Hacking Hardware Picofly - a HWFLY switch modchip

[rehius]

Any docs or sources on how to build the payload? I'm referring to the one that's only present in header file payload.h as an array. I'd like to tweak the logo shown on boot when no SD card is inserted, maybe the Vol+ button behavior as well.
For fun, not for profit.

All I've been able to gather is that it's likely derived from sdloader in some way.
(edit: this thread is close but it applies to hwfly rather than Picofly)

Unfortunately its author has decided to keep sources private. I am reversing this loader in my free time. If you have suggestions for the picture, please post them here, currently I'm planning to replace the logo with this one. It takes much effort to properly fit the picture manually by patching the binary, so I'm postponing it somewhere in the future

Post automatically merged: May 22, 2023

edit: this thread is close but it applies to hwfly rather than Picofly

oh, yes, it's the same author

 

[sionka]

i

You mean your switch don't want to get charge.


Edit: Please send the pics of your install so we can look why your switch don't want to be get charged.

fixed it already one of the caps near ground pin was shorted

 

[FlowerFire]

Is it possible that the i2c undervoltage hack actually made the glitch much worse for me?
I've got this v2 that can actually glitch just fine, but sometimes it takes up to 15 seconds to do the job. After soldering in SDA and SCL, it reached about a minute of time.
Am I the only one?

 

[rehius]

Is it possible that the i2c undervoltage hack actually made the glitch much worse for me?
I've got this v2 that can actually glitch just fine, but sometimes it takes up to 15 seconds to do the job. After soldering in SDA and SCL, it reached about a minute of time.
Am I the only one?

yes, undervoltage makes glitching time worse. that is why it's said to use only when you really need it (weak mosfet, etc)

 

[Adran_Marit]

In this case bsod happened because of pcb bending. I think that emmc is to far away for it to cause problem all the way to RAM during reflow but APU might be possible. Still, if you are applying heat on top of emmc and manage to break a connection on APU in the process that Emmc chip is probably dead already

All good XD dunno how people are bending the boards but not my issue XD

 

[Takezo-San]

@Takezo-San Worth a shot reballiing the RAM. I don't think the max chips cause BLOD, they're more charging or powering-on issues.

Have we seen pics of you install?

Tried the ram reball, still nothing. Heres some pics i salvaged. The mosfet install looks more messier than it is because i literally doused all connections so its hard to see but check for continuity before masking. check it out. Video is the initial install boot + light pattern. Motherboard pic is with mosfet and pico removed + after reballing attempts. Other two are mosfets. At this point I will wait to invest in a thermal cam + voltage injection tool to find out where exactly the short/problem is. Wether its a cap i missed or a chip thats gone. My uneducated suspicion is the APU has done a Houdini.

 

[Nephiel]

Unfortunately its author has decided to keep sources private. I am reversing this loader in my free time.

Also found this repo using an alternative basic sdloader. It does have sources that could be useful, but I've been unable to find their origin.

I'd like to look further into this, I just don't have the time, either.

 

[LogicalMadness]

The only ways I think PFly installs could be creating BSODs (oops, think my PS4 nightmares took over and I've been typing BLOD XD):

V1\2\Lite - Sloppy MOSFET\flex install, stray solder balls under APU\RAM, knocking parts you don't mean\know, using a high-heat iron for too long on the APU, shorting a weird way and somehow frying the APU (idk, I've abused a lot of Switch boards in my time and have recovered most of them), (V1\2 specific) emmc connector\socket jacked up. No BGA work is needed, so the APU balls should never become questionable, IPA-toothbrush cleaning (try to use a 'blower' on it too) will clear stray balls.

OLEDs are all the same PLUS more risk to emmc through reballing\crap-adaptor, and more risk to APU because CLK isn't for the faint of heart AND is close to the APU. My last BSOD actually WAS an OLED-PFly install, but I've been neglecting posting about it because it's such a 'one off'. That OLED went through hell because I kept chasing my tail on little dumb things and continually 'stepping on my own d'k'. Always 1 step fwd, 2 steps back. It all started with using a crap dat0 adapter though, be warned. So, after messing up and fixing nearly everything, seeing a BSOD meant it could have been ANYTHING (funny though, with how much 'no boot' I was getting, I was EXCITED to see anything on screen, even BSOD). I removed the PZero (being sure hanging wires weren't shorting), did my best emmc reball I'd done yet and it was still BSOD. Grabbed a new PZero to use for troubleshooting, got cyan and thought 'guess I should try a reflow', no change though. Swapped the stupid flex cable (that I'm never buying again, LET HWFLY DIE!) with MOSFETs and I was in Hekate! I restored a backup I had been able to make (seriously? There's MORE to this story? Yikes!) and VOILA! No more BSOD!

TLDR, I fixed a BSOD by successfully restoring a backup in Hekate. Maybe the emmc somehow gets corrupted during installs? And, yes, there's actually plenty more to that story, like how mine was actually a 256gb emmc upgrade XD

Post automatically merged: May 22, 2023

If you have suggestions for the picture, please post them here

I think it was @deeps that was hoping we could add 'press vol+\- for OFW' to the no sd screen. May I request this to be added?

Post automatically merged: May 22, 2023

Tried the ram reball, still nothing. Heres some pics i salvaged. The mosfet install looks more messier than it is because i literally doused all connections so its hard to see but check for continuity before masking. check it out. Video is the initial install boot + light pattern. Motherboard pic is with mosfet and pico removed + after reballing attempts. Other two are mosfets. At this point I will wait to invest in a thermal cam + voltage injection tool to find out where exactly the short/problem is. Wether its a cap i missed or a chip thats gone. My uneducated suspicion is the APU has done a Houdini.

For the video: 2x long pulses should be a CLK issue.

For the picture: The 7x red circles are concerns and the 2x blue circles are 'eh, should be fine but try not to let unconnected wires lay under motherboards ever'

Red circles from top-down:

1- Missing resistor?
2-4: Lots of mess, hard to be sure what's going on. Recommend trying to get back to factory here.
5. Sign of solder splash\balls? Flux\lighting can throw pics\vids 'off'.
6. Did you pry here? Maybe the caps\traces broke?

Pro tip: use heat to save your liquid damage stickers BEFORE you do work.

 

[Takezo-San]

The only ways I think PFly installs could be creating BSODs (oops, think my PS4 nightmares took over and I've been typing BLOD XD):

V1\2\Lite - Sloppy MOSFET\flex install, stray solder balls under APU\RAM, knocking parts you don't mean\know, using a high-heat iron for too long on the APU, shorting a weird way and somehow frying the APU (idk, I've abused a lot of Switch boards in my time and have recovered most of them), (V1\2 specific) emmc connector\socket jacked up. No BGA work is needed, so the APU balls should never become questionable, IPA-toothbrush cleaning (try to use a 'blower' on it too) will clear stray balls.

OLEDs are all the same PLUS more risk to emmc through reballing\crap-adaptor, and more risk to APU because CLK isn't for the faint of heart AND is close to the APU. My last BSOD actually WAS an OLED-PFly install, but I've been neglecting posting about it because it's such a 'one off'. That OLED went through hell because I kept chasing my tail on little dumb things and continually 'stepping on my own d'k'. Always 1 step fwd, 2 steps back. It all started with using a crap dat0 adapter though, be warned. So, after messing up and fixing nearly everything, seeing a BSOD meant it could have been ANYTHING (funny though, with how much 'no boot' I was getting, I was EXCITED to see anything on screen, even BSOD). I removed the PZero (being sure hanging wires weren't shorting), did my best emmc reball I'd done yet and it was still BSOD. Grabbed a new PZero to use for troubleshooting, got cyan and thought 'guess I should try a reflow', no change though. Swapped the stupid flex cable (that I'm never buying again, LET HWFLY DIE!) with MOSFETs and I was in Hekate! I restored a backup I had been able to make (seriously? There's MORE to this story? Yikes!) and VOILA! No more BSOD!

TLDR, I fixed a BSOD by successfully restoring a backup in Hekate. Maybe the emmc somehow gets corrupted during installs? And, yes, there's actually plenty more to that story, like how mine was actually a 256gb emmc upgrade XD

Post automatically merged: May 22, 2023

I think it was @deeps that was hoping we could add 'press vol+\- for OFW' to the no sd screen. May I request this to be added?

Post automatically merged: May 22, 2023

For the video: 2x long pulses should be a CLK issue.

For the picture: The 7x red circles are concerns and the 2x blue circles are 'eh, should be fine but try not to let unconnected wires lay under motherboards ever'
View attachment 373173

Red circles from top-down:

1- Missing resistor?
2-4: Lots of mess, hard to be sure what's going on. Recommend trying to get back to factory here.
5. Sign of solder splash\balls? Flux\lighting can throw pics\vids 'off'.
6. Did you pry here? Maybe the caps\traces broke?

Pro tip: use heat to save your liquid damage stickers BEFORE you do work.

Appreciate the unexpected feedback, very grateful to you for taking the time out of your day. 2-4 (apu caps) Looks messier than it is because it was initially covered/protected in solder mask. At this point I have checked all the caps surrounding the APU and they all give continuity.
Checking back on 5, not sure what that is but its not there anymore (might've been fluff from cleaning off residue after reball)
6 Yes, spotted that yesterday, checked the nearby cap for continuity and it was good. Looked deeper at the 'damage' and luckily no traces ran underneath that.
But 1, now that i did not spot before. hmmmm.
will investigate that asap.
thanks again

Edit - I did though download the firmware off of git when it was maybe 8hrs after the release. And maybe it wasn't a good idea as it might have been still in Alpha. And the changelog was - 'v2.72 + disable CLK check, it's unstable'. Just so happens that the pulses were related to CLK. So my question is, is the EMMC dead? Anyway to revive it or is it just gone gone....

 

[LogicalMadness]

Appreciate the unexpected feedback, very grateful to you for taking the time out of your day. 2-4 (apu caps) Looks messier than it is because it was initially covered/protected in solder mask. At this point I have checked all the caps surrounding the APU and they all give continuity.
Checking back on 5, not sure what that is but its not there anymore (might've been fluff from cleaning off residue after reball)
6 Yes, spotted that yesterday, checked the nearby cap for continuity and it was good. Looked deeper at the 'damage' and luckily no traces ran underneath that.
But 1, now that i did not spot before. hmmmm.
will investigate that asap.
thanks again

You're welcome! You're just proof that taking your time in asking, and then also being humble about it, will get more answers

I almost edited to say that I think #1 COULD BE IT. FINGERS CROSSED!

 

[rehius]

And the changelog was - 'v2.72 + disable CLK check, it's unstable'. Just so happens that the pulses were related to CLK.

There was 2.72 version with mistake, it always failed with CLK issue. please download a new firmware

 

[LogicalMadness]

Edit - I did though download the firmware off of git when it was maybe 8hrs after the release. And maybe it wasn't a good idea as it might have been still in Alpha. And the changelog was - 'v2.72 + disable CLK check, it's unstable'. Just so happens that the pulses were related to CLK. So my question is, is the EMMC dead? Anyway to revive it or is it just gone gone....

Did you do any emmc 'work'? Upgrade to bigger size? Emmc should be fine if you didn't touch it.

I'd remove the Pico (solder USB and downgrade to 2.7?), get the system working stock again and then come back to the PFly.

 

[nico77]

is there video/tutorial
how to remove usb-c port
RP2040 zero ??

without heat gun.
using iron soldering.

i only have manual iron soldering.

 

[LogicalMadness]

There was 2.72 version with mistake, it always failed with CLK issue. please download a new firmware

If you have suggestions for the picture, please post here

I think it was @deeps that was hoping we could add 'press vol+\- for OFW' to the no sd screen. May I request this to be added?

@rehius hates me...

Post automatically merged: May 22, 2023

is there video/tutorial
how to remove usb-c port
RP2040 zero ??

without heat gun.
using iron soldering.

i only have manual iron soldering.



View attachment 373180

*CAREFUL, GIANT blobs of solder*

Edit: ugh, I wasn't ready to send...

Solder wick and maybe a flush cutter too. Once I get my next shipment of PZeros, I'll make YouTube shorts on the various ways.

 

[bilalhassan341]

is there video/tutorial
how to remove usb-c port
RP2040 zero ??

without heat gun.
using iron soldering.

i only have manual iron soldering.



View attachment 373180

I removed it using a soldering iron. And don't ask it is pain in the ass. Add a solder to all four points and start heating it for sec and then move to second. But remove to first upper two points then move to lower points. But I can assure you the port will be remove and buttons as well .But there will be no more pads left. But first check your are using latest firmware.

It will look like this.


Edit: my finger also get a burn a little bit from the port Because I accidentally touched it, it was F hot. But please be carefull. Also, don't laugh at me.

 

[nico77]

I removed it using a soldering iron. And don't ask it is pain in the ass. Add a solder to all four points and start heating it for sec and then move to second. But remove to first upper two points then move to lower points. But I can assure you the port will be remove and buttons as well .But there will be no more pads left. But first check your are using latest firmware.

It will look like this.


Edit: my finger also get a burn a little bit from the port Because I accidentally touched it, it was F hot. But please be carefull. Also, don't laugh at me.

can those 4 legs
cutted ?

maybe using nail clipper ??

 

[abal1000x]

is there video/tutorial
how to remove usb-c port
RP2040 zero ??

without heat gun.
using iron soldering.

i only have manual iron soldering.



View attachment 373180

Some cheap hair dryer might have temperature more than normal, you could try to use that.
The working principle is similar. Theres heater near the opening, and the air blows strongly by fan in the back.

 

[Takezo-San]

There was 2.72 version with mistake, it always failed with CLK issue. please download a new firmware

Did you do any emmc 'work'? Upgrade to bigger size? Emmc should be fine if you didn't touch it.

I'd remove the Pico (solder USB and downgrade to 2.7?), get the system working stock again and then come back to the PFly.

Didn't touch the emmc what so ever. And from the picture, yes it looks like....SOMEHOW....SOME WAY....I wasn't careful enough and ripped that, what looks like, 0201 resistor which looks like the trace goes directly under the APU. Potentially have a winner here once I can find the value of that resistor to be replaced. In ohms mode it read at 560ohms but can't be 100% sure. I hope this is it. Thank you because this gives me hope that my soldering and mosfet work was good.

Edit - Anyone know a good resource as to where to find a breakdown/diagram of switch caps/resistor values. Googling it for a while feels like taking a pedal-bike on a motorway, getting nowhere fast.

 

[mimi8384]

hello guys, I bought a RP2040-Zero and I can't program it, when I connect it to the PC via USB it shows red, green and blue and the PC doesn't see them..

 

[lightninjay]

hello guys, I bought a RP2040-Zero and I can't program it, when I connect it to the PC via USB it shows red, green and blue and the PC doesn't see them..

Re-read the guide a little closer. You can't just plug in the board and expect it to work. There is a specific process to flash a RP2040.