Tutorial  Updated

How to flash the HWFLY Clone chips

See below for updates.

IF YOU BREAK YOUR BOOT0 PIN. DO NOT DM ME ASKING FOR HELP. THAT'S IT. YOU BREAK THAT PIN AND YOU CANT FLASH. YOUR CHIP IS STUCK WITH WHATEVER HWFLY PUT ON IT


Pre-requisites:




  • Raspberry Pi Zero W
    • You may use another flasher if you desire.
  • Pinout Diagram
  • Modchip Diagram
  • FULL_CHIP_STOCK.bin
  • Modchip Diagram, find the PA9(TX) and the PA10(RX) pins on your modchip, and do the following:
    • Connect GPIO14(TX) on your Raspberry Pi Zero W to the PA10(RX) pin on your modchip.
    • Connect GPIO15(RX) on your Raspberry Pi Zero W to the PA9(TX) pin on your modchip.

  1. Solder a wire to each of the following pinouts on the Raspberry Pi Zero W:
    • 3.3V
    • Ground
    • GPIO 14 (UART TX)
    • GPIO 15 (UART RX)
  2. Do the following to prepare the modchip:
    1. Lift pin 44 (also known as BOOT0).
    2. You will need a way to power the chip, so you need to find two 3.3v points. It can be on a MOSFET, but it will differ based on the revision of the modchip.
    3. Connect Ground on your Raspberry Pi Zero W to the Ground pin on your modchip.
    4. Check the Modchip Diagram, find the PA9(TX) and the PA10(RX) pins on your modchip, and do the following:
      • Connect GPIO14(TX) on your Raspberry Pi Zero W to the PA10(RX) pin on your modchip.
      • Connect GPIO15(RX) on your Raspberry Pi Zero W to the PA9(TX) pin on your modchip.
  3. Boot your Raspberry Pi Zero W and do the following:
    1. In the terminal, type the following command, and press enter:
      Bash:
      sudo nano /boot/config.txt
    2. Add the following line to the end of the file:
      INI:
      dtoverlay=pi3-miniuart-bt
    3. Press CTRL + X to save and exit the editor.
    4. In the terminal, type the following command, and press enter:
      Bash:
      sudo nano /boot/cmdline.txt
    5. Remove the following line from the file:
      INI:
      console=serial0,115200
    6. Press CTRL + X to save and exit the editor.
    7. Restart your Raspberry Pi with this command
      Bash:
      sudo /sbin/reboot
    8. In the terminal, type the following commands, and press enter after each command:

      Bash:
      git clone https://github.com/Pheeeeenom/stm32flash.git
      cd stm32flash
      sudo make install
  4. Now you will flash the modchip.
    Note: This will remove read protection, and the modchip will wipe itself (that is what we want).
    1. In the terminal, type the following command, and press enter:
      Bash:
      stm32flash -k /dev/serial0
    2. Now to flash Spacecraft-NX Version 0.2.0, type the following, and press enter:
      Bash:
      stm32flash -v -w ./FULL_CHIP_STOCK.bin /dev/serial0
  5. Once you're done flashing your modchip, remove the wiring from the modchip, and restore the 3.3v pin on the modchip to its original position.

Please post pictures of your work here to further the identification of the different board revisions!


UPDATE: So it seems like stitching the spacecraft bootloader and firmware together from the repo causes unstable glitching behaviors. For now, consistent glitching behavior works with this bootload/firmware combo.
This is the original file on the OLED variant chip which has 0.2.0 spacecraft. As for glitching, I'll figure it out, give me some time...unless someone else wants to hop in and reverse the differences.

For now, this at least solves the 0.1.0 HWFLY gen 3 issue. More to come.

UPDATE 2: This is only going to work on some HWFLY chips. Older ones use higher protection than the new revisions that seem to use the QFN FPGA.

UPDATE 3: This should fully work on OLED modchips with the QFN FPGA. https://github.com/Pheeeeenom/firmware
 
Last edited by Mena,

Linkgod

Member
Newcomer
Joined
Nov 6, 2022
Messages
5
Trophies
0
Age
32
XP
81
Country
Portugal
Check resistance between those caps and gnd, 20 ohm and -+0 is ok.
Also, detailed pictures of your abc solder points will help.
With the 0.71, does it try to glitch showing green light anytime?
with red probe on ground
A - 460
B - 408
C - 428
D - 797
i have the 3.3V and of course GND
its the hwfly 4.1 version
it only blinks for like 5 seconds orange and then i pulsates fast in yellow with no green ever ( video attached )
i will provide pictures tomorrow at work with the microscope
also console turns on just fine when i reset the chip
 

Attachments

  • VID_20221106_190512.mp4
    20 MB
Last edited by Linkgod,

Mena

Well-Known Member
OP
Member
Joined
Oct 5, 2020
Messages
148
Trophies
0
Age
29
XP
1,032
Country
United States
with red probe on ground
A - 460
B - 408
C - 428
D - 797
i have the 3.3V and of course GND
its the hwfly 4.1 version
it only blinks for like 5 seconds orange and then i pulsates fast in yellow with no green ever ( video attached )
i will provide pictures tomorrow at work with the microscope
also console turns on just fine when i reset the chip
Please get a putty log. Also, you never mentioned B
 
  • Like
Reactions: Linkgod

Mena

Well-Known Member
OP
Member
Joined
Oct 5, 2020
Messages
148
Trophies
0
Age
29
XP
1,032
Country
United States
i never done a putty log , here its, i hope i did the right options .
is something wrong with B value?

C:
enum STATUSCODE
{
    OK = 0, // generic ok

    ERR_UNKNOWN_DEVICE = 0xBAD00107,
    ERR_ADC_WAIT_TIMEOUT = 0xBAD00122,

    ERR_CONFIG_NOT_FILLED = 0xBAD0010B,
    ERR_CONFIG_TABLE_FULL = 0xBAD00125,
    ERR_CONFIG_RESET_FAIL = 0xBAD00000,
    OK_CONFIG = 0x900D0007,
    OK_CONFIG_RESET = 0x900D0002,

    ERR_FLASH_ERASE_FAIL = 0xBAD00109,
    ERR_FLASH_WRITE_FAIL = 0xBAD0010A,
    ERR_FLASH_PAYLOAD_FAIL = 0xBAD0010C,
    ERR_FPGA_STATUS_FAIL = 0xBAD00004,
    OK_FLASH_SUCCESS = 0x900D0008,

    OK_FPGA_RESET = 0x900D0000,

    // Glitch error codes
    ERR_GLITCH_TOO_MANY_ATTEMPTS = 0xBAD00124,
    ERR_GLITCH_NO_EMMC_COMM = 0xBAD00108,
    OK_GLITCH_SUCCESS = 0x900D0006,

    // MMC error codes
    ERR_MMC_GO_IDLE_FAILED = 0xBAD0010D,
    ERR_MMC_SEND_OP_COND_FAILED = 0xBAD00110,
    ERR_MMC_SEND_CID_FAILED = 0xBAD00111,
    ERR_MMC_SET_RELATIVE_ADDR_FAILED = 0xBAD00112,
    ERR_MMC_STATE_UNEXPECTED_NOT_IDENT = 0xBAD00113,
    ERR_MMC_SEND_CSD_FAILED = 0xBAD00114,
    ERR_MMC_SELECT_CARD_FAILED = 0xBAD00115,
    ERR_MMC_STATE_NOT_IDENT_OR_READY = 0xBAD00116,
    ERR_MMC_SEND_STATUS_FAILED = 0xBAD00117,
    ERR_MMC_STATE_UNEXPECTED_NOT_TRAN1 = 0xBAD00118,
    ERR_MMC_SET_BLOCKLEN_FAILED = 0xBAD00119,
    ERR_MMC_STATE_UNEXPECTED_NOT_TRAN2 = 0xBAD0011A,
    ERR_MMC_SWITCH_FAILED = 0xBAD0011B,
    ERR_MMC_STATE_UNEXPECTED_NOT_TRAN3 = 0xBAD0011C,
    ERR_MMC_READ_SINGLE_BLOCK_FAILED = 0xBAD0011D,
    ERR_MMC_STATE_UNEXPECTED_NOT_TRAN4 = 0xBAD0011E,
    ERR_MMC_WRITE_SINGLE_BLOCK_FAILED = 0xBAD00120,
    ERR_MMC_STATE_UNEXPECTED_NOT_TRAN5 = 0xBAD00121,
};

ERR_MMC_GO_IDLE_FAILED = 0xBAD0010D,

There's something up with your soldering, dat0, etc on the emmc lines
 
  • Like
Reactions: Linkgod and juanvlc

Linkgod

Member
Newcomer
Joined
Nov 6, 2022
Messages
5
Trophies
0
Age
32
XP
81
Country
Portugal
C:
enum STATUSCODE
{
    OK = 0, // generic ok

    ERR_UNKNOWN_DEVICE = 0xBAD00107,
    ERR_ADC_WAIT_TIMEOUT = 0xBAD00122,

    ERR_CONFIG_NOT_FILLED = 0xBAD0010B,
    ERR_CONFIG_TABLE_FULL = 0xBAD00125,
    ERR_CONFIG_RESET_FAIL = 0xBAD00000,
    OK_CONFIG = 0x900D0007,
    OK_CONFIG_RESET = 0x900D0002,

    ERR_FLASH_ERASE_FAIL = 0xBAD00109,
    ERR_FLASH_WRITE_FAIL = 0xBAD0010A,
    ERR_FLASH_PAYLOAD_FAIL = 0xBAD0010C,
    ERR_FPGA_STATUS_FAIL = 0xBAD00004,
    OK_FLASH_SUCCESS = 0x900D0008,

    OK_FPGA_RESET = 0x900D0000,

    // Glitch error codes
    ERR_GLITCH_TOO_MANY_ATTEMPTS = 0xBAD00124,
    ERR_GLITCH_NO_EMMC_COMM = 0xBAD00108,
    OK_GLITCH_SUCCESS = 0x900D0006,

    // MMC error codes
    ERR_MMC_GO_IDLE_FAILED = 0xBAD0010D,
    ERR_MMC_SEND_OP_COND_FAILED = 0xBAD00110,
    ERR_MMC_SEND_CID_FAILED = 0xBAD00111,
    ERR_MMC_SET_RELATIVE_ADDR_FAILED = 0xBAD00112,
    ERR_MMC_STATE_UNEXPECTED_NOT_IDENT = 0xBAD00113,
    ERR_MMC_SEND_CSD_FAILED = 0xBAD00114,
    ERR_MMC_SELECT_CARD_FAILED = 0xBAD00115,
    ERR_MMC_STATE_NOT_IDENT_OR_READY = 0xBAD00116,
    ERR_MMC_SEND_STATUS_FAILED = 0xBAD00117,
    ERR_MMC_STATE_UNEXPECTED_NOT_TRAN1 = 0xBAD00118,
    ERR_MMC_SET_BLOCKLEN_FAILED = 0xBAD00119,
    ERR_MMC_STATE_UNEXPECTED_NOT_TRAN2 = 0xBAD0011A,
    ERR_MMC_SWITCH_FAILED = 0xBAD0011B,
    ERR_MMC_STATE_UNEXPECTED_NOT_TRAN3 = 0xBAD0011C,
    ERR_MMC_READ_SINGLE_BLOCK_FAILED = 0xBAD0011D,
    ERR_MMC_STATE_UNEXPECTED_NOT_TRAN4 = 0xBAD0011E,
    ERR_MMC_WRITE_SINGLE_BLOCK_FAILED = 0xBAD00120,
    ERR_MMC_STATE_UNEXPECTED_NOT_TRAN5 = 0xBAD00121,
};

ERR_MMC_GO_IDLE_FAILED = 0xBAD0010D,

There's something up with your soldering, dat0, etc on the emmc lines
i will check again tomorrow and provide feedback
thank you both for the help provided so far
 

gnetoak29

Member
Newcomer
Joined
Aug 6, 2022
Messages
5
Trophies
0
Age
37
Location
Thailand
Website
youtu.be
XP
113
Country
Thailand
i will check again tomorrow and provide feedback
thank you both for the help provided so far
with red probe on ground
A - 460
B - 408
C - 428
D - 797
i have the 3.3V and of course GND
its the hwfly 4.1 version
it only blinks for like 5 seconds orange and then i pulsates fast in yellow with no green ever ( video attached )
i will provide pictures tomorrow at work with the microscope
also console turns on just fine when i reset the chip
pin CLK EMMC not connect
 
  • Like
Reactions: Linkgod

Linkgod

Member
Newcomer
Joined
Nov 6, 2022
Messages
5
Trophies
0
Age
32
XP
81
Country
Portugal
pin CLK EMMC not connect
It was exactly that, the flex cable sucked all the solder from the CLK point and it wasn't connecting.
The mod is done, once again thank you all for the support.
 

Attachments

  • IMG_20221109_132845.jpg
    IMG_20221109_132845.jpg
    4.9 MB · Views: 116

heinrich_frei

Well-Known Member
Newcomer
Joined
Dec 5, 2021
Messages
54
Trophies
0
Age
23
XP
824
Country
Russia
Has anyone met similar chips? After the flashing the chip stopped working. I would be grateful if someone could post a firmware for it.
 

Attachments

  • PXL_20221119_133148409.jpg
    PXL_20221119_133148409.jpg
    2.6 MB · Views: 127
  • Screenshot_2022-11-19-15-17-52-728_com.avito.android.jpg
    Screenshot_2022-11-19-15-17-52-728_com.avito.android.jpg
    605.9 KB · Views: 115

Mena

Well-Known Member
OP
Member
Joined
Oct 5, 2020
Messages
148
Trophies
0
Age
29
XP
1,032
Country
United States
Has anyone met similar chips? After the flashing the chip stopped working. I would be grateful if someone could post a firmware for it.
That’s certainly new. Unfortunately, you should've made a fw dump beforehand.

edit: someone mentioned that they've gotten this before and just flashed it with hwfly-nx 0.70 and it "just werked". Can you get a putty log
 
Last edited by Mena,

FR0ZN

Well-Known Member
Member
Joined
Nov 2, 2013
Messages
1,385
Trophies
1
Age
37
XP
3,893
Country
United States
That’s certainly new. Unfortunately, you should've made a fw dump beforehand.

edit: someone mentioned that they've gotten this before and just flashed it with hwfly-nx 0.70 and it "just werked". Can you get a putty log

How can we create FW dumps of such chips?
I know that the HWFLY-NX flasher creates a bootloader backup, but what is the process for the FW?
 

Phantomas77

Well-Known Member
Member
Joined
Dec 19, 2022
Messages
284
Trophies
0
XP
720
Country
Italy
Has anyone met similar chips? After the flashing the chip stopped working. I would be grateful if someone could post a firmware for it.
Did you have any luck solving the issue? I have exact same chip and flashed it before install with hwfly-nx_0.71, only get yellow blinking light, than green and the console boots to OFW. Tried with ChipNX 0.32 and get white blinking light with white screen. Later will try with ChipNX 0.31 that some suggested that works and hwfly-nx 0.70 as suggested by Mena.
 

Fox-Jet

New Member
Newbie
Joined
Jan 6, 2023
Messages
1
Trophies
0
Age
34
XP
29
Country
Germany
Hey guys,
Why do you connect the solder points on the HWFLY modchip with a Pi to flash the chip? I contacted the seller of the store and he said you can simply flash the modchip via USB.
I am now talking about the hwfly modchip v5 flashable for v1 and v2 (I have a mariko Switch).

Is this true now with the USB or do you really need a Pi as an intermediary to flash?
 

dygeo

Well-Known Member
Newcomer
Joined
Feb 5, 2023
Messages
51
Trophies
0
Age
31
XP
126
Country
France
hello how to flash a hwfly v5 lite chip that works with sx-firmware. I would like to know everything the firmware used I saw that it was better to remove the SD card. I don't want to make a error I've already destroyed a chip that no longer recognizes the usb cable. (What firmware used. what manipulation to do to avoid errors take out the SD card or let the chip work after the flash or let the console plug in or have a full battery preferably I would like to have a summary if you don't mind there has a lot of different firmware and it's not super well specified I have a flashable sx-core hwfly lite v5 with sx-firmware I would like the flash for the proper functioning of hekate or else not do it if it helps to nothing.
 

some1ne

Well-Known Member
Member
Joined
Sep 12, 2009
Messages
578
Trophies
1
Website
www.youtube.com
XP
903
Country
United States
HWFly-nx firmware sometime get stuck on some chips when updating sysnand and need to be reset manually

working good on my switch lite
This happened on a never-before-hacked switch. I updated to 16.0 before installing hwfly, and this happened only to modchips that had the custom hwfly-nx firmware. The ones with the stock firmware were working fine.
 

dygeo

Well-Known Member
Newcomer
Joined
Feb 5, 2023
Messages
51
Trophies
0
Age
31
XP
126
Country
France
This happened on a never-before-hacked switch. I updated to 16.0 before installing hwfly, and this happened only to modchips that had the custom hwfly-nx firmware. The ones with the stock firmware were working fine.
so it is better to keep the original firmware. Team hwfly mon said that on the switch lite no need to flash again normally.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
  • No one is chatting at the moment.
  • Materia_tofu @ Materia_tofu:
    im not a very bright individual, but we live and we learn
  • SylverReZ @ SylverReZ:
    @Materia_tofu, We do learn a lot from plenty of talented individuals.
  • Materia_tofu @ Materia_tofu:
    this is true! i learned how to make soundfont remixes from a friend back in 2021
    +1
  • BakerMan @ BakerMan:
    Update on my brother: He's home now, tired and hungry, obviously, but other than that, seems to be doing fine.
    +2
  • Veho @ Veho:
    That's a relief to hear. Do you know what happened?
  • SylverReZ @ SylverReZ:
    @BakerMan, Any idea what happened? I hope that your brother's doing good.
  • BakerMan @ BakerMan:
    Well, from what I've heard from my parents, he had a seizure last night, perhaps an epileptic episode, fucking died, had a near death experience, my dad called the paramedics, they showed up, took him to the hospital, and he woke up covered in tubes, and started complaining.
  • BakerMan @ BakerMan:
    He couldn't eat until after his MRI, when he had a bomb pop.
  • BakerMan @ BakerMan:
    What matters now is that he's doing alright.
  • Veho @ Veho:
    But you still don't know what it was?
  • Veho @ Veho:
    Has he had seizures before?
  • The Real Jdbye @ The Real Jdbye:
    apparently stress can cause seizures, my brother had one during a test once
  • The Real Jdbye @ The Real Jdbye:
    never had one before that, and never had one since
  • Redleviboy123 @ Redleviboy123:
    Question about game texture chanching Do i need an own game id?
  • The Real Jdbye @ The Real Jdbye:
    @Veho for those that want to
    experience being sonic the hedgehog
  • Veho @ Veho:
    Ah, you mean
    furries.
  • The Real Jdbye @ The Real Jdbye:
    well, sonic fans are a whole separate thing from furries
  • The Real Jdbye @ The Real Jdbye:
    like bronys
  • The Real Jdbye @ The Real Jdbye:
    sonic porn is too weird even for me
  • Dumpflam @ Dumpflam:
    bruh
  • Dumpflam @ Dumpflam:
    guys how do i delete a post
  • The Real Jdbye @ The Real Jdbye:
    you don't
  • The Real Jdbye @ The Real Jdbye:
    you can report it and request deletion
    The Real Jdbye @ The Real Jdbye: you can report it and request deletion