Pandora (unbricker/downgrader) for PSP-200X TA-088v3

[frostegater]

Service Kit for PSP-200X
(supports TA-088v3)
{ NO SALES HERE }

After a successful hack and hide the long-time topic:
"Размышления о возможностях взлома ТА88v3"
...it was decided unhide.

First video by Yoti

New video by ErikPshat

Service Kit and MSID Dumper:

• Service_memstick_TA-088v3.zip
  
• MSID Dumper & SRC.zip

Structure folders in first archive:

• Extracted Files Original - all files from original JigKick Card.
• MSID 512mb Original - dump MSPro ID from original JigKick card.
• Original Dump MS - full dump Service Card.
• Write IPL to MS - tool for writing ipl in MemoryStick™.

How to do your own magic Service Card:

1. Firstly you need not original MemoryStick™ PRO DUO (from our china friends, cards w/o MagicGate). Usually it's an 512 Mb, 2 Gb or 4 Gb models.
2. Original Sony MemoryStick™ PRO DUO are not supported ('cause we have no datasheets/programmers for it).
   
   This card is BAD

   
   

   
   
   
   
   
   
   
   
3. Download "MSID Dumper", insert MemoryStick™ in PSP and launch programm. Write on paper Serial Number and MSProID.
4. Remove the back shell of the MS using a knife (scalpel).
5. Extract internal board (with NAND) from case.
6. Unsold NAND microchip from card. [Some hardware magic!]
   
   This card is GOOD ('cause you have direct access to NAND)

   
   

   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
7. Insert NAND in NAND Flash TSOP-48 programmer: http://www.soft-center.ru/reader/
8. Support NAND list

   • 29F128G08CJAAA
   • 29F16G080AA
   • 29F16G08AAMCI
   • 29F16G08MAA
   • 29F32G08AAM02
   • 29F32G08CAMCI
   • 29F32G08CBAAA
   • 29F32G08FAA
   • 29F32G08FAMB2
   • 29F32G08JAMD2
   • 29F32G08QAA
   • 29F32G08TAA
   • 29F64G08AAME1
   • 29F64G08CAMD2
   • 29F64G08CAMDB
   • 29F64G08CFAAA
   • 29F64G08CFABA
   • 29F64G08FAMCI
   • 29F8G08MAA
   • 8GbUTHN
   • ???
   • D27UAG8T2MTR
   • F4GMSAP
   • FBAL41B8GK3W
   • FBNL41B8GK3PG
   • FBNL63B5IK3WG
   • FDL63AP-32U
   • FNNM29B2GK3WG
   • FQ64G08UCT1-24
   • FT16G08UCM03
   • FTAL41B8Gk3WG
   • FTNM40A4GK3W2
   • H27UAG8T2ATR
   • H27UDG8VEMYR
   • HN29V1G
   • HVPE4F4
   • HVPG3P3
   • HY27UA081G1M
   • HY27UBG8T2ATR
   • HY27UBG8T2MYR
   • HY27UBG8U5MTR
   • HY27UF081G2M
   • HY27UF084G2M
   • HY27UG082G (?)
   • HY27UG082G2M
   • HY27UG082G4 (?)
   • HY27UG084G2M
   • HY27UG088G5
   • HY27UG088G5M
   • HY27UH088G2
   • HY27UH08AG5
   • HY27US08121M
   • HY27UT084G
   • HY27UT084G2
   • HY27UT088G2M
   • HY27UU088G5M
   • HY27UU08AG5A
   • HY27UV08AG5
   • HY27UV08BG5
   • HY27UW08BGFM
   • K9ABG08U0A
   • K9BCG08U1A
   • K9CDG08U5A
   • K9E2G08U0M
   • K9F1208U0M
   • K9F1G08
   • K9F1G16
   • K9F2808
   • K9F2G08
   • K9F4G08
   • K9F5808
   • K9F8G08
   • K9G8G08U0B
   • K9G8G08UOM
   • K9GAG08U0M
   • K9GBG08U0M
   • K9HAG08U1M
   • K9HBG08U1A
   • K9HBG08U1M
   • K9HCG08
   • K9HDG08U5M
   • K9K1G08
   • K9K2G08
   • K9K2G16
   • K9K4G08
   • K9K8G08U0M
   • K9K8G08U1M
   • K9L8G08
   • K9LAG08
   • K9LBG08U0D
   • K9LBG08U0M
   • K9MDG08U5M
   • K9NBG08
   • K9NCG08U5M
   • K9W8G08
   • K9WAG08
   • M8UJ3C26AH
   • MT29F2G08
   • MT29F4G08
   • N1G08UOA
   • P1U4GR30CT
   • PQI-KA04-072A-1D00
   • PQI-KA04-072F-1D00
   • R1FV04G13RSA
   • SDTHGEHE0-1024
   • SDTNGCHE0-2048
   • SDTNGCHEM-1024
   • SDTNIGHSM-2048
   • SDTNIGHSM-4096
   • SDTNKLAHSM-1024
   • SDTNKLBHSM-2048
   • SDTNKLBHSM-2048
   • SDTNLLBHSM-4096
   • SDTNMMAHSM-002G
   • SDTNMMBHSM-004G
   • SDXNGDHE0-4096-I
   • T04G724
   • TC58DVG04B1FT00
   • TC58DVM72A
   • TC58DVM9
   • TC58NVG1
   • TC58NVG2
   • TC58NVG3
   • TC58NVG4T2ETA00
   • TC58NVG5D2FTAIO
   • TH58DVG2
   • TH58NVG4D4CTG00
   • TH58NVG5D1DTG20
   • TH58NVG5D1DTG20
   • TH58NVG5D2ETAK0
   • TH58NVG5D4CTG20
   • TH58NVG5T2ETA00
   • TH58NVG5T2ETA20
   • TH58NVG6D2ELA48
   • TH58NVG6D2ETA20
   • TH58NVG6T2ETA20
   • TH58NVG6T2ETA2A
   • TH58NVG7D1DLA87
   • TH58NVG7D2ELA48
   • TH58NVG7D2ELA89
   • TH58NVG8D2ELA89
   • Unknown
   • VD101L3LC03
   • VD101M3MC03
   • VD101N3NC03
   • VD102Q3QC33
   • xD card 128
   • xD card 256
   • xD card H1024
   • xD card H512
   • xD card M1024
   • xD card M2GB

   Source: http://www.soft-center.ru/reader/NAND_List.php
9. Install programmer software (Supplied with programmer).
10. Connect programmer to PC.
11. Dump part NAND with MSID (MemoryStick™ ID). If you dump not access part, dump other part...
12. Open NAND by HEX Editor and search HEX points: 204D5350534E5930.
    
    
    ScreenShot MSID in dump

    
    

    
    
    
    
    
13. If you not found this points, dump other list.
14. Correct msid from dump: 204D5350534E593000788884C6AA0000. Fat text-found points in dump (up items).
15. After correct msid, save file and writing dump in NAND.
16. Sold NAND in card and insert card in case.
17. Format card in PSP.
18. From folder "Write IPL to MS" launch "install_psp_ms_multi_loader_ipl.cmd"
19. Connect PSP to PC.
20. Press "Y".
21. If print "Write MS BOOT CODE" - IPL writing access.
    • If print "Canceled" - you press not correct pad.
    • If print "Check free reserved sector : to small reserved sectors" - using mspformat.exe.
22. Open MemoryStick™ by HEX editor. Veryfying installed IPL from 16 sector.
23. From folder "Extracted Files Original" copy all files in MemoryStick™.
24. Complete!

P.S. I`m translate The original theme in Russian by ErikPshat... Thanks vit9696. Sorry for my bad english...

[tymagix]

is it possible to program a micro sd card with a program to change the msid and then put in an adapter msproduo getting started the psp?

[psgamer]

To do this we need to know, how this adapter works(I haven`t found information about it). First question is where is located msid area - in adapter or in service area of microsd? All dumps, I succseeded to save, begins from following(I used 256mb microsd so don't be surprised about FAT16):
[img]http://img404.**************/img404/8980/screenmhp.jpg[/img]

And look here(File system part):


I have no idea how to access area before this in microsd

[c.ozzy]

Сообщение от lenovo3000 Usb xD READER plus adapter (PCB GOTRONIK with Flash-chip holder from Ebay) Screen

DOes it work? Have u tested it?
Have I to unsold my ms for "fit" it in this reader? or is it just a plug and play?

thanks

[tymagix]

Сообщение от psgamer First question is where is located msid area - in adapter or in service area of microsd?

msid the area is in the service area of the microsd I think because the adapter does not have a nand

[psgamer]

Adapter has build-in eeprom or, in old ones - separated 8-pin eeprom chip. It would be interesting to dump such chip, but I saw such adapter only on photo

[ru07]

Pleeeease! Help me unbrick my psp 2006 ta-088v3 i'm new to this programming thing but i promise i'll do my very best to make my psp alive, pleeeease!

[tymagix]

Сообщение от ru07 Pleeeease! Help me unbrick my psp 2006 ta-088v3 i'm new to this programming thing but i promise i'll do my very best to make my psp alive, pleeeease!

What help do you want? do not you understand that? it all there's the de******ion on how to unbrick your psp on the forum

[ru07]

first, there is no available link for the MSID dumper and SRC, then where to buy cheap NAND tsop 43 programmer? sorry for not understanding because im new to such things and i envy them, they've already fixed their psp 200x with the specific mobo.

[tymagix]

http://cgi.ebay.fr/Willem-5-0-Progra...item2eb3f4fe2a

tymagix добавил 03.04.2012 в 21:23
http://www.flash-extractor.com/shop/

tymagix добавил 03.04.2012 в 21:26
https://www.pspx.ru/forum/showthread.php?t=92433

tymagix добавил 03.04.2012 в 21:31

Сообщение от ru07 first, there is no available link for the MSID dumper and SRC, then where to buy cheap NAND tsop 43 programmer? sorry for not understanding because im new to such things and i envy them, they've already fixed their psp 200x with the specific mobo.

Here you have the links you need for the programmer you have to check that your nand is supported

[ru07]

is there any video or tutorial on how to make that service mem stick?

or is there a more simple way? i mean without buying such things? *sigh*

is this impossible for me

[tymagix]

Сообщение от ru07 is there any video or tutorial on how to make that service mem stick? or is there a more simple way? i mean without buying such things? *sigh* is this impossible for me

I'm sorry there is no video on how to make the card and unfortunately there is not no other way for now, we should ask if he has yoti can make a full video of the desoldering nand, its programming and its reintegration into the PSP.

[Gregorio]

No. We can't make a video of the desoldering nand, its programming and its reintegration into the PSP.

[ru07]

Сообщение от tymagix I'm sorry there is no video on how to make the card and unfortunately there is not no other way for now, we should ask if he has yoti can make a full video of the desoldering nand, its programming and its reintegration into the PSP.

for now? so i can still fix my psp if i'll wait for the fix right? but is there any possibilities that the fix will be discovered? or this is the only way? for the response.

[jaday143]

there is way to fix ta088v3 go to the psp service buy a MoBo and they will fix it for you. sorry for my bad english

[pokeloverhs]

I have a bricked psp 3004 3g model data code 8d.
Don't know motherboard because bricked before checking it. Will this work?????????
If yes please give me the link for nand programmer ebay or dealextreme will do. And i also need link for chinese memory stick because i have 3 but they are original. Please help I am a 13 year old noob. Dad is gonna help me with electronics and all but I need help from your side too.

Or else for me

[bugmenot_]

is there a possibility that this magic MS be massively produced and sold in the open? It would be cheaper than buying the programmer itself...

[Seymen]

It's too hard

[drh87]

Could work this clip: https://www.ic2005.com/shop/product.php?productid=129
with a NAND Programmer?

The pinout of HY27UH08AG5M is the same of the clip (8bit)

Could be a possible solution solderless?

[bruceteh95]

Can I use this memory card for make the MMS!! Please Help!!

[frostegater]

bruceteh95, try it