The new Hack your PSP thread

[Scorpus]

My Hack your PSP thread

There is one simple reason as to why I made this guide; BCman's guide is a bit confusing and outdated and too many links to follow. This guide is contained within the 1 thread and has all you need for Pandora, Downgrading etc.

You will be thinking now, well I've got a PSP, but I want to unlock its full potenital and use it for playing "backed up" games, homebrew, PS1 games and whatnot

The first thing you need to ask yourself is what type of PSP to do you have?

- A PSP 1000 (aka PSP fat)
- A PSP 2000 (aka PSP Slim & Lite)
- A PSP 3000

Both PSPs are currently hackable, except the very new Slims that come with firmware 4.01 official or over; ones with a TA-088v3 or TA-090 motherboard on the inside. Its is unknown when or if it will be hacked. Read this to determine whether you have an unhackable PSP by whats on the box -- http://www.psp-hacks.com/forums/f117...ox-by-t223726/

Next, you need to understand the basics of hacking a PSP. When people say they have "hacked" their PSPs it means that they have modified the firmware on it to a certain firmware called "Custom Firmware" or CFW for short.

CFW is modifed Sony made firmware so that you can run homebrew (user made programs) and copies of UMD games stored on your Memory Stick as ISOs.

The current Official Firmware is 5.02
The current Custom Firmware is 5.00 M33-4

Custom firmware retains all the features of Sony firmware and adds more (such as the capabilities I have already stated). I will show you how to load the best Custom Firmware, known as M33. M33 firmware is made by Dark_AleX of Team M33

There are loads of ways to get Custom firmware. Check what firmware you have already then choose one of the options below

Firmwares: 1.00, 1.50
Upgrade straight to Custom Firmware

Firmwares: 1.51, 1.52, 2.00, 2.01, 2.50, 2.60, 2.70, 2.71, 2.80
Downgrading 2.80 and Below

Firmwares: 2.81, 2.82, 3.00, 3.01, 3.02, 3.03
Downgrading 3.03 and Below

Firmwares: 3.10, 3.11, 3.30, 3.40, 3.50
Downgrading 3.50 and Below

Firmwares: If you have any official firmware, but a friend has 1.50 or Custom Firmware
Making a Pandora's Battery: The Softmod Method
-- Using your Pandora's Battery

Firmware: All
Making a Pandora's Battery: The Hardmod Method
-- Making the Battery
-- Making the Magic Memory Stick
-- Using your Pandora's Battery

Please post feedback and/or anything that needs adding

Notes:
- For the Pandora's Battery: A Fat battery will work in a Slim, but the Slim battery will not work in a Fat

For Further Reading:
- M33 Firmwares for Noobs
- Quick Guide For New Users
- Pandora Battery FAQ
- How to Post for Help

Thanks to: BCman, Demonchild, richluk, Stallone, RainMotorsports, kazebt, Calo

[Scorpus]

Upgrade straight to Custom Firmware

Notes:
This method cannot be used if you have official firmware 1.51 and above. Custom firmwares will work though
You can use this guide to update your existing M33 firmware to the latest firmware. Just start at the section "Now to go to 4.01 M33-2"

Requirements:

- PSP running 1.00 or 1.50 official firmware, or any Custom Firmware. If you have firmware above 3.52 M33-3, skip to step 4
- Memory Stick (preferably larger than 32MB)
- A PSP battery that is charged more than 76%

Notes:
It is a good idea to backup then format your Memory Stick on the PSP before you begin

Instructions:

1)
- Download the 3.52 M33 easy installer -- http://rapidshare.com/files/15579776..._Installer.rar
- Open the .rar
- If you are on firmware 1.50, open 1.50 Installation.exe; if you are on CFW click on CFW Installation.exe
- Select your PSPs drive letter
- Click Install

2)
- Once finished, go (on your PSP) to Game > Memory Stick.
- 1.50 Step Only Run KXploit Permanent Patcher. Follow on screen instructions. Once finished, continue with the steps
- Run 3.52 M33UPDATE (from Game > Memory Stick)
- Follow the on screen instructions
- Once completed you should have 3.52 M33
- Backup first, then format your Memory Stick

3)
- Open the .rar you downloaded before (3.52_M33_Installer.rar)
- Then, inside that, open M33-1234.rar
- Plug your PSP into the computer, and copy the entire PSP folder to the Memory Stick, confirming to merge, copy, replace whatever comes up
- Once copied, go into Game > Memory Stick and run the 3.52 M33-4 Updater
- Follow the prompts. If the installer fails, set your game kernel to 3.52 in the recovery menu. To do so, turn off your PSP by holding the switch up for 3 seconds. Then bootup while holding R. Go into Configuration then set "Game Folder Homebrew" to 3.52 Kernel

4) Start here if you have firmware above 3.52 M33-4
- Download the 5.00 M33 easy installer -- http://rapidshare.com/files/15592530..._Installer.rar
- Run 5.00 M33 Easy Installer.exe
- Select your PSPs drive letter
- Click Install

5)
- On your PSP, go to Game > Memory Stick
- Run the 5.00 M33 Updater
- Follow the on screen instructions

You should now have 5.00 M33 Custom Firmware installed on your PSP. Go exploring and find some homebrew to put on it

[Scorpus]

Pandora's Battery: The Softmod Method

Requirements:

- PSP running 1.00 or 1.50 official firmwares, or any Custom Firmware
- A battery that will become a Pandora's Battery (the battery that comes with your PSP will do, but you wont be able to use the battery normally, so a new battery is recommended)
- Memory Stick larger than 64MB

Instructions:

Download this file (quite large, but contains all you need) -- http://rapidshare.com/files/15603395...od_Pandora.rar

1) This might require you to repartition your MS if using a fresh formatted one. If it does, you will have to follow the guide at the end of this one that will use Hellcat's Pandora Installer to format your Memory Stick

2) Extract Despertar Cementerio, and move the 'DC7' folder to X:/PSP/GAME (where X: is your PSPs drive letter)

3) Extract the 4.01 update (inside the Update 401 folder). Place it on the root of your Memory Stick


4) Disable USB Mode. If you use a CTF/PTF, go to Settings > Theme Settings > Theme > Original. Turn it off or the installer wont load for you.

5) Launch Despertar Cementerio from Game > Memory Stick.


6) Once it loads, you will have to press X to begin installation.

7) Everything shall go fine. You will see a Sony like updater before you but its way more wicked and you have plugins enabled

8a) If you are using TimeMachine you will be prompted to press a button at the end of install so you can launch DCv6. Any button that doesn't boot any other firmware is good. (I use D-pad up). Hold whatever button you want to until the installer reads it and carries on with installation.

8b) If the install stops at 99%, writing the DC ipl loader, you will have to close the installer and reformat/repartition your stick, and re-do the installation. (Guide is at the end)

9) You now have a Magic Memory Stick. Continue to learn how to make a Pandora's Battery.

10) Go into the Hellcat folder and move the 'pan3xx' folder to X:/PSP/GAME.

11) Go into the Update 150 folder and copy the UPDATE.PBP to the root of your Memory Stick. This is necessary. If you don't do this step, Hellcat's Installer will fail to work for you..


12) Launch the installer, and go to 'Battery Options', and then go to 'Dump battery serial to file'. Afterwards, go to 'Make Battery Pandora'. Once done, exit, and you will have a working Magic Stick and a Pandora Battery.



Reformatting Memory Stick:

0) Skip steps 1 and 2 if you have already loaded the Pandora Installer

1) Go into the Hellcat folder and move the 'pan3xx' folder to X:/PSP/GAME.

2) Go into the Update 150 folder and copy the UPDATE.PBP to the root of your Memory Stick. This is necessary. If you don't do this step, Hellcat's Installer will fail to work for you..


3) Launch the installer. When it loads, go down to 'Memstick and MS-IPL options''


4) Then go to Repartition and format MemStick (DESTRUCTIVE!)


5) Acknowledge the warning if any, and repartition the MS. When done, shutdown and reboot. You are now ready to try and install DCv7 again

[Scorpus]

Pandora's Battery: The Hardmod Method

Requirements:

- PSP
- A battery that will become a Pandora's Battery (the battery that comes with your PSP will do, but you wont be able to use the battery normally, so a new battery is reccommended)
- Memory Stick larger than 64MB
- Some sort of wedge that isn't metal to get the battery open (like a guitar pick)
- Some sort of knife to cut a very small wire
- Tape or glue

Instructions:

Making the battery

Once you have made the battery read the next section to make a Magic Memory Stick (also needed) -- Making the Magic Memory Stick

FAT BATTERY (scroll down for the Slim battery)

This is our victim --

Please note that while this concept may work on non-Sony batteries, only official batteries are guaranteed to have the same internals, so we recommend using

one.

STEP 1:

The first thing you need to do is obviously crack open the battery. Surprisingly, the battery isn't very hard to get in to. In this picture --

-- you can see that I'm just using a guitar

pick to slide in through an edge and slide around the perimeter of the battery to seperate the two halves.

STEP 2:

Next, we need to locate a certain chip. The chip has the model number S93C56 printed on it. We are going to need to desolder pin 5 and lift it off of the board. Here is a magnified view of the board --



-- which shows where the chip is and which pin needs to be lifted.

Newer batteries have a much smaller board with a different layout. The same chip needs to have the pin lifted, but the chip is in a different position. Once you've located chip S93C56, the rest of the instructions are basically the same. This has

been confirmed with the 2200 mAH Official Sony battery.

STEP 3:

If you are not confident in your soldering skills, have a less than steady hand or have a larger-than-optimal sized tip, please desolder the cell pack from the battery first. If you make contact between pins 5 and 6 then you will short ground to

+3.6VDC! Not good! When desoldering the cell, only keep the iron on long enough to melt the solder. If you can, use a higher wattage iron so that the tip will be hotter, but you won't transfer as much heat to the cell pack. Remember that heat +

Li-Ion battery = large explosion (t3h sux0r5, unless you get in on video. Twisted Evil Seriously though, this operation is not for the faint hearted, and should definitely not be your first soldering experience. I recommend trying your hand on lifting

the pins on an N64 CPU chip. Surely if you spend enough time here you have a couple killed N64 mobos laying around. Razz)

Now is actually desoldering the pin. There are a few ways you could do this, but I think my method is the best because its less likely to damage components near by. Use an Xacto knife with a sharp tip and try to put it underneath the pin. Get

somebody to hold a soldering iron (WITH A VERY FINE CONICAL TIP!) on the pin. When the solder melts you can pop the pin up with the knife. Be sure not to hold the iron on the board too long to avoid the lithium battery from getting too hot and

exploding. When your done it will look something like this.

STEP 4:

Finally, close the battery's casing. Use some Krazy Glue to keep it closed, or just use electrical tape around the edges like I did. I don't actually recommend the electrical tape as it makes the battery very snug in the compartment and it takes a bit

of force to get it out. You can use the battery just like a regular Pandora's battery. As for getting the Memory Stick files, I can tell you that they are out there and you can find them after a bit of Googling. However, I can't tell you exactly where

to find them as they contain copyrighted Sony code, and sharing them is illegal.

How does this work?

The pin that we just lifted was actually the ground pin of the EEPROM. Removing this pin effectively shuts off the EEPROM. When the microcontroller inside the battery tries to read the EEPROM, it will think the EEPROM contains all 1s (in binary).

This is because of the pull-up resistors on the data lines. So the microcontroller returns a serial number of 0xFFFFFFFF to the PSP, which then goes into service mode.

SLIM BATTERY (thanks to kazebt)

Apparently instead of lifting or cutting the leg of the IC04 module on the circuit board in the battery of an original psp slim battery, you can simply cut one of the traces on the board to get the same results. You can cut it with a pen knife, but

don't cut completely through the board, just make sure it cuts the connection. Instant pandora battery! I may have overlooked something and before I know it my battery will send psp shrapnel into my hands. That would suck.

Trace = the cool looking connection lines that connect the components of the board together.

Also, be careful when opening your battery to not puncture the actual compnents inside since lithium can very dangerous and even explosive. It's much easier if you use something that is strong that doesn't bend easily like a glasses screwdriver

or just a small screwdriver that can get into small grooves without bending. Pen knives trying to open a battery case made it difficult since the blade is flimsy and if you aren't careful, you may end up cutting yourself or punching through the soft

plastic cover into the lithium cell. I haven't done this thank goodness, but the plastic is soft enough to where this can happen. And always, never apply insane amounts of pressure no matter how mad or difficult the process can be.

THE MATERIALS

1. I'm sure you've got a small spare screwdriver somewhere.

2. The pen knife can be really cheap. I got mine for like $1.00.

PROCEDURE

1. Open the battery. I would recommend running something like a guitar pick through the crack that you create to have less chances of hurting yourself or scratching your case too much. Do not use something metal to open the battery; it could

short out your battery, making it useless

2. Locate the trace to cut from this picture --

-- it's in the BLUE circle NOT THE RED -- DO NOT CUT THE PIN IN THE RED CIRCLE

3. Put your battery back together. You can tape your battery up with tape if you don't like how it comes apart due to lack of adhesive.

TIPS

1. If you have to, dig a small hole in the cover with your screw driver between where the top and bottom covers meet, then try to run your screwdriver all the way around to break the adhesive seal.

2. The corners are tough, so if you have to, work on all four sides of the battery before trying to seperate the adhesive on the corners.

3. Remember that the psp can still be powered with adapter if you manage to screw up your battery or need the psp to power up for some reason.

[Scorpus]

Making the Magic Memory Stick

To make the Magic Memory Stick we will be using Rain's Ultra Lite MMS Maker. To use this program your PSP doesn't have to be running Custom firmware

1) Download Rain's Ultra Lite MMS Maker (thanks RainMotorsports) -- http://www.psp-hacks.com/file/1580

2) Extract RainsUltraLiteMMS.exe

3) Connect your PSP to the computer then run RainUltraLiteMMS.exe


4) Download and extract the 4.01 Official update (extracting it to "My Documents" ("Documents" for Vista Users) is a good idea) -- http://rapidshare.com/files/155935440/4.01_Update.rar

6) In the Rain's Simple MMS Maker window, tick the "Format Memory Stick" box, then click Make MMS

7) You should now be prompted to find the eboot you just downloaded. Find it, then click Open. Then accept any prompts that appear

8) Wait as it installs


9) When done, some text saying "Make MMS is Finished" should appear above the progress bars. You now have a Magic Memory Stick

[Scorpus]

Using your Pandora's battery

So you now have a Pandora's battery and Magic Memory Stick. Here is what to do now to load M33 firmware

1) Insert Memory Stick into PSP

2) Insert battery into PSP

3) Despertar Cementerio will auto load. If it doesn't, shutdown your PSP then try booting it up holding the L trigger

4) You now have some options on a cool looking menu



5) If you are wanting to Install 4.01 M33 press the related option; if you are wanting to install official for whatever reason, choose that option

5a) If you are wanting to perform NAND operations, choose that, although that is not recommended for beginners (it's best to leave it alone)

5b) If you are wanting to view your hardware info such as what motherboard you have, choose that option

5c) If you are wanting to test M33 before you install it, choose test M33

5d) If you are having second thoughts about changing to Custom Firmware, choose the Shutdown option

6) If you have chosen to install a firmware, a loading bar should appear. When the loading bar gets to 100%, the PSP will auto shutdown


7) When your PSP has shutdown, you may now remove the Pandora's Battery and Memory Stick and insert your normal ones, or if you used your normal battery as the Pandora's Battery you can plug in the AC charger and use your PSP that way

8) Enjoy Custom Firmware

NOTE: If your PSP shuts down during your installation (or you remove the battery or something), your PSP will be bricked. Don't worry, just take out the battery and put it in again and DC will load and you can try to install Custom Firmware again. If your PSP is bricked, you can also use the battery to unbrick it.

[BCman]

nice job!
+rep

[Nothingface420]

nice guide +rep

this should be stickied

[bman2008]

Thanks Scorpus, Great guide, Repped! BTW, you mentioned that you can tell if a PSP in unhackable by looking at box(?). I read you guide several times but I can't see the part that can tell me if a PSP inside the box is unhackable or not? Can you tell me please?

Also, seems like most of the PSPs on store now probably have the new Mobo and firmware, so are we SOL'd? or will there be a hack for TA-088 Mobo in the future?

[RainMotorsports]

Scorpus until i get 1.0 updated add a note in there for vista users to right click and run as admin.