PSP Tool

User’s Manual
Table of Contents
1. Introduction .................................................................................................................................................................. 3
2. Feature Summary ......................................................................................................................................................... 3
3. Getting Started ............................................................................................................................................................. 3
4. Controls ........................................................................................................................................................................ 4
5. Feature Descriptions ..................................................................................................................................................... 4
a. USB Connection ....................................................................................................................................................... 4
b. Inject IPL to Memory Stick ....................................................................................................................................... 4
c. Erase IPL from Memory Stick ................................................................................................................................... 5
d. Check Memory Stick Information ............................................................................................................................ 5
e. Extract Memory Stick Data ...................................................................................................................................... 5
f. Format Memory Stick .............................................................................................................................................. 5
g. Create Magic Memory Stick ..................................................................................................................................... 6
a. Battery Options........................................................................................................................................................ 9
b. IdStorage Options .................................................................................................................................................... 9
4. Glossary ...................................................................................................................................................................... 10
5. Support Information ................................................................................................................................................... 11
a. Thanks.................................................................................................................................................................... 11
b. Frequently Asked Questions .................................................................................................................................. 11
c. Known Problems and Issues .................................................................................................................................. 13
d. Warranty Information ............................................................................................................................................ 13
e. Contact Information .............................................................................................................................................. 13

Page 2 of 13
1. Introduction
PSP Tool is a multi-purpose application designed for the PlayStation Portable console to perform various general
management functions with the console. Initially PSP Tool was designed just for extracting the IPL from the Memory
Stick but has since expanded and incorporates many other diagnostics functions.

2. Feature Summary
PSP Tool allows you to do the following:
 Backup and Restore the IdStorage of the PSP.
 Check the IPL injected on the Memory Stick or a file located on the Memory Stick.
 Check, Backup, Restore and change the battery EEPROM serial.
 Connect Memory Stick, Flash 0, Flash 1, Flash 2, Flash 3 and UMD Disc through a USB cable.
 Create a checksum of the IPL injected on the Memory Stick or an IPL located on the Memory Stick.
 Create a variety of different Magic Memory Sticks.
 Erase the entire IPL space of the Memory Stick.
 Extract the IPL injected on the Memory Stick to a file.
 Format the Memory Stick.
 Inject a variety of included IPLs or an IPL from a file to the Memory Stick.

3. Getting Started
a. System Requirements
 USB port and USB cable or a Memory Stick reader (for copying files to and from the console)
 Custom Firmware 2.71 SE-A or higher (excluding 3.71 M33 firmwares) or the mixed 1.50/3.40 kernel ran
under Time Machine.
 A correctly formatted Memory Stick with 512MB~ of free space to store the application, temporary files and
extracted data. Less space may be required if not all features are utilized ie. Magic Memory Stick Creation.

b. Installation from Internet

1. Download the software from the host site.
2. Once the download is complete using a file explorer utility navigate to the download location.
3. Open the downloaded file using a unzipping utility (such as WinRAR available at [Link]
4. Copy the PSP directory in the root of the downloaded archive to the root of the Memory Stick and select
yes if asked to overwrite any files.
5. Once the installation is complete ‘PSP Tool’ can be launched under GAME > Memory Stick™ in the PSPs
XMB.

Page 3 of 13
4. Controls
The following buttons are used to control PSP Tool:

Button Function
CROSS Goes to the menu of the selected item or executes the selected option.
CIRCLE Returns to the previous menu.
UP/DOWN/LEFT/RIGHT Navigates through the menus and pages.
SQUARE Changes the background colour to a random colour.
SQUARE & L Trigger Toggles between the installed firmware background colours and the background
colours stored internally.
SQUARE & R Trigger Changes the background colour to the selected system background colour.

5. Feature Descriptions
a. USB Connection
USB Connection is used to connect the device through a USB cable to
another device such as a computer. This function can connect the
Memory Stick, Flash 0, Flash 1, Flash 2, Flash 3 and the UMD Disc on
custom firmwares. If the firmware is being run under Time Machine
however only UMD Disc and Memory Stick will be able to be
connected through USB and if the installed firmware is too low only
the Memory Stick will be able to be connected through USB.

b. Inject IPL to Memory Stick

Injecting an IPL to the Memory Stick allows the console to boot with
a Pandora battery (battery with the serial set to 0xFFFFFFFF). If no IPL
is injected to the Memory Stick or an IPL injected is unable to load a
firmware than the PSP will act bricked if a Pandora battery is
inserted. The IPL available include:

 Time Machine IPL: This IPL is used for booting the Magic
Memory Sticks created by PSP Tool and allows the console to boot the firmware from the NAND with a
Pandora battery. However if the firmware installed on the NAND is 3.70 OFW or higher or the firmware
is 3.71 M33 or 3.80 M33 you will not be able to boot the NAND firmware using this IPL.
 Boosters Multi IPL: This IPL is similar to the Time Machine and has the same restrictions but is not widely
used and has more restrictions as to where an IPL can be loaded from.
 z3ros0ul Single IPL (Sleep Fix)
 z3ros0ul Multi IPL (Sleep Fix)
 Classic Pandora IPL: This was the first Memory Stick IPL released and was used only for booting a 1.50
kernel from the Memory Stick and installed a 1.50 – 2.71 update EBOOT.
 IPL from ms0:/[Link]: This option allows you to inject a file stored on the Memory Stick to the reserved
IPL sectors.

Page 4 of 13
c. Erase IPL from Memory Stick
This option will erase the entire reserved IPL space from the Memory
Stick and replace it with blank data. Once the IPL has been erased it
cannot be recovered so it is important to extract the IPL first, this is
essential if the IPL cannot be freely downloaded (such as the Datel
PSP Action Replay IPL).

d. Check Memory Stick Information

This menu contains functions to perform the following operations:

 Check Injected IPL: Attempts to identify the IPL injected on

the Memory Stick.
 Check IPL at ms0:/[Link]: Attempts to identify the IPL called
[Link] at the root of the Memory Stick.
 Check Memory Stick MBR: Shows various information which
is stored in the Master Boot Record of the inserted Memory
Stick. This information is similar to what is shown by MSInst.
 Create Checksum of Injected IPL: This option creates a SHA1 checksum of the first 4,096 bytes of the IPL
injected on the Memory Stick and saves the checksum to ms0:/[Link]. This function is for
reporting undetectable IPLs to the author of this software along with the IPL name and the IPL size.
 Create Checksum of ms0:/[Link]: This option creates a SHA1 checksum of the first 4,096 bytes of the
[Link] at the root of the Memory Stick and saves the checksum to ms0:/[Link]. This function is
for reporting undetectable IPLs to the author of this software along with the IPL name and the IPL size.

e. Extract Memory Stick Data

The options available under this menu allow the injected IPL to be
dumped to a file on the Memory Stick.

 Extract Memory Stick IPL: Extracts the injected IPL from the
Memory Stick and saves it as [Link] at the root of the
Memory Stick. This will extract the IPL based on detection of
the IPL or if the IPL cannot be detected it will try to guess the
IPL size by extracting it in blocks of 4,096 bytes until it
reaches a blank block.
 Extract Entire Memory Stick IPL Space: This option will extract the entire reserved IPL space to [Link] at
the root of the Memory Stick. This option is only needed when the IPL cannot be completely extracted
using the above method.

f. Format Memory Stick

This function formats the Memory Stick using the FAT16 file system
and relocates where the file system starts by approximately 1MB.
This function is similar to the MSPFormat and will allow larger IPLs to
be injected to the Memory Stick.

Page 5 of 13
g. Create Magic Memory Stick
The options available here will allow for a variety of different Magic
Memory Sticks to be created. Magic Memory Sticks are used to boot
the console from the Memory Stick instead of the firmware on the
NAND and require a compatible IPL to be injected and the battery
serial to be set to 0xFFFFFFFF. If the L Trigger is pressed down
towards the end of the creation process the current PSP system
registry files will be used for the unbricking process instead of a set of
generic 1.50 registry files. To create a Magic Memory Stick one or
more update EBOOTs may be required at the root of the Memory Stick and creation will fail if they do not exist.
The EBOOT download locations and the Magic Memory Sticks which can be created and their instructions
include:

EBOOT version Download location(s)

1.50 update EBOOT [Link]
3.40 update EBOOT [Link]
3.71 update EBOOT [Link]
3.80 update EBOOT [Link]
3.90 update EBOOT [Link]
4.01 update EBOOT [Link]
5.00 update EBOOT [Link]
other EBOOTs [Link]

Page 6 of 13
 1.50 Update Flasher (Original Pandora)
Requirements  1.50 Official firmware updater EBOOT.
 Any PSP-1000 (Fat) console (incompatible with all other PSP consoles).
Method 1. Rename the 1.50 update file to [Link].
2. Copy the 1.50 update file to the root of the Memory Stick.
3. Follow the prompts. If the Time Machine IPL is not detected you will be prompted to
install the IPL as well as setting the battery serial to 0xFFFFFFFF if it is not already.
Notes  Once the create process is complete the updater EBOOT file can be replaced with any
updater EBOOT ranging from 1.50 to 2.71.
 The installation/unbricking process will install the official version of whichever update
EBOOT exists during installation/unbricking.

Despertar del Cementerio v3 (3.71 M33-2)

Requirements  1.50, 3.40 and 3.71 Official firmware updater EBOOTs.
 Any PSP-1000 (Fat) or PSP-2000 (Slim) console with a TA-088 or lower motherboard.
Method 1. Rename the 1.50, 3.40 and 3.71 updater files to [Link], [Link] and [Link]
respectively.
2. Copy the 1.50, 3.40 and 3.71 update files to the root of the Memory Stick.
3. Follow the prompts. If the Time Machine IPL is not detected you will be prompted to
install the IPL as well as setting the battery serial to 0xFFFFFFFF if it is not already.
Notes  Once the create process is complete the 1.50 and 3.40 updater files can be removed.
 This MMS can install 3.71 M33-2 or 3.71 OFW.
 The installed firmware is incompatible with the Time Machine IPL and Boosters Multi
IPL.

Despertar del Cementerio v4 (3.80 M33-5)

Requirements  1.50, 3.40 and 3.80 Official firmware updater EBOOTs.
 Any PSP-1000 (Fat) or PSP-2000 (Slim) console with a TA-088 or lower motherboard.
Method 1. Rename the 1.50, 3.40 and 3.80 updater files to [Link], [Link] and [Link]
respectively.
2. Copy the 1.50, 3.40 and 3.80 update files to the root of the Memory Stick.
3. Follow the prompts. If the Time Machine IPL is not detected you will be prompted to
install the IPL as well as setting the battery serial to 0xFFFFFFFF if it is not already.
Notes  Once the create process is complete the 1.50 and 3.40 updater files can be removed.
 This MMS can install 3.80 M33-5 or 3.80 OFW.
 The installed firmware is incompatible with the Time Machine IPL and Boosters Multi
IPL.

Despertar del Cementerio v5 (3.90 M33-3)

Requirements  1.50, 3.40 and 3.90 Official firmware updater EBOOTs.
 Any PSP-1000 (Fat) or PSP-2000 (Slim) console with a TA-088 or lower motherboard.
Method 1. Rename the 1.50, 3.40 and 3.80 updater files to [Link], [Link] and [Link]
respectively.
2. Copy the 1.50, 3.40 and 3.90 update files to the root of the Memory Stick.
3. Follow the prompts. If the Time Machine IPL is not detected you will be prompted to
install the IPL as well as setting the battery serial to 0xFFFFFFFF if it is not already.
Notes  Once the create process is complete the 1.50 and 3.40 updater files can be removed.
 This MMS can install 3.90 M33-3 or 3.90 OFW.

Page 7 of 13
 Despertar del Cementerio v7 (4.01 M33-2)
Requirements  4.01 Official firmware updater EBOOTs.
 Any PSP-1000 (Fat) or PSP-2000 (Slim) console with a TA-088v2 or lower motherboard.
Method 1. Rename the 4.01 updater file to [Link].
2. Copy the 4.01 update file to the root of the Memory Stick.
3. Follow the prompts. If the Time Machine IPL is not detected you will be prompted to
install the IPL as well as setting the battery serial to 0xFFFFFFFF if it is not already.
Notes  This MMS can install 4.01 M33-2 or 4.01 OFW.

Despertar del Cementerio v8 (5.00 M33-4)

Requirements  5.00 Official firmware updater EBOOTs.
 Any PSP-1000 (Fat) or PSP-2000 (Slim) console with a TA-088v2 or lower motherboard.
Method 1. Rename the 5.00 updater file to [Link].
2. Copy the 5.00 update file to the root of the Memory Stick.
3. Follow the prompts. If the Time Machine IPL is not detected you will be prompted to
install the IPL as well as setting the battery serial to 0xFFFFFFFF if it is not already.
Notes  This MMS can install 5.00 M33-4 or 5.00 OFW.

Page 8 of 13
h. Battery Options
The options available here allow for manipulation of the EEPROM
stored on the battery. It is important to note that any options which
involve writing to the battery EEPROM will not work on consoles
which have a TA-085v2 or newer model motherboard. The options
include:

 Check Battery Serial: This will retrieve the serial and mode of
the battery stored in the EEPROM of the battery.
 Backup Battery EEPROM: Saves the entire EEPROM of the battery to [Link] in the root of the
Memory Stick.
 Restore Normal Battery: Restores [Link] in the root of the Memory Stick to the battery EEPROM.
 Restore Battery Serial: Restores just the serial from [Link] in the root of the Memory Stick to the
battery EEPROM.
 Convert to Normal Battery: Generates a random serial number and saves it to the EEPROM of the
battery. This option prevents the battery from booting in service mode or automatically booting.
 Convert to Service Mode Battery: Sets the battery EEPROM serial to 0xFFFFFFFF which causes the
console to boot into Service Mode.
 Convert to AutoBoot Battery: Sets the battery EEPROM serial to 0x00000000 which causes the console
to automatically boot from the NAND when the battery is inserted.

i. IdStorage Options
WARNING: Restoring IdStorage keys from another PSP console has
the potential of permanently bricking your PSP console or result in
loss of almost all function. Invalid IdStorage keys can also cause
issues with the PSPs Serial, MAC address, UMD, WLAN and region.
The author of this software nor any other developer cannot be held
liable for your actions and you agree to use these functions at your
own risk knowing that it may be impossible to restore your IdStorage
keys once they have been altered. You should also use another application to create a backup of your entire
NAND. The only way to recreate an IdStorage is using DC7 or higher which can resolve all IdStorage issues
except for MagicGate.

This mode allows for backing up the consoles IdStorage keys to a single file on the Memory Stick. This file can
later be restored to fix various issues which may arise due to corruption of the IdStorage keys. This size of this
file is also checked to help ensure safety and a checksum is appended to the end of the file to ensure the file
was copied correctly to the Memory Stick however the user has the option to override this safety measure.

j. About
The options available here allow you to view various information about the current PSP system and information
about the software.

Page 9 of 13
4. Glossary
Many of these terms are thanks to SilverSpring. The original page can be found at:
[Link]

Term Name Definition

Allegrex The codename of the main CPU of the PSP. The origin of the codename is unknown.
BARYON The codename of the SYSCON microcontroller IC (refer to SYSCON for more information). The
codename refers to a Star Trek term.
Brick A brick refers to the status of an electronic device that is inoperable due to corruption of one or more
of its vital components needed for operation.
CFW (Custom Firmware) A modified version of the Sony official firmware which removes Sony’s security patches to allow
homebrew to run and adds extra features to the official firmware.
HIBARI The codename of the PSP Slim LCD Controller IC. Means ‘Skylark’ in Japanese (a bird name is also used
for the codename of the PSP-1000’s (Fat) WLAN firmware: Magpie)
IdStorage A low-level storage area that holds specific configuration data and Id’s for each individual PSP. A basic
mapping format is used where a single NAND page is used to store a ‘leaf’. Each leaf is assigned a 16-bit
leaf Id and mapped to an index. The IdStorage is located in the first megabyte of non-mapped area of
the NAND flash. 256KB is reserved on the flash to hold the IdStorage area.
IPL (Initial Program The bootstrap program that loads the firmware. The IPL is Located in the first megabyte of non-
Load) mapped area of the NAND flash. 512KB is reserved on the flash to hold the IPL. If the battery serial is
set to 0xFFFFFFFF then the IPL is booted from the Memory Stick instead of the NAND flash.
KIRK The hardware crypto engine responsible for almost all aspects of the PSP’s security, including
decryption of EBOOTs & PRXs, save file, ad-hoc encryption and IdStorage verification. The codename
refers to Captain Kirk of Star Trek.
LEPTON The codename of the Mechacon UMD controller IC. A Sony custom-made LSI which holds the optical
media DSP & CPU, the ATAPI interface, 480KB DRAM read buffer and at least 384KB of flash ROM for
the firmware. The codename refers to a Star Trek term.
Magpie The codename for the PSP Fat’s WLAN firmware (a bird name is also used for the codename of the PSP
Slim’s LCD Controller IC: ‘Hibari’ – meaning Skylark.
NAND Refers to the NAND flash. A type of non-volatile memory similar to an EEPROM which uses NAND Gate
cells (as opposed to NOR Flash which uses NOR Gate). On the PSP, a single MCPIC holds both the NAND
Flash and DDR SDRAM both of which are 32MB in size (on the Slim PSP both are doubled to 64MB and
embedded into the TACHYON main CPU IC). The NAND flash holds the entire PSP firmware as well as
the IPL and IdStorage.
POMMEL The codename of the Power Controller IC. A DC-DC converter controlled by SYSCON. The codename
refers to a Star Trek term.
PBP (PSP Boot Package) The file extension for EBOOTs used to launch programs under the VSH. Holds the ELF executable as well
as optional icon/background/sound files to visually display under the VSH.
PRX (PSP Relocatable A custom relocatable ELF file used as the executable file format for PSP programs. Typically used as
Executable) library modules in the PSP firmware. Similar to the IRX (IOP Relocatable Executable) or ERX (EE
Relocatable Executable) of the PS2 executable formats.
PSAR (PlayStation An archiving file format used to store an image of the PSP’s firmware. Used by firmware updaters to
Archive) update the PSP’s firmware.
PSJS (PlayStation A JavaScript like scripting language used to drive the XMB and its resources.
JavaScript)
SPOCK The hardware crypto engine responsible for raw sector level decryption of UMD’s. Named after Captain
Spock of Star Trek.
SYSCON The System Controller microcontroller which handles everything from, controlling power to all devices
(including the LCD, UMD drive, Memory Stick, WLAN and the main CPU), keeping the date & time, sleep
mode control and controls all external switches including all buttons & the analog nub as well as the
headphone remote buttons/switches, LED control, main power & battery control, and even access of
the PSP’s Service Mode (SYSCON is the chip responsible for detecting the 0xFFFFFFFF serial of the
battery to enable service mode).
TACHYON The codename of the main CPU SoC IC. A Sony custom-made LSI which holds the main CPU (Allegrex),
the VFPU coprocessor, the Media Engine, CPU & its embedded DRAM, the Graphics Engine & its
embedded DRAM, the AVC decoder, the Virtual Mobile Engine DSP, the KIRK & SPOCK crypto engines
and the 4KB embedded mask ROM which holds the PreIPL and routines to boot into service mode. The
codename refers to a Star Trek term.
Voyager The codename of the PSP Slim’s WLAN firmware. Named after the Starfleet vessel of Star Trek.
VSH (Visual Shell) The main interface of the PSP, a user interface shell which provides the access to the kernel. Uses
Sony’s XMB (Cross Media Bar) for its GUI.
XMB (Cross Media Bar) The graphical component of the VSH. A script driven GUI first developed for the Sony Japaneses PSX
DVR (Digital Video Recorder) and also used on Sony WEGA & Bravia TV’s as well as the Sony PS3.

Page 10 of 13
5. Support Information
a. Thanks
cory1492: The battery functions are based on his Open Source Pandora Battery Tool.

Dark_AleX: Created the VLF ‘VSH Look & Feel’ library, Custom Firmware, Time Machine, Despertar del
Cementerio and is the PSP developer constantly working to bring us freedom in using our PSPs.

Davee: Helped me get the HEN version.

Hellcat: The Memory Stick format functions used are based on the format functions used in Pandora Installer.

RainMotorsport: Helped me implement and fix issues regarding the dumping of the IPL from the Memory Stick
and the features of his application formed the basis of the IPL functions of this application.

Team C+D: The amazing work of each individual of this group was the basis of probably the biggest exploit ever
found in the PSP and formed the basis of all of the Pandora software which has in turn led to most PSPs being
able to run custom firmware without Sony being able to patch this exploit in any future updates of their
firmware.

Torch: Helped me correct issues which caused corruption of the Memory Stick when injecting an IPL larger than
the reserved space.

b. Frequently Asked Questions

Q: This software does not create a full dump of my IPL?
A: Use the second dump method to dump the entire IPL space.

Q: The application freezes when I try to use a function or the function does not work?
A: There are a number of plugins which are incompatible with the software and interfere with a number of
functions or prevent the software from working at all.

Q: This software does not detect my IPL?

A: The application may not have a definition for the IPL please send the IPL to my e-mail address so I can add
detection of the IPL to the next release or send me a checksum of the IPL, the name of the IPL and the original
size of the IPL.

Q: Can this application extract the Datel Action Replay IPL from a Memory Stick?
A: Yes it can, the IPL has also been tested with Memory Sticks of different brands and sizes and has been
compatible, however the user must still have Official Firmware and a PSP-1000 unit or PSP-2000 unit without a
TA-088v3 motherboard and a compatible battery.

Q: The application detects that I have sufficient space to inject an IPL but when I attempt to inject that IPL I get
an error saying there is not enough reserved sector space, why?
A: When the IPL is injected it is written in blocks of 4096 bytes and therefore if the IPL size is not a multiple of
4096 it is rounded up. 8192 bytes of blank data are also added to ensure the IPL can be dumped correctly at a
later time.

Q: The application keeps corrupting my Memory Stick when I inject an IPL?

A: This issue should not arise due to the reserved IPL space being verified before injecting an IPL however if it
does please use MSPFormat to format the Memory Stick and try injecting the IPL again.

Q: The application freezes on load and my console powers off after a few seconds?
A: This application requires a large amount of free RAM and too many plugins in game mode can cause a crash.
A2: Your firmware may not support PSP Tool please update to a custom firmware which is compatible.

Page 11 of 13
Q: I created a Magic Memory Stick, installed the firmware and now my PSP will not boot?
A: DC3 and DC4 Magic Memory Sticks are not compatible with some IPLs including the Time Machine IPL and if
the battery serial is set to 0xFFFFFFFF and one of these IPLs are injected onto the Memory Stick the PSP will not
boot. To fix this boot the PSP with the battery out using the AC adapter and either change the battery serial,
inject a compatible IPL or install a firmware compatible with the IPL.

Q: Before I updated PSP Tool everything worked fine but now errors are appearing or the application crashes?
A: Once of the PRX modules might have been modified but the size of that PRX may not have changed. The PRX
files are only overwritten if they are not the same size as the once stored in the EBOOT to increase the life
Memory Stick and still make it only necessary to copy one file to the Memory Stick. The simplest way to fix this
error is delete the PRX files in ms0:/PSP/GAME/PSP Tool.
A2: There may be an incompatibility with your PSP model, please let me know about this.

Q: The application corrupts my Memory Stick during the format process, how can I fix this?
A: Format the Memory Stick using the default format function in the Sony firmware then after re-copying the
program to the Memory Stick try the format function in the application again.

Page 12 of 13
c. Known Problems and Issues
 The following plugins are incompatible with PSP Tool:
RemoteJoyLite: Crashes the system when exiting the software, this is likely caused by USBHostFS.
PSPLink: Crashes the system when exiting the software, this is likely caused by USBHostFS.

d. Warranty Information
This software is provided AS IS. No warranty of any kind is expressed or implied. You use this program at your
own risk. The authors will not be liable for data loss, damages, loss of profit or any other kind of loss while using
or misusing this software. It is important to carefully read and understand the use of the functions as some
functions if used incorrectly can brick the PSP console.

e. Contact Information
If you are experiencing difficulties with any aspect of this software please ensure that you have read and
understood the contents of this user manual and attempted re-installing the software before contacting
technical support for further help.

E-Mail: raing3@[Link]

©2008 - 2009 raing3.

All trademarks remain the property of their registered owners.

Page 13 of 13