Pandora (unbricker/downgrader) for PSP-200X TA-088v3

[frostegater]

Service Kit for PSP-200X
(supports TA-088v3)
{ NO SALES HERE }

After a successful hack and hide the long-time topic:
"Размышления о возможностях взлома ТА88v3"
...it was decided unhide.

First video by Yoti

New video by ErikPshat

Service Kit and MSID Dumper:

• Service_memstick_TA-088v3.zip
  
• MSID Dumper & SRC.zip

Structure folders in first archive:

• Extracted Files Original - all files from original JigKick Card.
• MSID 512mb Original - dump MSPro ID from original JigKick card.
• Original Dump MS - full dump Service Card.
• Write IPL to MS - tool for writing ipl in MemoryStick™.

How to do your own magic Service Card:

1. Firstly you need not original MemoryStick™ PRO DUO (from our china friends, cards w/o MagicGate). Usually it's an 512 Mb, 2 Gb or 4 Gb models.
2. Original Sony MemoryStick™ PRO DUO are not supported ('cause we have no datasheets/programmers for it).
   
   This card is BAD

   
   

   
   
   
   
   
   
   
   
3. Download "MSID Dumper", insert MemoryStick™ in PSP and launch programm. Write on paper Serial Number and MSProID.
4. Remove the back shell of the MS using a knife (scalpel).
5. Extract internal board (with NAND) from case.
6. Unsold NAND microchip from card. [Some hardware magic!]
   
   This card is GOOD ('cause you have direct access to NAND)

   
   

   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
7. Insert NAND in NAND Flash TSOP-48 programmer: http://www.soft-center.ru/reader/
8. Support NAND list

   • 29F128G08CJAAA
   • 29F16G080AA
   • 29F16G08AAMCI
   • 29F16G08MAA
   • 29F32G08AAM02
   • 29F32G08CAMCI
   • 29F32G08CBAAA
   • 29F32G08FAA
   • 29F32G08FAMB2
   • 29F32G08JAMD2
   • 29F32G08QAA
   • 29F32G08TAA
   • 29F64G08AAME1
   • 29F64G08CAMD2
   • 29F64G08CAMDB
   • 29F64G08CFAAA
   • 29F64G08CFABA
   • 29F64G08FAMCI
   • 29F8G08MAA
   • 8GbUTHN
   • ???
   • D27UAG8T2MTR
   • F4GMSAP
   • FBAL41B8GK3W
   • FBNL41B8GK3PG
   • FBNL63B5IK3WG
   • FDL63AP-32U
   • FNNM29B2GK3WG
   • FQ64G08UCT1-24
   • FT16G08UCM03
   • FTAL41B8Gk3WG
   • FTNM40A4GK3W2
   • H27UAG8T2ATR
   • H27UDG8VEMYR
   • HN29V1G
   • HVPE4F4
   • HVPG3P3
   • HY27UA081G1M
   • HY27UBG8T2ATR
   • HY27UBG8T2MYR
   • HY27UBG8U5MTR
   • HY27UF081G2M
   • HY27UF084G2M
   • HY27UG082G (?)
   • HY27UG082G2M
   • HY27UG082G4 (?)
   • HY27UG084G2M
   • HY27UG088G5
   • HY27UG088G5M
   • HY27UH088G2
   • HY27UH08AG5
   • HY27US08121M
   • HY27UT084G
   • HY27UT084G2
   • HY27UT088G2M
   • HY27UU088G5M
   • HY27UU08AG5A
   • HY27UV08AG5
   • HY27UV08BG5
   • HY27UW08BGFM
   • K9ABG08U0A
   • K9BCG08U1A
   • K9CDG08U5A
   • K9E2G08U0M
   • K9F1208U0M
   • K9F1G08
   • K9F1G16
   • K9F2808
   • K9F2G08
   • K9F4G08
   • K9F5808
   • K9F8G08
   • K9G8G08U0B
   • K9G8G08UOM
   • K9GAG08U0M
   • K9GBG08U0M
   • K9HAG08U1M
   • K9HBG08U1A
   • K9HBG08U1M
   • K9HCG08
   • K9HDG08U5M
   • K9K1G08
   • K9K2G08
   • K9K2G16
   • K9K4G08
   • K9K8G08U0M
   • K9K8G08U1M
   • K9L8G08
   • K9LAG08
   • K9LBG08U0D
   • K9LBG08U0M
   • K9MDG08U5M
   • K9NBG08
   • K9NCG08U5M
   • K9W8G08
   • K9WAG08
   • M8UJ3C26AH
   • MT29F2G08
   • MT29F4G08
   • N1G08UOA
   • P1U4GR30CT
   • PQI-KA04-072A-1D00
   • PQI-KA04-072F-1D00
   • R1FV04G13RSA
   • SDTHGEHE0-1024
   • SDTNGCHE0-2048
   • SDTNGCHEM-1024
   • SDTNIGHSM-2048
   • SDTNIGHSM-4096
   • SDTNKLAHSM-1024
   • SDTNKLBHSM-2048
   • SDTNKLBHSM-2048
   • SDTNLLBHSM-4096
   • SDTNMMAHSM-002G
   • SDTNMMBHSM-004G
   • SDXNGDHE0-4096-I
   • T04G724
   • TC58DVG04B1FT00
   • TC58DVM72A
   • TC58DVM9
   • TC58NVG1
   • TC58NVG2
   • TC58NVG3
   • TC58NVG4T2ETA00
   • TC58NVG5D2FTAIO
   • TH58DVG2
   • TH58NVG4D4CTG00
   • TH58NVG5D1DTG20
   • TH58NVG5D1DTG20
   • TH58NVG5D2ETAK0
   • TH58NVG5D4CTG20
   • TH58NVG5T2ETA00
   • TH58NVG5T2ETA20
   • TH58NVG6D2ELA48
   • TH58NVG6D2ETA20
   • TH58NVG6T2ETA20
   • TH58NVG6T2ETA2A
   • TH58NVG7D1DLA87
   • TH58NVG7D2ELA48
   • TH58NVG7D2ELA89
   • TH58NVG8D2ELA89
   • Unknown
   • VD101L3LC03
   • VD101M3MC03
   • VD101N3NC03
   • VD102Q3QC33
   • xD card 128
   • xD card 256
   • xD card H1024
   • xD card H512
   • xD card M1024
   • xD card M2GB

   Source: http://www.soft-center.ru/reader/NAND_List.php
9. Install programmer software (Supplied with programmer).
10. Connect programmer to PC.
11. Dump part NAND with MSID (MemoryStick™ ID). If you dump not access part, dump other part...
12. Open NAND by HEX Editor and search HEX points: 204D5350534E5930.
    
    
    ScreenShot MSID in dump

    
    

    
    
    
    
    
13. If you not found this points, dump other list.
14. Correct msid from dump: 204D5350534E593000788884C6AA0000. Fat text-found points in dump (up items).
15. After correct msid, save file and writing dump in NAND.
16. Sold NAND in card and insert card in case.
17. Format card in PSP.
18. From folder "Write IPL to MS" launch "install_psp_ms_multi_loader_ipl.cmd"
19. Connect PSP to PC.
20. Press "Y".
21. If print "Write MS BOOT CODE" - IPL writing access.
    • If print "Canceled" - you press not correct pad.
    • If print "Check free reserved sector : to small reserved sectors" - using mspformat.exe.
22. Open MemoryStick™ by HEX editor. Veryfying installed IPL from 16 sector.
23. From folder "Extracted Files Original" copy all files in MemoryStick™.
24. Complete!

P.S. I`m translate The original theme in Russian by ErikPshat... Thanks vit9696. Sorry for my bad english...

[bruceteh95]

Сообщение от frostegater bruceteh95, try it

I want to ask my psp had brick already , how do I run the "MSID Dumper"!!

[frostegater]

bruceteh95, ask your friends for PSP. Without PSP you cant dump msid.

[bruceteh95]

Сообщение от frostegater bruceteh95, ask your friends for PSP. Without PSP you cant dump msid.

Any psp also can ??? like psp v2 or psp 3000

[frostegater]

bruceteh95, facepalm. What do you mean you when write "psp v2"? Any PSP. NO VITA... noobs..

[toto99303]

Hi guys, I've been following this topic for long time and I have a question:

I have bricked PSP-3004.Date code is 8C. This indicates that the psp probably has ta088v3 mainboard and this method can be used to unbrick the PSP?
Can anyone confirm this? Thanks in advance.

[ErikPshat]

Сообщение от toto99303 this method can be used to unbrick the PSP?

This method can be used to unbrick the PSP-2000!

[evo_]

I have idea to use old s1 mp3 player as nand flasher.
S1clone is a tool to create and restore full nand backup from s1mp3.
It has a hynix hy27u... tsop48 nand flash with firmware in it, so potentially we can soldier nand and write MSPD dump.

s1 mp3 nand flashes (it has a G2M hynix chips instead G5M :/)
HY27UH081G2M 128MB
HY27UH082G2M 256MB
HY27UH084G2M 512MB
HY27UH088G2M 1024MB

What do You think ? Is it possible ?

[frostegater]

Сообщение от evo_ I have idea to use old s1 mp3 player as nand flasher. S1clone is a tool to create and restore full nand backup from s1mp3. It has a hynix hy27u... tsop48 nand flash with firmware in it, so potentially we can soldier nand and write MSPD dump. s1 mp3 nand flashes (it has a G2M hynix chips instead G5M :/) HY27UH081G2M 128MB HY27UH082G2M 256MB HY27UH084G2M 512MB HY27UH088G2M 1024MB What do You think ? Is it possible ?

You should have physical access to NAND included service spaces. I dont know can you make it using mp3player, because I don't know which controller used in player. Sorry for my bad English.

[evo_]

frostegater, Thanks for quick reply.
I have a s1 mp3 256MB - it has Hynix HY27UH082G2M chip inside.
S1clone http://s1mp3.de/tools.s1clone.html (it can be download from this site, from download section) is a tool, which can make full dump of nand flash of s1mp3 through usb. But it creates backup with different extension - .s1clone. However I can view dump by hex workshop - I think dump looks ok.

I don't know what's the differnce between HY27UH08*G2M and HY27UH08*G5M.
Info from hynix_part_number: G2M vs G5M
- 2 === 1 nCE & 1 R/nB; Sequential Row Read Disable
- 5 === 2 nCE & 2 R/nB; Sequential Row Read Disable

It will be cheap nand programmer to change msid. What do you think ?

PS: Nice site about s1mp3 players http://s1mp3.org/en/docs_hwspecs.php - hw specs etc.

[frostegater]

evo_, yeah, will be good if you can make it success. Please tell me your result.

[evo_]

Soldering is not a big problem for me, but it's hard to find fake memory stick card.

I have only 1 MSPD - geniune sandisk 4GB (black body).
My friend has a old fake "sony" memory stick 4GB card with magicgate unknown, but I didn't open it.
In my opinion the most possible way with s1mp3: take nand from card to s1mp3. make a backup, change serial number and MSID by hex editor, write it to mp3 again and solder nand to fake card. (but I'm not sure if this player can handle 4GB nand).

I think it may works, but I don't know what's the real difference between HY27UH08*G2M and HY27UH08*G5M chips (mp3 has a G2M chip :/)

[Washasat]

Can you Guys make a tutorial on how you did that because i dont understand anything from that tutorial .

[megadownlo]

pls. re-upload the files i need?? Thank you...

Service Kit and MSID Dumper:

* Service_memstick_TA-088v3.7z
* MSID Dumper & SRC.7z

could show a video of making the jigkick card and explained in english?
and how do i use the Time Machine or something?? where do I get one??

megadownlo добавил 31-01-13 в 0:Jan p
SIR YOTI



please make video of the jig kick card. please!!!!please!!!!please!!!!please!!!!please!!!!please!!!!please!!!!please!!!! please!!!!

THANK YOU!!!!!!!!

megadownlo добавил 31-01-13 в 0:Jan p
excuse me,
i couldn't understand what you were saying starting from here,
11. Dump part NAND with MSID (MemoryStickпїЅ ID). If you dump not access part, dump other part...

until step 24...

could you explain them in a noob way or in a way where children will understand, =)? please?

i don't know what you meant by dump, sorry....

I am all new to the technician stuff, perhaps you could add more screen shots because it's hard to rely on the verbal steps alone,
sir

megadownlo добавил 31-01-13 в 0:Jan p
is this trustworthy???

http://cgi.ebay.fr/Willem-Programmer...item2eb9498345

which among the e-bay could be trusted?? and how do i translate ebay into english, I can't seem to find the settings, it's all in russian, sorry

[ErikPshat]

Сообщение от megadownlo pls. re-upload the files i need?? Thank you... Service Kit and MSID Dumper: * Service_memstick_TA-088v3.7z * MSID Dumper & SRC.7z

OK, re-uploaded.

[cucho]

Эй, друг может устроить пластины ta_090v1 PSP извините за мой язык, я из Мексики

[M1limetrox]

What is this? He use a nand programmer?

http://www.ps3oon.com/2013/06/altern...d-psp2000.html