PSP Release: Baryon Sweeper lets you unbrick PSP 2000/3000, Pandora battery style

wololo

We are constantly looking for guest bloggers at wololo.net. If you like to write, and have a strong interest in the console hacking scene, contact me either with a comment here, or in a PM on /talk!

15 Responses

  1. NakedFaerie says:

    What a load of bull5h!t. I’ve got 2 pandora batteries a 1000 and a 2000. (Phat and slim) Had them for many years.
    Even got CFW which lets me boot with pandora batteries and choose what I do with switches.
    So I dont need 2 batteries, I just mod the battery into a pandora battery and boot from there.
    What I did was use the wireless switch, On is normal mode, off is service mode.
    So depends on where the wireless switch is depends on how the console boots up.

    I had it like this since before the PSP GO came out so many years ago so this bull5h!t about the 2000 not having pandora batteries is total BS..

    This is funny as yesterday I just brought 2 PSP batteries, a 1000 and 2000 as my old ones are worn out. 🙂
    Havent even modded them yet, thats how new they are. But later today will be turning them into pandora batteries THE OLD WAY then start using them.
    There is NO NEED for hardware mods. All you need is the pandora app which changes the serial number of the battery. I cant remember as its been what 15 years? But its something like 00000000 is service mode, 11111111 is normal mode. But your battery has its own serial number so back it up first or its gone when you make a pandora battery.

    • endmor says:

      iirc Sony patched newer revisions of the PSP 2000 so the pandora battery wouldnt work on them when previously the battery was patched so it couldnt become a Pandora battery

    • wololo says:

      NakedFaerie, please read again. I specifically said “newer” PSP Slim models. You are right that earlier PSP Slim models are compatible with the Pandora battery. apologies if my choice of words didn’t make that clear.

    • Mathieulh says:

      You need a hardware mode because existing battery controllers do not implement the new IDs/keys used for the challenge response to enable service mode on TA-088v3 and newer boards (like psp-3000).

      Fun fact, in Service Centers, Sony used a battery emulator all along and never actually used real batteries, challenge logs from service centers have leaked and show that the battery capacity reported by the Sony service center JIG battery is always static, which would not be possible on a real battery.

      P.S. The serial for service mode is actually 0xFFFFFFFF, that along with 0x00000000 forces the battery authentication on TA-088v3 and newer to use a specific challenge ID which is not implemented in any retail batteries (OEM or clones alike). On previous boards all authentication challenges used ID 0, which is why just changing the serial to 0xFFFFFFFF did the trick.

      • DS_Marine says:

        Soo that nand chip is for enabling a cheap usb/ttl to do Dallas/Maxim 1-wire (MicroLan) right? I haven’t even downloaded the stuff but could we technically generate an arduino program to do the battery’s ID stuff so ppl only buys an arduino nano instead of usb/ttl + nand chip +soldering + burnt fingers and short circuits? .D thanks.

    • Mathieu HERVAIS says:

      You need a hardware mode because existing battery controllers do not implement the new IDs/keys used for the challenge response to enable service mode on TA-088v3 and newer boards (like psp-3000).

      Fun fact, in Service Centers, Sony used a battery emulator all along and never actually used real batteries, challenge logs from service centers have leaked and show that the battery capacity reported by the Sony service center JIG battery is always static, which would not be possible on a real battery.

      P.S. The serial for service mode is actually 0xFFFFFFFF, that along with 0x00000000 forces the battery authentication on TA-088v3 and newer to use a specific challenge ID which is not implemented in any retail batteries (OEM or clones alike). On previous boards all authentication challenges used ID 0, which is why just changing the serial to 0xFFFFFFFF did the trick.

  2. benjamin says:

    TA-88v2 was the last motherboard to support pandora battery. v3, introduced late 08′ was not compatabile with pandora or any of the hacks available at the time.

  3. mathieulh says:

    To be specific this does work on (most) psp-3000, psp-go and street are still worked on (though street challenge/response is technically implemented so it’s more of a case of following the motherboard trace to the right syscon serial pin to connect the battery emulator to (probably one of the USB pins)).

    Missing psp-3000 and go will require a full dump of the syscon firmware on those, each syscon revision, due to vulnerability in use, requires 2 boards to dump the full firmware (the initial dump erases block 0 (0x400 bytes), to inject the payload that sends the firmware over serial, another dump is then required by injecting another payload in block 1 on another board (as to keep block 0 untouched).

    Finding the right timing used for the glitch (that allows to disable the syscon IC security bits) was also quite the expensive endeavor, many boards were sacrificed to get this done.

  4. Mathieulh says:

    You need a hardware mode because existing battery controllers do not implement the new IDs/keys used for the challenge response to enable service mode on TA-088v3 and newer boards (like psp-3000).

    Fun fact, in Service Centers, Sony used a battery emulator all along and never actually used real batteries, challenge logs from service centers have leaked and show that the battery capacity reported by the Sony service center JIG battery is always static, which would not be possible on a real battery.

    P.S. The serial for service mode is actually 0xFFFFFFFF, that along with 0x00000000 forces the battery authentication on TA-088v3 and newer to use a specific challenge ID which is not implemented in any retail batteries (OEM or clones alike). On previous boards all authentication challenges used ID 0, which is why just changing the serial to 0xFFFFFFFF did the trick.

  5. Ra-D-OH-3H says:

    Bravo to the team. wish it had come out a few years earlier. It would be more useful.

  6. Filipe Brauns says:

    So, i have a bricked psp that meets the criteria, but im having trouble on understanding the full process.

    Do i have to emulate an Pandora battery? or do i just have to make one? memory stick?…

    Still a little bit confusing. I would wish to try it mysel, anyone give me a hand?

    • Filipe Brauns says:

      By the way, I have a psp-3001 Datacode 8C

      • DS_Marine says:

        Right now it only works on TA-90!
        Go find some list to see wich motherboard your unit has inside.
        Also, you don’t need a pandora battery, you emulate some kind of sony service tool in the pc with the program and the usb adaptor.

  7. Rynne says:

    What is the point of a Pandora battery? I have a 3000 and a GO both on pro-c 6.60. Works fine what am I missing here? Thank you

  8. lumeniro says:

    Maybe battery pandora for psp e1004 ?

Leave a Reply

Your email address will not be published. Required fields are marked *

Most comments are automatically approved, but in some cases, it might take up to 24h for your comments to show up on the site, if they need manual moderation. Thanks for your understanding