Program for manual entry of battery serial number?

[insane]

I will start by saying I have a slim that can write to the eeprom and I have a 3000. I don't really understand What datel did to put the 3000 into service mode, so I am thinking that if there was a program that allowed manual entry of the battery serial # then after much trial and error, would it be possible to end up with a battery that puts 3000's into service mode? I would like to try this if some one has the program. I understand this will take a long, long time, but is it possible?

 

[Bubbletune]

You could manually hex-edit EEPROM dumps and write them back, although I can say with almost certainthy that it won't work. It is likely the SCE would want to use the same battery for all PSP's in the Service Center to save costs. Meaning the new batteries must at least be backwards compatible, thus having the original serial. It's more likely that they added extra stuff to verify in to the battery.

 

[SpAMCAN]

Datel never got it working, they just claimed that they had to generate sales.

Not that anyone cares, but someone on PSPSlimHacks posted a supposed 3000 PreIPL dump, but it was encrypted. I thought it was just plain text :\

 

[Hellcat]

Trying different bat.ser.'s will get you nowhere.

Still, if you wanna try it, grab the "Pandora Installer for 3.xx+", it has an option to dump the serial into a .BIN file.
You can then (hex)edit the serial in that file to w/e you want and write the (new) serial from the file back into the battery.

 

[LocutusEstBorg]

You could manually hex-edit EEPROM dumps and write them back, although I can say with almost certainthy that it won't work. It is likely the SCE would want to use the same battery for all PSP's in the Service Center to save costs. Meaning the new batteries must at least be backwards compatible, thus having the original serial. It's more likely that they added extra stuff to verify in to the battery.

Do you think they have new batteries which also have the old FFFFFFFF serial or the old official batteries can communicate more than just the serial (which wasn't required for old PSPs but required for the 3000)?

 

[NoEffex]

Datel never got it working, they just claimed that they had to generate sales.

Not that anyone cares, but someone on PSPSlimHacks posted a supposed 3000 PreIPL dump, but it was encrypted. I thought it was just plain text :\

No, they had to stop because of a lawsuit by Sony, at least that's the last I heard of it.

That basically fuels the argument that there was more there than just a serial.

 

[insane]

That basically fuels the argument that there was more there than just a serial.

Possibly. I do remember someone on the internet saying something about an extra chip in the light blue tool. The weird thing is my 3000 can use an autoboot battery but it functions as a normal battery and if I try to charge a service mode battery in my 3000 it will seem as if it kills the battery but if you jump two specific pins on the eeprom the battery will function again.

As far as the serials go the consensus seems to be a 2% chance of success and with the potential length of time involved I have no good reason to proceed. Thanks for the input.

 

[Frozty]

just wondering how should the preipl file appear as a .txt or something else if it was dumped?

 

[Hellcat]

just wondering how should the preipl file appear as a .txt or something else if it was dumped?

4k (IIRC) raw binary file.
It's plain MIPS ASM.

 

[Bill]

The battery signal has to be a lower voltage than regular in order to access Service Mode in newer PSP models.

That was the conclusion of DATEL's research.

 

[AR3S]

What I don't understand is, what is actually putting the psp into service mode? There is nothing writen into the f0 giving the psp instructions on how to deal with the battery unless it is code writen directly on the chip that is in the battery. Is this true?

 

[LocutusEstBorg]

What I don't understand is, what is actually putting the psp into service mode? There is nothing writen into the f0 giving the psp instructions on how to deal with the battery unless it is code writen directly on the chip that is in the battery. Is this true?

The PSP has several hardware flags. When a service battery is inserted the SysCon chip identifies it (based or serial or whatever in 3000), and sets a hardware flag. When the CPU boots the pre-IPL checks the flag and if its set it powers on the memory stick hardware and reads the IPL from the memory stick instead of flash0.

 

[explosions]

The PSP has several hardware flags. When a service battery is inserted the SysCon chip identifies it (based or serial or whatever in 3000), and sets a hardware flag. When the CPU boots the pre-IPL checks the flag and if its set it powers on the memory stick hardware and reads the IPL from the memory stick instead of flash0.

Would it have been possible to fake the hardware flag from the SysCon chip before we had pandora? I know it would be pointless now; just a question.

 

[LocutusEstBorg]

Would it have been possible to fake the hardware flag from the SysCon chip before we had pandora? I know it would be pointless now; just a question.

I have no idea how the hardware works. Maybe with a physical mod? But if you're going there you might as well hijack the memory lanes in the MCP and put your own code in place of the IPL when its executing.

 

[Hellcat]

Mhh, MCP.... ;D

Would it have been possible to fake the hardware flag from the SysCon chip before we had pandora? I know it would be pointless now; just a question.

Unlikely.
I could be a bit off, but as far as I figured syscon reads the serial from the battery and everything else happens inside the chip, not too much to be done from the outside....

 

[Bubbletune]

Even so, making the battery switch to service mode was far from the hardest part of Pandora. Hardest part would be forging the IPL signature.