The psp 3000 is the latest psp model that has an upgraded screen and a built in microphone. The number at the end is the region that the psp was sold in (e.g. 3001 = United States). They are all the same psps just a different region code. PSP 3000 is currently unhackable so you will have to wait before you can hack it.
The pandoras battery is a kit that consists of a hacked psp battery and a magic memory stick it allows you to hack your psp(not 3000 or TA-88v3).
Ok, 3003 is the name of the hardware of the psp. PSP slim is 2000/ 3000. My psp is psp 1003, which is the first psp hardware platform, in europe(ends in 3). for america it ends in 0, in japan 1(i think) australia 2 (i think).
Pandora is a process you put your psp through to hack it so you can play games off the memory stick, not just UMD's, as well as various other things. You need a pandora battery and a magic memory stick. the battery can be made at home (BUT DONT TRY IT A KID GOT 3RD DEGREE BURNS ON HIS LEG WHERE HE WAS CARRYING HIS HOMEMADE PANDORA BATTERY IN HIS POCKET AND IT BLEW UP) no joke. the maic memory stick just copies over files to the psp's internal hard drive, then you can use your normal battery and memory stick. Pandora does not work with psp slim aka psp 2000/3000
o ye and to tell if you have psp hardware take out the battery cover and there's a sticker which tells you what kind. if you bought your psp after august 2008 chances are you have a TA88 motherboard, which briks(locks) your psp if you pandora it. to tell if you have this flip open the UMD cover (take out the UMD dumbass), then look at the motherboard (green bit). it's kind of hidden in the shadows directly behind the white UMD lettering on the outside. found it? good. If it has random yellow text on you have an unhakable psp. im sorry.
Why TA88v3 cannot be hacked
This is an explanation of the security that was added in TA88v3, and which will be likely in PSP3000.
When the PSP boots, the boot code (aka pre-ipl or ipl loader) loads the ipl from either the nand or memory stick. The IPL is splitted into pieces of 0×1000 bytes.
First 0xA0 bytes of each block is a header for the kirk hardware command 1. It contains keys,
the size of the cipher data, and two hashes, one for part the header itself, and another one for the body. The 0xF60 remaining bytes are the ciphered body, which will decrypt to 0xF60 plain bytes? if the hashes, which are checked by kirk hardware itself, are OK. (Note: ciphered body can actually be less than 0xF60, in this case, remaining bytes are ignored? before TA88v3) Fir
The security of kirk hashes was destroyed by a timing attack, and the IPL became unprotected.
What has Sony added to fix this?
The answer can be found in 4.00+ slim ipl?s. They decreased the size of the ciphered body to 0xF40 to leave 0×20 bytes at the end of each block (at offset 0xFE0).
As stated before, these remaining bytes are ignored? in pre-ipl?s of psp?s prior to TA88v3, and in fact, they can be randomized and ipl will still boot in those psp?s. In newest pre-ipl?s, these 0×20 bytes have a meaning.
The first 0×10 bytes is an unknown hash calculated from the decrypted block. It is deduced that is calculated from the decrypted block and not the ciphered one due to the fact that 4.01 and 4.05 have a lot of ipl blocks in common, which, when decrypted, are similar, but they are totally different in its encrypted form. In these two ipl?s, this hash is same, as seen in the picture:
The second 0×10 bytes seem also to be dependent of the decrypted body (maybe dependent of the previous 0×10 bytes too?). In the picture it can be seen that they are different in 4.01 and 4.05, but they can actually be interchanged, you can move those 0×10 bytes from the same block in 4.05 ipl to the 4.01 ipl and it will still boot; however it cannot be randomized.
This protection also destroys any possibility of downgrading below 4.00, as these new cpu?s won?t be able to boot previous firmwares ipl?s.
Summary: basically, all security of newest psp cpu?s rely on the secrecy of the calculation of those 0×20 bytes. If pre-ipl were dumped somehow, the security would go down TOTALLY.
