Pandora (unbricker/downgrader) for PSP-200X TA-088v3

[frostegater]

Service Kit for PSP-200X
(supports TA-088v3)
{ NO SALES HERE }

After a successful hack and hide the long-time topic:
"Размышления о возможностях взлома ТА88v3"
...it was decided unhide.

First video by Yoti

New video by ErikPshat

Service Kit and MSID Dumper:

• Service_memstick_TA-088v3.zip
  
• MSID Dumper & SRC.zip

Structure folders in first archive:

• Extracted Files Original - all files from original JigKick Card.
• MSID 512mb Original - dump MSPro ID from original JigKick card.
• Original Dump MS - full dump Service Card.
• Write IPL to MS - tool for writing ipl in MemoryStick™.

How to do your own magic Service Card:

1. Firstly you need not original MemoryStick™ PRO DUO (from our china friends, cards w/o MagicGate). Usually it's an 512 Mb, 2 Gb or 4 Gb models.
2. Original Sony MemoryStick™ PRO DUO are not supported ('cause we have no datasheets/programmers for it).
   
   This card is BAD

   
   

   
   
   
   
   
   
   
   
3. Download "MSID Dumper", insert MemoryStick™ in PSP and launch programm. Write on paper Serial Number and MSProID.
4. Remove the back shell of the MS using a knife (scalpel).
5. Extract internal board (with NAND) from case.
6. Unsold NAND microchip from card. [Some hardware magic!]
   
   This card is GOOD ('cause you have direct access to NAND)

   
   

   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
   
7. Insert NAND in NAND Flash TSOP-48 programmer: http://www.soft-center.ru/reader/
8. Support NAND list

   • 29F128G08CJAAA
   • 29F16G080AA
   • 29F16G08AAMCI
   • 29F16G08MAA
   • 29F32G08AAM02
   • 29F32G08CAMCI
   • 29F32G08CBAAA
   • 29F32G08FAA
   • 29F32G08FAMB2
   • 29F32G08JAMD2
   • 29F32G08QAA
   • 29F32G08TAA
   • 29F64G08AAME1
   • 29F64G08CAMD2
   • 29F64G08CAMDB
   • 29F64G08CFAAA
   • 29F64G08CFABA
   • 29F64G08FAMCI
   • 29F8G08MAA
   • 8GbUTHN
   • ???
   • D27UAG8T2MTR
   • F4GMSAP
   • FBAL41B8GK3W
   • FBNL41B8GK3PG
   • FBNL63B5IK3WG
   • FDL63AP-32U
   • FNNM29B2GK3WG
   • FQ64G08UCT1-24
   • FT16G08UCM03
   • FTAL41B8Gk3WG
   • FTNM40A4GK3W2
   • H27UAG8T2ATR
   • H27UDG8VEMYR
   • HN29V1G
   • HVPE4F4
   • HVPG3P3
   • HY27UA081G1M
   • HY27UBG8T2ATR
   • HY27UBG8T2MYR
   • HY27UBG8U5MTR
   • HY27UF081G2M
   • HY27UF084G2M
   • HY27UG082G (?)
   • HY27UG082G2M
   • HY27UG082G4 (?)
   • HY27UG084G2M
   • HY27UG088G5
   • HY27UG088G5M
   • HY27UH088G2
   • HY27UH08AG5
   • HY27US08121M
   • HY27UT084G
   • HY27UT084G2
   • HY27UT088G2M
   • HY27UU088G5M
   • HY27UU08AG5A
   • HY27UV08AG5
   • HY27UV08BG5
   • HY27UW08BGFM
   • K9ABG08U0A
   • K9BCG08U1A
   • K9CDG08U5A
   • K9E2G08U0M
   • K9F1208U0M
   • K9F1G08
   • K9F1G16
   • K9F2808
   • K9F2G08
   • K9F4G08
   • K9F5808
   • K9F8G08
   • K9G8G08U0B
   • K9G8G08UOM
   • K9GAG08U0M
   • K9GBG08U0M
   • K9HAG08U1M
   • K9HBG08U1A
   • K9HBG08U1M
   • K9HCG08
   • K9HDG08U5M
   • K9K1G08
   • K9K2G08
   • K9K2G16
   • K9K4G08
   • K9K8G08U0M
   • K9K8G08U1M
   • K9L8G08
   • K9LAG08
   • K9LBG08U0D
   • K9LBG08U0M
   • K9MDG08U5M
   • K9NBG08
   • K9NCG08U5M
   • K9W8G08
   • K9WAG08
   • M8UJ3C26AH
   • MT29F2G08
   • MT29F4G08
   • N1G08UOA
   • P1U4GR30CT
   • PQI-KA04-072A-1D00
   • PQI-KA04-072F-1D00
   • R1FV04G13RSA
   • SDTHGEHE0-1024
   • SDTNGCHE0-2048
   • SDTNGCHEM-1024
   • SDTNIGHSM-2048
   • SDTNIGHSM-4096
   • SDTNKLAHSM-1024
   • SDTNKLBHSM-2048
   • SDTNKLBHSM-2048
   • SDTNLLBHSM-4096
   • SDTNMMAHSM-002G
   • SDTNMMBHSM-004G
   • SDXNGDHE0-4096-I
   • T04G724
   • TC58DVG04B1FT00
   • TC58DVM72A
   • TC58DVM9
   • TC58NVG1
   • TC58NVG2
   • TC58NVG3
   • TC58NVG4T2ETA00
   • TC58NVG5D2FTAIO
   • TH58DVG2
   • TH58NVG4D4CTG00
   • TH58NVG5D1DTG20
   • TH58NVG5D1DTG20
   • TH58NVG5D2ETAK0
   • TH58NVG5D4CTG20
   • TH58NVG5T2ETA00
   • TH58NVG5T2ETA20
   • TH58NVG6D2ELA48
   • TH58NVG6D2ETA20
   • TH58NVG6T2ETA20
   • TH58NVG6T2ETA2A
   • TH58NVG7D1DLA87
   • TH58NVG7D2ELA48
   • TH58NVG7D2ELA89
   • TH58NVG8D2ELA89
   • Unknown
   • VD101L3LC03
   • VD101M3MC03
   • VD101N3NC03
   • VD102Q3QC33
   • xD card 128
   • xD card 256
   • xD card H1024
   • xD card H512
   • xD card M1024
   • xD card M2GB

   Source: http://www.soft-center.ru/reader/NAND_List.php
9. Install programmer software (Supplied with programmer).
10. Connect programmer to PC.
11. Dump part NAND with MSID (MemoryStick™ ID). If you dump not access part, dump other part...
12. Open NAND by HEX Editor and search HEX points: 204D5350534E5930.
    
    
    ScreenShot MSID in dump

    
    

    
    
    
    
    
13. If you not found this points, dump other list.
14. Correct msid from dump: 204D5350534E593000788884C6AA0000. Fat text-found points in dump (up items).
15. After correct msid, save file and writing dump in NAND.
16. Sold NAND in card and insert card in case.
17. Format card in PSP.
18. From folder "Write IPL to MS" launch "install_psp_ms_multi_loader_ipl.cmd"
19. Connect PSP to PC.
20. Press "Y".
21. If print "Write MS BOOT CODE" - IPL writing access.
    • If print "Canceled" - you press not correct pad.
    • If print "Check free reserved sector : to small reserved sectors" - using mspformat.exe.
22. Open MemoryStick™ by HEX editor. Veryfying installed IPL from 16 sector.
23. From folder "Extracted Files Original" copy all files in MemoryStick™.
24. Complete!

P.S. I`m translate The original theme in Russian by ErikPshat... Thanks vit9696. Sorry for my bad english...