PSP Testing Tool Service Mode :D

[WorldGenesis]

Hello all!

So, I was able to get the PSP Testing Tool (DTP-H1500) to boot into service mode (not in the "official" Sony way). Long post warning?

The typical service mode/Pandora's battery works by putting in a PSP battery which contains the EEPROM serial 0xFFFFFFFF which the SYSCON reads and has the Pre-IPL read the bootloader/IPL from the memory stick, which causes the memory stick to act like a NAND flash. This allows the unit to still run its OS and software without relying on a badly flashed unit.

---
Of course, the PSP Testing Tool does not have a battery, since its a giant tower

Sometime ago, I figured out that on the H1500 motherboard, there's a set of dip switches, 3 labeled SYSCON [normal <-> write], and a dip switch containing 4-switches.

By setting one of the mini switches to on, it'll auto-power on the unit and boot the PSP when the AC power supply was plugged in. This is similar to the behavior where if you set the battery serial to all 00's on a retail PSP instead of FF's (probably used for quick factory testing)

So, I got my classic 1.50 Pandora MMS, I set all the front panel dip switches to on, opened up the unit to make sure I can access the motherboard switches while the unit is plugged in.

I set the 4-switch dip all one, except the far right one, and kept the SYSCON write switches to default / left. This should cause the tower's fan to turn on, where it'll actually set the battery serial to all 0's if you read it from any battery-based program.

I booted up the unit into the system software (which my unit is running 1.0.0 with some custom helper modules) and started Pandora's Battery tool (you can use any tool so as long it can set the battery serial to all FF's).

Once you are in the app, make sure the serial is currently set to all 00's, SET the SYSCON dip switches from left to right, so its in Write Mode (the top two, when looking from the bottom with the DVD drive down). From the program, I set the serial to all FF's, which in the program I was using auto-exited in a few seconds.

The controller unit's display will power off but the tower will still remain powered on, set the SYSCON switches that were in write mode set to off/normal mode.

From there the unit will warm reboot and run whatever IPL was injected on the memory stick
---
I'm not entirely certain how Sony themselves force the "battery" into service mode where the internal flash is not bootable. It definitely at least makes it somewhat possible to install whatever firmware from this mode so as long you can set the battery serial.

Enjoy! :O

---
EDIT: I think I just figured it out after like messing with it again :|

Make sure the tower is powered off

So, set all the SYSCON switches to off/normal, and set the 4-pack dip switch to the following pattern:

ON / OFF / ON / OFF

so, 4 and 2 should be clicked away from themselves.

Make sure to also set *all* the front panel switches to ON, and then power on the tower, it should auto-boot the unit with whatever IPL is injected on the memory stick.

Enjoy once again with this new found info XD

EDIT 2: The front panel dip switches! They do nothing! Just set the pattern for the mini 4-switch pack to that pattern and that'll be good.

EDIT 3: Just adding a thing, where I messed with the dipsw's sometime last year from the Assembler Archive: PSP Testing Tool DIPSW Mystery

 

[WorldGenesis]

Gonna throw this image in here, its running via the classic 1.50 Pandora IPL on the jas0nuk ELF Menu

 

[hermesconrad]

This is fantastic, great job

 

[zecoxao]

that EDIT makes me moister than an oyster

 

[Mathieulh]

Mathieu Hervais, [11.05.20 11:40]
I managed to do "SOMETHING"

Mathieu Hervais, [11.05.20 11:40]
I set the CP force power on dipsw (dipsw2) on

Mathieu Hervais, [11.05.20 11:40]
booted

Mathieu Hervais, [11.05.20 11:40]
(using the tower power button)

Mathieu Hervais, [11.05.20 11:40]
set serial to 0xFFFFFFFF

Mathieu Hervais, [11.05.20 11:41]
powered off (using the tower power button)

Mathieu Hervais, [11.05.20 11:41]
this keeps the serial because the main tower is still powered on even though the PSP side is off

Mathieu Hervais, [11.05.20 11:41]
then I powered on again

Mathieu Hervais, [11.05.20 11:42]
and regardless of the memory stick inside

Mathieu Hervais, [11.05.20 11:42]
until I disconnect the AC entirely

Mathieu Hervais, [11.05.20 11:42]
so it is booting with the CS mode flag on

Mathieu Hervais, [11.05.20 11:42]
but something prevents it from loading the IPL from the memory stick

Mathieu Hervais, [11.05.20 11:42]
I would assume it still branches to the boot code at some point

Mathieu Hervais, [11.05.20 11:43]
I tried with the real JIG memory stick stuff

Mathieu Hervais, [11.05.20 11:43]
doesn't boot either

Mathieu Hervais, [11.05.20 11:43]
so it's not a 0xBFD range issue

Mathieu Hervais, [11.05.20 11:43]
it just doesn't boot with serial 0xFFFFFFFF

Zecoxao, [11.05.20 11:46]
try to set only the 4 specific bits

Mathieu Hervais, [11.05.20 12:10]
not even sure that works, I just found force CP on only boots once for some reason
It works on both my L1500 and H1500 units, it does not work on T1000 however (as expected) the serial does not even change on T1000. I wonder if we can't force it by setting syscon write and writing the serial manually though.

Does the serial revert when we set all the switches back off after we manually programmed it?

UPDATE:
well, if I switch both sc write dipsw (especially s2201) to on on the T1000 it powers off the psp side and if I try to turn it with the switches on, it does not power on, so I can't force write the serial on T1000.

UPDATE2:

I managed to do "SOMETHING" on the T1000

I set the CP force power on dipsw (dipsw2) on and booted (using the tower power button)

set serial to 0xFFFFFFFF

powered off (using the tower power button)

this keeps the serial because the main tower is still powered on even though the PSP side is off

then I powered on again (using the tower power button)

and regardless of the memory stick inside the unit will not power on until I disconnect the AC entirely

so it is booting with the CS mode flag on but something prevents it from loading the IPL from the memory stick

I would assume it still branches to the boot code at some point

I tried with the real JIG memory stick software and it doesn't boot either so it's not a 0xBFD range issue it just doesn't boot with serial 0xFFFFFFFF

UPDATE3: Nevermind I just found the force CP on only boots once on T1000 for some reason.

 

[GregoryRasputin]

Great work

 

[Mathieulh]

Well, you don't need to set anything other than dipsw 4 (P24 on the S3503 switch) to position on, to get service mode to work on H1500/L1500

 

[RazorX]

does this mean once booted you can dump the nand and if ever you brick the testing tool zero fucks need to be given and you just restore the nand

 

[WorldGenesis]

does this mean once booted you can dump the nand and if ever you brick the testing tool zero fucks need to be given and you just restore the nand

Pretty much You can restore from a (recoverable) brick in case any thing goes wrong during firmware updates, or downgrade/upgrade to any retail or testing tool firmware.

Basically, its Pandora's Battery

 

[speedyink]

This is awesome, thanks for sharing your findings!

 

[RazorX]

does anyone have an image of the nand on a testing tool motherboard?
i'm curious where it's located and what the footprint is.

 

[Mathieulh]

does anyone have an image of the nand on a testing tool motherboard?
i'm curious where it's located and what the footprint is.

Yes, it's 64MB in size.

 

[Mathieulh]

By the way, setting both P23 and P24 sets the battery serial to 0x00000000 (auto boots to nand)

 

[RazorX]

Yes, it's 64MB in size.

sorry i think you missunderstood, by image i meant picture of the physical chip on the motherboard so i could see what it was ie plcc etc as well as the type to see if it's something that could be socketted and possibly replaced if need be providing you had a nand dump.

 

[Mathieulh]

sorry i think you missunderstood, by image i meant picture of the physical chip on the motherboard so i could see what it was ie plcc etc as well as the type to see if it's something that could be socketted and possibly replaced if need be providing you had a nand dump.

Why would you do that when you can restore the nand using service mode?

 

[RazorX]

Why would you do that when you can restore the nand using service mode?

i was just curious mainly

 

[WorldGenesis]

Why would you do that when you can restore the nand using service mode?

Replace a NAND chip incase of a large amount of bad blocks "Unrecoverable brick"

That would probably take a long time though or if you write to a bunch of times to the chip.