www.LenGoldenstein.com

Just letting people know that PSP Grader v006 has been released.  This version installs custom firmware 4.01M33-2 and may also work better on newer PSPs.  If you’ve have problems creating a bootable memory stick, please try this new version.

Introduction
Step 1: Creating a bootable memory stick
Step 2: Creating a service tool battery
Step 3: Flashing the firmware
Conclusion

Congratulations for making it through this HOWTO.  I hope, if you chose to perform these steps, that everything was successful.  Your PSP now has quite a lot more functionality and customizable options than it did out of the box.

You can backup your original UMD games or movies to the memory stick for playback.  This makes data access times much faster from memory than from the UMD.  This will improve battery life since the motor and laser of the UMD drive do not need to be used.  This keeps your original UMD safe from damage and avoids wear on the sensitive moving parts in the UMD drive.

You can load homebrew applications on the PSP.  There is strong community of PSP developers that have created some excellent pieces of software.  Some of freely available software includes original games, emulators, VNC clients, PDA applications and much more.  I enjoy a Super Nintendo emulator called SNES9xTYL.

This HOWTO was written with the assumption of only using the battery that the PSP comes with and using a single general purpose memory card.  After the service mode battery and bootable memory stick have been created and used, it is possible to continue using these items in the PSP.  However, when using the service battery, it will always look for boot code on the memory stick.  You MUST keep your bootable memory stick in the PSP when using the service battery.  It’s really not a big deal since if you only have the one battery and one memory stick, chances are they will always stay in the PSP.  If you get a second memory stick and continue to use the service mode battery, you can use PSP Grader to make this a bootable memory stick as well.

Should you wish to convert the service battery back to a regular battery, you can fill-in the cut trace with a lead pencil.  This will re-connect the cut trace wire and the battery will be back to normal.  You can continue using the bootable memory stick with the normal battery since the normal battery will never check the memory stick for boot code.  The only problem is if you want to go back in to service mode, you will need to re-cut the trace again.

I’ve been using the service battery and bootable memory stick combination for regular usage for almost a month now and I’ve had no problems.

I hope you have enjoyed reading this HOWTO document.  If you have successfully followed this guide and installed custom firmware on your PSP, please leave a comment just so I know people are benefiting from this information.  I am open to all suggestions on how to improve this guide or to answer any questions that you might have.

On a final thought, this guide brings in to question the recently introduced (but not passed as law) Canadian DMCA bill.  This bill, should it be passed in to law, would make the circumvention of digital locks a crime carrying a maximum fine of $20,000.  Would this law make the information contained in this guide illegal?  Would cutting a trace wire on a battery that you paid for and own become a criminal act?  This would even imply that guitar picks and utility knives would have a questionable legal status since they can be used as tools for circumventing digital locks.  Quite ironically, the Canadian DMCA will allow for a single legal transfer of purchased content to a different form of media.  However the restrictions of digital locks make this “perk” completely un-realistic.  Where can a person draw a clear line of what is fair-use of their own property?

Please exercise your right to vote in the next election and stand up for what you believe in.

Thanks for reading!

Introduction
Step 1: Creating a bootable memory stick
Step 2: Creating a service tool battery
Step 3: Flashing the firmware
Conclusion

Now that we have made a bootable memory stick and a service tool battery, we are ready to flash the PSP’s embedded firmware to our custom version.  Just to recap, the service mode battery allows the PSP to boot from the memory stick and the memory stick is already loaded with a boot image, service utilities and the custom firmware image.  After the PSP boots from the memory stick, we will write the custom firmware image to the PSP’s embedded flash memory.  Make sure you fully understand the contents and risks of this tutorial before performing any steps.  Failure to perform these steps correctly can result in permanent damage to your PSP.  I am not responsible for any damage you may cause – proceed at your own risk.

Before we begin, the PSP should NOT have the bootable memory stick or service mode battery inserted yet.  Also, the battery should be as fully charged as possible.  If the battery has less than an 80% charge, the PSP may not go in to service mode correctly.  If necessary, insert the service mode battery and plug in the PSP with the AC adapter.  Wait for the battery to completely charge and then remove the AC adapter and battery.

Step 1: Insert the bootable memory stick.  Easy…

Step 2: While holding down the L shoulder-button on the PSP, insert the service tool battery.  Holding L while in service mode makes the PSP boot from the memory stick.  After a couple of seconds, you will see a black screen with white text on it – this means that everything is working as planned!  You are presented with four options:

Press X to install 3.90 M33
Press O to install original 3.90
Press [ ] (square) to dump the nand
Press L+R+start+home to restore nand dump physically (dangerous!)

Step 3: As an option, you can press [ ] (square) to make a backup of the existing embedded firmware to the memory stick.  I haven’t found much use for this backup personally so this step may be skipped.  If you do create the backup, you will need to restart the PSP afterwards using the procedure in Step 2.  Don’t worry if you get bad blocks when performing the NAND dump – this is normal.

Step 4: Finally, what you have been waiting for!  Pressing the X button will write the 3.90 M33-3 firmware image to the PSP’s internal flash memory.  Go ahead and press X.  Enjoy watching the text scroll through the screen as new files are written to the PSP.  This process will take a minute or two to complete.  Once the custom firmware is installed, the PSP will prompt you to press X to shut down.  It is very important to press the X button when prompted.  Under no circumstance should you shut off the PSP without pressing X – Doing so may damage the PSP!

Step 5: Turn the PSP back on – do not hold or press any buttons.  If all went well, the green power will come on, the fimiliar Sony boot logo will load and then the PSP menu will be available.   If for any reason the power is on but you only get blank black screen, repeat steps 2 and 4 to retry writing the custom firmware image.

Step 6: If you made it this far, then everything went according to plan!  Let’s quickly check the firmware version of the PSP just to be sure.  Navigate the menu to Settings -> System Settings -> System Information.  The “System Software” should now read “3.90 M33-3″.  SUCCESS!!

Step 7: Post-install cleanup.  Now that your PSP has the 3.90 M33-3 firmware installed, we are just about done.  Since the PSP’s firmware has been changed, you will need to re-configure any customizations you had on the system.  This includes the system’s nickname and the wireless network settings.

Step 8: Once all your settings are back in place (but even if they aren’t), you should now take a look at the M33 recovery menu.  Turn your PSP off by holding the power switch up for 2 seconds.  Before turning the PSP back on, hold down the R shoulder-button.  After a couple seconds, you will see the M33 Recovery menu load.  Press down once to highlight “Configuration” and press X to select it.  Take a look at the options and you can customize to suit your preferences.  Some important ones are:

Skip Sony logo – Toggles displaying the Sony animation when powering up the PSP.
UMD Mode – How the system accesses the UMD.  I would recommend changing this to “M33 Driver -NO UMD-”.
Use VshMenu – Allows changing of certain M33 settings while in the regular PSP menu.
Charge battery when USB cable plugged – Allows the PSP to charge from the USB connection without using the System -> USB Connection command.
Use M33 network update – Allows the latest M33 firmware to be downloaded and installed through the PSP’s Internet connection.

Select Back, press X and then select Exit and press X.  You will be returned to the main PSP menu.  While in the main PSP menu, you can press the Select button to access and change certain M33 settings, assuming you have the Use VshMenu option enabled.

The 3.90 M33-3 firmware is quite well tested and very stable.  Please take some time to make sure everything is working as you would expect it to.  You have the option of using the Settings -> Network Update option to update the PSP to current version of M33 which, as of this writing, is 4.01 M33-2.

This pretty much concludes the tutorial on how to install custom firmware on your PSP Slim.  For some final thoughts and observations, please read the conclusion.

Introduction
Step 1: Creating a bootable memory stick
Step 2: Creating a service tool battery
Step 3: Flashing the firmware
Conclusion

Now that we have a bootable memory stick created containing the service utilities and the custom firmware, we need to get the PSP to boot off the memory stick.  Under normal circumstances, the PSP will always boot from the firmware image stored its embedded flash memory.  By booting from our freshly created magic memory stick, we can replace the contents of the PSP’s embedded flash memory with the custom firmware image.

To make the PSP boot from the memory stick is very simple, we need to tell the PSP to enter service mode.  Sony created a service mode for the PSP that allows a technician to boot from a secondary device and run service utilities on defective or damaged PSPs.  One example might be if a PSP no longer turns on, a technician would be able to diagnose and replace a damaged firmware through these service utilities – very similar to the goal of this HOWTO.  This service mode is accessed by using a service tool battery – sometimes referred to as a Pandora or Jigkick battery.  When this type of battery is inserted in to the PSP, the PSP recognizes it and the function of booting from the memory stick becomes available.  Since Sony does not make these service tool batteries available to consumers, it is possible to create our own service tool battery from the battery that comes with the PSP slim.

My best understanding of how it works is that each PSP battery has a unique serial number programmed in to the battery’s EEPROM which is checked when the battery is inserted in to the PSP.  If a normal battery is inserted, the serial number is checked and the PSP operates as normal.  The difference is a service battery has a serial number of all 1s.  When inserting the service battery, the PSP will recognize the serial number of all 1s and allow booting from the memory stick.

Although there are different methods of creating a service tool battery, I will only focus on the “hard-mod” method.  Through this method, we will be making a physical change to the battery itself.  Although this step is not overly difficult, it is a bit challenging.  If you decide to attempt this procedure, please use extreme care.  Work in a clean and well lit area.  Exercise care and patience.  Make sure you full understand this tutorial and the risks associated with it.  I am not responsible for any damages caused by this tutorial.

We will need the following items to complete this step:
PSP Slim battery model PSP-S110 (3.6V 1200mAh)
Guitar pick
Magnifying glass
Sharp utility knife
Packing tape

Step 1: Prepare your work area.  Always have a clean and well lit area to work with.  It is a small step that is often overlooked.  Have your required tools listed above ready to work with.  Prepare yourself for about 20 minutes of work.  When you are ready, open the battery door of your PSP and remove the battery.

Step 2: Open the battery case using a guitar pick.  Although a small screwdriver or utility knife might work well too, I like the simplicity of a standard guitar pick.  The guitar pick is sturdy, has very thin rounded off edges with a nicely rounded off point.  The guitar pick has a very small chance of doing any permanent damage to the PSP whereas a metal tool can do more damage to the battery’s plastic shell or even worse, permanently damage the small circuit board inside the battery beyond repair.  Note that the pick I used had a small crack in it before opening up the battery.

This step only requires some time and patience.  It is really quite easy.

First, gently slide the guitar pick in to the left and right sides of the battery where the two halves of the plastic shell meet.  Work it in slowly and you should feel the pick getting between the halves.  Slowly work your way up and down the groove and you will feel and hear the seals snap.

Repeat this for the bottom of the battery.  Work the guitar pick in to the bottom seam and slow and gently break the seal.  The corners can be a bit trick but just work slowly and be gentle.  I cannot stress enough to take your time and be patient during this procedure.

Once the two sides and bottom have been unsealed, we only need to complete the top of the battery to remove the casing.  The top of the battery is a bit harder in the area where the battery terminals connect to the PSP.  As always, just work slowly and be gentle and you may need to apply some mild pressure to physically separate both pieces of the battery shell.

Step 3: Now that the battery case has been opened, you will see a small circuit board attached to the still-sealed Lithium-ion battery by two small piece of metallic foil.  Gently unfold the circuit board away from the battery pack and lay out flat.  Notice in the following picture the red circle around the number 19 on the circuit board.  In this case, 19 is the magic number.

Step 4: Cut the number 19 trace.  Using a magnifying glass and well lit area will make this a easier.  Hold the battery and circuit board securely and very still. Using a very sharp utility knife and some pressure, make a good and deep cut right through the number 19 trace wire.  This will damage the circuit board in a way that the EEPROM will report the serial number as all 1s.

Step 5: Close the battery back up.  Fold the circuit board back in to place and re-assemble the plastic battery shell.  Since the battery shell will not stay closed on its own anymore, use some small pieces of packing tape to hold the shell firmly together.  Put a piece of tape on the sides with some extra attention to the top of the battery.  This is due to how the battery requires a little upward force when removed from the PSP.  I like packing tape since it is very thin and strong.  Other tapes are thicker which might cause the battery to get stuck inside the battery compartment.  Packing tape can also be removed easily if you need to repeat step 4 in the event that it didn’t work – or just to show your friends.

If you have completed these steps successfully, the PSP power will automatically power on when the battery is inserted.  The screen will likely remain black but the green power light should come on.  If the power does not automatically come on, try manually turning the PSP on to make sure the battery has not been permanently damaged.  If you get no power at all, you better go buy a new battery.  If you do get power, then chances are you did not cut trace 19 completely.  Repeat steps 4 & 5 until you can insert the battery and the power light automatically comes on.  It took me two tries to get it right so don’t worry or rush yourself.

Remove the battery from the PSP and leave it off to the side for now.  Now that we have a service tool battery and bootable memory card ready for use.  In the next step, we will use these two tools together for bringing new and wonderous functionality to our PSP.

On to step 3…

Introduction
Step 1: Creating a bootable memory stick
Step 2: Creating a service tool battery
Step 3: Flashing the firmware
Conclusion

Now that we are ready to go, the first step is creating a bootable memory stick – also referred to as magic memory stick.  Much like how computers boot-up (and can take quite some time to do so), the PSP needs to load its operating system software after it is powered on.  When the PSP boots up, it loads the operating system from the embedded firmware.  Since the goal is to alter the embedded firmware, we must boot from a secondary device that will allow the PSP to load some service utilities which will modify the embedded firmware.  As you may have already assumed, we will be using a memory stick as a secondary boot device.

Just about compatible Memory Stick PRO Duo should be fine to use.  I would recommend either a Sony or Sandisk brand that is at least 512 megabytes in size.  I was having a hard time finding any memory sticks that were less than a gig in size and the 1gig sticks cost about $30.  I ended up buying a SanDisk 4GB Memory Stick Pro DUO at Costco for $38 on sale.

Creating the magic memory stick is a non-destructive process and the magic memory stick will continue to work as normal memory stick after the custom firmware has been installed.  If you are paranoid, you should get a dedicated memory stick for this sole purpose.  Otherwise if you intend to use your general purpose memory stick (Like I did), make sure to backup your memory stick contents…just in case…

Step 1: Download the official Sony 3.90 firmware from the www.pspslimhacks.com official Sony PSP firmware archive.  Since Sony distributes the PSP firmware on its own website freely to the public, I have no issues with providing a third-party download link.  The custom firmware consists of extensions on top of the official Sony firmware and thus the official Sony firmware is required for the installation.  Extract the EBOOT.PBP file from the PSP-Firmware-390.RAR archive and put it somewhere that will be quick to access.

Step 2: Download and install PSP Grader v005 from www.x-projects.org.  PSP Grader is an application that easily creates the bootable memory stick.  I used PSP Grader v004 to create my bootable memory stick but it is no longer available for download.  PSP Grader v005 is the current version as of this writing.  After installing PSP Grader, launch it.  If you are using Windows Vista, you will need to run this program with administrator privileges.
Update: PSP Grader v005 no longer seems to be available from x-projects.org.  You can use the newer v006 which is not specifically covered in these instructions or if you still wish to use v005, you can download it from rapidshare: http://rapidshare.com/files/155093962/PSP_Grader_v005_-_Lite_Setup.rar.html

Step 3: You will see a screen like this:

Now connect your PSP to your computer via USB connection.  Make sure that either your battery is fully charged and/or use the AC adapter.  PSP Grader should detect your PSP’s drive letter.

Step 3A: Click “Open” and select the EBOOT.PBP file you extracted from the official Sony 3.90 firmware archive.  PSP Grader will copy the EBOOT.PBP to its own resource directory so don’t worry if the path and filename change.  We’ll leave the “Select IPL” option as TimeMachine IPL – there should not be a need to change this.

Step 3B: Verify the drive letter of your PSP.  Make absolutely sure that this is correct.  If you are using a general purpose memory stick, make sure that “Format Memorystick” remains unchecked.  If you have a dedicated memory stick that will be used solely as a magic memory stick or are having booting issues, check this option.

Step 3C: Click “Create Pandora Stick”.  A window will come showing the progress and then a complete message will appear.

The magic/bootable memory stick has now been created.  You may wish to browse your PSP memory card to make sure any previous save games or files still remain on the memory card…just to be sure.

The memory stick now contains boot code that will allow the PSP to start-up and load service utilities from the memory stick itself instead of the PSP embedded firmware.  The memory stick also contains an image of the Sony 3.90 firmware customized with the M33-3 extensions.  The goal will be to read this customized firmware image from the memory card and write it to the embedded firmware on the PSP.  However, we are not able to boot from this memory stick quite yet.

Remove the memory card from the PSP and set it off to the side for now.  The next step will be a tutorial on making the PSP enter service mode so the secondary boot device can be used.

Update: I bought a Sandisk 8GB memory stick pro duo on sale at Future Shop for $56.  This worked perfectly fine with PSP Grader!

On to Step 2…

As I like to do with the gadgets I purchase, I like to tinker with them and figure out what makes them tick. One of the things that makes almost every portable electronics tick is the firmware. This is usually an operating system embedded in the device’s memory. It’s a piece of software that tells the hardware what to do and how to do it. When you buy a PSP (or other devices such as iPods) from a store, it comes pre-loaded with the factory firmware. As time goes on, the device manufacturer may release new firmware updates that correct problems and add new features.

So why customize the firmware of a PSP? Custom firmware adds new features to the PSP which are not supported or available through the official Sony firmware. The custom firmware allows me to run homebrew applications on the PSP, charge the PSP battery through USB while not having an established data connection (ie: charge while playing a game) and also backup purchased UMD games to memory stick where the games are playable direct from memory stick – this eliminates mechanical wear on the UMD drive, greatly increases load times and also greatly increases battery life.

Although this is not an overly difficult procedure, it does require some knowledge of how computers work and also some patience. This information is presented for educational use only. I am not responsible for any physical, emotional or financial damage you may cause to your PSP, yourself, your family, your pets, your friends, etc. If you decide to follow these procedures, you do at your own risk!

This tutorial will be divided in to five steps:
Introduction
Step 1: Creating a bootable memory stick
Step 2: Creating a service tool battery
Step 3: Flashing the firmware
Conclusion

This tutorial is intended for PSP Slim (Model PSP-2000/2001) ONLY. I do not have an older “Fat” PSP-1000 to test on and I cannot comment on the accuracy of this information towards the previous model.

This tutorial will change the PSP Slim firmware to 3.90M33-3. This means that the base firmware will be Sony’s 3.90 firmware with the “M33″ extensions and revision 3. As of writing this document, firmware 4.01M33-2 is the latest version and it will be an easy update at the conclusion of this tutorial.

Tools required (in order):
PSP Slim Model-2000 or Model-2001
Memory Stick Pro DUO of at least 512MB in size. I am using a Sandisk 4GB stick.
Guitar pick
Magnifying glass
Sharp utility knife
Packing tape

All set? Let’s go to Step 1!

I found out about a promotion EB Games is currently running: Trade-in 6 used games and get a brand new PSP slim core system for $19.99.  K so I trade-in any 6 games (that EB values at $8 or more) and they sell me a PSP for twenty bucks when a new PSP core system costs $170 regular?  Wow…  So I dug through all the DS and Wii games I haven’t played for a bit and came up with 10 games to trade-in.  I took everything to EB and not all my games were with the $8 minimum but after all the trades, I only had to pony up $31+tax for the PSP deal.  Not too bad!  So now I have a shiny new PSP, 4GB Sandisk memory stick duo ($39@Costco) and God of War ($39@Costco).  It’s a pretty neat little system.  The best part about the system is the large LCD screen which makes games and videos look pretty colourful, clear and crisp.  The PSP packs quite a bit of processing power putting it about on par with PS2 system – pretty good for a handheld system!  So yeah, it’s a pretty damn good deal.  The funny thing is that the memory card and game both cost more than the PSP itself.

On another note, I still can’t get over how good the Iron Maiden concert was a few days ago!!!  Check out my YouTube videos if you missed the show.