PSP Downgrade v1.0 Theory using 1.5 PSP ?

    by
    Zeus
    Published on 03-05-2006 12:04 PM
    18 Comments Comments
    Mathieulh claims to have a valid and working theory of downgrading to v1.0 firmware. He claims you will require a v1.5 psp in the first place as you need kernel mode to use scenand.



    quote:


    from every piece of informations I gathered, here is how the psp updater's elf work:



    from 0 to 1% overwrites the IPL using the SCENAND API (The IPL is locates within the data.psp file for updates prior to 2.00 and within the data.psar file in the form of a file called kboot.bin in the updates after 2.00, for the debug units it's given separately with the psar file and it's called kbooti.bin)



    Then the updater format the FAT12 flash0 drive to remove every current files on it and starts writting the flash0 files of the newer firmware using fat access thanks to the Scelo API .(that's from 2 to 98%) then from 99 to 100% it will create the new flash1 folders (if not existing) and update the system.dreg and ireg files.

    finally it reboots the vshell.



    All you need to create a nice 1.50 to 1.00 downgrader is to dump the 1.00 ipl, overwrite it in a 1.50 psp using the scenand API (don't forget to set scenandsetflag to 1 otherwise the nand will remain write protected) then use Scelo API to remove the 1.50 fw files, and then copying the 1.00 fw files from the MS to the flash0 drive, using fat access.

    Don't touch the flash1 you wont need to, the fw will generate a new one from himself.



    Here you know how to create a working 1.50 to 1.00 downgrader



    Don't worry the official sony updater doesn't touch anything else than the IPL within the NAND non fat area (I checked every single opcodes in it and I didn't find anything that suggest me otherwise)



    I hope I helped



    BTW you can also extract the IPL from the 1.0bogus decrypted data.psp (it's a copyrighted file so I can't share it howevever you can decrypt it using a regular 1.00 psp (1.50 wont work as it doesn't have the keys to decrypt it)) then copy the fw files from the 1.00bogus and you will have the first retail psp to ever run this firmware

    (the 1.00 psp were bricked using the untouched official 1.00bogus update from sony, because the updater didn't use scenand to overwrite the IPL as it was meant to be flashed in a debug unit psp and those use external kbooti.bin)



    Don't every forget, to each fw version his IPL, do not mix up a fw version with another IPL otherwise the psp wont boot !



    BTW Beware that this method still remain untested as you read those lines, however the chances for it not to work (according to the many analysis I have performed on most of the decrypted data.psp) is almost unexistant (there is still a few chances that I might be wrong or mistaken by some unknown factors and that my information wouldn't be 100% accurate but I highly doubt it)



    Using an 1.50 psp of course, as you need kernel mode to use scenand

    all I didn't know was how to format the flash0 fat12 partition so instead, I manually erased all the files using scelo and then copied every file using the same api form the ms to the flash0 drive (after overwritting the ipl).



    Then I rebooted the psp, and tadaa! 1.00

    in fact when you think about it, the way the official updater works is quite simple...but I had to be sure it didn't do anything such as changing the partition tables or modifying any other binaries within the non fat area before testing it on a psp to make sure it didn't brick.





    News Source: PS2dev.org and Mathieulh



    N.B please treat this as just a whacky theory only, no thorough testing has been conducted apart from on one PSP I am told.
    Comments 18 Comments
    1. lucifer316's Avatar
      will this allow us to play sfa3
      Reply
    1. kersplatty's Avatar
      1.5 has beter iso loaders
      Reply
    1. Piny's Avatar
      Quote Originally Posted by lucifer316
      will this allow us to play sfa3
      yes of course. and we can play xbox games.

      Reply
    1. japots's Avatar
      Quote Originally Posted by lucifer316
      will this allow us to play sfa3
      first it was GTA, now it's SFA3. You leechers are never satisfied.
      Reply
    1. zshadow's Avatar
      Quote Originally Posted by japots
      first it was GTA, now it's SFA3. You leechers are never satisfied.
      exactly, what is the deal with people that keep asking if SFA3 works. Its a 2.0 loader, 2.5 games cannot be expected to work (even if some do..).

      answering his question, no it will not allow you to play SFA3.

      SonyXteam come out with another useless post, although the concept of 1.5 -> 1.0 downgrading is interesting, we are at a point in the PSP scene where almost all homebrew devs compile their code for 1.5. So the whole point of 1.0 was to have easy "drag and drop" homebrew, but now everything is made for 1.5, so you'd need to convert it anyway.

      May be useful for some devs who wish to test their code on a 1.0, but for users I'd say its useless.
      Reply
    1. lucifer316's Avatar
      Quote Originally Posted by japots
      first it was GTA, now it's SFA3. You leechers are never satisfied.
      it was a joke loser hence the smiley face im poking fun at the new holy grail

      and im sure you own every game that you play for all systems right mister holier than thou
      Reply
    1. lucifer316's Avatar
      Quote Originally Posted by zshadow
      exactly, what is the deal with people that keep asking if SFA3 works. Its a 2.0 loader, 2.5 games cannot be expected to work (even if some do..).

      answering his question, no it will not allow you to play SFA3.

      SonyXteam come out with another useless post, although the concept of 1.5 -> 1.0 downgrading is interesting, we are at a point in the PSP scene where almost all homebrew devs compile their code for 1.5. So the whole point of 1.0 was to have easy "drag and drop" homebrew, but now everything is made for 1.5, so you'd need to convert it anyway.

      May be useful for some devs who wish to test their code on a 1.0, but for users I'd say its useless.

      whats with the people who question the usefulness of anything they have no immediate utility for
      Reply
    1. Mathieulh's Avatar
      Quote Originally Posted by zshadow
      May be useful for some devs who wish to test their code on a 1.0, but for users I'd say its useless.
      That's exactely why I posted it on ps2dev in the first place...
      Beside it's also interesting because

      -1.00 is more homebrew friendly (not everyone cares about iso loader)
      -1.00 is a rare firmware that would have disapeared soon or later, and having a way to get back to 1.00 from 1.50 might prevent 1.00 fw from disapearing.
      -Finally if you are an official psp devlopper it might help you to flash a debug firmware into a retail psp (I am sure many of them will be interested )
      -And as you said it, it's much more convenient for devloppers who don't have to use kxploit all the time or use the "make kxploit" command
      Reply
    1. JAMESBDX's Avatar
      salut mathieu, on entend plus parler de ton pote yoshi. pourtant il a créé tellement de choses... le 2.0 downgrader , le firmware changeur qui ne servait a foutre rien , le loader de jeux , la terre en 6 jours , putain il etait trop fort. t'as de la chance d'etre associé a ses "créations"
      Reply
    1. Mathieulh's Avatar
      Quote Originally Posted by JAMESBDX
      salut mathieu, on entend plus parler de ton pote yoshi. pourtant il a créé tellement de choses... le 2.0 downgrader , le firmware changeur qui ne servait a foutre rien , le loader de jeux , la terre en 6 jours , putain il etait trop fort. t'as de la chance d'etre associé a ses "créations"
      Et toi, qu'est ce que tu as fait pour la scene psp ? A ma connaissance rien, arrête de critiquer tu vaux pas mieux que le reste des noobs sur la scene.

      Oui Yoshihiro est un developpeur respectable et respecté de nombreux developpeurs, moi inclus, mais aussi d'autres comme tyranid, nem etc etc..

      Et en effet je suis fiers d'être associé à ses créations...
      Reply
    1. JAMESBDX's Avatar
      je n'ai aucune pretention de developpeur. j'avoue que j'aimerai pouvoir mais mon travail me prends trop mon temps malheureusement. je respecte toutes les personnes developpeurs ou testeurs qui contribuent a la scene psp. je fais donc partie des testeurs qui ont participé a la scene psp (regarde bien j'ai été le premier a découvrir comment jouer a certains jeux). je te signale que sans les testeurs de programmes comme moi et tant d'autres, on jouerai pas a autant de jeux, on aura pas autant de modifications interessantes sur les programmes homebrew etc etc. j'adore qu'on me traite de noob car 1) ca ne veut strictement rien dire. 2)je considere avoir aidé la scene en partageant mes decouvertes et mes connaissances.
      j'ai du mal a respecter yoshi car meme si c'est un programmeur (et je suis daccord c'est un programmeur) il a annoncé beaucoup de conneries dans le passé. je suis "simple" testeur mais je n'avance jamais rien sans etre sur de ce que je dit.
      Reply
    1. Zeus's Avatar
      Please keep the written language to English.

      Thankyou.
      Reply
    1. JAMESBDX's Avatar
      Quote Originally Posted by Zeus
      Please keep the written language to English.

      Thankyou.
      sorry. there wasn't anything worth translating anyway, i'll stick with english from now on.
      Reply
    1. Mathieulh's Avatar
      removed because I don't want to bother to translate
      Reply
    1. byteworkz's Avatar
      Hmmm I think it's pretty useless to, but just a great "have"
      -Bytes
      Reply
    1. cory149's Avatar
      Am I the only one who was missing this point?

      One obstacle I have seen constantly in many of the forums is the fact that the crypt on the eboot.pbp update files is stopping some from looking into making custom firmwares. (we cant do custom firmware because we only have the public keys yadda yadda)

      Knowing how to write the IPL and flash files properly without using the private crypt key is yet again another step towards such a thing; being able to downgrade to 1.00 is great as the 1.00 beasts are indeed rare, being able to use the knowledged gained by doing so is ... priceless (cmon, who wouldnt want to add a custom debug firmware to be able to see whats really going down inside that homebrew their developing on their PSP, without having to code the it into the program every time?)

      Just the fact that they are indeed trying to understand it, experimenting on expensive PSP's and such ... well, my hat is off to you diehard hardware hackers, without you all homebrew on the PSP would not exist (although, were that the case we wouldnt have people looking to play SFA from a iso; and no, not Street Fighter, Sweet Frack All )
      Reply
    1. delt31's Avatar
      Quote Originally Posted by japots
      first it was GTA, now it's SFA3. You leechers are never satisfied.
      Actually it was always SFA3 for me.
      Reply
    1. DaWaN's Avatar
      This is pretty usefull for a future downgrading. Because we can't simply overwrite the index.dat on >2.50 firmwares. If a flash acces is found on >2.50 firmware we could downgrade that firmwares too. Nice ain't ?
      Reply