PSP-3000 and TA-088v3 owners — it’s your time to shine… Or at least I hope it is… Yoshihiro and Team GEN have released their highly anticipated PSP Custom Firmware 5.03 GEN-B for all ChickHEN-enabled handhelds. It’s on you; I don’t have a PSP-3000 to test with… So whether your 5.03 GEN-B experience be a positive or negative one, I ask you leave it below.

Core features:

• Play games (UMD or backup) requiring firmware 5.50+, including 6.xx
• Play games that introduce their own cfw detection / protection
• Play PSOne games
• Access to the VSH and Recovery Console

Known bugs:

• MGS demo refuses to run
• The Recovery mode menu is “mixed”

Keep in mind: you need a PSP-3000 or PSP-2000 with the TA-088v3 board. Your PSP also needs to be running [official] firmware 5.03; this is required for ChickHEN.

Download:
ChickHEN R2
PSP Custom Firmware 5.03 GEN-A
PSP Custom Firmware 5.03 GEN-B

- source: pspgen

Nah, probably not… Take the next 6 minutes and 46 seconds to witness history, or complete tomfoolery, in the making…

This video stems from Despertador21 over at pspgen. Whether it’s authentic or pure speculation; I’m learning towards freshly squeezed speculation. So I wouldn’t get your hopes up, not yet anyway. Really, where are the goods? Discuss amongst yourselves…

- source: pspgen

So as suspected, that blue Datel battery, it’s a total sham… Well, sort of… When put into service mode on the PSP-3000 it’ll result in nothing but a flashing light and black screen; at least for those sporting a TA-088v3 motherboard. Someone still needs to bypass or hack the pre-IPL hash process. Over at sceners is an update confirming the battery’s falsifications, as well some clarification on hacking the 88v3 IPL –

…it’s confirmed that this over exalted battery will leave 3k at least like the 88v3, just with a flashing light, a black screen and nothing but that LED indicator, as we announced.

…

Now onto the 88v3 IPL. You might remember this post from where part of the signing (there were 2 functions missing) was hacked from Brokencodes; so being as partial as it is, it would be interesting now to say, after reading about it on all the PSP-related webpages, that is NOT conclusive or definitely, so please, be aware that a “hack” for this couple of mobos might need further and longer study.

Now, I shouldn’t say it’s a total fake… The battery functions as described on other hackable PSP models, i.e.) the PSP-2000.

- source/full article via sceners

Remember when Dark_AleX explained why a PSP equipped with the TA-088v3 motherboard couldn’t be hacked? Well, good news — apparently a hacker by the name of Brokencodes has indeed broken the code.

Released yesterday was a bit of somethin’ somethin’ that should generate the signature to resign the IPL and ultimately pass the pre-IPL hash process. In other terms: sit tight, soon you’ll be enjoying custom firmwares, 3rd party plug-ins, and homebrew galore.

- source: sceners

According to Alek the new PSP-3000, well at least the first round of manufactured units, is actually equipped with a TA-090 motherboard — not the TA-88v3 you’ve read about. So if you have recently purchased the PSP-3000, there is still hope for complete hackability.

But wait a minute… Doesn’t the PSP-2000 (Slim) use the TA-090 motherboard? Yes, it does. Unfortunately Sony has introduced new protection for the PSP-3000. The good news: developers are taking a crack at it. We’ll keep you posted.

- source: sceners

Dark_AleX has released a simple tool to determine whether or not you’re a sucker with a [new] non-hackable hand-held. Copy each firmware EBOOT, both 3.90 and 4.05, to the root of your memory stick. Launch the TA-088v3 Identifier (GETIPL) from a homebrew-enabled PSP and it will extract and create the IPLs; if you’re good to go, the app should auto-exit in 10 seconds. This leaves you with an “ipl390.bin” and “ipl405.bin” file in the memory stick’s root.

Next, do this –

• Connect the PSP via USB.
• Format a memory stick with the included “mspformat” tool.
• Use “msinst” to install the 3.90 IPL onto the freshly formatted memory stick.
• Insert the memory stick into the PSP to be TA-088v3 tested.
• Turn it on with a Pandora Battery. Two (2) possible results:
  1. PSP immediately turns off — your PSP is NOT equipped with a TA-088v3 motherboard.
  2. PSP stays on with the green light — your PSP is a TA-088v3, or perhaps you’ve done something wrong. Continue…
• Connect the PSP via USB again.
• Repeat the above steps with the 4.05 IPL. Again, two (2) possible results:
  1. If the PSP turns off immediately with this IPL and it previously remained on with the green light — this indicates a TA-088v3 board.
  2. PSP and the green light remain on — you’ve likely done something wrong. Try again.

Whatever the indicator — the TA-088v3 ain’t hacked yet.

Download:
TA-088v3 Identifier
PSP 3.90 FW EBOOT (rename to 390.PBP)
PSP 4.05 FW EBOOT (rename to 405.PBP)

- source: dark-alex.org

Straight from the source — Dark_AleX verbatim…

When the PSP boots, the boot code (aka pre-ipl or ipl loader) loads the ipl from either the nand or memory stick. The IPL is splitted into pieces of 0×1000 bytes.

First 0xA0 bytes of each block is a header for the kirk hardware command 1. It contains keys, the size of the cipher data, and two hashes, one for part the header itself, and another one for the body. The 0xF60 remaining bytes are the ciphered body, which will decrypt to 0xF60 plain bytes… if the hashes, which are checked by kirk hardware itself, are OK. (Note: ciphered body can actually be less than 0xF60, in this case, remaining bytes are ignored… before TA88v3)

What has Sony added to fix this?

The answer can be found in 4.00+ slim ipl’s. They decreased the size of the ciphered body to 0xF40 to leave 0×20 bytes at the end of each block (at offset 0xFE0). In newest pre-ipl’s, these 0×20 bytes have a meaning.

…

…

This protection also destroys any possibility of downgrading below 4.00, as these new cpu’s won’t be able to boot previous firmwares ipl’s.

Summary: basically, all security of newest psp cpu’s rely on the secrecy of the calculation of those 0×20 bytes. If pre-ipl were dumped somehow, the security would go down TOTALLY.

And you know the real kicker? The yet-to-be released PSP-3000 will likely sport the new TA88v3 board.

- source / full article: dark-alex.org