Hacking Hardware Picofly - a HWFLY switch modchip

[tootallnate]

I see three possibilities:

- your dat0 adapter shorts between dat0 and dat1
- your cmd resistor is blown, or your cmd wire is shorted to gnd somehow
- you need higher resistance for dat0/cmd connections to the chip

I would start by measuring your cmd resistor and wire with a multimeter.
If it seems good then test by disconnecting cmd/clk/dat0/3v3 from the chip (leave gnd/cpu/rst connected) and see if the system boots at all.
If it does, you might want to try stronger resistors (add another 47 ohm for dat0/cmd)
If no go then remove dat0 adapter.
Still no go? Use it as a paper weight, or replace and rebuild emmc

I went all the way to removing the dat0 adapter, and unhooking the modchip. Still getting purple screen when booting up. So sounds like the emmc is destroyed? Replacing and rebuilding is definitely out of my comfort zone, so I think I'm back to trying to find a modder who would be willing to take this repair order for me.

Is anyone in this thread interested? Or can anyone recommend somewhere else to find a repair shop who would take this on? Thanks for the help everyone who's replied.

 

[abal1000x]

I went all the way to removing the dat0 adapter, and unhooking the modchip. Still getting purple screen when booting up. So sounds like the emmc is destroyed? Replacing and rebuilding is definitely out of my comfort zone, so I think I'm back to trying to find a modder who would be willing to take this repair order for me.

Is anyone in this thread interested? Or can anyone recommend somewhere else to find a repair shop who would take this on? Thanks for the help everyone who's replied.

Have you checked the CMD resistor on the Switch Main Board?

 

[tootallnate]

Have you checked the CMD resistor on the Switch Main Board?

I did check it, and it was reading 70 ohms, so I think that resistor is still good. Could be wrong though.

 

[abal1000x]

I did check it, and it was reading 70 ohms, so I think that resistor is still good. Could be wrong though.

I remembered oled is 4.7k, need to search on old post in the thread.

Post automatically merged: Jul 5, 2023

I did check it, and it was reading 70 ohms, so I think that resistor is still good. Could be wrong though.

Here
https://gbatemp.net/threads/switch-oled-missing-the-cmd-capacitor.603541/post-9697833

 

[deeps]

I did check it, and it was reading 70 ohms, so I think that resistor is still good. Could be wrong though.

sounds like the resistor is broken. it should read about 4700 ohm. you will need to replace it

 

[Arakon]

Here's the video of the gray screen issue I get. It's not plain gray, but lots of grayish lines. As you can see, it takes a moment to start up, but it DOES start up every single time, so the actual glitch is working perfectly fine.

 

[cgtchy0412]

Here's the video of the gray screen issue I get. It's not plain gray, but lots of grayish lines. As you can see, it takes a moment to start up, but it DOES start up every single time, so the actual glitch is working perfectly fine.

Yup I can confirm this behaviour as i have one with this issue now. Its a Lite year 22.. so lcd problem should at least minimum suspect.
Ill try to redo/reclean my wires instalation (ussualy because of this), lets see how it goes.

 

[Dee87]

(I am cross-posting from the AIO thread to here since this thread seems to have more activity. This time with pics):

Hey all. Hoping I can get some help here.

First time Switch modchip installation here, but I managed to install the Hwfly RP2040 modchip onto my OLED this weekend. I was very excited to see the "No SD Card" screen and thought things were going to be fine from here on out. Hekate boots up fine.

However, any attempts at interacting with the emmc are failing, and if I attempt to Reboot -> OFW, I get the purple screen.

I've been trying to search the forums here and, if I'm understanding correctly, it seems like the most likely cause is a bad point A / CMD connection (or blown resistor). I am attaching pics of the modchip before installation as well as some shots of my motherboard and Dat0 connection.

My questions are:

• Is there anything obviously wrong here? I'd be willing to give any suggestions a try, but I'm also starting to feel a bit out of my depth here, thus:
• Would any modders on this forum be interested in fixing / completing this modchip installation? Ideally US-based, but I'd ship to anywhere if you are confident that you could get this resolved.

Cheers, and thanks in advance.

First of All you Have a hwfly chip wich are not supported here for different reasons explained more then enough not gonna do it again.

Did u ask ur supllier what the issue is?


Just for the shits
purple screen is eather emmc or cmd resistor on switch board (4,7k) check the resistor first if it have 4.7k the your issue is with the emmc and u have bridged Dat0 and Dat1 and the data is corrupted.
that's what u get from buying those shitty chips with those shitty adapters.



U can also test and set 100ohm on the Hwfly Rp2040 dat 0 and cmd instead of the original 47 ohm.

Post automatically merged: Jul 5, 2023

Yup I can confirm this behaviour as i have one with this issue now. Its a Lite year 22.. so lcd problem should at least minimum suspect.
Ill try to redo/reclean my wires instalation (ussualy because of this), lets see how it goes.

Like I said I would say it eather the LCD connector, or a cable interfering with some LCD component, maybe a cap defective or the raspi has a issue , try checking that then change ur raspi

 

[twins333]

I once work as a designer on quartz crystal resonator. The heart of the oscillator circuit. My job is to reduce noise which we called spur at that time as much as we can. Usually every manufacture has their own 'recipe' on lapping, bevelling, shaping, until etching. And i also got my own recipe. 16MHz, 8Mhz usually result in a bad graphic. The best one as far as i know, is 12-13Mhz in the dimension of 7550 or 7050, or something similar. The graphic is clean, less spur. So if you use a multiplier frequency, the signal will be stable. Also in the market there is different crystal purposes. The worst is the one publicly sold. Better is in the automotive industry. And the best is in the space industry. So if you got crystal from automotive pcb, its far superior compared to tv, computer, or something similar.

And as far as i know, crystal is parametric to size. I can't imagine make a crystal so tiny that it could goes inside the microchip. The tiniest crystal i work is in the range of 3225 (3.2mmx2.5mm) and the last experimental job i've done is making a 2010 size. All in the range of mm. So to goes inside the microchip it need to shrink into the size of micrometer. The last time i work on this field, i've no news on someone could reduce the size until micrometer size of quartz crystal. Subjectively, i think its impossible.

When i read the datasheet, what i assume is not a quartz crystal resonator, but an oscillator circuit / functionality. Theres no crystal inside the chip. Only resistor, capacitor, and inductor, and some of transistor to flip flop the signal.

If you read on the datasheet page 222, its talking about ROSC or Ring Oscillator. I believe this is what the "Hardware Design" document refer to on the crystal. CMIIW.

I should have known better than to doubt you
It just looked to me that the quartz is already embedded.
Thanks for the definitive answer and help.
Keep it up!

Post automatically merged: Jul 5, 2023

RP2040 chip has no internal memory, you need external SPI flash

Thanks dude. You rock!
EDIT: upon further reading the specs:
Code may be executed directly from external memory through a dedicated SPI, DSPI or QSPI interface. A small cache
improves performance for typical applications.

 

[abal1000x]

I should have known better than to doubt you
It just looked to me that the quartz is already embedded.
Thanks for the definitive answer and help.
Keep it up!

Post automatically merged: Jul 5, 2023

Thanks dude. You rock!

I also surprise with your document screenshot.

I've googling and read it myself. Got confused. Googling quartz crystal inside microprocessor to make sure whether the technology exist. Found none. So highly probable its a typo.

 

[FreeLander]

Spoiler: temporarily spoilered due to potential technical issue in the non-lite install

@QuiTim @jkyoho thank you for your patience; here is the diagram for how I attached the status LED to the joy-con PCB. I removed the original home button LED in my installation, though it may be possible to mount the status LED directly next to the original, as the LED used on the RP2040 zero is smaller than the one on my seeed xiao RP2040. I also cut a hole in the rubber membrane between the button and the motherboard, to accommodate the LED and make certain the button could depress properly.

View attachment 380935
DIN point on the RP2040-Zero:

View attachment 380940

points to connect the LED DIN line from the RP2040 to the joy-con rail ribbon connector (first is v1/v2, second is oled):

View attachment 380939View attachment 380936

edit: while I have the photoshop file open, here is a diagram for how I wired my lite install as well. this one is far more practical and I have seen a couple other people do it since my first post, so it would be fun to see more home button lights moving forward

View attachment 380957

Do you think you could make a video out of this? Would be great!

 

[Switxh]

Do you think you could make a video out of this? Would be great!

Why aren't the diagrams enough? Or do you mean a video of it in action? Because if the latter he has posted videos of it in action just have to look back a bit. There's no need for a video tutorial though you're just asking for someone to invest a lot of time into making a video for no reason when we already have the diagrams.

 

[snaker]

In Hekate:

• Console Info -> eMMC gives the "slow mode" warning and only shows init errors.
• Attempting to create an emuNAND also shows the "slow mode" warning, but if I try to continue anyways it shows "eMMC init failed" and nothing more.
• Trying to create a backup of BOOT0 or BOOT1 also prints "eMMC init failed".
• Reboot -> OFW gives the purple screen.

I've also updated the modchip with fw_2.73.uf2, but it didn't seem to make any difference.

I already told you your dat0 adapter was sorted for sure under the emmc chip! Check at this screenshot how horrible is the included adapter at your kit. Yours is number 4! There is no way on earth that this dapter had not solder dat0 and dat1 balls under the emmc chip. You need to rebuild your emmc. Also you need to change smd resistors for cmd and dat0 to 100 ohms or else it will not glitch after you have successfully rebuild you emmc of course.

 

[deeps]

I already told you your dat0 adapter was sorted for sure under the emmc chip! Check at this screenshot how horrible is the included adapter at your kit. Yours is number 4! There is no way on earth that this dapter had not solder dat0 and dat1 balls under the emmc chip. You need to rebuild your emmc. Also you need to change smd resistors for cmd and dat0 to 100 ohms or else it will not glitch after you have successfully rebuild you emmc of course.

I think you should wait for him to replace the cmd resistor before making confident but possibly incorrect statements about this.

 

[snaker]

I think you should wait for him to replace the cmd resistor before making confident but possibly incorrect statements about this.

lets see then.

 

[TheFlymo]

Hello good folks, I've done some searches but couldn't see anything exactly like my issue:

I just installed a Picofly with a Waveshare RP2040 and V2 Flex on my HDH-001 / XJE7 Lite. I've got soldering experience and the install went fine, and I'm fairly sure I didn't touch or break anything I shouldn't. I checked for continuity, shorts and resistances before powering on.

The RP LED first showed Blue pulsing then white, and later boots show quick Blue then White but in both cases the screen is blank with backlight on, then appears to power itself off. If I wait then press power again the cycle repeats.

If I disconnect the 3,3V to the RP, I can hear the Switch initial setup sounds as it boots to OFW, but again the screen is black with the backlight on.

So I suspect the the mod is working but I've somehow broken the screen connection. Could it be the daughterboard flex cable? Is there anything else that commonly gets disrupted during an install?

Any advice much appreciated- thanks in advance!

 

[Fibonacci]

Hello I try to install a picofly inside a Oled switch but at the end I got this led error (cf video)
Can someone help me to understand how to fix this error ?
My switch boot on the OFW
I’m not confident about the flex v3 mofset part
thank you so much

 

[abal1000x]

Hello I try to install a picofly inside a Oled switch but at the end I got this led error (cf video)
Can someone help me to understand how to fix this error ?
My switch boot on the OFW
I’m not confident about the flex v3 mofset part
thank you so much


View attachment 381719

Yeah the flex installation seems problematic. The code is
==* CPU always reach BCT check (no glitch reaction, check mosfet)

Post automatically merged: Jul 5, 2023

Hello good folks, I've done some searches but couldn't see anything exactly like my issue:

I just installed a Picofly with a Waveshare RP2040 and V2 Flex on my HDH-001 / XJE7 Lite. I've got soldering experience and the install went fine, and I'm fairly sure I didn't touch or break anything I shouldn't. I checked for continuity, shorts and resistances before powering on.

The RP LED first showed Blue pulsing then white, and later boots show quick Blue then White but in both cases the screen is blank with backlight on, then appears to power itself off. If I wait then press power again the cycle repeats.

If I disconnect the 3,3V to the RP, I can hear the Switch initial setup sounds as it boots to OFW, but again the screen is black with the backlight on.

So I suspect the the mod is working but I've somehow broken the screen connection. Could it be the daughterboard flex cable? Is there anything else that commonly gets disrupted during an install?

Any advice much appreciated- thanks in advance!

What 3.3v point you use? and the GND?

 

[TheFlymo]

What 3.3v point you use? and the GND?

Hi! I used the points from the GBATemp guide- 3.3V from the trace to the right of the SOC cover, and GND on the north end of the capacitor to the top right of the SOC cover. I used thicker/wrapped wife for those.

 

[abal1000x]

Hi! I used the points from the GBATemp guide- 3.3V from the trace to the right of the SOC cover, and GND on the north end of the capacitor to the top right of the SOC cover. I used thicker/wrapped wife for those.

Then its left with this issue you need to check:
You could read it on the Q&A

Q: GREEN, but instant reset
A: Clean flux near the RST point

Editted:
I think i misunderstand your cases. I previously think that your picofly are randomly reset, even though success. But it seems not. after read your comment again i think the flows already correct:
1. Blue light (power on)
2. White led (write the payload to emmc, only once. Next boot wont happened)
3. Blue light (glitching)
4. Short white (success)
5. No Sd should shown.

If you don't see anything then its lcd connector problem

It will be better if you could upload some video on it. I might make a wrong assumption.