PSP Exploit

Disclaimer
Following the processes that follow is done solely at your own risk. The developers of any tools mentioned in this article cannot be held responsible for any negative effects of their use. Also, I do not accept credit for these tools or processes.

In my previous post, I talked about homebrew and custom firmware, but only mentioning being able to install it on a fat PSP running firmware 1.5. Well, there is another way which works on any PSP. This method can be used to unbrick any firmware handicapped PSP or upgrade (or downgrade) a PSP to just about any version of custom firmware. Unfortunately, a working PSP running either 1.5 firmware or custom firmware is needed, as well as a spare battery and memory stick (1Gb works, but 512Mb should work as well). The battery is used to create what’s known as a Pandora battery, and the memory stick is used to create a Pandora Memory Stick (aka jigstick or Magic Memory Stick).

For the battery, I chose to use an official Sony battery for the phat PSP since it is proven to work very well. I have read that you should not attempt to use a slim battery as this will kill it. Even though the phat PSP battery does not properly fit the PSP slim, it can still be used in the Slim for these purposes. Just make sure the battery is as secure as it can be, and lay the PSP on a stable surface while performing any actions involving this battery.

First, grab a program called mspformat. Get it here. Connect the PSP to a computer and place it in USB mode. If desired, back up the contents of the memory card (simply copy the entire contents to your computer), because it is about to be formatted. Using the command prompt (Start, run, cmd), navigate to the location of the mpsformat program, and type the following to format the memory stick correctly:

mspformat X (where X is the drive letter of the PSP memory stick)

Exit USB mode and reboot the PSP (rebooting may not be necessary, but I usually do it anyway just in case). Connect to the computer again with USB mode.

Now, head over to Dark_Alex’s page and download Despertar del Cementerio. Manually create a directory in the root of your formatted memory stick called PSP. Within that directory, create a directory called GAME. Place the folder DC5 from the Despertar del Cementerio download into the PSP\GAME directory. Next, you are going to need Sony’s official firmware updates for firmware versions 1.50, 3.40, and 3.90. I cannot link to these here, but they are pretty easy to find by searching for “1.50 Official PSP Update”, or something along those lines. Each of these downloads may be named EBOOT.PBP. If they are, rename them 150.PBP, 340.PBP, and 390.PBP and place them into the root of the memory stick. Don’t worry too much, because if something isn’t right, the program will tell you and you’ll just have to try again.

Once everything is setup, exit USB mode, navigate to the game menu, and enter the memory stick. If the contents look strange, power down the PSP, remove and replace the memory stick, and turn it back on. This should fix it. Now, execute Despertar del Cementerio. Once this is complete, re-connect to the PC and delete 150.PBP and 340.PBP as they are no longer needed. Leave 390.PBP. At this point, the memory stick is ready for action and can be put aside for later use. Credit goes to Dark_Alex for portions of this guide.

Next, we need a proper battery (more aptly, a Pandora battery) to utilize the Magic Memory Stick we just created. There are two different ways to do this, depending on which PSP is being used. Since I was using a Slim PSP, I used the corly149 tool, found here (registration is required to download, but only takes a minute). There is also the c+d tool for those that have a phat PSP with either custom firmware or 1.50. Check it out here, and please, if you can, drop those guys a donation and thank them for all of their contributions to the community.

Once you have your chosen Pandora Battery creation tool ready to use, it’s time to modify that spare battery you have. Plug the AC adapter in the PSP and remove your normal battery and replace it with the battery you wish to make a Pandora Battery. Make sure the battery is charged at least 75%, but 80% is better to be safe. Disconnect the AC adapter and execute the Pandora Battery creation tool. This process should be pretty self explanatory. This comes from the readme of the tool:

service mode writes a serial 0xFFFFFFFF to the battery eeprom (inserting the battery will power on and wait for a proper MS)
auto boot mode writes a serial 0×00000000 to the battery eeprom (inserting the battery will power on and boot the firmware)
dummy normal writes a serial 0×12345678 to the battery eeprom (the battery will work normally)
backup eeprom reads the battery eeprom to a file “eeprom.bin” in the root of a MS
restore eeprom if a file “eeprom.bin” is present, it will attempt to write it to the batteries eeprom

I believe there are two restore options that will initially be disabled, but more on those in a moment. First, you want to backup your battery’s EEPROM. This is necessary if you want to return to normal at a later time, but it should be done regardless as it really doesn’t hurt to have the backup. Now the restore options should be enabled since the backup file is now present. Now, you want to choose service mode. This writes the 0xFFFFFFFF serial number to the battery’s EEPROM, making it a service mode battery (or Pandora Battery). Once complete, exit the application. Re-attach the AC adapter and remove the modified battery and replace it with the normal battery. Congratulations, you now have a Pandora Battery and a Magic Memory Stick that can be used to unbrick any PSP. It can also be used to install Custom Firmware to any PSP.

Note that this process sets up the battery and memory stick combo to install firmware 3.90 (the most recent at this time). This process can also be used to downgrade to a previous firmware, but I won’t go into that detail here. You should have the gist of it by now.

To use the combo, simply take the PSP you want to use it on and insert your Magic Memory Stick. Be sure to insert the stick when no battery is installed! Now, install your Pandora battery and the PSP will automatically turn on. The PSP will boot into service mode and you can follow the on screen instructions. Pressing X (cross) will install 3.90 m33 custom firmware. Pressing O (circle) will install the original 3.90 firmware. It’s that easy.

If you are running custom firmware on your PSP, these are priceless tools to have. That way, if you screw up installing a custom theme (or do anything else to trash your firmware), you’ll have what you need to bring the PSP back to life. Spread the joy of custom firmware to your friends and show them what it can do. And most of all, have fun!