Pandora's Battery is, currently,
the hack for the Sony PSP. It allows anyone to run unsigned (unauthorized by Sony) code on
any current PSP hardware or firmware revision, primarily for installing Custom Firmware. The wonderful thing is, Sony created this service mode. We now get to use it
You do
not need a bricked PSP to use it, and it
can be used to restore a fully bricked PSP, with the exception of IDStorage, which currently cannot be regenerated.
Those who wish to know exactly how it works, and how it was discovered, should see
this video from the 24C3 Conference.
Installation guide, Homebrew method and Non-Homebrew method, follows. I recommend having a spare battery for normal operation before creating a Pandora's Battery.
This is a guide on how to mod a normal battery into a Pandora's Battery, and install 3.80 M33-5 with or without a homebrew PSP. If you do not have access to a Homebrew enabled PSP, you have to obtain the Magic Memory Stick files from somewhere (Hint: Google, I'm sure some members will be willing to provide.) Remember, discussion of where to find said files is strictly prohibited.
By following any information or advice in this thread, you accept any and all responsibility for any damage which may happen, to your PSP, battery, and (if you choose the soldering method) limbs. Yes, that's right, limbs.
Those who choose to solder the battery pack, if you fail to remove the Li-Ion cell, and apply heat for too long, the battery pack will explode.You have been warned.
Before proceeding, ensure you have a Memory Stick Pro Duo (256MB or more), and access to a computer with Windows XP installed. This guide offers no support for installation from other operating systems.
I won't be updating this thread for Despertar del Cementario V5 - TimeMachine integration and IPL differences make it too difficult for (sorry, but) noobs to manage, and makes it frustrating for the person helping/supplying files.
Installing the 1.50 Downgrader.Allows the user to downgrade any Phat PSP (PSP-10XX) to Official Firmware Revision 1.50, capable of running most homebrew.This downgrader CAN NOT be used on PSP Slims. Doing so will result in a brick. Slim users must install Despertar del Cementario 4, described below.Note: For this, you need Windows XP, and a Memory Stick Pro Duo with a capacity of 256 MB or more.
First, Download:
-
Team C+D Pandora's Battery Package -
1.50 Official Firmware Update File -
Pandora's GUI v1.5If you're not using Homebrew:
-
The illegal-to-distribute Pandora 1.50 Downgrader files.Homebrew Method:Step 1. Copy all the files on your memory stick somewhere safe, then install Pandora's GUI v1.5, open it, and plug in your PSP. In the PSP Location frame, locate your PSPs drive letter, if it has not done so by itself. Then, click the button in 'Step 1: Formatting' to format and partition your Memory Stick.
Step 2. Locate the 1.50 Update File in the '1.50 Sony eBoot' of Pandora's GUI, then click the Copy Files button in Step 2.
Step 3. Disconnect USB, and (on a homebrew PSP, obviously) navigate to Game -> Memory Stick -> Pandora's Battery Firm. Installer. Once the files have been installed to the memory stick, head to USB Connection and copy the folders kd and registry, and the file msipl.bin somewhere safe on your computer. The base Pandora's Battery Kernel is now installed on your PSP, capable of downgrading Phat PSPs to 1.50. It won't, however, boot yet, so we need to write the Initial Program Loader (IPL).
Step 4. Reconnect the PSP via USB, then in Pandora's GUI v1.5, under 'Step 4: Removing the contents', click the Write IPL button.
Step 5. Paste the files you copied off the Memory Stick in Step 1 back onto the Memory Stick.
Non-Homebrew Method:Step 1. Obtain the illegal files (Google?), copy 'KD', 'REGISTRY' and 'msipl.bin' to the root of your Memory Stick.
Step 2. Connect the Memory Stick via USB, then in Pandora's GUI v1.5, under 'Step 4: Removing the contents', click the Write IPL button.
Simple as that.
Note: If you are planning on using your Pandora's Battery on a PSP Slim & Lite, DO NOT USE THE CURRENT INSTALLATION. You must now install Despertar del Cementario, as below.
Installing Despertar del Cementario V4.Allows the user to install Firmware Revision 3.80, Custom (3.80 M33-5) or Official (3.80) on *any* PSP hardware revision, Phat (PSP-10XX) or Slim & Lite (PSP-20XX). Custom Firmware can run Homebrew, Official cannot.Slims MUST use this.Note: For this, you need Windows XP, and a Memory Stick Pro Duo with a capacity of 256 MB or more.
First, download:
-
Sony's official 3.80 Update -
Despertar del Cementario V4 InstallerIf you're not using Homebrew:
-
The illegal-to-distribute Despertar del Cementario V4 files.Step 1.
Homebrew: Connect the Memory Stick to your PSP via PSP or Card Reader, then unrar despertar_cementerio4.rar (in WinRAR... Rar rar rar) and copy the despertar_cementario folder to ms0:/PSP/GAME. On the PSP, head to Game -> Memory Stick, and run the Despertar del Cementario installer. Press X to install to memory stick.
Non-Homebrew: When you receive the illegal-to-distribute Despertar del Cementario V4 files, you should have two folders: 'kd' and 'registry', and one file called 'msipl.bin'. Copy all those to the root of your memory stick.
Step 2. If you have already installed the IPL with the above method, you don't need to complete any more steps, as just installing the Despertar del Cementario files should work. Otherwise, continue:
Step 3. Copy all the files on your memory stick somewhere safe, then install Pandora's GUI v1.5, open it, and plug in your PSP. In the PSP Location frame, locate your PSPs drive letter, if it has not done so by itself. Then, click the button in 'Step 1: Formatting' to format and partition your Memory Stick.
Step 4. Paste the files you copied off the Memory Stick in Step 3 back onto the Memory Stick, then in Pandora's GUI v1.5, under 'Step 4: Removing the contents', click the Write IPL button.
Making the battery.Homebrew Method.Make sure the battery in the homebrew PSP is the one you want to make a Pandora out of,and that you still have the applications copied by Pandora's GUI in PSP/GAME. On your Homebrew Enabled PSP, run Game -> Memory Stick -> Pandora's Battery Creator.
You can make a backup of your battery's serial if you want, by pressing Triangle then restarting the application. This can be restored in future, though there's no real need for it. Pressing Square to convert your battery back to normal, with the serial 0x12345678, is sufficient for restoring normal operation. Press X to convert the battery into "a Service Mode one (aka Pandora's Battery)". Don't worry if it can't write to address 0x14.
Your battery's serial number is now 0xFFFFFFFF, making it a Pandora's Battery. When inserted into the PSP, the unit will turn itself on, and try to boot firmware from the Memory Stick. As long as you have followed the instructions further above, you will be presented with Firmware/A menu. Otherwise, you will be greeted by an unlit, black screen.
Making the battery.Non-Homebrew Method.Step 1:
The first thing you need to do is crack open the battery. Surprisingly, the battery isn't very hard to get in to. Cut the top part off (shown below), then just use a guitar pick or something similar to slide in through an edge and slide around the perimeter of the battery to separate the two halves.
Now, I've discovered both batteries
can be hard modded by detaching Pin 5 on the EEPROM. But when there's an easier alternative, who really wants to
. Phat Batteries do require the pin method, but for Slim batteries, there's a much easier hard mod (skip the
PSP Phat Battery: section)
PSP Phat Battery:Step 2:
Next, we need to locate a certain chip. The chip has the model number S93C56 printed on it. We are going to need to desolder (or cut) pin 5 and lift it off of the board. Here is a magnified view of the board, which shows where the chip is and which pin needs to be lifted or cut.
Old Batteries:
Your battery may alternatively look like this:
At this point, choose whether to solder, or cut your pin. Soldering should only be attempted with the ideal tools, and high soldering experience. Cutting the pin means the battery can, pretty much, never be returned to it's Non-Pandora state. Various spit-and-prayer methods of reconnecting it are out there.
If you choose to cut, simply cleanly sever pin 5, and go to Step 4.Step 3:
If you are not confident in your soldering skills, have a less than steady hand or have a larger-than-optimal sized tip, please de-solder the cell pack from the battery first. If you make contact between pins 5 and 6 then you will short ground to +3.6VDC! Not good! When de-soldering the cell, only keep the iron on long enough to melt the solder. If you can, use a higher wattage iron so that the tip will be hotter, but you won't transfer as much heat to the cell pack. Remember that heat + Li-Ion battery = large explosion. Seriously though, this operation is not for the faint hearted, and should definitely not be your first soldering experience.
Now, time to actually de-solder the pin. There are a few ways you could do this, but I think my method is the best because its less likely to damage components near by. Use an Xacto knife with a sharp tip and try to put it underneath the pin. Get somebody to hold a soldering iron (WITH A VERY FINE CONICAL TIP!) on the pin. When the solder melts you can pop the pin up with the knife. Be sure not to hold the iron on the board too long to avoid the lithium battery from getting too hot and exploding.
Note: You can convert it back to a fully functional Non-Pandora by resoldering pin 5.
PSP Slim Battery:Step 2-3 (Er, heh):
I stumbled upon this today, and thought it might be a good idea for those wanting to hard mod their PSP Slim battery, without fear of shorting the EEPROM.
Simply sever the PCB line circled in blue above, and you're done. Continue onto Step 4.
(Circled in red is Pin 5 of the EEPROM, just for fun.)
Step 4:
Finally, close the battery's casing. Use some Krazy Glue to keep it closed, or just use electrical tape around the edges. I don't actually recommend the electrical tape as it makes the battery very snug in the compartment and it takes a bit of force to get it out. You can use the battery just like a regular Pandora's battery. As for getting the Memory Stick files, I can tell you that they are out there and you can find them after a bit of Googling. However, I can't tell you exactly where to find them as they contain copyrighted Sony code, and sharing them is illegal.
How does this work?
The pin that we just lifted was actually the ground pin of the EEPROM. Removing this pin effectively shuts off the EEPROM. When the microcontroller inside the battery tries to read the EEPROM, it will think the EEPROM contains all 1s (in binary). This is because of the pull-up resistors on the data lines. So the microcontroller returns a serial number of 0xFFFFFFFF to the PSP, which then goes into service mode.
Running Despertar del Cementario V4Step 1. Make sure the KD and Registry folders are in the root of your memory stick, and you've followed the above instructions for installing the IPL to your memory stick, then insert into the PSP (in this order) your memory stick, then the battery. The PSP will automatically turn on. Press [] (Square) to create a backup dump of your PSPs internal memory (it will appear on your memory stick as a file named 'nand-dump.bin'). After 3-5 minutes, the PSP will switch itself off. This file is important, mainly in case for some reason your IDStorage (a set of keys, some unique to your unit, held on the PSP, vital for WiFi, launching games, among other things) becomes corrupted, restoring a NAND dump will fix this.
Step 2. Flick the power switch up again, and this time press X (Cross) to install 3.80 M33-5. When this process is done, take the battery out of the PSP, and insert a normal battery, or the AC Adapter, and power on your PSP. Under System Information, it should now say 3.80 M33-5.
Using your Magic Memory Stick and Pandora's Battery normally.Your Memory Stick can still be used as a normal one, and will trigger 'service mode' whenever used in conjunction with a Pandora's Battery. DO NOT run chkdsk on it, or leave the PSP or memory stick connected to the computer when booting. Windows reads the partition as somehow invalid, and tries to correct it (as Windows does). All it does, in my experience, is corrupt the entire memory stick.
The battery cannot boot the PSP normally. To be able to do that, you must use a Pandora's Battery creation tool (either the C+D one mentioned above, or HellCat's one) to reflash your batteries backed up serial, or to flash a generic serial number. If you wish to operate the PSP normally with a Pandora's Battery, you can do the following:
Step 1. Remove the Battery from the PSP. Wait a few seconds.
Step 2. Insert the AC Adapter cord into the yellow AC plug on the PSP, and flick the Power switch up to boot the PSP.
Step 3. Once the screen turns on, it's safe to insert the Pandora's Battery, to use the PSP normally.
Should the PSP freeze, reboot, or turn off for any other reason, you will have to repeat this process.
Booting regularly with 3.90 M33-2+ & TimeMachineSince the release of Dark_AleX's TimeMachine, you can now boot directly to internal firmware as per normal with a Pandora's Battery and Magic Memory Stick, provided you have both 3.90 M33-2 or higher, and TimeMachine, installed. See my thread
here on installing and using TimeMachine.
PM me if you have any questions unanswered in this thread, but make sure you read through a few times to be sure.
