Pandora's Battery & ID Storage Values

**MicroNut** · August 23rd, 2007, 02:40

Read the whole article here: N00bz

Written by Fanjita

We told you that we'd be releasing an unbricker for the M33 bricks. But then we got to thinking, maybe that just wouldn't be exciting enough.

Would you like a super special surprise bonus? How about an unbricker for ALL PSPs? Yep, you read that right. We call it "Pandora's Battery".

There's a larger story behind this unbricker, though, and it deserves to be told. It's the culmination of years of behind-the-scenes research and development by some of the top names in PSP hacking, under the name of the Prometheus project. This group of people, from various development teams, was dedicated to developing and releasing PSP hacks and exploits, with the aim of improving the status of PSP homebrew, and making sure that it was kept alive.

For some time this project was highly successful - many releases from Noobz, C+D and others were direct results of this work. The zenith of this success was the development of this unbricker - which required some amazing technical leaps, including:

Reverse engineering of the service (unbrick) mode
Development of a technique to change an ordinary battery into a service mode trigger battery (and back)
Development of custom IPL code along with a technique to sign that code as authentic.

Even more impressive is that all of the above was achieved without any access to the official hardware or software. With careful nurturing, this unbricker and custom IPL was to become the foundation of a whole new homebrew environment.

Sorry did notice that it hit the front page about 20 minutes ago

**Safari Al** · August 23rd, 2007, 03:25

lol happens to the best of us man

**MicroNut** · August 23rd, 2007, 20:41

I buried this reply in another post.
So I decided to use it here to make this thread worth something...
I would like to know more about this (sorry if its a double post)
If its possible to make sure everyone has access to clean ID Storage keys I think it is worth it.
Not so that they can just run any official firmware again.
So that they have a clean system to run their cfw on.

ID Storage on TA-82+ PSP Motherboards
With the release of the Pandora battery recovery
I decided to take a a deeper look at this and this is what I have learned.

Noobz info may not be up to date or it may be correct
I don't know:
http://www.noobz.eu/joomla/news/down...-firmware.html

From what I have read at other websites it is possible to fix key 5 of the id storage value
if you have a clean dump of that key (or set of keys) for a spacific TA-82 motherboard.
Or a least know the correct hash value the key needs to be edited.

If this is true it would be very helpful to have an archive of clean id storage dumps for all TA-82+ motherboards.

Using Chilly Willy's Key Cleaner it is possible to
Discover the exact motherboard type
Discover broken keys
And restore those broken key(s) on downgraded psp's.
After which it wold be possible to run any official firmware again... if you really wanted too.

Which brings me to Pandora's recovery.
The readme states there is no known way to regenerate the id storage keys for these psp's.

Does that mean that they cannot be recovered using a clean dump of the motherboards ID storage keys... I dont know.
I want to be able to use the Battery Recovery and restore my TA-79 ID storage keys, if I have too.

In any case I am posting excepts from the forums I gathered this information from.
And posting a clean dump of a TA-82 ID Storage key set for research purposes only.

Clean_TA82_keys.zip

**MicroNut** · August 24th, 2007, 07:48

Ahhh... ok I am an idiot.

This is a great misunderstanding on my part.

A good person in another forum squared me away.
"N00bz Quote:
We are working on the solution to enable you to go back to official firmwares if you need to - this includes helping people stuck on v3.30 or v3.40 v3.10 or v3.11 firmware. It will take some time though, and we're all very busy right now."

"It just means for people that messed up ther key 5 and got stuck in those firmwares. Basically they couldn't update or downgrade and were screwed. The way this works is like this, if you want to go back to OFW you need to first go back to 1.50 (key 5 should still be patched, otherwise the 1.50 IPL will hang, and your PSP would basically be messed up, of course, this unbricker saved us all though) After you are at 1.50, then you'd need to update to 2.71 since you cant upgrade to any 3.30 firmware just yet. Then you'd use KeyCleaner to fix your patched 1.50 key 5 back to its original state, and then you'd be ready to update to 3.30+ FW if you so desired.

So basically it's 1.50 (key 5 patched) --> 2.71, Use HEN D (Unpatch Key 5 with KeyCleaner) --> Update to 3.30 FW without any hassle."

**tgm123** · August 29th, 2007, 18:27

micronut, could i direct your attention to my curent problem?

h**p://www.dcemu.co.uk/vbulletin/showthread.php?p=503904#post503904

replace ** in the http bit, (not sure if direct linking is allowed on here)

im in a bit of a mess and basically, its my key 0x0005 that is returning "unknown value" no matter what i do to it

**MicroNut** · August 30th, 2007, 09:24

Originally Posted by tgm123

micronut, could i direct your attention to my curent problem?

h**p://www.dcemu.co.uk/vbulletin/showthread.php?p=503904#post503904

replace ** in the http bit, (not sure if direct linking is allowed on here)

im in a bit of a mess and basically, its my key 0x0005 that is returning "unknown value" no matter what i do to it

I read your other posts regarding your problem
And now that I understand that ID_Storage values are not generic to every PSP.
While the values maybe the same the "keys" are unique to each specific PSP.

What I have learned most so far is that it is very important to backup the nand of a bricked PSP before debricking it.
It can be used later to recover your PSP's ID_Storage keys.
Its also the first thing you should do with a non-bricked psp once you have Pandora

This is a great thread on this exact problem:
Pandora's Battery FAQ's with Links to Guides and more Information
What you are looking for really starts on about page 11 or 12

This could be of great help:
A little trick to recover a UMD Drive with OE

More:
Help restoring Keys to original? (chilly-willy soft-downed)

More:
Guides: un-patched keys with a CWF/Fast install to M33

And Finally:
KeyCleaner Chilly Willy

**MicroNut** · September 4th, 2007, 11:40

Chilly Willy has released:
KeyCleaner v1.3
A Great update to a crucial PSP app.
TA-082/86 users will really appreciate this one.

**MicroNut** · September 8th, 2007, 22:41

MaxSafe (Backup your IDStorage by team 0x4658)

What this program does is add additional menu options to Pandora

The best part of this is that it allows you to dump the ID_Storage keys before resurrecting a bricked PSP.

It a perfect edition to Pandora.

Especially good for dead PSP's that have never had the ID_Storage backed up.
(provided the keys weren't damaged in the first place)

Take one bricked PSP:
1. Back up ID_Storage using Pandora MaxSafe
2. Resurrect the dead using Pandora
3. Restore the original "ID_Storage" of the PSP 100%

Good Stuff imo

The dump location and file name on the memory stick is:
ms0:\kd\idstorage_backup\backup.back