via forums.benheck.com

Full credits to iam7805 for posting this info

Search Google for the TOTALNewbi MS Installer. This will create the files you need for the memory stick. It's much more versatile then the files I have previously been distributing.

Ok, so you want to unbrick or downgrade your PSP but don't have a PSP capable of running homebrew apps. No problem! In this tutorial I will show you how to modify the battery's hardware to make it activate service mode.

This is our victim. Please note that while this concept may work on non-Sony batteries, only official batteries are guaranteed to have the same internals, so we recommend using one.

STEP 1:

The first thing you need to do is obviously crack open the battery. Surprisingly, the battery isn't very hard to get in to. In this picture you can see that I'm just using a guitar pick to slide in through an edge and slide around the perimeter of the battery to seperate the two halves.

STEP 2:

Next, we need to locate a certain chip. The chip has the model number S93C56 printed on it. We are going to need to desolder pin 5 and lift it off of the board. Here is a magnified view of the board, which shows where the chip is and which pin needs to be lifted.

Newer batteries have a much smaller board with a different layout. The same chip needs to have the pin lifted, but the chip is in a different position. Once you've located chip S93C56, the rest of the instructions are basically the same. This has been confirmed with the 2200 mAH Official Sony battery.

STEP 3:

If you are not confident in your soldering skills, have a less than steady hand or have a larger-than-optimal sized tip, please desolder the cell pack from the battery first. If you make contact between pins 5 and 6 then you will short ground to +3.6VDC! Not good! When desoldering the cell, only keep the iron on long enough to melt the solder. If you can, use a higher wattage iron so that the tip will be hotter, but you won't transfer as much heat to the cell pack. Remember that heat + Li-Ion battery = large explosion (t3h sux0r5, unless you get in on video. Seriously though, this operation is not for the faint hearted, and should definitely not be your first soldering experience. I recommend trying your hand on lifting the pins on an N64 CPU chip. Surely if you spend enough time here you have a couple killed N64 mobos laying around. )

Now is actually desoldering the pin. There are a few ways you could do this, but I think my method is the best because its less likely to damage components near by. Use an Xacto knife with a sharp tip and try to put it underneath the pin. Get somebody to hold a soldering iron (WITH A VERY FINE CONICAL TIP!) on the pin. When the solder melts you can pop the pin up with the knife. Be sure not to hold the iron on the board too long to avoid the lithium battery from getting too hot and exploding. When your done it will look something like this.

STEP 4:

Finally, close the battery's casing. Use some Krazy Glue to keep it closed, or just use electrical tape around the edges like I did. I don't actually recommend the electrical tape as it makes the battery very snug in the compartment and it takes a bit of force to get it out. You can use the battery just like a regular Pandora's battery. As for getting the Memory Stick files, I can tell you that they are out there and you can find them after a bit of Googling. However, I can't tell you exactly where to find them as they contain copyrighted Sony code, and sharing them is illegal.

How does this work?

The pin that we just lifted was actually the ground pin of the EEPROM. Removing this pin effectively shuts off the EEPROM. When the microcontroller inside the battery tries to read the EEPROM, it will think the EEPROM contains all 1s (in binary). This is because of the pull-up resistors on the data lines. So the microcontroller returns a serial number of 0xFFFFFFFF to the PSP, which then goes into service mode.

Thank you for reading this, and if you have any questions, make sure to post and I'll try to help you!

-iam
_________________
Blackbox IRC channel: #blackbox on SorceryNet

ROSES ARE #FF0000
VIOLETS ARE #0000FF
ALL MY BASE
ARE BELONG TO YOU

---