMD/CLK/DAT0 anyway since it's a v2 and you don't need to solder to those points. Add a photo of your sp1/sp2 soldering as well, although if you messed up those two points your switch won't boot at all.

Your best bet at the moment, I'd say is to install the chip properly and see if it can glitch and boot to hekate. Then you can make a full backup of your emmc and try to recover prodinfo, then rebuild your emmc.

Does instinct nx v6 have this problem with OLEDS? I do not want a blue screen of death.

 

[randy_w]

Does instinct nx v6 have this problem with OLEDS? I do not want a blue screen of death.

Instinct NX is good, I've switched to instinct after my v4 ran out of stock. They may have a little QC issue with the first batch (white pcb) according to my seller, but I've never had any issue with them. Only catch is that they are not supported by hwfly-nx, although I don't see any reason to update it anyway since it solves all problems v4 had before (Toshiba/Hynix emmc issue and broken L4T Android/Ubuntu). Also it removed the reset pads, a minor inconvenience but you can reset it with serial console anyway.

 

[Blakejansen]

Instinct NX is good, I've switched to instinct after my v4 ran out of stock. They may have a little QC issue with the first batch (white pcb) according to my seller, but I've never had any issue with them. Only catch is that they are not supported by hwfly-nx, although I don't see any reason to update it anyway since it solves all problems v4 had before (Toshiba/Hynix emmc issue and broken L4T Android/Ubuntu). Also it removed the reset pads, a minor inconvenience but you can reset it with serial console anyway.

What is serial console?

I have the black instinct chip and I read about ground issues with the first PCB.

Practiced on a broken switch motherboard and the soldering doesn't seem bad at all. I've scratched and soldered onto probably 10 vias on the broken motherboard no problem.

Seems like the main difficulty is taking the switch apart.

 

[randy_w]

What is serial console?

I have the black instinct chip and I read about ground issues with the first PCB.

Practiced on a broken switch motherboard and the soldering doesn't seem bad at all. I've scratched and soldered onto probably 10 vias on the broken motherboard no problem.

Seems like the main difficulty is taking the switch apart.

You connect the modchip to your pc with provided usb dongle, it will show up as a serial port, you can control the chip with any serial console like hyperterminal and putty. You can use it to reset the chip, show debug information, etc..

 

[minimanimo]

You mean switch v2 (mariko) right? Which hwfly chip are you using? Add a picture if you can.

Blue screen is usually caused by bad emmc/soc/ram. As you tried to install hwfly before, and some hwfly clones (especially v5, and other variants of v5 with green pcb) are known to trash your emmc, I'd say your emmc is wiped/damaged.

Don't think you need to check CMD/CLK/DAT0 anyway since it's a v2 and you don't need to solder to those points. Add a photo of your sp1/sp2 soldering as well, although if you messed up those two points your switch won't boot at all.

Your best bet at the moment, I'd say is to install the chip properly and see if it can glitch and boot to hekate. Then you can make a full backup of your emmc and try to recover prodinfo, then rebuild your emmc.

Hi @randy_w,
Thanks for stepping into this and helping me!

Yes, my Switch should be indeed V2 Mariko (Serial starts with XKJ and you can also see from the attached picture of the CPU).

HwFly is Core RP2040 F4 - V11 from Aliexpress (also photos attached).

I also added photos of soldering points. Assuming SP1 and SP2 are the two condensators I should solder on the board, do you have the values they should have tested against ground in continuous mode with a multitester, for both sides?

Like you mentioned, I can also try to install again the modchip and run it.
However, the first time I launched it (by firstly checking the soldering and everything looked fine before boot) the chip gave no signs of life (no LED lights up) so I disconnected the power supply after 20/30 seconds and finally removed everything.

Shouldn't an LED light up on the HwFly right away?
Note: I installed the HwFly as it arrived, as the firmware should already be flashed.

Do you have a video of someone exactly installing my modchip so I can see what the behavior should be?

Assuming also that the new installation of the modchip is successful, can you send me in advance any useful links for what the next steps will be?

Thank you in advance, I really appreciate it.

 

[randy_w]

Hi @randy_w,
Thanks for stepping into this and helping me!

Yes, my Switch should be indeed V2 Mariko (Serial starts with XKJ and you can also see from the attached picture of the CPU).

HwFly is Core RP2040 F4 - V11 from Aliexpress (also photos attached).

I also added photos of soldering points. Assuming SP1 and SP2 are the two condensators I should solder on the board, do you have the values they should have tested against ground in continuous mode with a multitester, for both sides?

Like you mentioned, I can also try to install again the modchip and run it.
However, the first time I launched it (by firstly checking the soldering and everything looked fine before boot) the chip gave no signs of life (no LED lights up) so I disconnected the power supply after 20/30 seconds and finally removed everything.

Shouldn't an LED light up on the HwFly right away?
Note: I installed the HwFly as it arrived, as the firmware should already be flashed.

Do you have a video of someone exactly installing my modchip so I can see what the behavior should be?

Assuming also that the new installation of the modchip is successful, can you send me in advance any useful links for what the next steps will be?

Thank you in advance, I really appreciate it.

SoC looks good, no damage during soldering or anything. If you want you can check SP1/SP2 voltage in diode mode, should be very low on one side (0.02V iirc) and ground on the other.

Btw that is not hwfly, but picofly/rp2040. You should flash the firmware yourself anyway since picofly firmware updates very frequently.
https://github.com/Ansem-SoD/Picofly/tree/main

As I said, if you remove the chip and connect emmc back to motherboard, and switch still boots to blue screen, your emmc is corrupted. Best thing you can do right now is flash the chip and get it working, then install it and dump your emmc, save prodinfo and try to rebuild emmc. Your switch isn't gonna boot without the modchip, unless you send it back to nintendo and somehow let them replace it under warranty.

 

[minimanimo]

Thanks @randy_w for the useful information. I will try to update the firmware of the picofly and solder it back on the SoC. What should I do if the modchip, once mounted and started, shows no signs of life? I mean if the LEDs does not light up.

Any reliable guide for dumping and rebuilding the emmc? Is it common procedure and you think is feasible to restore my switch given current status? Assuming its corruption due to the modchip.

Thanks!

 

[randy_w]

What should I do if the modchip, once mounted and started, shows no signs of life? I mean if the LEDs does not light up.

Then you might have a dead chip. Return it, or ask for a refund.

If you can boot to hekate, make a backup of your emmc at once. Go to tools - backup emmc - backup boot0/1 and backup GPP.
Then you can try to create emummc and see if it boots. If it doesn't, then you need to follow a emmc rebuild guide, there are a few here but can't help you with that as I've never done it myself

 

[minimanimo]

Then you might have a dead chip. Return it, or ask for a refund.

Sorry, I was unclear: I was wondering if there was a procedure, in that specific case, to do to avoid further corrupting/damaging the emmc.

I am wondering how is it possible that the emmc got corrupted at first run?

If the chip doesn't work and I have to ask for another one, is there anything that will let me diagnose the problem and rule out that the switch doesn't require CPU or Ram reflow/reballing?

Post automatically merged: Jul 15, 2023

Also I cannot understand if I can flash latest firmware on Picofly without mounting it on chip, so just using the micro USB port. Is it that possible?

 

[randy_w]

Sorry, I was unclear: I was wondering if there was a procedure, in that specific case, to do to avoid further corrupting/damaging the emmc.

I am wondering how is it possible that the emmc got corrupted at first run?

If the chip doesn't work and I have to ask for another one, is there anything that will let me diagnose the problem and rule out that the switch doesn't require CPU or Ram reflow/reballing?

Post automatically merged: Jul 15, 2023

Also I cannot understand if I can flash latest firmware on Picofly without mounting it on chip, so just using the micro USB port. Is it that possible?

The modchip does need to write to boot0 on emmc at first boot (payload, sdloader.enc). Maybe due to wiring issue/glitches the chip overwrote something else, idk but there are reports of wiped emmc due to faulty modchip, especially those v5 clones.

Anyway, try to flash the chip with usb dongle first, follow the guide on picofly github. If it still doesn't boot/glitch, ask for a refund/replacement.
If you are positive the switch works fine prior to modding, you can safely rule out bad soc/ram.

 

[minimanimo]

Hey @randy_w ,

I've followed your suggestions. I have good and bad news, I hope you can help me in figuring this out and turing again to a good news.

So, I've remounted the modchip on console, checked everything and so on. Once confident, I've turned it on and it worked!
My switch booted to the screen with raspberry logo and "No sd card". Removed the connection to the battery, it was time to check how to close everything and arrange the modchip.

I literally adjust a bit the main cover (the one covering the cpu), bend a bit the flat cable of the modchip to face it up, without forcing and I try to run it again. Here I find the bad news: it doesn't boot up. Black screen.
The modchip now is blue one time and then 3x yellow (looks like short, long, long). I have attached the video.

This yellow error code doesn't look to be listed on the github readme, I have no idea what it means and what to do.
Thanks in advance!

Post automatically merged: Jul 16, 2023

For some reason, gbatemp doesn't show my video. In case the attach doesn't work, I've uploaded also here:

 

[randy_w]

This yellow error code doesn't look to be listed on the github readme, I have no idea what it means and what to do.
Thanks in advance!

You need to download the pdf readme, the error code means something wrong with CMD connection:

*== No eMMC CMD1 request (poor wiring, or dead CPU)

Try to reconnect the emmc to modchip and modchip to motherboard, maybe a bad connection.

And you have a toshiba emmc, no wonder picofly is acting up. Iirc picofly has issues with toshiba emmc, if you already updated firmware to latest, you might need to experiemnt different CMD resistors. And if it still doesn't work, you either need to image your toshiba emmc to a samsung one with emmc programmer, or get an instinct NX oled chip, and solder it in your v2.

 

[minimanimo]

Try to reconnect the emmc to modchip and modchip to motherboard, maybe a bad connection.

Hey @randy_w that was actually the problem :/
I was bit scared about the yellow LEDs that I didn't actually tried to turn it on again, without knowing what was going on.
Adjusting the connector modchip-motherboard did work. Now looks stable, I've tried to turn it on three times (just to the main page with "No SD card").

And you have a toshiba emmc, no wonder picofly is acting up. Iirc picofly has issues with toshiba emmc, if you already updated firmware to latest, you might need to experiemnt different CMD resistors. And if it still doesn't work, you either need to image your toshiba emmc to a samsung one with emmc programmer, or get an instinct NX oled chip, and solder it in your v2.

Doesn't sounds good!
I've found the pdf you mentioned, but is not exactly structured and that's why I decided to not follow for the firmware upgrade.
I think, in this case, I will give it a shot (maybe I will first try to run Hereke and backup Boot and NAND).

Can I attach the usb dongle to the modchip while it is still connected to the eMMC and motherboard, or shall I first unplung everything?

You are literally my hero

 

[randy_w]

Can I attach the usb dongle to the modchip while it is still connected to the eMMC and motherboard, or shall I first unplung everything?

Well that's the first thing I said, update the chip first before you install it, the firmware it ships with may be months old.
Anyway since you can already boot to hekate, make a full dump of your emmc (boot0/1 and gpp), make a emummc and see if it boots up.
You can keep everything connected, just hold the boot button and plug the chip to your pc, like the guide says.

 

[minimanimo]

Hi again @randy_w,

Here we go again: today I had put everything back together and ready to do all the software side work. I was very happy, but unfortunately I had to change my mind and now worse has happened, still on the hardware side.

Let me describe what I did: proceeding with the re-assembling, I tried to turn on the console and verify that it booted to the "No sd card" screen. I verified this upon closing the cpu cover, after installing the heatsink, and closing the metal cover (which I cut to accommodate the modchip and protected with kapton to prevent contact). I then reassembled the console entirely and unfortunately it would not turn on.

I disassembled the whole thing and the modchip was again giving the same error as on Sunday. I tried disconnecting and reattaching the motherboard-chip and chip-emmc connector but nothing this time. Obviously I have disconnected the battery as soon as possible.
I then unplugged the modchip, leaving the adapter soldered, and plugged the emmc to the original slot: the result is that it won't turn on or at least is black screen (before it gave blue screen instead).

I literally have no idea what happened; I did not force the closure and checked that the modchip was seated properly. Up to the metal cover, it would turn on.
It's frustrating. I hope there is no hardware failure and that it is fixable. I trust in your feedback.

Post automatically merged: Jul 18, 2023

The two condensator values, checked with multimeter, still looks good

 

[randy_w]

There's definitely something wrong with your emmc connection (motherboard to rp2040, or rp2040 to emmc module).
Maybe when you screwed the back cover in it put pressure on the modchip/emmc and shorted something out. Add a layer of kapton tape between the modchip and emmc module, or just wrap the module with kapton tape.

I see you installed the soc/ram cover, not that you shouldn't use it but make sure you cut it where the cpu ribbon cable comes out, otherwise it may cause problems. Also add a layer of kapton tape over sp1/sp2 points, it may touch the shield and short it out.

At this point I'm out of ideas. If you connect the emmc chip back to motherboard and it doesn't even show blue screen, maybe your emmc is really messed up.

 

[minimanimo]

At this point I'm out of ideas. If you connect the emmc chip back to motherboard and it doesn't even show blue screen, maybe your emmc is really messed up.

Oh no!
I am very sad, as I said I was very confident to solve it because it was booting up until I screwed the metal plate!

Is there something to check if the issue is emmc? If, at least, the console is powering on?

I really have no idea what to do.
Maybe I would try to reinstall again the chip, but if I have the error code 3x short, long, long I have no idea what would be.

I am very sad I didn't make a backup at the time it was working, so before closing it up

Post automatically merged: Jul 18, 2023

I see you installed the soc/ram cover, not that you shouldn't use it but make sure you cut it where the cpu ribbon cable comes out, otherwise it may cause problems. Also add a layer of kapton tape over sp1/sp2 points, it may touch the shield and short it out.

Just wanted to mention the metal cover where the CPU ribbon comes out was bended to avoid any issue. I don't see physical damage on the modchip cable, I would exclude it.
I will also add all the kapton tape as you mentioned (hoping to recover the console)

 

[randy_w]

You can check which stage the console is stuck at by probing emmc data pins if you have an oscilloscope/logic analyzer, or by measuring current draw. Here's a detailed guide:
https://www.retrosix.wiki/emmc-booting

Pretty sure the problem is the emmc chip. You can buy replacement ones on aliexpress for about $10. You also need mmcblknx, regular emmc to sd card adapters won't work, it has to be a realtek chipset one iirc so it can write to boot partitions. Or you can use emmc programmer if you got one.

You can generate boot0/1 partitions with EmmcHaccGen, and I believe that's the minimum requirement to boot a switch to hekate with modchip. Then you can follow through the emmc rebuild guide and see if you can recover your original emmc partitions, otherwise you won't be able to play online anymore.