Pandora (unbricker/downgrader) for PSP-200X TA-088v3

[frostegater]

Service Kit for PSP-200X
(supports TA-088v3)
{ NO SALES HERE }

After a successful hack and hide the long-time topic:
"Размышления о возможностях взлома ТА88v3"
...it was decided unhide.

First video by Yoti

New video by ErikPshat

Service Kit and MSID Dumper:

• Service_memstick_TA-088v3.zip
  
• MSID Dumper & SRC.zip

Structure folders in first archive:

• Extracted Files Original - all files from original JigKick Card.
• MSID 512mb Original - dump MSPro ID from original JigKick card.
• Original Dump MS - full dump Service Card.
• Write IPL to MS - tool for writing ipl in MemoryStick™.

How to do your own magic Service Card:

1. Firstly you need not original MemoryStick™ PRO DUO (from our china friends, cards w/o MagicGate). Usually it's an 512 Mb, 2 Gb or 4 Gb models.
2. Original Sony MemoryStick™ PRO DUO are not supported ('cause we have no datasheets/programmers for it).
   
   This card is BAD

   
   

   
   
   
   
   
   
   
   
3. Download "MSID Dumper", insert MemoryStick™ in PSP and launch programm. Write on paper Serial Number and MSProID.
4. Remove the back shell of the MS using a knife (scalpel).
5. Extract internal board (with NAND) from case.
6. Unsold NAND microchip from card. [Some hardware magic!]
   
   This card is GOOD ('cause you have direct access to NAND)

   
   

   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
7. Insert NAND in NAND Flash TSOP-48 programmer: http://www.soft-center.ru/reader/
8. Support NAND list

   • 29F128G08CJAAA
   • 29F16G080AA
   • 29F16G08AAMCI
   • 29F16G08MAA
   • 29F32G08AAM02
   • 29F32G08CAMCI
   • 29F32G08CBAAA
   • 29F32G08FAA
   • 29F32G08FAMB2
   • 29F32G08JAMD2
   • 29F32G08QAA
   • 29F32G08TAA
   • 29F64G08AAME1
   • 29F64G08CAMD2
   • 29F64G08CAMDB
   • 29F64G08CFAAA
   • 29F64G08CFABA
   • 29F64G08FAMCI
   • 29F8G08MAA
   • 8GbUTHN
   • ???
   • D27UAG8T2MTR
   • F4GMSAP
   • FBAL41B8GK3W
   • FBNL41B8GK3PG
   • FBNL63B5IK3WG
   • FDL63AP-32U
   • FNNM29B2GK3WG
   • FQ64G08UCT1-24
   • FT16G08UCM03
   • FTAL41B8Gk3WG
   • FTNM40A4GK3W2
   • H27UAG8T2ATR
   • H27UDG8VEMYR
   • HN29V1G
   • HVPE4F4
   • HVPG3P3
   • HY27UA081G1M
   • HY27UBG8T2ATR
   • HY27UBG8T2MYR
   • HY27UBG8U5MTR
   • HY27UF081G2M
   • HY27UF084G2M
   • HY27UG082G (?)
   • HY27UG082G2M
   • HY27UG082G4 (?)
   • HY27UG084G2M
   • HY27UG088G5
   • HY27UG088G5M
   • HY27UH088G2
   • HY27UH08AG5
   • HY27US08121M
   • HY27UT084G
   • HY27UT084G2
   • HY27UT088G2M
   • HY27UU088G5M
   • HY27UU08AG5A
   • HY27UV08AG5
   • HY27UV08BG5
   • HY27UW08BGFM
   • K9ABG08U0A
   • K9BCG08U1A
   • K9CDG08U5A
   • K9E2G08U0M
   • K9F1208U0M
   • K9F1G08
   • K9F1G16
   • K9F2808
   • K9F2G08
   • K9F4G08
   • K9F5808
   • K9F8G08
   • K9G8G08U0B
   • K9G8G08UOM
   • K9GAG08U0M
   • K9GBG08U0M
   • K9HAG08U1M
   • K9HBG08U1A
   • K9HBG08U1M
   • K9HCG08
   • K9HDG08U5M
   • K9K1G08
   • K9K2G08
   • K9K2G16
   • K9K4G08
   • K9K8G08U0M
   • K9K8G08U1M
   • K9L8G08
   • K9LAG08
   • K9LBG08U0D
   • K9LBG08U0M
   • K9MDG08U5M
   • K9NBG08
   • K9NCG08U5M
   • K9W8G08
   • K9WAG08
   • M8UJ3C26AH
   • MT29F2G08
   • MT29F4G08
   • N1G08UOA
   • P1U4GR30CT
   • PQI-KA04-072A-1D00
   • PQI-KA04-072F-1D00
   • R1FV04G13RSA
   • SDTHGEHE0-1024
   • SDTNGCHE0-2048
   • SDTNGCHEM-1024
   • SDTNIGHSM-2048
   • SDTNIGHSM-4096
   • SDTNKLAHSM-1024
   • SDTNKLBHSM-2048
   • SDTNKLBHSM-2048
   • SDTNLLBHSM-4096
   • SDTNMMAHSM-002G
   • SDTNMMBHSM-004G
   • SDXNGDHE0-4096-I
   • T04G724
   • TC58DVG04B1FT00
   • TC58DVM72A
   • TC58DVM9
   • TC58NVG1
   • TC58NVG2
   • TC58NVG3
   • TC58NVG4T2ETA00
   • TC58NVG5D2FTAIO
   • TH58DVG2
   • TH58NVG4D4CTG00
   • TH58NVG5D1DTG20
   • TH58NVG5D1DTG20
   • TH58NVG5D2ETAK0
   • TH58NVG5D4CTG20
   • TH58NVG5T2ETA00
   • TH58NVG5T2ETA20
   • TH58NVG6D2ELA48
   • TH58NVG6D2ETA20
   • TH58NVG6T2ETA20
   • TH58NVG6T2ETA2A
   • TH58NVG7D1DLA87
   • TH58NVG7D2ELA48
   • TH58NVG7D2ELA89
   • TH58NVG8D2ELA89
   • Unknown
   • VD101L3LC03
   • VD101M3MC03
   • VD101N3NC03
   • VD102Q3QC33
   • xD card 128
   • xD card 256
   • xD card H1024
   • xD card H512
   • xD card M1024
   • xD card M2GB

   Source: http://www.soft-center.ru/reader/NAND_List.php
9. Install programmer software (Supplied with programmer).
10. Connect programmer to PC.
11. Dump part NAND with MSID (MemoryStick™ ID). If you dump not access part, dump other part...
12. Open NAND by HEX Editor and search HEX points: 204D5350534E5930.
    
    
    ScreenShot MSID in dump

    
    

    
    
    
    
    
13. If you not found this points, dump other list.
14. Correct msid from dump: 204D5350534E593000788884C6AA0000. Fat text-found points in dump (up items).
15. After correct msid, save file and writing dump in NAND.
16. Sold NAND in card and insert card in case.
17. Format card in PSP.
18. From folder "Write IPL to MS" launch "install_psp_ms_multi_loader_ipl.cmd"
19. Connect PSP to PC.
20. Press "Y".
21. If print "Write MS BOOT CODE" - IPL writing access.
    • If print "Canceled" - you press not correct pad.
    • If print "Check free reserved sector : to small reserved sectors" - using mspformat.exe.
22. Open MemoryStick™ by HEX editor. Veryfying installed IPL from 16 sector.
23. From folder "Extracted Files Original" copy all files in MemoryStick™.
24. Complete!

P.S. I`m translate The original theme in Russian by ErikPshat... Thanks vit9696. Sorry for my bad english...

[Yoti]

Сообщение от manyaksbs how to magic memory stick please video.

1. hardware: get a right memstick, unsold nand, do a dump of nand, reprogram dump with new msid, write new/modified dump to nand, sold nand back to memstick
2. software: inject ipl from archive, copy all files to card
3. unbrick: insert your jigstick, insert pandora battery, wait for "OK"

[xland]

After hard work (regenerate ecc and spare part for changed page in nand) I make one stick (1GB) with corect MSID.
I inserted IPL from archive and verify if are corect writed.
All files was transfered to MS but when I put standard Pandora battery with MS inserted dont make nothing. Only green light like when use standard MSID.
Files was transfered in MS root.
Here's my dump MSID after change operation: attr0.rar.
I change only MSID, its necesary to change and serial (35000000)?.
Please give me some advice where Im wrong.
PSP its with mainboard TA088v3
attr0.rar

[Yoti]

Сообщение от xland its necesary to change and serial (35000000)?

No

Сообщение от xland Please give me some advice where Im wrong.

Hardware problems on bricked PSP?
You may test card on ANY psp2k. Not all of cards are will work more than 0 (zero) times

[xland]

Сообщение от Yoti Hardware problems on bricked PSP?

No

Сообщение от Yoti You may test card on ANY psp2k.

I have one bricked PSP and good one. Same on both.

Сообщение от Yoti Not all of cards are will work more than 0 (zero) times

Be more explicit please .

[Yoti]

Сообщение от xland Be more explicit please

If you do your card 100% right it may not work.

[xland]

Сообщение от Yoti If you do your card 100% right it may not work.

Thanks, I'll try with other card.

[xland]

I make new card and I have same issues like first card.
When tell me dont work all cards means dont work because its wrong ECC and stick controller dont pass errors or and if I have good ECC (with good MSID of course) and card its recognised correct may not work?
Why PSP memory led stay all time off?
I think when put Pandora battery PSP must read information about MSID and after that MSIPL from card but card isnt accesed any more.

PS. I read and information from russian thread. Who make working stick have luck and find card what dont check ECC and change only MSID or change both: and MSID and ECC like me?

[Yoti]

Сообщение от xland When tell me dont work all cards means dont work because its wrong ECC and stick controller dont pass errors or and if I have good ECC (with good MSID of course) and card its recognised correct may not work?

Don't know why, may be as you explained.

Сообщение от xland I think when put Pandora battery PSP must read information about MSID and after that MSIPL from card but card isnt accesed any more.

PSP -> Battery : Your SN?
Battery -> PSP : FFFFFFFF
PSP -> MemStick : IPL?
MemStick -> PSP : %here it is%
PSP -> Pre-IPL : Check it!
Pre-IPL -> PSP : All ok.

[xland]

Сообщение от Yoti PSP -> Battery : Your SN? Battery -> PSP : FFFFFFFF PSP -> MemStick : IPL? MemStick -> PSP : %here it is% PSP -> Pre-IPL : Check it! Pre-IPL -> PSP : All ok.

That I know from this steps:
PSP -> Battery : Your SN? - its FFFFFFFF (Pandora Battery)
Battery -> PSP : FFFFFFFF - returned corect
PSP -> MemStick : IPL? - Here I dont know because I dont see light on MS led - Your IPL its injected and begin at 16 sector.
MemStick -> PSP : %here it is%
PSP -> Pre-IPL : Check it!
Pre-IPL -> PSP : All ok.

I dont see in above steps MSID verification or its used only after all this steps for decrypting?

xland добавил 19.12.2011 в 22:41
Thanks a lot for advices Yoti.
My mistake was I inject IPL on PSP 2004 and for me dont work this.
After I inject IPL on PSP Phat all was OK.
Was good and first card.
Bricked PSP with TA088v3 its now alive again

[ikyak]

excuse me, i got a lot of question here, how do i connect TSOP-48 programmer to pc? does TSOP-48 programmer using usb port? what OS does it support to? if it's available, where do i can buy it? any help would be appreciated,

[frostegater]

Сообщение от ikyak excuse me, i got a lot of question here, how do i connect TSOP-48 programmer to pc? does TSOP-48 programmer using usb port? what OS does it support to? if it's available, where do i can buy it? any help would be appreciated,

You buy programmer in soft-center?

[Yoti]

Сообщение от xland I dont see in above steps MSID verification or its used only after all this steps for decrypting?

*.prx.enc files and may be some other signed with msid.

Сообщение от xland Bricked PSP with TA088v3 its now alive again

Congrats!

[ikyak]

Сообщение от Frostegater You buy programmer in soft-center?

NOT YET, I'M JUST WONDERING HOW TO CONNECT IT JUST BEFORE I BUY ONE.

ikyak добавил 24.12.2011 в 17:57
i'm sorry, can i just buy both magic Service Card and Pandora Battery from u? 'cause it's impossible for me to make one, i don't even have a soldering skill. my psp slim 2k (ta-088v3) have been dying here,

[gettergtr]

Well...it's not easier to buy a complete Pandora pack for novice?

[mari95]

Hello. It's good programmer for this operation? http://www.ebay.com/itm/Willem-EPROM...item2eb1693c82

[frostegater]

mari95, may be.. but not tested... I think, you will have problems with ECC.

[mari95]

What program selector will you recommend? Cheap and with socket and adapter TSOP48. Give me link from e-bay , please.

Sorry for my bad english. I'm is from Poland.

[lenovo3000]

@mari95 - musi być taki co obsługuje te układy http://www.soft-center.ru/reader/NAND_List.php
The programmer that supports systems with a nand_list np. http://dybkowski.net/download/nand_flash/k9g8g08u0a.pdf

[mari95]

lenovo3000, jesteś z Polski? Mógłbyś mi pomóc na gadu gadu z tym programatorem?

[lenovo3000]

Usb xD READER plus adapter (PCB GOTRONIK with Flash-chip holder from Ebay)

Screen