Pandora (unbricker/downgrader) for PSP-200X TA-088v3

[frostegater]

Service Kit for PSP-200X
(supports TA-088v3)
{ NO SALES HERE }

After a successful hack and hide the long-time topic:
"Размышления о возможностях взлома ТА88v3"
...it was decided unhide.

First video by Yoti

New video by ErikPshat

Service Kit and MSID Dumper:

• Service_memstick_TA-088v3.zip
  
• MSID Dumper & SRC.zip

Structure folders in first archive:

• Extracted Files Original - all files from original JigKick Card.
• MSID 512mb Original - dump MSPro ID from original JigKick card.
• Original Dump MS - full dump Service Card.
• Write IPL to MS - tool for writing ipl in MemoryStick™.

How to do your own magic Service Card:

1. Firstly you need not original MemoryStick™ PRO DUO (from our china friends, cards w/o MagicGate). Usually it's an 512 Mb, 2 Gb or 4 Gb models.
2. Original Sony MemoryStick™ PRO DUO are not supported ('cause we have no datasheets/programmers for it).
   
   This card is BAD

   
   

   
   
   
   
   
   
   
   
3. Download "MSID Dumper", insert MemoryStick™ in PSP and launch programm. Write on paper Serial Number and MSProID.
4. Remove the back shell of the MS using a knife (scalpel).
5. Extract internal board (with NAND) from case.
6. Unsold NAND microchip from card. [Some hardware magic!]
   
   This card is GOOD ('cause you have direct access to NAND)

   
   

   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
7. Insert NAND in NAND Flash TSOP-48 programmer: http://www.soft-center.ru/reader/
8. Support NAND list

   • 29F128G08CJAAA
   • 29F16G080AA
   • 29F16G08AAMCI
   • 29F16G08MAA
   • 29F32G08AAM02
   • 29F32G08CAMCI
   • 29F32G08CBAAA
   • 29F32G08FAA
   • 29F32G08FAMB2
   • 29F32G08JAMD2
   • 29F32G08QAA
   • 29F32G08TAA
   • 29F64G08AAME1
   • 29F64G08CAMD2
   • 29F64G08CAMDB
   • 29F64G08CFAAA
   • 29F64G08CFABA
   • 29F64G08FAMCI
   • 29F8G08MAA
   • 8GbUTHN
   • ???
   • D27UAG8T2MTR
   • F4GMSAP
   • FBAL41B8GK3W
   • FBNL41B8GK3PG
   • FBNL63B5IK3WG
   • FDL63AP-32U
   • FNNM29B2GK3WG
   • FQ64G08UCT1-24
   • FT16G08UCM03
   • FTAL41B8Gk3WG
   • FTNM40A4GK3W2
   • H27UAG8T2ATR
   • H27UDG8VEMYR
   • HN29V1G
   • HVPE4F4
   • HVPG3P3
   • HY27UA081G1M
   • HY27UBG8T2ATR
   • HY27UBG8T2MYR
   • HY27UBG8U5MTR
   • HY27UF081G2M
   • HY27UF084G2M
   • HY27UG082G (?)
   • HY27UG082G2M
   • HY27UG082G4 (?)
   • HY27UG084G2M
   • HY27UG088G5
   • HY27UG088G5M
   • HY27UH088G2
   • HY27UH08AG5
   • HY27US08121M
   • HY27UT084G
   • HY27UT084G2
   • HY27UT088G2M
   • HY27UU088G5M
   • HY27UU08AG5A
   • HY27UV08AG5
   • HY27UV08BG5
   • HY27UW08BGFM
   • K9ABG08U0A
   • K9BCG08U1A
   • K9CDG08U5A
   • K9E2G08U0M
   • K9F1208U0M
   • K9F1G08
   • K9F1G16
   • K9F2808
   • K9F2G08
   • K9F4G08
   • K9F5808
   • K9F8G08
   • K9G8G08U0B
   • K9G8G08UOM
   • K9GAG08U0M
   • K9GBG08U0M
   • K9HAG08U1M
   • K9HBG08U1A
   • K9HBG08U1M
   • K9HCG08
   • K9HDG08U5M
   • K9K1G08
   • K9K2G08
   • K9K2G16
   • K9K4G08
   • K9K8G08U0M
   • K9K8G08U1M
   • K9L8G08
   • K9LAG08
   • K9LBG08U0D
   • K9LBG08U0M
   • K9MDG08U5M
   • K9NBG08
   • K9NCG08U5M
   • K9W8G08
   • K9WAG08
   • M8UJ3C26AH
   • MT29F2G08
   • MT29F4G08
   • N1G08UOA
   • P1U4GR30CT
   • PQI-KA04-072A-1D00
   • PQI-KA04-072F-1D00
   • R1FV04G13RSA
   • SDTHGEHE0-1024
   • SDTNGCHE0-2048
   • SDTNGCHEM-1024
   • SDTNIGHSM-2048
   • SDTNIGHSM-4096
   • SDTNKLAHSM-1024
   • SDTNKLBHSM-2048
   • SDTNKLBHSM-2048
   • SDTNLLBHSM-4096
   • SDTNMMAHSM-002G
   • SDTNMMBHSM-004G
   • SDXNGDHE0-4096-I
   • T04G724
   • TC58DVG04B1FT00
   • TC58DVM72A
   • TC58DVM9
   • TC58NVG1
   • TC58NVG2
   • TC58NVG3
   • TC58NVG4T2ETA00
   • TC58NVG5D2FTAIO
   • TH58DVG2
   • TH58NVG4D4CTG00
   • TH58NVG5D1DTG20
   • TH58NVG5D1DTG20
   • TH58NVG5D2ETAK0
   • TH58NVG5D4CTG20
   • TH58NVG5T2ETA00
   • TH58NVG5T2ETA20
   • TH58NVG6D2ELA48
   • TH58NVG6D2ETA20
   • TH58NVG6T2ETA20
   • TH58NVG6T2ETA2A
   • TH58NVG7D1DLA87
   • TH58NVG7D2ELA48
   • TH58NVG7D2ELA89
   • TH58NVG8D2ELA89
   • Unknown
   • VD101L3LC03
   • VD101M3MC03
   • VD101N3NC03
   • VD102Q3QC33
   • xD card 128
   • xD card 256
   • xD card H1024
   • xD card H512
   • xD card M1024
   • xD card M2GB

   Source: http://www.soft-center.ru/reader/NAND_List.php
9. Install programmer software (Supplied with programmer).
10. Connect programmer to PC.
11. Dump part NAND with MSID (MemoryStick™ ID). If you dump not access part, dump other part...
12. Open NAND by HEX Editor and search HEX points: 204D5350534E5930.
    
    
    ScreenShot MSID in dump

    
    

    
    
    
    
    
13. If you not found this points, dump other list.
14. Correct msid from dump: 204D5350534E593000788884C6AA0000. Fat text-found points in dump (up items).
15. After correct msid, save file and writing dump in NAND.
16. Sold NAND in card and insert card in case.
17. Format card in PSP.
18. From folder "Write IPL to MS" launch "install_psp_ms_multi_loader_ipl.cmd"
19. Connect PSP to PC.
20. Press "Y".
21. If print "Write MS BOOT CODE" - IPL writing access.
    • If print "Canceled" - you press not correct pad.
    • If print "Check free reserved sector : to small reserved sectors" - using mspformat.exe.
22. Open MemoryStick™ by HEX editor. Veryfying installed IPL from 16 sector.
23. From folder "Extracted Files Original" copy all files in MemoryStick™.
24. Complete!

P.S. I`m translate The original theme in Russian by ErikPshat... Thanks vit9696. Sorry for my bad english...

[mari95]

Lenovo3000 give me links for good offer of this reader and adapter TSOP48 , please.

[lenovo3000]

@mari95
Reader = czytnik kart xD
adapter TSOP48 = adapter kupiony na ebay
płytka pod adapter = płytka z Gotronik.pl kupiona na allegro
Najgorzej wlutować w/w adapter w płytkę tak by nie doszło do zwarcia na istotnych pinach.
Nie ma linku do gotowego programatora. Jedynie do tego co Rosjanie proponują. Samemu musisz coś takiego złożyć. Jak to będzie działać zależy od dokładności składającego. Karty xD to nic innego jak nandflash tylko w innej obudowie jak TSOP48. Programu do edycji zawartości to poleciłbym DMDE.
Całkiem ciekawy pomysł to skrzyżowanie rozłożonej karty Mstick (tylko sam kontroler) ze złączem-szczęką umożliwiającą wsadzenie karty xD. Wtedy nie będzie potrzebne babrać się w NANDach bo wystarczy odpowiedni wsad Yoti-ego wsadzony na Xd i dalej jak w opisie. Wtedy nie będzie potrzeby kupować drogiego programatora. Tak czy inaczej samemu trzeba nad tym pomysleć.
Sam widzisz że linku żadnego nie podam. By znaleźć adapter wpiszesz "TSOP48" w ebay.com.au i ci wywali kilku sprzedawców . Są dwa czy trzy rodaje tych adapterów. Ja kupiłem najtańszy. Wydałem koło 49zł . Korzystaj że dolar tani. Może do 2.50zł za 1USD daleko ale urwać 1/3 można przy wahaniach. Powodzenia.

[mari95]

Lenovo3000 to widzę ,że jednak lipna sprawa z tym programowaniem. Nie takie łatwe jakby się wydawało. Czy ty umiesz zaprogramować i możesz zaprogramować taką kartę? Odkupiłbym od ciebie. Szkoda ,że nie ma chociaż jednej osoby ,która sprzedaje takie karty.

[cw455]

you can unlock my psp
PSP-3004 è il codice 8D ta-090
PSP-3004 è il codice 9D ta-090
PSP-3004 è il codice 9C ta-093

[lpinho]

A big thanks from Portugal for the work and translation.

It's a shame that the reader is so expensive, I hoped some chinese fab already taken up the task to sell these online.

Thanks anyway!!! Great work

[Gregorio]

cw455, no, only ta-088v3(PSP-200*) supported

[frostegater]

Сообщение от gregorio cw455, no, only ta-088v3(PSP-200*) supported

For all PSP-20xx

[mari95]

Frostegater, not work on TA-090v2?

[frostegater]

mari95, yaaahr.. 090v2 its PSP-200x?!

[mari95]

TA-090 is in slim 2000. TA-090v2 - first motherboard in slim 3000.

[Gregorio]

mari95, TA-090v2 not supported, all psp 300* not supported

[ikyak]

excuse me, what is the main point of having TSOP Programmer? is it only to CHANGE the MS ID?

[tymagix]

hello I would like to know if it was possible to modify the ms without resorting to the method of opening the ms, a software program in bulk?

[Gregorio]

tymagix, it is impossible
ikyak, I do not understand the question

[lpinho]

Hi, sorry if these are stupid questions.

Is the information that you change in the nand of a memory stick protected by any copyright laws or any law? Why is it impossible to find this for sale anywhere?(lack of commercial interest? illegal to sell? am I looking in the wrong places ?)

Thanks

[Gregorio]

lpinho, it is illegal, and that no one involved in

[tymagix]

agreed for your reply I have only bought me a nand programmer TSOP48

tymagix добавил 01.03.2012 в 14:58
for the programmer need a TSOP48 8 bit or 16 bit?

[Gregorio]

tymagix, 16 bit

[ikyak]

Сообщение от Gregorio I do not understand the question

i mean, is the reason of having that tool(TSOP, only to change msid? if so, then why don't we just change it via some softwares which already have the feature, such as MiniTool Partision Wizard. CMIIW

[Gregorio]

ikyak, it is impossible to have all tried