5.5 KiB
Exact-version firmware changes without distributing images
Stock reference
PICO Swift2.0 FW189 file name: Swift2.0_sv1.89_20241213_b189_app.bin. The vendor container is193385bytes, SHA25641bd2d24dd9293e7d17c62ab18acd1001d6085da393123a67d226b28d2132e54. A321byte(0x141) header precedes two identical96532byte application segments. The application SHA256 is477000fc1fde2b518f51a3a2233dc38714731049093e236d15cfe049cd690a89, load baseVA0x1000.96532 decimal is0x17914; the end-exclusive VA is0x18914. Do not disassemble the vendor container as if offset0 were application code.
No stock container/application, patched application, assembly listing, linker output, shared library or decompiled file is included. Obtain the exact stock privately as described in ACQUISITION.md.
Installed diagnostic10
The exact recorded installed image is98868bytes, SHA256040b304d33e200785bb04ad4b2c0d8730f75d97e4798691530ac2d79b247376d. Appended section beginsVA0x18918 after four alignment bytes;2332 authored payload bytes plus4padding bytes produce2336bytes total expansion. The sparse comparator independently finds90 changed stock-position bytes,22 contiguous changed runs. The historical patch manifest describes24 logical edit sites: these counts measure different things and must not be conflated.
Changes include conditional stock/Frame radio timing selectors, startup mode handling, a mode-query/switch protocol, deferred mode commit after native receive completion, heap/state reservation, and event observers.32bytes are reserved at0x20005150..0x2000516f, reducing the native heap512→480. Active mode and pending mode are distinct. Event sequence and five ordered timestamps are stronger evidence than isolated8bit summary counters.
The product version stays189. Mode query is identity/nonce/schema-bound, not a version-string test. Default stock behavior and early boot-release gestures are documented, but physical button timing and power-cycle behavior must be proved for the admitted image. Nominal startup release100..149counts is not a universal1second hardware guarantee.
Native code paths outside the hooks remain stock by design; exact equality must be checked for the path under investigation. ACK is not native mode commit. Commit requires native pending/N/RADIO-idle conditions; host must observe a fresh reply with actual applied mode/N/pending state. Service mode0 is used for separately authorized update operations; normal Game mode1 needs continuously refreshed finite proof.
Historical branches and hazards
The catalog includes grid-only and dual-mode generations, rejected fallthrough/unaligned/u8-counter candidates, revisions07–10 and the uninstalled candidate11 short-producer branch. Every distinct reconstructed image is tied to its hash and source aliases. Except for the saved installed baseline, candidates remain historical/offline and must not be treated as approved hardware releases.
Stale pending OTA workers can ACK after a fresh queue barrier. Empty queue, new nonce and reconnect alone did not prove clean application state. Prepare ACK, block/tag generation, zero-length sentinel,24byte blocks, CRC8/MAXIM and transfer/activation are distinct stages. The reflected CRC8 polynomial is8C; check string123456789 givesA1. A transfer can finish while boot/recovery remains unproved.
Revision07 initially failed during transfer, later service-specific transfer succeeded; revision09 and diagnostic10 introduced additional admission/observer work.189 completed diagnostic10 transfer;191 supplied later activation evidence. Older manifests intentionally preserve offline flags such as approved_for_otafalse; do not rewrite them as current blanket permission or repeat OTA because of historical flags.
Recovery searches in PICO OS/APKs/system/vendor/product/odm and native commands had limited coverage. Station/controller boot/download paths are not a verified Swift recovery loader. b97 is not assumed compatible. GET_BASE_ADDR in the investigated BLE updater queues PAGE_ERASE; log getters can write/advance cursors. Do not call them read-only dump APIs. Read-only SWD requires audited no-unlock/no-erase/no-reset/no-halt hooks and checked power-request release; an OpenOCD reset_config alone is insufficient.
Difference files and offline use
firmware-diffs/catalog.json lists24 unique sparse diffs. Each records exact stock and result lengths/hashes, changed positions only, appended authored difference only, and source aliases. No unchanged stock image data is included. Both forward reconstruction and reverse-to-stock were executed against local originals during packaging.
Use tools/firmware_diff.py only with a lawfully obtained exact stock or exact patched input, and put any reconstructed image outside this package. The utility refuses mismatched hashes and package-contained output. Its verify operation reconstructs in memory and writes no image. This is offline reproducibility, not OTA tooling or device readiness.
Reimplementing from source
Obtain the rights-cleared first-party builder and authored source from the owner, verify the catalog hashes, compile Cortex-M4 Thumb assembly with the recorded Clang/LLD toolchain, extract the appended section, apply the exact stock-relative hooks and compare the final SHA. The diagnostic10 recorded compiler was LLVM18.1.6 from the Zig bootstrap distribution. A different compiler may produce a different image; only exact hash establishes identity. This handoff does not assign MIT/Apache rights to unknown code or claim binary provenance alone proves ownership.