khubik2/pysweeper

BaryonSweeper - a JigKick internal service tool emulator

BaryonSweeper - a JigKick internal service tool emulator

How-to

You can watch the video or follow a text instruction below.

To restore your PSP, follow a simple instruction:

1. Get neccessary hardware to make a probe:
   • a USB to TTL converter;
   • a 1n4148 diode;
   • a 10kOhm resistor (not required);
   • a way to connect to battery contacts (anything from loose wires to connector from a sacrificial battery)
   • soldering equipment or breadboard with jumpers
2. Build your probe - one-wire UART (aka K-line) adapter. You can omit an external battery if you power your PSP with a DC charger. Be aware that adapter's power output alone is not sufficient to power the PSP. You can also omit 10kOhm diode.
3. Create a Magic Memory Stick compatible with PSP-3000. You need to use either an official JigKick MS clone or balika011's DDCv9 - you can create both with my tool (https://github.com/khubik2/JigKick-Media-Creator)
4. To start the emulator, install necessary pip packages: pycryptodome, tk and pyserial.
5. Insert your memory stick and connect your adapter to computer running the emulator, select the COM port of your adapter and start the service.
6. Connect your probe to PSP's battery terminals. If done right, it should take one or two seconds for PSP to enter recovery mode and boot from MS.

Compatibility list

Model (last digit does not matter)	DATE CODE	Is compatible?
PSP-1000	Any	Supported, any magic MS
PSP-2000	Any besides 8C	Supported, any magic MS
PSP-2000	8C	Supported, only JigKick clone or DDCv9
PSP-3000	8C 8D 9A 9B and some 9C	Supported, only JigKick clone or DDCv9
PSP-3000	some 9C; 9D, any code starting with 0 or 1	Supported, only JigKick clone
PSPgo (N1000)	Any	Supported. Instructions to enter service mode unknown
PSP Steet (E1000)	Any	Supported. No MMS image available yet.

About

• M4j0r - Syscon Voltage Fault Injection glitch help
• Wildcard - Syscon glitching and dumping
• Sean Shablack aka Kyp40 aka FBIsoBOT - Syscon glitching and dumping, simplest one wire UART adapter schematic ever
• Proxima - Firmware reverse engineering, battery authentication response generator script
• khubik - Emulator code, GUI design, authentication script porting
• dogecore - Authentication script porting, GUI code, C# emulator threading fix
• Mathieu Hervais - decrypt-sp & decrypt-OS2 homebrew code
• SSL/Zerotolerance - re-encryption for Math's homebrews
• zecoxao - decrypt-sp & decrypt-os2 PC ports, boards supply, authentication script porting help
• Yoti - decrypt-sp improvements, MSID Dumper, contribution to PSPx.ru's 3000 series JigKick hacking thread, PSP 3000 supplier (<3), PSP 3000 unbrick PoC
• ErikPshat - Useful intel about JigKick, PSPx.ru's 3000 series JigKick hacking thread contribution, creation of functional JigKick memcard clone from original dump, userguides for MSID dumping and JigKick memory card creation
• Boryan, lport3, dx3d and many others from PSPx.ru's 3000 JigKick hacking thread - battery communication dumps and protocol reversal, one wire UART adapter schematics and more!
• lolivera - PSP 3000 unbrick PoC, TA-095 testing
• 预见 (zakezzzz) - TA-092 testing
• dee008 - Portable PSP battery controller emulator, PSP Street K-line pin location
• Wr0zen - PSPgo boards donation
• VrOdin - PSPgo tracing

pysweeper's Issues

PSP-3001 TA-090

Hello, I wanted to ask if this is compatible with the PSP-3001, it has the TA-090 plate and I don't know its DateCode, it doesn't have it on the battery sticker.
The green light comes on at startup but goes off after 2 seconds.

Trying to reach someone who could help me

Hello. I`m just trying to find someone who could know something about psp battery eeprom to develop a project.
I am trying to make custom batteries and wanna try to make custom eeproms to get correct percentage and duration info on the psp

TA-088v2 DATECODE 8B is not working.

Hello,

I tried to use this method with an European Crisis Core PSP 2000 with TA-088v2 and DATECODE 8B, but it never starts the service mode . I know this model is able to run with a Pandora's battery. However, in the Wololo forum they mentioned that now all the models are supported by Baryon Sweeper.

In the README.md compatibility list you mentioned:

PSP-2000 | Any besides 8C | Supported, any magic MS

Are we missing a key for this kind of model?

Stuck at A5 05 06 10C306 76 on PSP-1000

I have a launch model PSP 1000 that I'm trying to debrick, I hooked up the PSP battery pins to a PL2303HXA USB-to-TTL converter and started service, here's the logs :

Service started. Using serial FFFFFFFF 5A 02 01 A2 A5 05 06 10C306 76

PSP Go ? Someone?

@khubik2 @zecoxao Hi, i try to make some change in my PSP Go (N1004) and mess up with flash0 and flash1 and had brick and show me this now, i press the O but just restart and the same message, you have any solution how to fix it? Can fix it with this tutorial from here?

Did the key 151 lost in the keys.json

in the keys.json. challenge1_secret and challenge2_secret contains the 151. but,the keystore no contains 151.did it lost.
5A 0B 80 97BB9312C44CADB431 81
this is the last i reviced from serial port. 151 is i need.
pls update the keys.json,or provide the documentation.
thanks a lot.

[HELP] Anyone for PSP Go

@khubik2 @Yoti @zecoxao
Because i don't have the FT232RL need it for this and can't get it, i have USB to Serial Module - CP2102, DC-DC Step-Down 1.8-12V 2A - MP2315, 4-channel I2C-safe Bi-directional Logic Level Converter - BSS138 and resist and diode and the non original psp cable, anyone know how can use all this to make it 1.8V need the PSP Go for open the service menu ? Any details tutorial

Full Tutorial PSP Go

@khubik2 @zecoxao As i see now can enter service mode in PSP Go, but we need specific FT232RL with 1.8v and soldering skill, if anyone want build itself this where we connect the cables to the head if need it? Can't found a tutorial on internet, only this cable, and is easy just cut and soldering the non original cable to FT232RL ?

PSP-3004 - 9C (2 PSP's)

Hello, so I have been watching your tutorial and decided to give it a try with both of my PSP ending with 9C.
I have zero knowledge on USB TTL - Arduino but following your tutorial seems OK I guess since I'am getting response from the PSP.
I see some are supported some are NOT (9C) .

How do you know if it's supported or not ?

Here is my log:

5A 02 01 A2
A5 05 06 10C306 76
5A 02 0C 97
A5 06 06 FFFFFFFF 52
5A 02 0D 96
A5 07 06 9D10102814 54
5A 02 08 9B
A5 04 06 E204 6A
5A 02 16 8D
A5 13 06 536F6E79456E6572677944657669636573 6B
5A 0B 80 0D2072C28ABBC07E93 A3
A5 12 06 82D11E642C3E9115F97652736D2A3DD0 85
5A 0A 81 952CA4959A90B94A F3
A5 12 06 D6D6F9331445ABAFDE29F6450365C060 ED
5A 0B 80 045B56D400FF60D7B5 A6
A5 12 06 7FBCEE4A7A61F4D570430FA2208E5588 3C
5A 0A 81 1DF8A545A4BDE05E 7C
A5 12 06 87359D3E063D827091FAE8EC2EA25200 F5
5A 0B 80 976BD639CD8D04385C 17
An exception occurred in IO loop: TypeError("'str' object cannot be interpreted as an integer")

I believe object cannot be interpreted can confirm my 9C is not supported ? Or it can be some other issue?
My PSP has no power led, but has the memory sitck led blinking.

Thank you,

We Need A PSP Go Details Tutorial

@khubik2 @zecoxao I'm little confused about psp go, the only new is this https://www.psdevwiki.com/psp/Psp_Go_Jigkick, but this tutorial need a psp go dock n340 and is expensive, and is more cheaper go to a techinian or buy a almost new psp go. Only this with the dock work with psp go?

Comport busy

Hello Everyone,
I made the breadboard setup, have Python and all of the packs installed, magic memory card created, and can run the sweeper. However, when I run the program and connect to the nodes on the PSP, it stops and says the comport is busy.

Any ideas what is wrong?

Mac/linux compatible issue

Has this script been tested on mac/linux?
I tried this on my Mac and the console printed 5A 01 02 A2 5A0102A25A0102A2....

But it succeed on a Windows laptop.