Unbricking PSPs - Even with complete Flash corruption - PSP3D.com - Sony PlayStation Portable News, Homebrew, Hacks, Reviews, Videos, Mods, Forums

testrun99 · #1 (**permalink**) 09-09-2007, 03:10 PM

This tutorial is for people who have corrupted or deleted their flash0, flash1, or IDStorage on their PSP.
For people who don’t know what the flash is, it is a part of your PSP that holds your firmware files which allows your PSP to run.
Now, there are two parts of your flash on the PSP. The first is the Flash0, Flash1, and for higher firmwares flash2 and flash3 folders. The Second is the part, were the IDStorage is kept. Now if you have a PSP that has been bricked this should, in theory, unbrick any PSP no matter the flash state.

First you need –

Pandora’s battery - bought off ebay.com, or made yourself using this Pandora’s battery files (use readme)

Memory card - for running 1.5(tutorial here) and downgrading with Pandora’s battery,

KeyCleaner v1.3 - for dumping and flashing IDStorage keys onto and from MS

Previously backed up IDStorage keys and another PSP with flash1 folder in tact (Alternatively you can install devhook .46 or .44 on your MS with Pandora’s battery and install 1.50 on devhook and just use the created flash1 folder.)

Flash1 formatter - Here

1.5 Enabler - Homebrew Enabler for 2.71 (Revision B)
Homebrew Enabler for FW 2.71 (Rev C)
Homebrew Enabler for FW 2.71 (Rev D)

1.5 Eboot - Here

There are three steps in restoring your PSP’s flash to stock condition. The first step is creating your Pandora’s battery and memory stick that runs 1.5. Then using them to run Keychanger 1.3 on the bricked PSP to flash the previously dumped keys.

The second step is to format flash1 of your PSP with Flash1 Formatter v2. Then placing the battery and MS into the 2nd PSP, running Flash1 formatter, and then dumping the PSP’s flash1 to MS. Then just flash the dump on the MS to the bricked PSP.

Then finally format the MS again using the Pandora’s battery unbricker/downgrader and use the finalized MS and battery to format flash0 and install firmware 1.5. Now just take out the battery plug in the PSP charger and turn on the PSP. The firmware on the flash should come up. (Let it be known that you might have to push the brightness button to turn on light when it boots up) Now just go to the battery maker on the MS, put the battery back in and change it back to a normal battery. Your PSP is now unbricked.

Note about upgrading to Official Firmware: If you got the keys from a Custom firmware M33 that used the Kxploit patcher method it modified the 5th IDStorage key so you’ll have to follow this tutorial (CLICK HERE) to upgrade to OFW. If it was a motherboard TA-079/81 your can skip that. Unfortunately if you have gotten keys from a TA-82/86 motherboard that was downgraded by old downgraders then you need to follow this tutorial (Tutorial 2). If you got the keys from a PSP TA-82/86 that hasn’t been downgraded you can skip this step.

If you have a PSP with your IDStorage in tact I suggest you back it up so if it ever gets corrupted in the future you can repair it.

There is no guarantee that this will work 100%, because as of now it is just an untested theory. But it is logical to assume that it would work. If you have any questions send me an email at bleedingsilents@yahoo.com

By: Vash Vassmer

iamstrange14 · #2 (**permalink**) 09-09-2007, 03:19 PM

it is a 100% gaurentee that it does work as long as you follow it correctly

and way too many outside links

djcopey · #3 (**permalink**) 09-09-2007, 04:13 PM

ive read on other places that you cant use other peoples idstorage (dont know why) may be fact may be fiction, plus if your messing with the psp in a serious corruptable way you should back up the idstorage anyway.

iamstrange14 · #4 (**permalink**) 09-09-2007, 04:15 PM

what exactly is the idstorage?

dorkdork777 · #5 (**permalink**) 09-09-2007, 04:39 PM

Quote:

Originally Posted by HarleyG

The idstorage is located after the IPL on the nand at 0xc0000, and is used to store
low-level information on the PSP, such as the serial, mac address, umd, wlan and region.
Most idstorage keys have a pair, although some do not (explained later.) Idstorage keys
are 512(+16) bytes and are stored in an index of two nand pages (512 bytes.) Nand pages
are also 515(+16 spare area) bytes. The index of idstorage is identified by byte 6 of the
spare (0x73), byte 7 is the idstorage version, byte is either 1 or 0; depending on whether
the idstorage has been formatted or not (???), and finally byte 9 indicates if the idstorage
is read-only or not.

HarleyG is a genius.

EDIT: Here's why you can't use someone else's idstorage...

Quote:

Originally Posted by HarleyG

The rest of key is filled with random data, which is unique to each PSP. If this data is changed,
getpscode will return:
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Meaning an invalid region.

iamstrange14 · #6 (**permalink**) 09-09-2007, 05:03 PM

i kindove understand what harley is sayin, but kinda dont. can it be restored any way? how do you back it up if your on 3.50?

zzaz3 · #7 (**permalink**) 09-09-2007, 06:03 PM

Wowza! I'm in iamstrange14's signature!

testrun99 · #8 (**permalink**) 09-09-2007, 06:27 PM

Quote:

Originally Posted by iamstrange14

i kindove understand what harley is sayin, but kinda dont. can it be restored any way? how do you back it up if your on 3.50?

It does not matter what firmware you have as long as you use Pandora's battery and the magic MS with 1.5 on it, because it boots from the memory stick and not the PSPs flash. If you want to back up the keys on your PSP you need to be in a custom firmware to use KeyCleaner 1.4 or IDstorage Manager applications.

jsf · #9 (**permalink**) 09-09-2007, 08:27 PM

Nice tutorial

djcopey · #10 (**permalink**) 09-10-2007, 12:06 AM

the only thing you can do is backup your idstorage before any modification to flash\idstorage which could cause irreprable damage. and dont mess to you have a back up.