Motherboards: Difference between revisions
m (→Hackability) |
m (→Comparison Table: TA-095v3/v4 for 07g versions of "95v1/v2") |
||
Line 472: | Line 472: | ||
|- | |- | ||
| TA-095v3 | | TA-095v3 | ||
| Brite 3000 | |||
| 07g | |||
| 0x00810000 | |||
| 0x012E4000 | |||
| 0x00000154 | |||
| 201006081334 | |||
| 1.300 | |||
| Samwise VA2 | |||
| Date: 2010-06-08 13:34:29 +0900 | |||
| Type 2 | |||
| 97 | |||
|- | |||
| TA-095v4 | |||
| Brite 3000 | | Brite 3000 | ||
| 07g | | 07g |
Revision as of 13:06, 2 August 2023
Description
Every PSP motherboard has an on-board flash chip that contains the PSP NAND image. That NAND image contains flash0-5 and the IDStorage.
- Flash0 - Contains the PSPs Primary Firmware.
- Flash1 - Used to store the XMB settings, network configurations, the background image in FW 2.00 and above, and the Custom Theme in FW 3.70 and above.
- Flash2 - In firmwares 3.00 and up, this contains the half of the DRM for Sony's official PS1 emulator (the other half being in the flash0)
- Flash3 - Used on development kits in firmware 5.00 and later to store kbooti.bin, kbooti is copied from flash3 to 0xBFE00000 (tachsm) by bootdispi.bin, about 1 MiB in size, It is used on retail units to store vsh specific applications such as 1seg. In custom firmwares it can be used along with flash2 to redirect firmware elements such as fonts. Also contains the Premium XMB Theme which is exclusively available on the MHP3rd PSP 3000 models.
- Flash4 - Cannot be mounted. It is suspected that it is unformatted and may be for future use hence why it cannot be read.
- Flash5 - Cannot be mounted. It is suspected that it is unformatted and may be for future use hence why it cannot be read.
- IDStorage - PSP-specific storage that store info such as MAC address, region, etc, and are used for operation of PSP.
The motherboard contains Tachyon, Baryon, Pommel, Kirk, and Spock.
- Tachyon - Codename of the chip which contains the CPU, ME and GPU.
- Baryon - Codename of the PSP System Controller (SYSCON) chip.
- Pommel - Codename of the PSP GPIO/watchdog which handles system events and shuts down in the event of a crash.
- Kirk - Codename of the PSP main decryption/verification chip.
- Spock - Codename of the PSP secondary decryption chip, only used to decrypt data from the UMD discs.
Revisions
TA-079 Series
The very first version of the Phat/Classic PSP were shipped out with the TA-079 motherboards. So far, there has been 2 revisions of this motherboard with v3 adding in a new WiFi card. It is not known whether the second or third versions of the TA-079 had security features implemented to prevent downgrades or homebrew to be ran.
Please note due to a smaller WiFi card in newer motherboards, some replacement housing (particularly the back plate) will not fit TA-079 boards, as most parts are designed for the newer models. Also a known issue with the WiFi cards for TA-079 is that they die faster than newer models. If this happens the user will be presented with error code 0x80410A0B when scanning or connecting to the internet.
TA-081 Series
Sometime in late 2005 production of PSPs was changed from Japan to China. This marked the change to TA-081 motherboards likely to reduce manufacturing costs and source enough parts for the European launch. These motherboards addressed a few customer complaints from the TA-079 models. These include screens shipping with dead pixels (bad QA), memory stick doors falling off, and difficult to use D-Pad. Additionally a new, smaller WiFi card replaced the older one which had problems with overheating and internal errors. Ironically the new improved WiFi card was made in Japan whilst the TA-079 one was made in China.
It is unlikely any new security measures were added in this motherboard, as it is fully compatible with 1.00/1.50 firmwares and downgraders weren't popular until later on in 2006.
TA-082 Series
Before Sony saw the 2.50/2.60 downgrader they made a new motherboard for the PSP called TA-082, with a different Manufacturers Clock Generator Vendor ID. When a TA-082 is downgraded below firmware 2.00, the older firmware IPL won't recognise the new Clock Generator ID, and the PSP will fail to boot, appearing bricked.
Beginning with the TA-082 the PSP's factory firmware is now stored in IdStorage. While it doesn't appear to be used for anything, it can be speculated this was a security measure to detect people downgrading. For example Sony could use this to detect a PSP running a lower firmware than it shipped, and it would void the warranty or prevent upgrading. This is implied as Sony added detection for IdStorage downgrader patch in 3.30+ and it will refuse to update if the keys are corrupted.
A method of checking whether or not a TA-082 motherboard is installed on a PSP without voiding the warranty is shown here.
On 27 December 2006, a TA-082 downgrader was released by Dark AleX, Mathieulh and harleyg allowing PSPs with 2.71 firmware and TA-082 or TA-086 motherboard to downgrade to 1.50. It appears that the downgraded units behave like any other non-TA-082s and after this process it is possible to upgrade to 2.71 SE, 3.XX OE or any other version of firmware, custom or official. However, problems do exist as a side effect of the downgrade. In order to allow the motherboard accept the 1.50 IPL some keys in the motherboards IDStorage are corrupted. This has led to many problems in downgraded PSPs.
These range from:
- Connection errors in AD-HOC.
- Brightness issues. (Upon the initial boot up of a downgraded TA-082 PSP, users may be greeted by a blank screen. Pressing the brightness button will resolve this issue)
- Battery issues. (If a PSP is shut off under 12% battery the PSP will not restart until the AC adapter is plugged in.)
One of the problems faced was the USBHOSTFS function of the PSP was corrupted after a TA-082 downgrade. The USBHOSTFS function is used in some homebrew programs and communication with the PS3. This however has been fixed in a release from a homebrew developer here. Also Using the NOOBZ 2.80 and 3.03 downgraders does not create this problem since they do not change the IDStorage keys associated with the USBHOSTFS function. Only the 2.71 downgrader corrupts the USBHOSTFS IDStorage keys.
There is a reported fix for these problems found here. The latest version of this is idreset v7 (for people who downgraded using the Dark AleX 2.71 TA-082 downgrader) which is found here or idcopy v1 (for people who downgraded with NOOBZ 2.80 TA-082 downgrader) which is found here. This has been reported to fix most or all of the problems associated with these downgraders. These fixes are for TA-082 and TA-086 PSPs only. It is also possible to use a modified 1.50 IPL to boot the 1.50 on TA-082/TA-086 without modifying IdStorage.
The official Sony updates 3.30+ now check for these corrupted keys, and will refuse to install if it finds them. Users on homebrew enabled PSPs can restore the keys and then upgrade to 3.30+, but those who have corrupt keys and have upgraded to firmwares 3.10 or 3.11 are now stuck. They cannot upgrade to any newer firmware but also cannot use homebrew to change the keys or downgrade. Now that a user-mode exploit has been found on these firmwares (with the Illuminati exploit) it is hoped that this may pave the way towards a kernel mode exploit which would be able to reset the IDStorage keys to allow upgrading. If a kernel mode exploit can not be found the only solutions would be to purchase and install a mod-chip or use the Pandora's Battery as a downgrader.
3.71 M33 Custom Firmware fixes the IDStorage before upgrading. It automatically checks if it is a TA-082/TA-086 before fixing it.
Newer downgraders have been built with these issues in mind. The only problem that remains with the latest downgrader (3.50 "Illuminati" exploit) is the brightness issue. However, a fix (which makes the PSP read from firmware 2.71 files when controlling brightness) can be applied to downgraded PSPs, thereby eliminating this problem as well (However, one must remove these added files prior to using the recovery downgrade / official update otherwise it can results in a brick). Alternatively, some have suggested this could be fixed with keycleaner, it has been reported not resolving the brightness issue. TA-079 up to TA-081 motherboards are not affected by these problems.
- comes shipped with 78K0/KE2, 64 pin Syscon
TA-086 Series
Please refer to the TA-082 series section. Everything in it pertains to this as well. This is the last motherboard revision for the PSP Fat series. It comes after the TA-085 likely because the Slim was in development long beforehand.
The only known change is to the LCD to make it more similar to the upcoming Slim. When downgraded to 1.50, the screen will appear black. Pressing the brightness button fixes it. Additionally the brightness settings will be wrong (reversed order) without an additional patch. The 1.50 Time Machine corrects this.
- comes shipped with 78K0/KE2, 64 pin Syscon
TA-085 Series
The currently released PSP Slim series are known to use a TA-085 motherboard, with the recent release of the TA-085 v2, and later on the TA-088 series. The only extra security in the TA-085v2 motherboard revision is the inability to write to the PSP battery's EEPROM, so a Pandora battery cannot be created on a TA-085 v2. However, a battery already with the Pandora EEPROM code can still be used, allowing regular custom firmware installation. No other abilities have been discovered yet. TA-085v1 Slims function normally and are still able to write to the battery's EEPROM.
Some TA-085 Motherboards are known to have display issues causing vertical bars to appear on the screen, and overtime this completely burns out the screen, replacement screens do not fix this issue.
TA-088 Series
Recently, TA-088 has been found in the newer Slims in Asia. (Particularly the Mint Green one) The TA-088 functions similar to the TA-085v2, and blocks the ability to write the battery's EEPROM while the PSP can still read it. The TA-088 has been incorrectly referred to as the TA-085v3 as motherboard identification tools referred to it as the TA-085, and it has been renamed to the TA-088. As time went on, Slims with different revisions to the TA-088 motherboard has been released, and are confirmed to be Pandora-proof. The TA-088v2 first reported being shipped with Slims in the Asia continent, has a patched tachyon that disabled the loading of all current Pandora Initial Program Loaders (ipl), but however did not defeat the loading of custom firmware ipls. The ability to flash custom firmware via Despertar Cementerio will be fixed with the newest release (version 6) which uses a new kernel, therefore allowing Pandora to work again. A third revision to the TA-088 came weeks later. Dubbed the TA-088v3, this motherboard is completely Pandora-proof as discovered by Silverspring of the M33 Team. According to Silverspring, a new Tachyon has been inserted into these motherboards, and patched the loading of any IPL's before the PSP booted up. If this patch is correctly applied, Pandora is defeated on all TA-088v3's until a new development comes through.
TA-090 Series
There has been reports that the TA-090 has shown up in a PSP-2000. There has been confirmed reports by Alek that it is also in the PSP-3000. This is the reason for the v1/2 listed below. The PSP-2000 version of the TA-090 is hackable with pandora. However, The PSP-3000 version of TA-090 Pandora's battery does not even turn on the PSP.
Datecodes/Shipped Firmwares
Information about motherboard Datecodes/Shipped firmwares can be found here.
Wifi Boards
Wifi Model | MAC OUI | Manufacturer | Country | Motherboard | Comments |
---|---|---|---|---|---|
MS-268 | 00:01:4A | Sony Corporation | China | TA-079 (+TA-081v2) |
Has two antennas, more prone to overheat/failure |
MS-299 | 00:02:C7 | Alpsalpine Co,.Ltd | Japan | TA-081 (+TA-079v5?) |
Moved to one antenna and smaller design |
J20H017 | - 00:16:CE - 00:16:CF |
Hon Hai Precision Ind. Co, Ltd | Taiwan | TA-082 | |
MS-329 | 00:16:FE | Alpsalpine Co,.Ltd | Japan | TA-086 |
Comparison Table
Note 1: common knowledge is that three versions of TA-079 exist but there are actually five. These other two are only found on Japanese launch units from 2004 whereas the rest are found worldwide. Previous known v1-v2-v3 are now v3-v4-v5 respectively.
Note 2: The last byte in Baryon version is either 0x00 or 0x01 for production and development units respectively.
Motherboard Model | PSP Model | Generation | Tachyon | Baryon | Pommel | Baryon Timestamp | Lepton (UMD firmware) | CodeName | Notes | Baryon Handshake Type | Service Key |
---|---|---|---|---|---|---|---|---|---|---|---|
?TMU-001? | DEM-1000 | 01g | 0x00140000 | 0x00010601 | 0x00000103 | 200409230625 | First | Guessed, final DEM version | N.A. | N.A. | |
TMU-001 | DTP-T1000 | 01g | 0x00140000 | 0x00020601 | 0x00000103 | 200410071128 | 1.020 Sep 24, 2004 |
First | Development Tool | N.A. | N.A. |
TMU-002 | DTP-H1500 | 01g | 0x00140000 | 0x00030601 | 0x00000103, 0x00000104 | 200411290757 | 1.090 Oct 18, 2004, 1.090 Nov 04, 2004 |
First | Testing Tool | N.A. | 00 |
TA-079v1 | Fat 1000 | 01g | 0x00140000 | 0x00010600 | 0x00000103 | 200409230625 | 1.020 Sep 24, 2004 |
First | Japanese launch (less common) | N.A. | 00 |
TA-079v2 | Fat 1000 | 01g | 0x00140000 | 0x00020600 | 0x00000103 | 200410071128 | 1.090 Oct 18, 2004 |
First | Japanese launch | N.A. | 00 |
TA-079v3 | Fat 1000 | 01g | 0x00140000 | 0x00030600 | 0x00000103 | 200411290757 | 1.090 Oct 18, 2004 |
First | Initial Worldwide release | N.A. | 00 |
TA-079v4 | Fat 1000 | 01g | 0x00200000 | 0x00030600 | 0x00000103 | 200411290757 | 1.090 Oct 18, 2004 |
First | N.A. | 00 | |
TA-079v5 | Fat 1000 | 01g | 0x00200000 | 0x00040600 | 0x00000103 | 200504040852 | 1.090 Oct 18, 2004 |
First | N.A. | 00 | |
TA-081v1 | Fat 1000 | 01g | 0x00300000 | 0x00040600 | 0x00000103 | 200504040852 | 1.090 Oct 18, 2004 |
First | N.A. | 00 | |
TA-081v2 | Fat 1000 | 01g | 0x00300000 | 0x00040600 | 0x00000104 | 200504040852 | 1.090 Oct 18, 2004 |
First | N.A. | 00 | |
TA-082 | Fat 1000 | 01g | 0x00400000 | 0x00114000 | 0x00000112 | 200509260441 | 1.150A Aug 30, 2005 |
Legolas1 | N.A. | 00 | |
TA-086 | Fat 1000 | 01g | 0x00400000 | 0x00121000 | 0x00000112 | 200512200558 | 1.150A Aug 30, 2005 |
Legolas2 | Date: 2005/12/20 05:58:05 | N.A. | 00 |
TA-085v1 | Slim 2000 | 02g | 0x00500000 | 0x0022B200 | 0x00000123 | 200704161420 | 1.240A Nov 10, 2006 |
Frodo | Date: 2007-04-16 14:20:33 +0900 | N.A. | 02 or 08 |
TA-085v2 | Slim 2000 | 02g | 0x00500000 | 0x00234000 | 0x00000123 | 200710022249 | 1.240A Nov 10, 2006 |
Frodo | N.A. | 02 or 08 | |
TA-088v1 | Slim 2000 | 02g | 0x00500000 | 0x00243000 | 0x00000123 | 200711022212 | 1.240A Nov 10, 2006 |
Frodo | Date: 2007-11-02 22:12:21 +0900 | N.A. | 02 or 08 |
TA-088v2 | Slim 2000 | 02g | 0x00500000 | 0x00243000 | 0x00000123 | 200711022212 | 1.240A Nov 10, 2006 |
Frodo | Needs DCv6 or higher, Date: 2007-11-02 22:12:21 +0900 | N.A. | 02 or 08 |
TA-088v3 | Slim 2000 | 02g | 0x00600000 | 0x00243000 | 0x00000123 | 200711022212 | 1.240A Nov 10, 2006 |
Frodo | Needs DC 9.00 or higher, Date: 2007-11-02 22:12:21 +0900 | N.A. | 02 or 08 |
TA-090v1 | Slim 2000 | 02g | 0x00500000 | 0x00243000 | 0x00000132 | 200711022212 | 1.240A Nov 10, 2006 |
Frodo | Date: 2007-11-02 22:12:21 +0900 | N.A. | 02 or 08 |
TA-090v2 | Brite 3000 | 03g | 0x00600000 | 0x00263100 | 0x00000132 | 200803241434 | 1.240A Nov 10, 2006 |
Samwise | Date: 2008-03-24 14:34:52 +0900 | Type 1 | D9 |
TA-090v3 | Brite 3000 | 03g | 0x00600000 | 0x00263100 | 0x00000133 | 200803241434 | 1.240A Nov 10, 2006 |
Samwise | Date: 2008-03-24 14:34:52 +0900 | Type 1 | D9 |
TA-092 | Brite 3000 | 03g | 0x00600000 | 0x00285000 | 0x00000133 | 200902091613 | 1.240A Nov 10, 2006 |
Samwise | Type 1 | D9 | |
TA-093v1 | Brite 3000 | 04g | 0x00810000 | 0x002C4000 | 0x00000141 | 200904011911 | 1.240A Nov 10, 2006 |
Samwise VA2 | Date: 2009-04-01 19:11:10 +0900 | Type 2 | 97 |
TA-093v2 | Brite 3000 | 04g | 0x00810000 | 0x002C4000 | 0x00000143 | 200904011911 | 1.240A Nov 10, 2006 |
Samwise VA2 | Date: 2009-04-01 19:11:10 +0900 | Type 2 | 97 |
TA-095v1 | Brite 3000 | 09g | 0x00810000 | 0x002E4000 | 0x00000154 | 201006081334 | 1.300 | Samwise VA2 | Date: 2010-06-08 13:34:29 +0900 | Type 2 | 97 |
TA-095v2 | Brite 3000 | 09g | 0x00820000 | 0x002E4000 | 0x00000154 | 201006081334 | 1.300 | Samwise VA2 | Date: 2010-06-08 13:34:29 +0900 | Type 2 | 97 |
TA-095v3 | Brite 3000 | 07g | 0x00810000 | 0x012E4000 | 0x00000154 | 201006081334 | 1.300 | Samwise VA2 | Date: 2010-06-08 13:34:29 +0900 | Type 2 | 97 |
TA-095v4 | Brite 3000 | 07g | 0x00820000 | 0x012E4000 | 0x00000154 | 201006081334 | 1.300 | Samwise VA2 | Date: 2010-06-08 13:34:29 +0900 | Type 2 | 97 |
TA-091 | Go N1000 | 05g | 0x00720000 | 0x00304000 | 0x00000133 | 200904092125 | N/A | Strider | Date: 2009-04-09 21:25:55 +0900 | Type 3? | ?? |
TA-094 | Go N1000 | 05g | 0x00800000? | 0x0030XXXX? | unknown | unknown | N/A | Strider2? | Type 3? | ?? | |
TA-096 | Street E1000 | 11g | 0x00900000 | 0x00403000 | 0x00000154 | 201105092045 | 1.300 | Bilbo | Date: 2011-05-09 20:45:25 +0900 | Type 2 | 2F |
TA-097 | Street E1000 | 11g | 0x00900000 | 0x00403000 | 0x00000154 | 201105092045 | 1.300 | Bilbo | Date: 2011-05-09 20:45:25 +0900 | Type 2 | 2F |
Other boards
Along with TA-85 1-871-259-11:
- HP-142 1-871-260-11
- SW-510 1-873-421-11
Hackability
Motherboard | PSP Model | Generation | cIPL | Perma Patch | Temporary CFW (LCFW) | Create Pandora | Pandora Unbrick | Lowest Possible OFW |
---|---|---|---|---|---|---|---|---|
TMU-001 | DTP-T1000 and DEM-1000 | 01g | N/A (depends on kbooti.bin, cannot use Pandora cIPL only Kirk1) | (Use kbooti) | (Use kbooti) | N/A (battery is emulated) | N/A (use kbooti)
Emulated JIG mode (on kbooti 0.7.0 and later) when value stored at address 0xBFEFFFFC < 0 (Reset target with boot parameters 0x80000000 to enable using official tools) |
0.40 |
TMU-002 | DTP-H1500 and DTP-L1500 | 01g | YES (Use kirk1 or Pandora block) | (Use cIPL Instead) | (Use cIPL Instead) | N/A (battery is emulated) | YES (set P24 on the S3503 DIPSW to 1) | 1.50 |
TA-079v1 | Fat 1000 | 01g | YES (Use kirk1 or Pandora block) | (Use cIPL Instead) | (Use cIPL Instead) | YES | YES | 1.00 |
TA-079v2 | Fat 1000 | 01g | YES (Use kirk1 or Pandora Block) | (Use cIPL Instead) | (Use cIPL Instead) | YES | YES | 1.00 |
TA-079v3 | Fat 1000 | 01g | YES (Use kirk1 or Pandora Block) | (Use cIPL Instead) | (Use cIPL Instead) | YES | YES | 1.00 |
TA-081 | Fat 1000 | 01g | YES (Use kirk1 or Pandora Block) | (Use cIPL Instead) | (Use cIPL Instead) | YES | YES | 1.00 |
TA-082 | Fat 1000 | 01g | YES (Use kirk1 or Pandora Block) | (Use cIPL Instead) | (Use cIPL Instead) | YES | YES | 2.00 |
TA-086 | Fat 1000 | 01g | YES (Use kirk1 or Pandora Block) | (Use cIPL Instead) | (Use cIPL Instead) | YES | YES | 2.00 |
TA-085v1 | Slim 2000 | 02g | YES (Use kirk1 or Pandora Block) | (Use cIPL Instead) | (Use cIPL Instead) | YES | YES | 3.60 |
TA-085v2 | Slim 2000 | 02g | YES (Use kirk1 or Pandora Block) | (Use cIPL Instead) | (Use cIPL Instead) | NO | YES | 3.60 |
TA-088v1 | Slim 2000 | 02g | YES (Use kirk1 or Pandora Block) | (Use cIPL Instead) | (Use cIPL Instead) | NO | YES | 3.60 |
TA-088v2 | Slim 2000 | 02g | YES (Use kirk1 or Pandora Block) | (Use cIPL Instead) | (Use cIPL Instead) | NO | YES | 3.60 |
TA-088v3 | Slim 2000 | 02g | YES (Only 03g+ compatible block with load addr or xor hash exploit) | 5.00 M33-7
6.61 Infinity2 |
6.61 PRO-C or 6.61 LME-2.3 | NO | YES (Using DC9) | 3.9x/4.0x |
TA-090v1 | Slim 2000 | 02g | YES (Use kirk1 or Pandora Block) | (Use cIPL Instead) | (Use cIPL Instead) | NO | YES | 3.60 |
TA-090v2 | Brite 3000 | 03g | YES (Only 03g+ compatible block with load addr or xor hash exploit) | 5.00 M33-7
6.61 Infinity2 |
6.61 PRO-C or 6.61 LME-2.3 | NO | YES (Using DC9 and battery emulator) | 4.20 |
TA-090v3 | Brite 3000 | 03g | YES (Only 03g+ compatible block with load addr or xor hash exploit) | 5.00 M33-7
6.61 Infinity2 |
6.61 PRO-C or 6.61 LME-2.3 | NO | YES (Using DC9 and battery emulator) | 4.20 |
TA-091 | Go N1000 | 05g | YES (Only 03g+ compatible block with load addr or xor hash exploit) | 6.61 Infinity2 | 6.61 PRO-C or 6.61 LME-2.3 | NO | NO | 5.70 (05g) |
TA-092 | Brite 3000 | 03g | YES (Only 03g+ compatible block with load addr or xor hash exploit) | 5.00 M33-7
6.61 Infinity2 |
6.61 PRO-C or 6.61 LME-2.3 | NO | YES (Using DC9 and battery emulator) | 4.20 |
TA-093 | Brite 3000 | 04g | YES (Only 03g+ compatible block with load addr or xor hash exploit) | 6.61 Infinity2 | 6.61 PRO-C or 6.61 LME-2.3 | NO | YES (using official service mode tools 6.20) | 5.70 (04g) |
TA-094 | Go N1000 | 05g | YES (Only 03g+ compatible block with load addr or xor hash exploit) | 6.61 Infinity2 | 6.61 PRO-C or 6.61 LME-2.3 | NO | NO | 5.70 (05g) |
TA-095v1 | Brite 3000 | 09g | YES (Only 03g+ compatible block with load addr or xor hash exploit) | 6.61 Infinity2 | 6.61 PRO-C or 6.61 LME-2.3 | NO | YES (using official service mode tools 6.20) | 5.70 (04g) |
TA-095v2 | Brite 3000 | 09g | YES (Only 03g+ compatible block with load addr or xor hash exploit) | 6.61 Infinity2 | 6.61 PRO-C or 6.61 LME-2.3 | NO | YES (using official service mode tools 6.20) | 5.70 (04g) |
TA-095v3 | Brite 3000 | 07g | YES (Only 03g+ compatible block with load addr or xor hash exploit) | 6.61 Infinity2 | 6.61 PRO-C or 6.61 LME-2.3 | NO | YES (using official service mode tools 6.30) | 6.30 |
TA-096 | Street E1000 | 11g | YES (Only 03g+ compatible block with load addr or xor hash exploit) | 6.61 Infinity2 | 6.61 PRO-C or 6.61 LME-2.3 | NO | YES (using official service mode tools 6.60) | 6.50 |
TA-097 | Street E1000 | 11g | YES (Only 03g+ compatible block with load addr or xor hash exploit) | 6.61 Infinity2 | 6.61 PRO-C or 6.61 LME-2.3 | NO | YES (using official service mode tools 6.60) | 6.50 |