Black screen after closing switch with HwFly RP2040

[minimanimo]

Hello folks,
I am here in asking for help from some experts.

I am very sad about the situation.
Long story short: I soldered the hwfly rp2040 (but basically is a clone based on picofly) and after after some problems, i got to a state where the modchip booted to the “No sd card” screen. So I was ready to close it.

I did various power-on tests while closing it. Until the metal cover was closed, it worked (booting to the screen mentioned). The moment I closed the black cover, the switch no longer turned on.

I disassembled everything, the modchip gives the following error (with led blinking): *== No eMMC CMD1 request (poor wiring, or dead CPU)

I’m posting screenshots, but basically I covered the metal plate where to allocate the modchip with kapton tape. I have also cut the cover to accommodate it. I have the impression that when closing, the modchip touched somehow the emmc board, which was not protected with kapton. Or something else. Also, I didn’t even put the kapton above the capacitor soldered to the adapter (but I don’t think it touched the metal cover).

So I unsoldered everything, cleaned the CPU, inserted the emmc in the original housing. Nothing, black screen here too.
A user in the other post assumes a problem with the emmc, probably hardware.
When I press the power button and the modchip powers up, that’s why I talk about “black screen”.

Worst of all, I didn’t get to run Hereke and backup my keys.
Has anyone encountered this error and is willing to help me figure out what the error is and maybe identify if it is due to a short, how to identify and fix it?

I can provide more detailed photos using a microscope (not very high resolution, pretty cheap one).
I have good tools for basic electronics (concerning this installation). I do have a multimeter, but not an oscilloscope or more sophisticated strumentation.

Does it make sense in the meantime to buy an emmc + programmer from aliexpress, in order to read my corrupted emmc and possibly replace it (assuming the short is with the emmc)?

Thanks in advance!

EDIT: apparently cannot post images

[Severence]

The modchip works by modifying the EMMC boot0 paritiion afair following the “glitching”, whether it does this without the files present on the SD I’m not sure but you would assume it would if you gained access to the “bootloader” throwing the SD error you mentioned.

So it’s possible you have a boot 0/1 issue and will have to determine your [nintendo] FW version by looking at prodinfo (if I remember right) partition and note the version number (viewable in NXNandManager) and “regenerate” the corresponding boot 0/1 paritions using Choi or other and then write those partitions back to the EMMC. The only way you can look at these hidden partitions (easily) is using tools such as mmcblknx (which is unfortunate given the bad hardware design) or by using an unpatched switch and mounting the EMMC over USB (would be the easiest way) but be careful about burning your update fuses on the unpatched in this case.

Anyway, this is all just guesses and assumes your EMMC is still currently working and that my theory over you boot partition/s is accurate (I’m not 100% sure) and that the “SX” bootloader would prevent stock boot

Hardware wise, you can search the forum as I’ve covered many, many times how to do basic rail checks for your primary rails

@minimanimo

EDIT: apparently cannot post images

After four posts this is unlocked I think, so just make a few dummy posts or upload your media to an image hoster - animagehost(dot)com for example

[minimanimo]

@Severence

animagehost

[minimanimo]

Hi @Severence
Thank you so much for coming back to this.
Yeah, apparently at the moment I cannot post images also if they are hosted somewhere else.

So your assumption is that the issue is software side, not hardware.

@Severence

The modchip works by modifying the EMMC boot0 paritiion afair following the “glitching”, whether it does this without the files present on the SD I’m not sure but you would assume it would if you gained access to the “bootloader” throwing the SD error you mentioned.

The situation is slightly different: the “No sd card” screen with the raspberry pi logo is good sign, it is shown when the glitch works. Unfortunately, I cannot post an image of it yet.
The console performed the glitch and screen startup consistently.

Instead, upon shutting it down, something went wrong and so now I have the black screen both with and without the modchip, with the error *==

@Severence

So it’s possible you have a boot 0/1 issue and will have to determine your [nintendo] FW version by looking at prodinfo (if I remember right) partition and note the version number (viewable in NXNandManager) and “regenerate” the corresponding boot 0/1 paritions using Choi or other and then write those partitions back to the EMMC. The only way you can look at these hidden partitions (easily) is using tools such as mmcblknx (which is unfortunate given the bad hardware design)

I read indeed something the boot0 partition and the possibility to use mmcblknx. Should I also buy a new emmc as well? Could you DM a good reliable mmcblknx tool? I saw them on Aliexpress but I cannot understand which one should I take.

[Severence]

@minimanimo

Yeah, apparently at the moment I cannot post images also if they are hosted somewhere else.

4 posts needed by you i think bud and then you should be able to post them directly here. And yeah you can post to an image hoster, for example https://imageshack.com/yourimage which you’d change to imageshack (dot) com/yourimage (for example)

@minimanimo

Instead, upon shutting it down, something went wrong and so now I have the black screen both with and without the modchip, with the error *==

Which would make sense with a dead EMMC or bad boot0 parition

@minimanimo

Should I also buy a new emmc as well?

No, because if your current EMMC is dead, then that’s it your whole switch is basically dead now, paperweight… If your able to read/see the partitions on your current EMMC (using the methods mentioned previously) then it’s physically fine and doesn’t need replacing.

@minimanimo

good reliable mmcblknx tool?

There isn’t one, as far as I’m concerned the tool is poorly designed and shouldn’t be sold but it’s basically your only option without an unpatched Switch donor board. The “official” version is here https://www.tindie.com/products/ignas/emmc-reader-for-hac-emmc/

[minimanimo]

@Severence

@minimanimo

Instead, upon shutting it down, something went wrong and so now I have the black screen both with and without the modchip, with the error *==

Which would make sense with a dead EMMC or bad boot0 parition

I am sorry, instead of “shutting it down” I had to write “upon closing completely the console”. Until the moment I had only the main big metal cover installed, everything was fine.
I really don’t understand how is that possible that the emmc got messed up from software side, instead of hardware (which, of course, if the issue is software maybe is better in term of recoverability).

I literally turned on and off 15 times during the closing procedure and 30/40 times overall from when I started to work the installation

Some photos:
(maybe later, says “you cannot include links in your post”)

[Severence]

@minimanimo

I am sorry, instead of “shutting it down” I had to write “upon closing completely the console”. Until the moment I had only the main big metal cover installed, everything was fine.

I understand, hardware issue is entirely possible (but this is a seperate issue)

@minimanimo

I really don’t understand how is that possible that the emmc got messed up from software side, instead of hardware (which, of course, if the issue is software maybe is better in term of recoverability).

We first have to determine what is the problem in a stock situation (no modchip) I’m making the assumption that the RP2040 modchip which your using is working in the same way as the HwFly/SX modchip (I have not looked into this) - which as far as I know modifies the boot0 parition on the EMMC, now, boot0 is the primary bootloader on Switch and without it you won’t see any nintendo logo/s and will just have a black screen, now, if the modchip has modified this boot0 or corrupted it then you will no longer be able to boot stock OS as a result. Hopefully that makes sense so this is how a software issue can cause such an issue. I’d also wager that the modchip requires a valid (or prior valid then modified) boot0 parition in order to work which it will likely determine based on a checksum (guess)

Anyway, once you’ve confirmed your EMMC is good, and if so, regen boot 0/1 etc then we can troubleshoot your modchip and install later.

If you can, provide my high quality photos of your SoC and all other areas closeup where you soldered in good lighting with the modchip removed and I can check for any potential install issues etc

[minimanimo]

Hi @Severence,
I was not able to write a reply because the forum has a limit and then you have to wait 24 hours. I hope I can get rid of this soon.

Sorry, I forgot to mention my Switch is a Mark V2.
Modchip is HwFly RP2040 core.

@Severence

We first have to determine what is the problem in a stock situation (no modchip) I’m making the assumption that the RP2040 modchip which your using is working in the same way as the HwFly/SX modchip (I have not looked into this) - which as far as I know modifies the boot0 parition on the EMMC, now, boot0 is the primary bootloader on Switch and without it you won’t see any nintendo logo/s and will just have a black screen, now, if the modchip has modified this boot0 or corrupted it then you will no longer be able to boot stock OS as a result. Hopefully that makes sense so this is how a software issue can cause such an issue. I’d also wager that the modchip requires a valid (or prior valid then modified) boot0 parition in order to work which it will likely determine based on a checksum (guess)

I would say you right, because I had a preliminary issue where my chip had a firmware not very up-to-date and overwritten the boot at the first start.

@Severence

Anyway, once you’ve confirmed your EMMC is good, and if so, regen boot 0/1 etc then we can troubleshoot your modchip and install later.

I’ve bought the emmc reader from the link you provided (tindie) but I guess it will take some time. Might be a dummy question: is it also capable of writing? If not, I guess would be a problem to recover the emmc.

@Severence

If you can, provide my high quality photos of your SoC and all other areas closeup where you soldered in good lighting with the modchip removed and I can check for any potential install issues etc

Yes please, here some (EDIT: I have also added other photos at the bottom, under the spoiler):

Some other photos I wanted to share before:

Previous photos

[Severence]

@minimanimo

Modchip is HwFly RP2040 core.

I see, for clarity the original Hwfly was a 1:1 clone of the SX modchip and this newer version which you have seems to be a clone of the original hwfly/SX using “picofly” software afaict (and of course using a RP IC instead of GD32 and CPLD)… anyway looking at the git and on quick glance (sorry i’m not going to start delving into their code) but it does mention it writes to the EMMC, so I can only guess it’s working pretty much the eact same way as the original SX/Hwfly in terms of functionality.

@minimanimo

Might be a dummy question: is it also capable of writing?

No it’s not a dummy question this device basically works like any SD reader so yeah, you can read and write with it. though, just to note, in order to see, read or write the boot0 / boot1 partitions you need to do it in a linux enviroment (unless there is some software which i don’t know about which can utilize this hardware within Windows OS).

@minimanimo

Yes please, here some (EDIT: I have also added other photos at the bottom, under the spoiler):

These images of the SoC are a bit blurry and cropped so bit hard to see anything unfortunately but i can see minor damage to the SoC die bottom left (though i have seen worse and for them stiill to work)

[minimanimo]

@Severence

just to note, in order to see, read or write the boot0 / boot1 partitions you need to do it in a linux enviroment

Oh yes, I was already looking some documentation/tutorials. For this, no problem I can run on ubuntu environment.

@Severence

These images of the SoC are a bit blurry and cropped so bit hard to see anything unfortunately but i can see minor damage to the SoC die bottom left (though i have seen worse and for them stiill to work)

Oh yes, I will try to make better pictures, this was done via the (cheap) microscope. Luckily, checking with multimeter, the caps looks still having good values.

I’ve also checked the M92T chip: all caps around it are good, no shorts.
Do you know if I can check any other short?

My biggest fear is if the CPU is dead, or Emmc dead at hardware level

[Severence]

@minimanimo

Do you know if I can check any other short?

you’ll wanna check resistance to ground on your primary rails (several posts on the forum by me on this) as the modchip connects up to I think four of these, those being your boot CPU rail, secondary CPU rail and 3V3PDR and 1V8PDR for the EMMC (most of these rails can be easily found at the main max PMIC)

@minimanimo

My biggest fear is if the CPU is dead, or Emmc dead at hardware level

Unfortunately it’s entirely possible, the designs of these modchips / ribbons are terrible and so is the locations which they connect to. It’s also far to easy for solder to go underneath the ribbon and bridge out those SoC caps either hard or soft short unbeknownst to the installer and sometimes the solder mask on the ribbon comes away on the edges and encourages this (again, poor design) - Also the possibility of it killing the EMMC or corrupting the data is also likely given the way these devices work, meaning any interruption during it’s EMMC write process could corrupt or damage the EMMC (depending) - I’m really not a fan of these modchips tbh and if i absolutely just had to use one (though as I say, I wouldn’t) I’d be installing them with enamel wire and not those ribbon cables, and I certainly wouldn’t be soldering them directly to the SoC (there are far better locations which you can buzz out in continuity mode)

If it turns out the SoC or EMMC is dead, then just write it off and keep the board as a donor and pick up an unpatched Switch instead

[minimanimo]

Hey @Severence,
I hope to find you well!

I got a notification, might be that the reader arrived to the pickup point but I will discover it later the day.

Question: in case the Emmc is good, would it be possible to restore the original boot partition and boot it without modchip? Or is only possible to write a modified boot and thus forced to boot it via the modchip?

I would like to test if the console will still be fine, also because I cannot exclude if the V2 flex adapter is damaged (any tip on how to test it?)

Many thanks

[Severence]

@minimanimo

would it be possible to restore the original boot partition and boot it without modchip?

Yes and no, if the OS/FW version is low enough to use Choidujournx on PC to generate these partitions or if there is another tool which can do it with the more recent OS versions (sorry I’ve not looked into it) As far as I remember Daybreak is on console only (though someone correct me if I’m wrong) - failing that, then asking someone else to provide you these partitions from their dumps should work afaik. If you let me know what version your on I might have the corresponding boot0/1 (though don’t get your hopes up)

If you get these dumps then you can write them back, though, if you can, try to find a GUI tool to do this in linux as using the terminal is inviting disaster. Of course, prior to all this (assuming the EMMC is good) you should back up all EMMC partitions and put them in a safe place.

@minimanimo

(any tip on how to test it?

Measure in resistance across the “pads” which would connect either side of the caps… though, as i mentioned earlier you should toss this in the bin and buzz out better locations and use enamel wire instead. But, let’s worry about this later if and once your booting stock standard again.

[minimanimo]

Good news @Severence,

I’ve received the reader, connected in Ubuntu and I can see all the Emmc partitions! Apparently, it is alive.

I am backing up right now boot0, boot1 and the whole raw nand. I will do it two times, just to be sure ahahha

@Severence

If you let me know what version your on I might have the corresponding boot0/1

That’s a tricky question: is there a way to derivate it somehow from the dumps?

I have the serial number, I can tell you the switch is Mariko V2 but I don’t remember about the last firmware version on the console

[Severence]

@minimanimo

I’ve received the reader, connected in Ubuntu and I can see all the Emmc partitions! Apparently, it is alive.

Good news

@minimanimo

That’s a tricky question: is there a way to derivate it somehow from the dumps?

Yes, as mentioned earlier you can view the EMMC in NXNandManager on Windows and you should be able to see the FW version (I think by selecting the prodinfo partition) and afair you don’t even need the keys.

@minimanimo

I am backing up right now boot0, boot1 and the whole raw nand. I will do it two times, just to be sure ahahha

Can you upload the boot0/1 partitions to a file sharing site and provide the link, I’d like to take a look at them and see if they’ve been modified or corrupted.

[minimanimo]

Hey @Severence,
I went through the whole conversation and must have missed it, sorry.

Not sure if is a good news: I’ve tried to open as file in NxNandManager the raw nand, I have some informations but not the FW ver.

I attach the screenshot here.
In the meantime, I will google to check better the tool.

@Severence

Can you upload the boot0/1 partitions to a file sharing site and provide the link, I’d like to take a look at them and see if they’ve been modified or corrupted.

Sure, I am going to DM you with the link. I hope I can DM you.
Thanks!

[Severence]

@minimanimo

Not sure if is a good news: I’ve tried to open as file in NxNandManager the raw nand, I have some informations but not the FW ver.

Sorry, I’ve misremembered, I think you can get the full FW version from the decrypted Prodinfo parition (which you can’t do in your case) but you can also get a loose (missing digit after the demial place which shouldn’t matter) version number from the boot 0 partition - so hopefully I can see from your boot 0 dump what this is assuming the data is still there.

You can also just try opening the boot 0 file up in NXNandManager and see what it says.

@minimanimo

Sure, I am going to DM you with the link. I hope I can DM you.

You can just make it public… there is nothing special about the boot 0/1 partitions

[minimanimo]

Not great luck while reading the Boot0:

Here Boot0 and Booo1, I hope you can save me

[doesn’t allow me to link, please add dots in the first 3 words] drive google com/drive/folders/1h0lVuKMnOm54XNoRP9uxw86-e60YTmhx?usp=drive_link

[Severence]

Make it a public link, this one requires access code (don’t worry there is nothing special about your boot 0/1 at all as it’s the same as every other boot 0/1 on this FW version hence why it is not encrypted/doesn’t require keys) Or upload it to Mega or something

[minimanimo]

Oh sorry, my bad.

Can you retry now? It should be available without code or authentication.