Sony PSP Test assembly guide

Discussion in 'Sony Programming and Development' started by Parris, Jan 1, 2008.

  1. npt

    npt Spirited Member

    Joined:
    Nov 6, 2009
    Messages:
    173
    Likes Received:
    2
    Let's see pics of your shined up test!!

    Tsukasa,
    Let's see the pics! ; ) Once I clean my room up I'll put up pics of my DTP-T3000A! : ) (could take a little bit hehe)

    Regards,

    npt

    :thumbsup:
     
    WorldGenesis likes this.
  2. Tsukasa

    Tsukasa Member

    Joined:
    Jun 22, 2009
    Messages:
    22
    Likes Received:
    0
    I can take some pics, but they won't differ that much from the ones already taken by others. ;)

    Nevertheless I'd like to see your H300 in action *jealous*. :D
     
  3. mathieulh

    mathieulh Problem Solver

    Joined:
    Jan 26, 2006
    Messages:
    558
    Likes Received:
    182
    To people with DTP-H1500 or even DTP-L1500 units,
    Can you test something on your DTP-H1500/DTP-L1500? It will probably lead to nothing but I am curious, can you create a pandora memory stick (running something like Despertar del Cementario v8 (aka DCv8) on a psp, or even just using the old pandora release), put the memory stick in the DTP-H1500 unit, plug the AC in, press the F1 button (you can try the F2 button too or even both at the same time) and while keeping the button pressed, press the power button. I want to see if that enables service mode on the unit (sadly I only have a DTP-T1000 here so I can't test this myself as the buttons are used for system init and network init respectively)

    There is also a chance this leads to nothing though but it'd be nice to test it, as I still wonder how they service these units.
     
    Last edited: Sep 13, 2016
  4. mathieulh

    mathieulh Problem Solver

    Joined:
    Jan 26, 2006
    Messages:
    558
    Likes Received:
    182
    All right, I looked at little further, it seems (still not 100% sure, will check over the weekend or later next week) that the SYSCONPWR DIPSW on the motherboard is what sets the GPIO register to enable service mode (without a battery) and run an IPL from a memory stick.

    This could potentially allow testingtool unbricking/servicing and hopefully as well as bypass register 9 on DTP-T1000 (which forces pre-ipl to jump to 0xbfd00000) (if it doesn't, I can't test this, as I don't have a DTP-H1500.
     
  5. mathieulh

    mathieulh Problem Solver

    Joined:
    Jan 26, 2006
    Messages:
    558
    Likes Received:
    182
    Ok, I got to test things on my DTP-T1000
    SYSCONPWR: This does turn on the unit as soon as you plug in the AC cable displaying a similar behavior to when plugging in a battery with serial 0x00000000 or 0xFFFFFFFF, unfortunately my unit does not boot in this mode, even with a Pandora memory stick in, I assume this is because it's a DTP-T1000 and the CPU still want a pre-ipl (kbooti.bin) to be fed from the CP but the CP isn't running in this mode. The power led stays orange in this mode until you press the power button, it then blinks green forever. Because I can't test service mode using the CP, I didn't feel the need to test the CP_ForceOn switch. I expect a very different behavior on a DTP-H1500 or DTP-L1500 if a pandora memory stick is inserted while SYSCONPWR On is set to HI, unfortunately, I don't own one so I can't test this.

    P23: This disables the power led, other than that, the unit does however operate normally
    P24: I've tried it but it didn't seem to have any effect.

    Finally my unit operated normally once I set all the switches back to their initial off state.

    P.S. if someone with a DTP-H1500 could try the SYSCONPWR On with a working pandora memory stick inserted, that would be great.
     
    Last edited: Feb 10, 2017
  6. CelticR

    CelticR Member

    Joined:
    Jun 26, 2017
    Messages:
    6
    Likes Received:
    2
  7. mathieulh

    mathieulh Problem Solver

    Joined:
    Jan 26, 2006
    Messages:
    558
    Likes Received:
    182
    I acquired a DTP-H1500 yesterday and I figured out what the F1 button is for, it enables battery emulation by default the unit is 100% charged connected to external power, pressing the F1 button until the led blinks while no GPI is set sets it as 100% charged battery doing it while setting the GPI switches configuration changes the battery values, so far all I found is GPI 7 sets the battery to 12% (the battery level does decrease!), pressing F1 again until the power LED blinks sets it back to an external power connected state.
    To change the battery configuration one needs to restore it to external power, set the GPI switches, change it back to battery state, the configuration does not change on the fly.

    I do not know if F2 is used at all or what it is used for.
    The F1 button battery emulation does not work on the DTP-T1000 (pressing the system init button while the unit is in operation has no effect), instead it is controlled through an external battery emulator application which I unfortunately do not possess.
     
  8. Borman

    Borman Digital Games Curator

    Joined:
    Mar 24, 2005
    Messages:
    9,564
    Likes Received:
    2,221
    Hah I actually knew that, I had the unit power off during a stream once because I had hit the button
     
  9. mathieulh

    mathieulh Problem Solver

    Joined:
    Jan 26, 2006
    Messages:
    558
    Likes Received:
    182
    I didn't know about it because Sony did not document those buttons, I only found out once I started fuzzing with these.
    Do you have any idea what F2 is for by any chance?

    I also presume that F1 and/or F2 + GPI combo enable service mode but there are 8 switches, that's a lot of possible combinations to look for. I wish someone who serviced those units would step forward and tell us how it's done xD
     
  10. Borman

    Borman Digital Games Curator

    Joined:
    Mar 24, 2005
    Messages:
    9,564
    Likes Received:
    2,221
    F2 I didn't discover. I can't even remember how I figured out the battery thing before that, maybe it was in a game doc.
     
  11. mathieulh

    mathieulh Problem Solver

    Joined:
    Jan 26, 2006
    Messages:
    558
    Likes Received:
    182
    I am pretty sure the docs say "For service only" or something similar.

    Well, the battery emulator runs on a H8/3687 IC which uses its own ISA, the firmware for the testingtool battery emulator ships inside batemu_inst.prx for which I decrypted versions 6.00 to 6.60, I now need to extract the H8 firmware from the module, unpack it if it's packed in .H8P or a similar format and then reverse it to find which GPI configurations the battery emulator reads, which is not going to be easy.
    I won't have time to seriously work on that until I am back from Japan however :/
     
  12. Borman

    Borman Digital Games Curator

    Joined:
    Mar 24, 2005
    Messages:
    9,564
    Likes Received:
    2,221
    It may have been in a game design document or a build testing thing, not necessarily from Sony. But I may have figured it out when I hit buttons too and saw the battery going down. It all blends together at this point.
     
  13. WorldGenesis

    WorldGenesis irc.worldgenesis.net

    Joined:
    May 12, 2007
    Messages:
    127
    Likes Received:
    29
    Its really weird they allow GPI usage for the battery emulator, especially if a game needs to use GPI for debugging and does checks for battery states at the same time. o_O
     
  14. mathieulh

    mathieulh Problem Solver

    Joined:
    Jan 26, 2006
    Messages:
    558
    Likes Received:
    182
    The GPI state is only read upon enabling the emulator (pressing the F1 button), from then on, you can set the GPI to any state you like.

    Pressing the F1 button will make the power led blink twice and enable the battery emulation, pressing it again will make the power led blink once which will restore the normal external charge operation.

    Keep in mind that this only works on the testingtool and was not intended for third party use as this was never documented.

    The DTP-T1000 battery emulation offers much better and refined control as its set through an external application. Unfortunately I couldn't get my hands on it, I would have loved to analyze it.
     
  15. WorldGenesis

    WorldGenesis irc.worldgenesis.net

    Joined:
    May 12, 2007
    Messages:
    127
    Likes Received:
    29
    Ahh, thank you for that information :D

    Since Testing Tools do not have DECI2p / Communication Processor hardware, it would make sense they'd have some sort of battery emulation *somewhere*, definitely curious what the other F1 functions do.

    I guess its just a matter of opening up the hardware, and analyzing the F-button bits :p
     
  16. mathieulh

    mathieulh Problem Solver

    Joined:
    Jan 26, 2006
    Messages:
    558
    Likes Received:
    182
    To anyone who has been wondering, a PSP-1000 UMD Drive assembly works great in a DTP-T1000. I just fixed one of my units UMD Drive this way.
     

    Attached Files:

    WorldGenesis and PixelButts like this.

Share This Page