PSPx форум

PSPx форум (https://www.pspx.ru/forum/index.php)
-   For english speaking (https://www.pspx.ru/forum/forumdisplay.php?f=124)
-   -   Pandora (unbricker/downgrader) for PSP-200X TA-088v3 (https://www.pspx.ru/forum/showthread.php?t=92463)

frostegater 13.07.2011 00:37

Pandora (unbricker/downgrader) for PSP-200X TA-088v3
 
Service Kit for PSP-200X
(supports TA-088v3)

{ NO SALES HERE }

After a successful hack and hide the long-time topic:
"Размышления о возможностях взлома ТА88v3"
...it was decided unhide.

First video by Yoti
New video by ErikPshat



Service Kit and MSID Dumper:
Structure folders in first archive:
  • Extracted Files Original - all files from original JigKick Card.
  • MSID 512mb Original - dump MSPro ID from original JigKick card.
  • Original Dump MS - full dump Service Card.
  • Write IPL to MS - tool for writing ipl in MemoryStick™.

How to do your own magic Service Card:
  1. Firstly you need not original MemoryStick™ PRO DUO (from our china friends, cards w/o MagicGate). Usually it's an 512 Mb, 2 Gb or 4 Gb models.
  2. Original Sony MemoryStick™ PRO DUO are not supported ('cause we have no datasheets/programmers for it).
  3. Download "MSID Dumper", insert MemoryStick™ in PSP and launch programm. Write on paper Serial Number and MSProID.
  4. Remove the back shell of the MS using a knife (scalpel).
  5. Extract internal board (with NAND) from case.
  6. Unsold NAND microchip from card. [Some hardware magic!]

  7. Insert NAND in NAND Flash TSOP-48 programmer: http://www.soft-center.ru/reader/
  8. Support NAND list
    • 29F128G08CJAAA
    • 29F16G080AA
    • 29F16G08AAMCI
    • 29F16G08MAA
    • 29F32G08AAM02
    • 29F32G08CAMCI
    • 29F32G08CBAAA
    • 29F32G08FAA
    • 29F32G08FAMB2
    • 29F32G08JAMD2
    • 29F32G08QAA
    • 29F32G08TAA
    • 29F64G08AAME1
    • 29F64G08CAMD2
    • 29F64G08CAMDB
    • 29F64G08CFAAA
    • 29F64G08CFABA
    • 29F64G08FAMCI
    • 29F8G08MAA
    • 8GbUTHN
    • ???
    • D27UAG8T2MTR
    • F4GMSAP
    • FBAL41B8GK3W
    • FBNL41B8GK3PG
    • FBNL63B5IK3WG
    • FDL63AP-32U
    • FNNM29B2GK3WG
    • FQ64G08UCT1-24
    • FT16G08UCM03
    • FTAL41B8Gk3WG
    • FTNM40A4GK3W2
    • H27UAG8T2ATR
    • H27UDG8VEMYR
    • HN29V1G
    • HVPE4F4
    • HVPG3P3
    • HY27UA081G1M
    • HY27UBG8T2ATR
    • HY27UBG8T2MYR
    • HY27UBG8U5MTR
    • HY27UF081G2M
    • HY27UF084G2M
    • HY27UG082G (?)
    • HY27UG082G2M
    • HY27UG082G4 (?)
    • HY27UG084G2M
    • HY27UG088G5
    • HY27UG088G5M
    • HY27UH088G2
    • HY27UH08AG5
    • HY27US08121M
    • HY27UT084G
    • HY27UT084G2
    • HY27UT088G2M
    • HY27UU088G5M
    • HY27UU08AG5A
    • HY27UV08AG5
    • HY27UV08BG5
    • HY27UW08BGFM
    • K9ABG08U0A
    • K9BCG08U1A
    • K9CDG08U5A
    • K9E2G08U0M
    • K9F1208U0M
    • K9F1G08
    • K9F1G16
    • K9F2808
    • K9F2G08
    • K9F4G08
    • K9F5808
    • K9F8G08
    • K9G8G08U0B
    • K9G8G08UOM
    • K9GAG08U0M
    • K9GBG08U0M
    • K9HAG08U1M
    • K9HBG08U1A
    • K9HBG08U1M
    • K9HCG08
    • K9HDG08U5M
    • K9K1G08
    • K9K2G08
    • K9K2G16
    • K9K4G08
    • K9K8G08U0M
    • K9K8G08U1M
    • K9L8G08
    • K9LAG08
    • K9LBG08U0D
    • K9LBG08U0M
    • K9MDG08U5M
    • K9NBG08
    • K9NCG08U5M
    • K9W8G08
    • K9WAG08
    • M8UJ3C26AH
    • MT29F2G08
    • MT29F4G08
    • N1G08UOA
    • P1U4GR30CT
    • PQI-KA04-072A-1D00
    • PQI-KA04-072F-1D00
    • R1FV04G13RSA
    • SDTHGEHE0-1024
    • SDTNGCHE0-2048
    • SDTNGCHEM-1024
    • SDTNIGHSM-2048
    • SDTNIGHSM-4096
    • SDTNKLAHSM-1024
    • SDTNKLBHSM-2048
    • SDTNKLBHSM-2048
    • SDTNLLBHSM-4096
    • SDTNMMAHSM-002G
    • SDTNMMBHSM-004G
    • SDXNGDHE0-4096-I
    • T04G724
    • TC58DVG04B1FT00
    • TC58DVM72A
    • TC58DVM9
    • TC58NVG1
    • TC58NVG2
    • TC58NVG3
    • TC58NVG4T2ETA00
    • TC58NVG5D2FTAIO
    • TH58DVG2
    • TH58NVG4D4CTG00
    • TH58NVG5D1DTG20
    • TH58NVG5D1DTG20
    • TH58NVG5D2ETAK0
    • TH58NVG5D4CTG20
    • TH58NVG5T2ETA00
    • TH58NVG5T2ETA20
    • TH58NVG6D2ELA48
    • TH58NVG6D2ETA20
    • TH58NVG6T2ETA20
    • TH58NVG6T2ETA2A
    • TH58NVG7D1DLA87
    • TH58NVG7D2ELA48
    • TH58NVG7D2ELA89
    • TH58NVG8D2ELA89
    • Unknown
    • VD101L3LC03
    • VD101M3MC03
    • VD101N3NC03
    • VD102Q3QC33
    • xD card 128
    • xD card 256
    • xD card H1024
    • xD card H512
    • xD card M1024
    • xD card M2GB
  9. Install programmer software (Supplied with programmer).
  10. Connect programmer to PC.
  11. Dump part NAND with MSID (MemoryStick™ ID). If you dump not access part, dump other part...
  12. Open NAND by HEX Editor and search HEX points: 204D5350534E5930.


  13. If you not found this points, dump other list.
  14. Correct msid from dump: 204D5350534E593000788884C6AA0000. Fat text-found points in dump (up items).
  15. After correct msid, save file and writing dump in NAND.
  16. Sold NAND in card and insert card in case.
  17. Format card in PSP.
  18. From folder "Write IPL to MS" launch "install_psp_ms_multi_loader_ipl.cmd"
  19. Connect PSP to PC.
  20. Press "Y".
  21. If print "Write MS BOOT CODE" - IPL writing access.
    • If print "Canceled" - you press not correct pad.
    • If print "Check free reserved sector : to small reserved sectors" - using mspformat.exe.
  22. Open MemoryStick™ by HEX editor. Veryfying installed IPL from 16 sector.
  23. From folder "Extracted Files Original" copy all files in MemoryStick™.
  24. Complete!

P.S. I`m translate The original theme in Russian by ErikPshat... Thanks vit9696. Sorry for my bad english...

enzo9 13.07.2011 07:18

Congrats for the finding. If find a site that sells mms please publishing it
thanks

(Sorry for my english, i'm Argentinian :crazy:)

erutan 14.07.2011 09:52

enzo9, welcome =) We are glad to see you =)))

jorpakko 16.07.2011 19:43

Good news!!!
Unfortunately I don't have the equipment to make the MS.:(
Anyone selling these yet? Could really use one for my bricked 2004 TA88v3.

Oh, greets from Finland. :drinks:

acquetto 30.07.2011 11:09

thanks

raztabob12 30.07.2011 13:02

good news to bricked ta-088v3 users like me...

thanks guys...

are these available in "Repair Package" that is "already made" for sale?

and any approximate how much would it cost?...

coz my psp's been dead for quite some time now... :D

thanks once again...

kudos to the geniuses behind it all... :drinks:

sadwolf 27.08.2011 01:44

Im still dont understand a little bit. if i want to unbrick my psp 2003 ta 88 v3 i will need to buy NAND Flash TSOP-48 or i can use files witch is in Service_memstick_TA-088v3.7z ?

c.ozzy 04.09.2011 18:33

Цитата:

want to unbrick my psp 2003 ta 88 v3 i will need to buy NAND Flash TSOP-48 or i can use files witch is in Service_memstick_TA-088v3.7z ?
You need also the nand programmer (because u have to dump the memorystick and then change the MS_ID) or an already "modded" memorystick.. i don't know if u can find it on ebay or something else

Semeye 09.09.2011 19:05

Didn't Dark_Alex say doing such a thing as this was almost impossible? I don't get it! Anyway, excellent work! Unbelievable... xD

gm619 19.09.2011 19:26

can it unbreak psp 3000?

totoybatotoy 22.09.2011 13:18

hmmm i hope you would release the decoder

deluxe372 16.10.2011 16:31

Я чето не понял ето инфа по востановке
ТА88v3

flash_zero 16.10.2011 16:44

deluxe372, Смотри на русском https://www.pspx.ru/forum/showthread.php?t=92433

deluxe372 16.10.2011 17:14

всеравно не понимаю(
как можна востановит TA88v3

DIIGMO 16.10.2011 21:40

deluxe372, по типу пандоры) Или смотри видео, как именно идёт процесс.

inoob 19.10.2011 06:44

Hi guys! Well, i'm from Brazil, and i got one PSP 2000 with TA-088v3 bricked! I would like know if could you do a video-lesson with the needed steps to make the unbrick! Sorry for my bad english! Thank you all!

hichem05 02.11.2011 00:21

Good Job man you are the best ,it will be better if you did the manipulation to create the MS on video .
try to do it ......

thibistin 06.11.2011 15:23

hello
I have a psp slim (TA 088 V3 mothercard) which was bricked for a year and a half.
good if I start it, nothing is displayed, as in this video
http://www.youtube.com/watch?v=UIMHT6It5bs

Is there really a solution for unbrick please

and .

( sorry for my bad english :$ )

Sad King 14.11.2011 17:03

what i need for do the unbrick of my psp plz hlp me ! im not have a pandora battry like this in video !

manyaksbs 03.12.2011 19:55

how to magic memory stick please video.

Kardeş türksün anladım videonuda izledim aynı psp var bendede 2006 versiyon. aga özelden msn adresimi yolladım eklede belki birbirimize yardımımız dokunur. :)

Yoti 03.12.2011 22:27

Цитата:

Сообщение от manyaksbs (Сообщение 993746)
how to magic memory stick please video.

1. hardware: get a right memstick, unsold nand, do a dump of nand, reprogram dump with new msid, write new/modified dump to nand, sold nand back to memstick
2. software: inject ipl from archive, copy all files to card
3. unbrick: insert your jigstick, insert pandora battery, wait for "OK"

xland 16.12.2011 14:43

Вложений: 1
After hard work (regenerate ecc and spare part for changed page in nand) I make one stick (1GB) with corect MSID.
I inserted IPL from archive and verify if are corect writed.
All files was transfered to MS but when I put standard Pandora battery with MS inserted dont make nothing. Only green light like when use standard MSID.
Files was transfered in MS root.
Here's my dump MSID after change operation: Вложение 5287.
I change only MSID, its necesary to change and serial (35000000)?.
Please give me some advice where Im wrong.
PSP its with mainboard TA088v3
Вложение 5287

Yoti 17.12.2011 00:30

Цитата:

Сообщение от xland (Сообщение 996340)
its necesary to change and serial (35000000)?

No

Цитата:

Сообщение от xland (Сообщение 996340)
Please give me some advice where Im wrong.

Hardware problems on bricked PSP?
You may test card on ANY psp2k. Not all of cards are will work more than 0 (zero) times ;)

xland 17.12.2011 00:57

Цитата:

Сообщение от Yoti (Сообщение 996467)
Hardware problems on bricked PSP?

No
Цитата:

Сообщение от Yoti (Сообщение 996467)
You may test card on ANY psp2k.

I have one bricked PSP and good one. Same on both.
Цитата:

Сообщение от Yoti (Сообщение 996467)
Not all of cards are will work more than 0 (zero) times ;)

Be more explicit please :).

Yoti 17.12.2011 02:51

Цитата:

Сообщение от xland (Сообщение 996471)
Be more explicit please

If you do your card 100% right it may not work.

xland 17.12.2011 03:06

Цитата:

Сообщение от Yoti (Сообщение 996484)
If you do your card 100% right it may not work.

Thanks, I'll try with other card.

xland 19.12.2011 10:58

I make new card and I have same issues like first card.
When tell me dont work all cards means dont work because its wrong ECC and stick controller dont pass errors or and if I have good ECC (with good MSID of course) and card its recognised correct may not work?
Why PSP memory led stay all time off?
I think when put Pandora battery PSP must read information about MSID and after that MSIPL from card but card isnt accesed any more.

PS. I read and information from russian thread. Who make working stick have luck and find card what dont check ECC and change only MSID or change both: and MSID and ECC like me?

Yoti 19.12.2011 13:34

Цитата:

Сообщение от xland (Сообщение 997003)
When tell me dont work all cards means dont work because its wrong ECC and stick controller dont pass errors or and if I have good ECC (with good MSID of course) and card its recognised correct may not work?

Don't know why, may be as you explained.

Цитата:

Сообщение от xland (Сообщение 997003)
I think when put Pandora battery PSP must read information about MSID and after that MSIPL from card but card isnt accesed any more.

PSP -> Battery : Your SN?
Battery -> PSP : FFFFFFFF
PSP -> MemStick : IPL?
MemStick -> PSP : %here it is%
PSP -> Pre-IPL : Check it!
Pre-IPL -> PSP : All ok.

xland 19.12.2011 22:41

Цитата:

Сообщение от Yoti (Сообщение 997026)

PSP -> Battery : Your SN?
Battery -> PSP : FFFFFFFF
PSP -> MemStick : IPL?
MemStick -> PSP : %here it is%
PSP -> Pre-IPL : Check it!
Pre-IPL -> PSP : All ok.

That I know from this steps:
PSP -> Battery : Your SN? - its FFFFFFFF (Pandora Battery)
Battery -> PSP : FFFFFFFF - returned corect
PSP -> MemStick : IPL? - Here I dont know because I dont see light on MS led - Your IPL its injected and begin at 16 sector.
MemStick -> PSP : %here it is%
PSP -> Pre-IPL : Check it!
Pre-IPL -> PSP : All ok.

I dont see in above steps MSID verification or its used only after all this steps for decrypting?

xland добавил 19.12.2011 в 22:41
Thanks a lot for advices Yoti.
My mistake was I inject IPL on PSP 2004 and for me dont work this.
After I inject IPL on PSP Phat all was OK.
Was good and first card.
Bricked PSP with TA088v3 its now alive again :)

ikyak 23.12.2011 10:19

excuse me, i got a lot of question here, how do i connect TSOP-48 programmer to pc? does TSOP-48 programmer using usb port? what OS does it support to? if it's available, where do i can buy it? any help would be appreciated, :)

frostegater 23.12.2011 11:41

Цитата:

Сообщение от ikyak (Сообщение 997881)
excuse me, i got a lot of question here, how do i connect TSOP-48 programmer to pc? does TSOP-48 programmer using usb port? what OS does it support to? if it's available, where do i can buy it? any help would be appreciated, :)

You buy programmer in soft-center?

Yoti 23.12.2011 18:37

Цитата:

Сообщение от xland (Сообщение 997030)
I dont see in above steps MSID verification or its used only after all this steps for decrypting?

*.prx.enc files and may be some other signed with msid.

Цитата:

Сообщение от xland (Сообщение 997030)
Bricked PSP with TA088v3 its now alive again

Congrats!

ikyak 24.12.2011 17:57

Цитата:

Сообщение от Frostegater (Сообщение 997885)
You buy programmer in soft-center?

NOT YET, I'M JUST WONDERING HOW TO CONNECT IT JUST BEFORE I BUY ONE.

ikyak добавил 24.12.2011 в 17:57
i'm sorry, can i just buy both magic Service Card and Pandora Battery from u? 'cause it's impossible for me to make one, i don't even have a soldering skill. my psp slim 2k (ta-088v3) have been dying here,

gettergtr 02.01.2012 23:01

Well...it's not easier to buy a complete Pandora pack for novice?

mari95 30.01.2012 22:40

Hello. It's good programmer for this operation? http://www.ebay.com/itm/Willem-EPROM...item2eb1693c82

frostegater 31.01.2012 05:46

mari95, may be.. but not tested... I think, you will have problems with ECC.

mari95 31.01.2012 17:39

What program selector will you recommend? Cheap and with socket and adapter TSOP48. Give me link from e-bay , please.

Sorry for my bad english. I'm is from Poland. :)

lenovo3000 05.02.2012 01:16

@mari95 - musi być taki co obsługuje te układy http://www.soft-center.ru/reader/NAND_List.php
The programmer that supports systems with a nand_list np. http://dybkowski.net/download/nand_flash/k9g8g08u0a.pdf

mari95 05.02.2012 01:40

lenovo3000, jesteś z Polski? Mógłbyś mi pomóc na gadu gadu z tym programatorem?

lenovo3000 09.02.2012 00:54

Usb xD READER plus adapter (PCB GOTRONIK with Flash-chip holder from Ebay)


Текущее время: 10:25. Часовой пояс GMT +3.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2025, vBulletin Solutions, Inc. Перевод: zCarot
PSPx Forum - Сообщество фанатов игровых консолей.