[USMarine]

What is a PSP Motherboard? (MOBO)

- The Motherboard refers to the hardware of the PSP that contains all of the physical parts of the PSP as well as the Nand Image. To date, there are 8 Motherboards created for the PSP.

About PSP Motherboards

All Motherboards has an Onboard Flash Chip (OFC) that contains the PSP's Nand Image. That Nand Image contains Flash0-5, and the IDStorage Keys. Also, the Motherboard contains the Tachyon, Baryon, Pommel, Kirk, and Spock. Here is an explanation of each:

Nand - An image of flash0-3 and the IDStorage Keys of a PSP. It is stored on the onboard flash chip.

Flash0 - Contains the PSPs Primary Firmware.

Flash1 - Used to store the XMB settings, network configurations, the background image in 2.00 and above, and the Custom Theme in 3.70 and above.

Flash2 - In firmwares 3.00 and up, this contains the half of the DRM for Sony's official PS1 emulator (the other half being in the flash0)

Flash3 - Currently unused and about 1 MB in size although in custom firmwares it can be used along with flash2 to redirect firmware elements such as fonts.

Flash4 - Cannot be mounted. It is suspected that it is unformatted and may be for future use hence why it cannot be read.

Flash5 - Cannot be mounted. It is suspected that it is unformatted and may be for future use hence why it cannot be read.

IDStorage Keys - PSP-specific keys that store info such as MAC Address, Region, etc, and are used for operation of PSP.

Tachyon - Possibly the version of the chip which contains the CPU, ME and GPU.

Baryon - Version number of the PSP's System Control chip.

Pommel - The PSP's GPIO/watchdog which handles system events and shuts down in the event of a crash.

Kirk - The PSP's main decryption/verification chip.

Spock - The secondary decryption chip, only used to decrypt data from the UMD discs.

Motherboard Types

TA-079 Series

The very first version of the Phat/Classic PSP were shipped out with the TA-079 motherboards. So far, there has been 2 revisions of this motherboard with v3 adding in a new WiFi card. It is not known whether the second or third versions of the TA-079 had security features implemented to prevent downgrades or homebrew to be ran.

TA-081 Series

Please refer to the TA-079 Series. Everything in it pertains to this as well.

TA-082 Series

Before Sony saw the 2.50/2.60 downgrader they made a new motherboard for the PSP called TA-082, with a different Manufacturers Clock Generator Vendor ID. When a TA-082 is downgraded below firmware 2.50, the older firmware IPL won't recognize the new Clock Generator ID, and the PSP will fail to boot, appearing bricked.

A method of checking whether or not a TA-082 motherboard is installed on a PSP without voiding the warranty is shown here.

On 27 December 2006, a TA-082 downgrader was released by Dark AleX, Mathieulh and harleyg allowing PSPs with 2.71 firmware and TA-082 or TA-086 motherboard to downgrade to 1.50. It appears that the downgraded units behave like any other non-TA-082s and after this process it is possible to upgrade to 2.71 SE, 3.XX OE or any other version of firmware, custom or official. However, problems do exist as a side effect of the downgrade. In order to allow the motherboard accept the 1.50 IPL some keys in the motherboards IDStorage are corrupted. This has led to many problems in downgraded PSPs.

These range from:
- Connection errors in AD-HOC.
- Brightness issues. (Upon the initial boot up of a downgraded TA-082 PSP, users may be greeted by a blank screen. Pressing the brightness button will resolve this issue)
- Battery issues. (If a PSP is shut off under 12% battery the PSP will not restart until the AC adapter is plugged in.)

One of the problems faced was the USBHOSTFS function of the PSP was corrupted after a TA-082 downgrade. The USBHOSTFS function is used in some homebrew programs and communication with the PS3.

The official Sony updates 3.30+ now check for these corrupted keys, and will refuse to install if it finds them. Users on homebrew enabled PSPs can restore the keys and then upgrade to 3.30+, but those who have corrupt keys and have upgraded to firmwares 3.10 or 3.11 are now stuck. They cannot upgrade to any newer firmware but also cannot use homebrew to change the keys or downgrade. Now that a user-mode exploit has been found on these firmwares (with the Illuminati exploit) it is hoped that this may pave the way towards a kernel mode exploit which would be able to reset the IDStorage keys to allow upgrading. If a kernel mode exploit can not be found the only solutions would be to purchase and install a mod-chip or use the Pandora's Battery as a downgrader.

3.71 M33 Custom Firmware fixes the IDStorage before upgrading. It automatically checks if it is a TA-082/TA-086 before fixing it.

Newer downgraders have been built with these issues in mind. The only problem that remains with the latest downgrader (3.50 "Illuminati" exploit) is the brightness issue. However, a fix (which makes the PSP read from firmware 2.71 files when controlling brightness) can be applied to downgraded PSPs, thereby eliminating this problem as well (However, one must remove these added files prior to using the recovery downgrade / official update otherwise it can results in a brick). Alternatively, some have suggested this could be fixed with keycleaner, it has been reported not resolving the brightness issue. TA-079 up to TA-081 motherboards are not affected by these problems.

TA-085 Series

The currently released PSP Slim series are known to use a TA-085 motherboard, with the recent release of the TA-085 v2, and later on the TA-088 series. The only extra security in the TA-085v2 motherboard revision is the inability to write to the PSP battery's EEPROM, so a Pandora battery cannot be created on a TA-085 v2. However, a battery already with the Pandora EEPROM code can still be used, allowing regular custom firmware installation. No other abilities have been discovered yet. TA-085v1 Slims function normally and are still able to write to the battery's EEPROM.

TA-086 Series

Please refer to the TA-082 Series. Everything in it pertains to this as well.

TA-088 Series

Recently, TA-088 has been found in the newer Slims in Asia. (Particularly the Mint Green one) The TA-088 functions similar to the TA-085v2, and blocks the ability to write the battery's EEPROM while the PSP can still read it. The TA-088 has been incorrectly referred to as the TA-085v3 as motherboard identification tools referred to it as the TA-085, and it has been renamed to the TA-088. As time went on, Slims with different revisions to the TA-088 motherboard has been released, and are confirmed to be Pandora-proof. The TA-088v2 first reported being shipped with Slims in the Asia continent, has a patched tachyon that disabled the loading of all current Pandora Initial Program Loaders (ipl), but however did not defeat the loading of custom firmware ipls. The ability to flash custom firmware via Despertar Cementerio will be fixed with the newest release (version 6) which uses a new kernel, therefore allowing Pandora to work again. A third revision to the TA-088 came weeks later. Dubbed the TA-088v3, this motherboard is completely Pandora-proof as discovered by Silverspring of the M33 Team. According to Silverspring, a new Tachyon has been inserted into these motherboards, and patched the loading of any IPL's before the PSP booted up. If this patch is correctly applied, Pandora is defeated on all TA-088v3's until a new development comes through.

TA-090 Series

There has been reports that the TA-090 has shown up in a PSP-2000. There has been confirmed reports by Alek that it is also in the PSP-3000. This is the reason for the v1/2 listed below. The PSP-2000 version of the TA-090 is hackable with pandora. However, The PSP-3000 version of TA-090 Pandora's battery does not even turn on the PSP.

Tachyon / Baryon / Pommel's

PSP-100x
TA-079v1. Tachyon: 0x00140000, Baryon: 0x00306000, Pommel: 0x00000103
TA-079v2. Tachyon: 0x00200000, Baryon: 0x00306000, Pommel: 0x00000103
TA-079v3. Tachyon: 0x00200000, Baryon: 0x00040600, Pommel: 0x00000103
TA-081.... Tachyon: 0x00300000, Baryon: 0x00040600, Pommel: 0x00000103
TA-082.... Tachyon: 0x00400000, Baryon: 0x00114000, Pommel: 0x00000112
TA-086.... Tachyon: 0x00400000, Baryon: 0x00121000, Pommel: 0x00000112

PSP-200x
TA-085..... Tachyon: 0x00500000, Baryon: 0x0022B200, Pommel: 0x00000123
TA-085v2.. Tachyon: 0x00500000, Baryon: 0x00234000, Pommel: 0x00000123
TA-088v1.. Tachyon: 0x00500000, Baryon: 0x00243000, Pommel: 0x00000123
TA-088v2a Tachyon: 0x00500000, Baryon: 0x00243000, Pommel: 0x00000123
TA-088v2b Tachyon: 0x00.........., Baryon: 0x00..........., Pommel: 0x0000
TA-088v3.. Tachyon: 0x00.........., Baryon: 0x00..........., Pommel: 0x0000
TA-090v1.. Tachyon: 0x00.........., Baryon: 0x00..........., Pommel: 0x0000

PSP-300x
TA-090v2.. Tachyon: 0x00.........., Baryon: 0x00263100, Pommel: 0x00000132

[icejack1]

Nice Guide
Maybe now people won't ask can my psp be hacked?

[USMarine]

Nice Guide
Maybe now people won't ask can my psp be hacked?

I am hoping for that too. Also, I wanted to share a Motherboard guide if anyone is interested with modding the MOBO itself. I've done it myself a couple of time in the past.

[GTReventon]

Great Post Marine!


Would be Very helpful for those New Timers on PSP Scene.

[Dark Assassin]

nice thanks

[pricecheck]

I hacked my Psp 2001 with a Phat Pandora
and its a Ta88v3 mobo

[alex042682]

hello Mr. US MARINE.. remember me about last year and emailed my problem to you.. i bricked my psp3000 w/ motherboard TA-090v2 is there's any solution on how to unbricked my psp.. im still waiting for any updates.. would you kind. this is my email alex042682@yahoo.com, thnk you very much..

[se7en_Pride]

how am i able to tell what motherboard mine has?

[GTReventon]

If you have a hacked PSP then you can run PSPIdent. It is a Homebrew that tells your Motherboard and some of your PSP Information.

[Flyer]

plenty of ways. Homebrew called pspident, datacode (digit and letter, like 8C, you can find it under battery, above s/n (not on battery)), via umd drive and so on. Easiest are pspident and data code .

[Skitz]

If your PSP is hacked you can use PSPIdent to find that out, here's a download link: http://www.mediafire...3d4mzzjki93rp7z

If your psp isn't hacked, you can use this app to sign PSPIdent so that it can work on your unhacked PSP. Yes the signer will work on your unhacked psp. Here's a download link: http://www.mediafire...1wvk3sd8exc456c

You should be good to go now

[Flyer]

, pspident is kernel app, it can't be signed yet (it actually can, but no tools available for public )

[Skitz]

_Flyer_, on 06 February 2011 - 04:20 PM, said:

, pspident is kernel app, it can't be signed yet (it actually can, but no tools available for public )

Can Psp Tool be signed? Cuz i think it shows you more info than pspident. If it can, i can drop that link for him instead

[Flyer]

psp tool kernel too, anything that shows such info as mobo info obviously needs kernel access
if your psp is unhacked, find out your data code (it's place shown on pic below)

and compare it to data code table below

[El Kuatex]

nice guide, probably wont ever use this information but its still good to know

[Skitz]

this is pretty handy stuff, i had no idea. This should go into the original post

[Flyer]

this is pretty old pic, and data code is not shown on newer psps