Disable tivoization on your PSP

2009-03-14
2009-05-21

To run GNU FreeDink on PSP, you need to disable the "tivoization" that restrict you from running your programs on your hardware.

What is tivoization?

This means that your computer doesn't let you run the applications you want. In this case, a PSP only runs programs that are signed (digitally) by Sony, so it won't let you run FreeDink.

Links:

• Tivoisation explained - implementation and harms - a good introduction
• What is tivoization? How does GPLv3 prevent it? - the GPLv3 is the software license used by GNU FreeDink
• A movie about Trusted Computing (sub fr) - watch this video about another form of hardware control called "treacherous computing" [1]
• Other links at gnu.org and fsf.org: [1] [2]

The goal of this page is to unlock your PSP.

A program that is not signed is nicknamed "homebrew". The default system from Sony (that cannot run homebrews) is called "original firmware" or "ofw". The system that can run homebrews is called "custom firmware" or "cfw".

Disabling tivoization is possible on:

• PlayStation Portable 1000 "Fat"
• PlayStation Portable 2000 "Slim&Lite"
• PlayStation Portable 3000 "Brit" (since May 2009, semi-unlock only)

For this you can either:

• Use a Pandora Battery: all PSPs
• Use a trick on the original PSP Fat systems
• Use a temporary semi-unlocker aka HEN that works until you reboot

The reference documentation is http://alek.dark-alex.org/pspwiki/.

Solution 1: Pandora Battery

A Pandora Battery consists of:

• a battery with a serial number set to 0xffffffff (JigKick)
• and a bootable memory stick (Magick Memory Stick)

When a PSP is turned on with a battery (no sector), and when the battery's serial number is 0xffffffff, then it boots on the memory stick. This is similar to booting from a CD-ROM instead of the hard-disk on a PC.

JigKick

This battery can be bought, under the name Pandora Tool. For example Datel sells such a battery, color red, under the name "Tool, service mode battery", at the price of a classic PSP battery.

Alternatively, you can reset the serial number of your normal battery. For this, you need a friend who is already running custom firmware on her PSP. You then run a program such as "HellCat's Pandora Installer"; in its menu:

• Battery Options > dump battery serial to file: to save the serial, so you can restore it later
• Battery Options > make battery Pandora: to set the serial to 0xffffffff

If you turn on your PSP while using this battery, you'll be able to boot on a memory card - see below how to prepare it.

There is a limitation: this doesn't work on very recent batteries. In addition, recent PSP S&L (technically: with a motherboard newer than TA-085-v2) cannot modify the battery serial. Note that all S&L still boot on a Pandora Battery, it's just that some cannot create a JigKick. You can check your motherboard version using HellCat's Pandora Installer.

Battery versions: you can use a Fat battery in a PSP Slim, but you can't use a Slim battery in a PSP Fat. Both batteries' serial can be reset.

Magic Memory Stick

This is a normal memory card that you make bootable by installing an executable boot sector near the beginning.

Installing a prepared image

If you are running GNU/Linux, the most simple to download the memory stick image I prepared and burn it to your memory stick (1GB minimum). Download it here (50MB): magicstick.img.tar.gz.

Here is a very detailed installation process:

1. Backup your memory stick, as we'll erase it
2. Connect your PSP to your computer using a standard USB cable
3. Pass the PSP in USB mode: Settings > USB Connection
4. Note the name of your PSP drive (such as /dev/sdb). You can type:

   $ dmesg | tail
   [262743.402562] sd 152:0:0:0: [sdb] 1963008 512-byte hardware sectors (1005 MB)
   [262743.403054] sd 152:0:0:0: [sdb] Write Protect is off
   [262743.403061] sd 152:0:0:0: [sdb] Mode Sense: 00 ce 20 00
   [262743.403065] sd 152:0:0:0: [sdb] Assuming drive cache: write through
   [262743.405677] sd 152:0:0:0: [sdb] 1963008 512-byte hardware sectors (1005 MB)
   [262743.406177] sd 152:0:0:0: [sdb] Write Protect is off
   [262743.406184] sd 152:0:0:0: [sdb] Mode Sense: 00 ce 20 00
   [262743.406188] sd 152:0:0:0: [sdb] Assuming drive cache: write through
   [262743.406193]  sdb: sdb1
   [262743.409053] sd 152:0:0:0: [sdb] Attached SCSI removable disk
   

   after you plugged the USB cable.
5. Unmount the PSP drive in your computer
6. Decompress the archive in your home directory:

   tar xzvf magicstick.img.tar.gz
   

7. Type in a terminal, replacing /dev/sdb with what you found in 4.

   dd if=magicstick.img of=/dev/sdb
   sync
   

You can also look for installers that work from ms windows, such as "Rain's UltraLite MMS Maker" or "PSP Pandora Deluxe".

Preparing the card manually

Alternatively, you can create the memory stick manually (cf. this French tutorial):

• Install HellCat's Pandora Installer R4b (post by HellCat):

  cp -a hellcat-pandora-installer-4rb/PSP/GAME/pan3xx \
    /media/sdb1/PSP/GAME/
  

• Run it from Game > Memory Stick > Pandora Installer for 3.xx+ -R4b-
• In the menu, choose MemStick and MS-IPL Options > Repartition and format MemStick (DESTRUCTIVE!) (this gives more space to boot sector)
• Install "Despertar del cementerio v8" to PSP/GAME/dc8 (cf. dark-alex.org)
• Install 500.PBP (from http://alek.dark-alex.org/pspwiki/index.php/Official_Firmware or http://www.psp-hacks.com/category/36) to the root / of your memory stick.
• Run DC8 from Game > Memory Stick > Despertar del cementerio v8

Use it

• Turn off your PSP
• Unplug the electrical outlet
• Insert your Magic Memory Stick
• Install your JigKick battery

At this point, the PSP boots on the Magic Memory Stick, and offer your to install the custom firmware (Install 5.00 M33).

Solution 2: Tricks

If you don't have a Pandora Battery, some tricks can be used to upgrade to custom firmware. I didn't try first hand, so I'll just note the general principle here.

• The original 1.5 firmware for PSP Fat can be told to run a homebrew. It works out-of-the-box.
• In later versions, the initial verification can be bypassed by using an upgrade (using a vulnerability in the Tiff library).
• In later versions it is also possible to bypass the initial verification by using special savegames for some games. This is generally a buffer overflow technique.

Solution 3: HEN

The latest HEN, or semi-unlocker, which works on all PSPs including model 3000, is called ChickHEN.

Without it, when you try to run FreeDink, the PSP says "This game cannot be started. The data is corrupted" (which is a lie).

To install ChickHEN:

• Upgrade to firmware 5.03. (If you installed 5.50, that's bad luck, you need to downgrade (PSP1&2, see Pandora Battery above) or you're stuck (PSP3))
  • Download the 5.03 firmware from Dark Alex's page
  • Put 503.PBP in ms0:/PSP/GAME/UPDATE/EBOOT.PBP (precisely)
  • On your PSP, go to "Game > Memory Stick" and run "PSP^TM Update ver 5.03"
• Download ChickHEN R2 (not a previous version, they don't work fine yet) from the link above
• Copy h.bin to the root of your memory stick (i.e. not in a subdirectory)
• Copy slim the ChickHEN/ directory in PSP/PHOTO/ on your memory stick. For example you will get ms0:/PSP/PHOTO/ChickHEN/slim.tiff
• Go to "Photo > Memory Stick", then in the "ChickHEN" directory
  
• The PSP will attempt to read all pictures. Don't touch any button. The last image is special and will run ChickHEN
• The screen flashes and the PSP reboots, now your system information will show "5.03 ChickHEN R2"
• You now can run FreeDink from "Games > Memory Stick". Note that, since this is only a semi-unlock, you can't use the latest front-end, which needs a small kernel module (kernel modules need full unlock). You still can run stand-alone FreeDink alright.
  

Other tools

Copyleft

Copyright (C) 2009  Sylvain Beucler
Copying and distribution of this file, with or without modification,
are permitted in any medium without royalty provided the copyright
notice and this notice are preserved.