Using Dark_Alex's Time Machine

[Demonchild]

Well, it's been a while since I written a tutorial so why not get straight to it, and write about Dark_Alex's Time Machine. (TM) (Whether the TM = Time Machine, it's going to become a trademark.. ;) )



Anyways, what is the TM?

The TM is a Dev-hook like utility that allows users to travel back in time to earlier firmware versions that are launched straight from the user's memory stick. Like Pandora, it allows users to actually use their PSPs even if the internal flash0 is destroyed. So far, the firmware list is small, but it's the most popular nowadays.

What does it take to use the TM?

It just takes one thing. A JiKick battery aka Pandora Battery. If you are a Slim user, you WILL need to be on 3.90 M33-2 or TM won't work for you and your Slim won't boot to begin with.

What firmwares are supported by TM?

So far, 1.50, a 1.50 and 3.40 Mix up (Think like 3.10 and 3.30 for UP), 3.40 OE-A, and 3.60 M33 are supported. TM will eventually expand towards other firmwares.. Do not try to get other firmwares running unless you really know what you are doing. One good point is Devhook under TM.

Note: Do NOT attempt to run DevHook on TimeMachine. There is a known bug that can cause corruption to ID Storage, meaning you won't be able to restore your PSP without an ID Storage or NAND backup.

What do I need to install TM?

You will need a memory stick that is real, (Or fake formatted via UPMS). Also, you will need space for whatever firmwares you want to install. On top of that, you will need a PSP that can write ipls (3.80 M33+ needs to be enabled with UPMS Sapphire)

Now the actual guide

Preparation

First, you will need to download DAX's TimeMachine v0.1 from virtually anywhere that somewhere. You can from:

Here
There

Note: It is recommended to reformat your MS to install TM. However, it isn't required, but TM will work better.

1. Once you do, you will be greeted with an archive with 2 folders and a readme. Extract all to the desktop. Move both the 'TIMEMACHINE' and '360DUMPER' folders to /PSP/GAME. From there, open up the 'readme.txt'. Read through it. It will take more than 1 reading to understand the context.

2. Now, download the 3.40 and 1.50 EBOOTS. Extract them and rename them to '340.PBP' and '150.PBP' respectively. Be sure not to name them '340.PBP.PBP' or '150.PBP.PBP', or it will not be correct. When done, move them to the root of your memory stick.

2a. If you want the 1.50 + 3.40 Mix Up and the 3.60 M33 firmwares installed, you must have a dumped 3.60 M33 firmware from a Slim (Duh), dumped by the 360DUMPER included in the Time Machine package. More details to come. After you dump 3.60 M33, move the '360.PSAR' to the root of your MS. If you're too lazy to downgrade to 3.60 M33, here's the file:

http://www.sendspace.com/file/wy98b1

Note: If you have a Magic Stick, and you are putting TM on the same MS, you will have to find a Pandora 'msipl.bin' file. If you do, move it to the root of your MS, and rename it to 'msipl.bin'. If you do not, read 3. All others, skip to 4.

3. Once done with that, find a Pandora ipl somewhere on your MS (root if you use Pandora), or C:\msinst if you used the cmd method and forgot about it. If you have it, rename it to 'msipl.bin' and move to the root. If not, pick up Despertar Cementerio (doesn't matter), and run it. (You will need the files needed as well.)

4. When you have placed 'msipl.bin' on the root, upgrade your PSP if you haven't to 2.71 SE or any 2.XX or 3.XX firmware that can run homebrew. If you do not, TimeMachine will spit a nice error at you.

5. Make sure you obtain a Pandora Battery.

Installing Time Machine



Now for the fun part. After you have prepared your memory stick, go and launch the installer. The installer can be made on either a Phat or a Slim. Once its boot, you will be presented with the menu.

TIME MACHINE INSTALLER

Install iplloader on PSP MS boot sector
Convert Pandora/DC1-DC4 ipl into TM format
Install 1.50 <PHAT>
Install 1.50 with 3.40 hw modules <PHAT&SLIM>
Install 3.40 OE <PHAT>
Install 3.60 M33 <SLIM>

1. You must first install the iplloader on the MS. (Step 1) You must do this step or else the TimeMachine wont boot. After it is done, press X to go back.

2. If you are installing TM on top of your Magic Stick, perform step 2. Make sure 'msipl.bin' exists on your root, and perform step 2. This will move the new TM-Pandora ipl to /TM/pandora.bin.

3. If you want the 1.50 firmware installed, make sure '150.PBP' exists on your root. Once done, select that option. This will dump/decrypt the 1.50 firmware to /TM/150. ;) Once it is done, you will be prompted to press X to fall back into the main menu.

4. If you want to install the 1.50 + 3.40 Mix up, you will need the '150.PBP', '340.PBP', and '360.PSAR' at the root of your memory stick. This will decrypt/dump everything to /TM/150_340. Once done, press X to go back to the main menu.

5. If you want the 3.40 OE-A firmware, make sure both '150.PBP', and '340.PBP' is at root. From there, just hit X and watch the firmware get dumped.

6. If you want the 3.60 M33 firmware, make sure you have the '360.PSAR' at the root. From there, you know the rest.

When you made up your mind, do what you need to do, and exit.

Using TM

1. If you are using TM with a Slim, you MUST MUST MUST upgrade to 3.90 M33-2. If not, TM won't work. Phats can stay anywhere they have to. (2.71 SE+)

2. Shutdown completely. Insert your TM stick, and Pandora Battery. If you boot normally, whether on a Phat or Slim, it is working normally. Just shutdown again.

3. Choose a firmware to boot to. Be reminded, that you only have 2 options for a Slim, and 3 for a Phat. The default keys are below:

For 1.50, hold X.
For the 1.50 and 3.40 mix, hold 0
For 3.40 OE, hold triangle
For 3.60 M33, hold square []
For Pandora Service Mode, hold D-Pad up
To boot normally, hold nothing.

4. Now, hold the button for the firmware you want to boot, and power on. The PSP will not boot automatically. Wait 4 seconds, and the PSP should boot into the selected firmware. When it does, let go of the button.

5. The first time you boot into a firmware, you will have to set settings as if it was the first time you turned on your PSP. Run through them, and they will be saved. (To the MS) You can let go of that button now. (When you booted)

6. From there, explore away. Remember the difference between a CFW bug and a TM bug, and the limitations of each firmware. The critical bugs will be fixed, so no need to worry about updating or anything.

From there, you're done. Enjoy the realm of possibility, and the past.

Post-install

1. Upgrade your Slim to 3.90 M33-2.
2. Delete all the firmware files you don't need off the root.
3. Make sure your Pandora Battery works.
4. Turn off WLAN Power Save in the 1.50 + 3.40 firmware.
5. Add your stuff back on if needed.
6. Share the joy.

Expanding TimeMachine

There isn't much to do to expand the TimeMachine besides install all of the firmwares and re-add the Pandora stuff, and the stuff that were on your Magic Stick. However, there is a config file that you can mess with that controls the paths of each firmware ipl, and which button boots which firmware. The config file can be accessed in any firmware, and it is available at /TM/config.txt.
Here's the readme to editing the config file. Where DAX mentions Digital-UP/DOWN/LEFT/RIGHT, he is referring to the D-pad.

This document explains how to use the file config.txt.
This file (config_read.txt) is not necssary, you can delete it if you want.

Limits:
- The file has a limit of 1024 bytes. If the file is bigger, only first 1024 bytes will be read.
- Lines shouldn't be more than 126 characters.
- Strings inside "" shouldn't be more than 64 characters.

Each line consists of two parts separated by the symbol "="

The left part indicates a button or a set of buttons separated by "+".
In the case a set of buttons is indicated you shouldn't put spaces between each button separated by "+".

Examples

L -> fine
L+START -> fine
L + START -> not fine

The buttons that can be used are followings:

UP -> Digital UP
DOWN -> Digital DOWN
LEFT -> Digital LEFT
RIGHT -> Digital RIGHT
TRIANGLE
CIRCLE
SQUARE
CROSS
SELECT
START
LTRIGGER
RTRIGGER
L -> alias for LTRIGGER
R -> alias for RTRIGGER
HOME
WLAN -> indicates that the wlan switch is in "on" position. (usually you will want to use it in latest positions).
VOLDOWN -> volume down
VOLUP -> volume up
NOTE
LCD -> the brightness button
HPREMOTE -> The hpremote is plugged
NOTHING -> Indicates no keys. This doesn't mean that "no keys are pressed", but instead that the value is ignored.
This value is useful for when you want the default action not to be the nand boot.
This value should be used as the last one in the file, as it would make the condition to always be true
and further lines would not be parsed.

All names can be upper case or lower case.

If an incorrect key name is detected, only the part read before is valid. For example:
TRIANGLE+WTF+CIRCLE -> is equivalent to TRIANGLE.



The right part contains the path of the ipl. The path must be enclosed with "". Do not use drive names
like "ms0:", there are no drives at ipl time!

You can use the path "NAND" to indicate NAND boot. (this can be useful used together with the key "NOTHING").

The format of ipl accepted by the iplloader is the following:
The first 0x3000 (12288) bytes are loaded to address 0x040e0000.
The rest of the file is loaded to address 0x040f00000

This format is not compatible with the pandora ipl and the DC1-DC4 ipl (which is same as pandora).
To convert that ipl, use the apropiated option in the Time Machine installer.
Future DC ipl's will be already in "Time Machine format".

The following characters can be used for comments: # and ;
Everything after those characters will be ignored (except if they are inside "")

Considerations:

The iplloader parser reads line by line until a match with the current key state is found.
If no match found, the nand ipl will be booted. Because of this, be careful with the following kind
of lines:

L+R = "/TM/150/ipl.bin";
L+R+START = "/TM/340OE/ipl.bin";

If the user presses L+R+START, when the parser reads the first line, it will check that the current
key state is OK, as L+R are pressed, and the 1.50 ipl will be loaded, instead of the 3.40 OE one,
which was probably the desired action.

To resolve this kind of conflicts, put always the more restrictive things at beginning.
The following lines would behave as expected:

L+R+START = "/TM/340OE/ipl.bin";
L+R = "/TM/150/ipl.bin";

If a ipl file is not found, the process will continue reading next file.
If config.txt is not found, nand ipl will be booted.

Examples of files:

CROSS = "/TM/150/ipl.bin";
CIRCLE = "/TM/150_340/ipl.bin";
TRIANGLE = "/TM/340OE/ipl.bin";
SQUARE = "/TM/360M33/ipl.bin";
UP = "/TM/pandora.bin";


This file will load 1.50 ipl when cross is pressed, the 1.50with3.40hw modules ipl when circle is pressed,
the 3.40 OE ipl when triangle is pressed, the 3.60 M33 ipl when square is pressed, the pandora ipl when digital UP
is pressed, and the NAND ipl in any other case.


CROSS = "/TM/150/ipl.bin";
CIRCLE = "/TM/150_340/ipl.bin";
TRIANGLE = "/TM/340OE/ipl.bin";
UP = "/TM/pandora.bin";
DOWN = "NAND";
NOTHING = "/TM/360M33/ipl.bin"; Notice the NOTHING was put at the end!

This file will load 1.50 ipl if cross is pressed, the 1.50with3.40hw modules ipl when circle is pressed,
the 3.40 OE ipl when triangle is pressed, the pandora ipl when digital UP is pressed, the NAND ipl
when digital DOWN is pressed, and the 3.60 M33 ipl in any other case.

If you can't understand the above, this,
will help you out. This nifty tool will generate the 'config.txt' file for you depending on what buttons you press for each FW asked for. On top of that, it's ran from the PSP. (Thanks RS, and bcman!)

Using TM as flash0 firmware recovery

It's weird, but with Pandora, a lot of things are possible. Last night, I was messing around with 3.60 M33 and I launched the 3.90 M33-2 installer. Instead of writing to my MS, it wrote to flash0 cleanly without any problems. So, if I can do that, why not do that with the rest of the firmwares?

What you'll need

-A TM stick that has Pandora on it, and has the msipl.bin file converted. Also, 1.50/3.40 OE or 3.60 M33 installed.
-Jas0nuk's ELF menu
-Cory's Nand Tool
-Your Favorite CFW

Note: To unbrick on a Slim, you must be booted in 3.60 M33, and use a CFW installer 3.71 M33 or higher. You will need the 3.52 M33 installer if you are recovering on a Phat.

When you acquired those, transfer them to your MS. Make sure you have the Sony update eboot in the 'UPDATE" folder or else this won't work.

On a Slim

To start the recovery mode, boot into 3.60 M33. From there, launch the CFW installer and install it normally. When done, press X/0 to reboot or you will brick your flash0 firmware. When you reboot, you will be rebooted into your new flash0 firmware, and it should work perfectly. Remember that if your nand image or IDstorage keys are messed up, it will remain that way.

On a Phat

Boot into either the 1.50, or 3.40 OE-A firmware. From there, create the 3.52M33UPDATE file, and launch it from the XMB. Just update normally. When you reboot, you should be on a fresh install on 3.52 M33. From there, just upgrade to 3.52 M33-4 so you will be allowed to upgrade past 3.52 M33.. :p

FAQ

?: How do I switch between TM's firmwares?
A: Shutdown completely, and reboot into the other firmware by holding the button assigned.

?: Do I really need a Pandora Battery?
A: Dark_Alex does not lie.

?: The TimeMachine won't boot for me! What to do?
A: If you are running TM on a Slim, upgrade to 3.90 M33-2. If that isn't the problem, make sure you written the ipl for TM. If that isn't the problem, keep trying. The button needs to be pressed quickly. Also, make sure you installed the firmwares.

?: Can I add my own firmwares to TM?
A: When compatibility is added, yes.

?: Can I boot into a Phat-only firmware on a Slim and vice-versa?
A: No. 3.60 M33 is a Slim-only firmware, 1.50 is only for Phats, and 3.40 OE is only for Phats.

?: PMF playback is messed up while in the 1.50 + 3.40 Mix Up firmware. <Slim only problem>
A: That's a bug in the firmware. Read.

Originally Posted by Dark_Alex

- The "videocodec bug", aka crappy pmf play, only happening in the slim.
For some hw incompatibilty that coudln't been resolved yet, pmf videos, including
the gameboot, will play crappily in the slim.

This will happen also in 1.5 games you try to run, videos will play crappily.

Because PMPAVC videos also use the videocodec API, they will play crappily too.
Normal pmp (xvid) (used on pimpstreamer too) will play fine however as they are decoded by cpu.

- The exit with home with "odd colors" bug.
When exiting with home from a homebrew or game, you may see random colors at the end of the framebuffer.
Nothing important, it even gives it an accidental stylistic look :)

?: While in the 1.50 + 3.40 Mix up firmware, I can't access any media on the XMB.
A: DAX knows that. This firmware was made mainly for homebrew. Either boot into 1.50, 3.40 OE, 3.60 M33, or the flash0 firmware.

?: Some stuff are messed up in the TM firmwares. (UMD, etc.)
A: Everything BUT your IDStorage keys are loaded from the MS. If your keys are messed up, it will stay that way throughout the TM firmwares. However, DAX is working on making the keys loaded from the MS, as an option.

?: Will there be a 1.50 kernel addon for Slims now that it can be ran?
A: No. Not now. The 1.50 and 3.40 Mix up does this nicely, and the hardware of the Slim will cause some problems.

?: I can't boot into one particular firmware! What to do then?
A: Keep trying. Press the button first enough. If that doesn't work, try it again on a faster MS. Also, make sure you are booting to a firmware supported for your PSP type. If not, re install that particular firmware.

?: During install, the installer always say that the needed files are missing and it ends in an error. I checked them and they are there.
A:Make sure they are the correct files, and they are named properly. Also, make sure the MD5 of the '360.PSAR' is correct or the installer will end in another error.

?: Can I have OFW as my flash0 firmware, and still be able to use the CFW firmwares?
A: Yep. TM boots before the flash0 does. (Like Pandora does)

?: Can I still run my Magic Stick stuff normally?
A: Yes. Hold up while booting, and it will boot to your Pandora Service Menu.

?: Booting takes forever! How do I speed this up?
A: Get a faster memory stick. My 512MB is slow and it takes 15-20 seconds to boot to the 1.50 firmware, and about 10-15 seconds to reboot. My good 4 GB takes 5 seconds for booting.

?: WTS!? There's no recovery menu on either 3.40 OE-A or 3.60 M33! WTF?
A: There is a recovery menu accessible. (Thanks Ryu) Read this post to learn how to bring it up. Read

?: Can I add my custom firmware files for that specific firmware?
A: It's possible. Please keep in mind that you are only adding on to the loading times throughout TM whenever you use that firmware with the custom files in it. (Themes work ;) )

?: Now, that I'm on 1.50, that means I can emulate other firmwares using Devhook?
A: Hell no. I repeat, hell no. If you attempt, you will corrupt your IDStorage Keys, and go into an unrecoverable brick. This not only means that you need Pandora to fix, you also need a backup of your IDstorage keys, or your nand image. If not, your totally screwed. This is from Ryu.

Note: Do NOT attempt to run DevHook on TimeMachine. There is a known bug that can cause corruption to ID Storage, meaning you won't be able to restore your PSP without an ID Storage or NAND backup.

Well, that's it. Have fun traveling back and forth. Don't expose any loopholes..

[mrthong]

nice tut i just downloaded it :)

[REDRYNO1221]

How well does it work... bugs?

[mattrey94]

Nice Tut Demonchild. I'm gonna try it out now. Hope DAX expands this to like 3.80m33 or like 3.52m33.

[Demonchild]

Originally Posted by REDRYNO1221

How well does it work... bugs?

I tested 3.40 OE-A, and 1.50 on my Phat and they work fine. However, 3.40 OE-A won't boot anymore on my 4 gig. (After the 1st boot). Also, my 3.40 OE install keeps freezing, and never completes.

Asides from that, no problems here. (Except for the problems already in the firmware.)

[mattrey94]

I just tried 1.5 and 3.40 OE-A also. but on a 1 GB memory stick. No problems yet. Everything is working for me. One question though, could I like install a 3.40 OE-A theme to my memory stick and have it boot to that? That would be pretty awsome.

[Demonchild]

Originally Posted by mattrey94

I just tried 1.5 and 3.40 OE-A also. No problems yet. One question though. could I like install a 3.40 OE-A theme to my memory stick and have it boot to that? that would be pretty awsome.

Maybe. I was thinking that as well. However, you got to remember loading times on your MS.

[mattrey94]

Originally Posted by Demonchild

Maybe. I was thinking that as well. However, you got to remember loading times on your MS.

True. I'll try it tomorrow and I'll get back to you guys.

[mrthong]

is it possible to have 1.5 on slim and 3.60m33? on the same ms and use them both?

[Demonchild]

Originally Posted by mrthong

is it possible to have 1.5 on slim and 3.60m33? on the same ms and use them both?

Yes. Install the 1.50 + 3.40 Mix up and 3.60 M33 from the installer.