Pandora (unbricker/downgrader) for PSP-200X TA-088v3

frostegater · 13.07.2011, 00:37

Service Kit for PSP-200X
(supports TA-088v3)
{ NO SALES HERE }

After a successful hack and hide the long-time topic:
"Размышления о возможностях взлома ТА88v3"
...it was decided unhide.

First video by Yoti

New video by ErikPshat

Service Kit and MSID Dumper:

Structure folders in first archive:

Extracted Files Original - all files from original JigKick Card.
MSID 512mb Original - dump MSPro ID from original JigKick card.
Original Dump MS - full dump Service Card.
Write IPL to MS - tool for writing ipl in MemoryStick™.

How to do your own magic Service Card:

Firstly you need not original MemoryStick™ PRO DUO (from our china friends, cards w/o MagicGate). Usually it's an 512 Mb, 2 Gb or 4 Gb models.
Original Sony MemoryStick™ PRO DUO are not supported ('cause we have no datasheets/programmers for it).

This card is BAD
Download "MSID Dumper", insert MemoryStick™ in PSP and launch programm. Write on paper Serial Number and MSProID.
Remove the back shell of the MS using a knife (scalpel).
Extract internal board (with NAND) from case.
Unsold NAND microchip from card. [Some hardware magic!]

This card is GOOD ('cause you have direct access to NAND)
Insert NAND in NAND Flash TSOP-48 programmer: http://www.soft-center.ru/reader/
Support NAND list
- 29F128G08CJAAA
- 29F16G080AA
- 29F16G08AAMCI
- 29F16G08MAA
- 29F32G08AAM02
- 29F32G08CAMCI
- 29F32G08CBAAA
- 29F32G08FAA
- 29F32G08FAMB2
- 29F32G08JAMD2
- 29F32G08QAA
- 29F32G08TAA
- 29F64G08AAME1
- 29F64G08CAMD2
- 29F64G08CAMDB
- 29F64G08CFAAA
- 29F64G08CFABA
- 29F64G08FAMCI
- 29F8G08MAA
- 8GbUTHN
- ???
- D27UAG8T2MTR
- F4GMSAP
- FBAL41B8GK3W
- FBNL41B8GK3PG
- FBNL63B5IK3WG
- FDL63AP-32U
- FNNM29B2GK3WG
- FQ64G08UCT1-24
- FT16G08UCM03
- FTAL41B8Gk3WG
- FTNM40A4GK3W2
- H27UAG8T2ATR
- H27UDG8VEMYR
- HN29V1G
- HVPE4F4
- HVPG3P3
- HY27UA081G1M
- HY27UBG8T2ATR
- HY27UBG8T2MYR
- HY27UBG8U5MTR
- HY27UF081G2M
- HY27UF084G2M
- HY27UG082G (?)
- HY27UG082G2M
- HY27UG082G4 (?)
- HY27UG084G2M
- HY27UG088G5
- HY27UG088G5M
- HY27UH088G2
- HY27UH08AG5
- HY27US08121M
- HY27UT084G
- HY27UT084G2
- HY27UT088G2M
- HY27UU088G5M
- HY27UU08AG5A
- HY27UV08AG5
- HY27UV08BG5
- HY27UW08BGFM
- K9ABG08U0A
- K9BCG08U1A
- K9CDG08U5A
- K9E2G08U0M
- K9F1208U0M
- K9F1G08
- K9F1G16
- K9F2808
- K9F2G08
- K9F4G08
- K9F5808
- K9F8G08
- K9G8G08U0B
- K9G8G08UOM
- K9GAG08U0M
- K9GBG08U0M
- K9HAG08U1M
- K9HBG08U1A
- K9HBG08U1M
- K9HCG08
- K9HDG08U5M
- K9K1G08
- K9K2G08
- K9K2G16
- K9K4G08
- K9K8G08U0M
- K9K8G08U1M
- K9L8G08
- K9LAG08
- K9LBG08U0D
- K9LBG08U0M
- K9MDG08U5M
- K9NBG08
- K9NCG08U5M
- K9W8G08
- K9WAG08
- M8UJ3C26AH
- MT29F2G08
- MT29F4G08
- N1G08UOA
- P1U4GR30CT
- PQI-KA04-072A-1D00
- PQI-KA04-072F-1D00
- R1FV04G13RSA
- SDTHGEHE0-1024
- SDTNGCHE0-2048
- SDTNGCHEM-1024
- SDTNIGHSM-2048
- SDTNIGHSM-4096
- SDTNKLAHSM-1024
- SDTNKLBHSM-2048
- SDTNKLBHSM-2048
- SDTNLLBHSM-4096
- SDTNMMAHSM-002G
- SDTNMMBHSM-004G
- SDXNGDHE0-4096-I
- T04G724
- TC58DVG04B1FT00
- TC58DVM72A
- TC58DVM9
- TC58NVG1
- TC58NVG2
- TC58NVG3
- TC58NVG4T2ETA00
- TC58NVG5D2FTAIO
- TH58DVG2
- TH58NVG4D4CTG00
- TH58NVG5D1DTG20
- TH58NVG5D1DTG20
- TH58NVG5D2ETAK0
- TH58NVG5D4CTG20
- TH58NVG5T2ETA00
- TH58NVG5T2ETA20
- TH58NVG6D2ELA48
- TH58NVG6D2ETA20
- TH58NVG6T2ETA20
- TH58NVG6T2ETA2A
- TH58NVG7D1DLA87
- TH58NVG7D2ELA48
- TH58NVG7D2ELA89
- TH58NVG8D2ELA89
- Unknown
- VD101L3LC03
- VD101M3MC03
- VD101N3NC03
- VD102Q3QC33
- xD card 128
- xD card 256
- xD card H1024
- xD card H512
- xD card M1024
- xD card M2GB
Source: http://www.soft-center.ru/reader/NAND_List.php
Install programmer software (Supplied with programmer).
Connect programmer to PC.
Dump part NAND with MSID (MemoryStick™ ID). If you dump not access part, dump other part...
Open NAND by HEX Editor and search HEX points: 204D5350534E5930.

ScreenShot MSID in dump
If you not found this points, dump other list.
Correct msid from dump: 204D5350534E593000788884C6AA0000. Fat text-found points in dump (up items).
After correct msid, save file and writing dump in NAND.
Sold NAND in card and insert card in case.
Format card in PSP.
From folder "Write IPL to MS" launch "install_psp_ms_multi_loader_ipl.cmd"
Connect PSP to PC.
Press "Y".
If print "Write MS BOOT CODE" - IPL writing access.
- If print "Canceled" - you press not correct pad.
- If print "Check free reserved sector : to small reserved sectors" - using mspformat.exe.
Open MemoryStick™ by HEX editor. Veryfying installed IPL from 16 sector.
From folder "Extracted Files Original" copy all files in MemoryStick™.
Complete!

P.S. I`m translate The original theme in Russian by ErikPshat... Thanks vit9696. Sorry for my bad english...

enzo9 · 13.07.2011, 07:18

Congrats for the finding. If find a site that sells mms please publishing it
thanks

(Sorry for my english, i'm Argentinian

)

**erutan** · 14.07.2011, 09:52

enzo9, welcome =) We are glad to see you =)))

jorpakko · 16.07.2011, 19:43

Good news!!!
Unfortunately I don't have the equipment to make the MS.

Anyone selling these yet? Could really use one for my bricked 2004 TA88v3.

Oh, greets from Finland.

acquetto · 30.07.2011, 11:09

thanks

raztabob12 · 30.07.2011, 13:02

good news to bricked ta-088v3 users like me...

thanks guys...

are these available in "Repair Package" that is "already made" for sale?

and any approximate how much would it cost?...

coz my psp's been dead for quite some time now...

thanks once again...

kudos to the geniuses behind it all...

sadwolf · 27.08.2011, 01:44

Im still dont understand a little bit. if i want to unbrick my psp 2003 ta 88 v3 i will need to buy NAND Flash TSOP-48 or i can use files witch is in Service_memstick_TA-088v3.7z ?

c.ozzy · 04.09.2011, 18:33

want to unbrick my psp 2003 ta 88 v3 i will need to buy NAND Flash TSOP-48 or i can use files witch is in Service_memstick_TA-088v3.7z ?

You need also the nand programmer (because u have to dump the memorystick and then change the MS_ID) or an already "modded" memorystick.. i don't know if u can find it on ebay or something else

Semeye · 09.09.2011, 19:05

Didn't Dark_Alex say doing such a thing as this was almost impossible? I don't get it! Anyway, excellent work! Unbelievable... xD

gm619 · 19.09.2011, 19:26

can it unbreak psp 3000?

totoybatotoy · 22.09.2011, 13:18

hmmm i hope you would release the decoder

deluxe372 · 16.10.2011, 16:31

Я чето не понял ето инфа по востановке
ТА88v3

**flash_zero** · 16.10.2011, 16:44

deluxe372, Смотри на русском https://www.pspx.ru/forum/showthread.php?t=92433

deluxe372 · 16.10.2011, 17:14

всеравно не понимаю(
как можна востановит TA88v3

**DIIGMO** · 16.10.2011, 21:40

deluxe372, по типу пандоры) Или смотри видео, как именно идёт процесс.

inoob · 19.10.2011, 06:44

Hi guys! Well, i'm from Brazil, and i got one PSP 2000 with TA-088v3 bricked! I would like know if could you do a video-lesson with the needed steps to make the unbrick! Sorry for my bad english! Thank you all!

hichem05 · 02.11.2011, 00:21

Good Job man you are the best ,it will be better if you did the manipulation to create the MS on video .
try to do it ......

thibistin · 06.11.2011, 15:23

hello
I have a psp slim (TA 088 V3 mothercard) which was bricked for a year and a half.
good if I start it, nothing is displayed, as in this video
http://www.youtube.com/watch?v=UIMHT6It5bs

Is there really a solution for unbrick please

and .

( sorry for my bad english :$ )

Sad King · 14.11.2011, 17:03

what i need for do the unbrick of my psp plz hlp me ! im not have a pandora battry like this in video !

manyaksbs · 03.12.2011, 19:55

how to magic memory stick please video.

Kardeş türksün anladım videonuda izledim aynı psp var bendede 2006 versiyon. aga özelden msn adresimi yolladım eklede belki birbirimize yardımımız dokunur.