Downgrading : Experimentation

[F9zDark]

I have aquired, through alot of searching the original Japanese 1.50 update. I figured that by having this I could simply change the SFO and run the update. Well to no avail.

Originally, using this method, I got an error saying that the data was corrupt. Now I assume this was from the faulty SFO.

So, using the same EBOOT with the altered SFO file, which was changed to title the Update as 1.52 and the Required firmware of 1.51. I loaded that onto on memory stick and then on another loaded the original 1.50 update from Japan.

I started the altered EBOOT file and as the PSP screen showed up, I popped in the memstick with the original 1.50 update. It loaded the update, showing the standard updating screen but then gave the error : "A later version of the system software is already installed. No need to update."

Now this got me thinking of two things. 1)There may be a cross check of the SFO again, to ensure the data within the EBOOT file. This would explain why an SFO file can be altered to allow for an update or to make the system say an update is required. Or 2)The DATA.PSP may contain information that checks for system information.

From these tests I believe that perhaps the data.psp file is executed first. Being smaller, it would most likely contain the code for starting the program and executing the data contained in the data.psar file. I cannot imagine that the information inside the PSAR file is not responsible for what is written to the flash.

While this may be a small step towards downgrading, I am not giving up yet and plan on testing this with the actual SFO from the 1.52 update. If that does not work, I plan on testing again with the DATA.PSP from the 1.52 update and the DATA.PSAR from the 1.50 update.

I will have the results soon enough. :)

[Fluff]

i highly doubt the update checks only the sfo of the update program :)
it's quite possible that when its ready to unpack, it checks the version number of the unpacked update files before flashing, in which case this method will never work.

Before you jump on the 'i know lets replace the files with xxx firmware dump!", it has been tried, and bricked many psp's

[F9zDark]

Not firmware dump. Actual Firmware update. That is the key difference, hence why I thought it might work without making a PSP a fancy paper weight.

I do not doubt that it double checks somewhere. I am thinking it checks in Data.PSP. As I said from my speculation before(I wish I could test this). If was able to some how decompile the .PSP and .PSAR files and see whats going on in them, I could certainly make some more headway. But I believe for now, that may be impossible...

[F9zDark]

I tried again today, using the JP 1.52 update SFO incorporated into the JP 1.50 update PBP. Got a similar error as though I used an altered SFO.

Apparently the SFO is cross linked into the other files, therefore completely nulling attempt to jerry rig a downgrade without .PSP and .PSAR compilation meant to physically downgrade.

[Roscco]

A guy over at psphacker.com has been trying to figure out how to run stuff on 1.5x he also speculates about the DATA.psar file being used for more than we think, here is some of his post talking about why unsigned code will run on 1.50 but not 1.51

I think i know why.... everyone that have the 1.51 psp says that they get an error: Game could not be started (80020148) and i searched google and this 80020148 code means that the PSAR file is missing. And i think it have something to do with the error cuz homebrew PBP files doesnt have this PSAR file but the Games authorized by sony have!
Did i say too much?


Man, te 1.51+ check for the <<Data.PSAR>> and this is the problem!
If only we could decode one Data.Psar and see how it works...

hope this helps

[fashidus]

hope is lost...

[F9zDark]

It isn't lost. We know what is written to the flash during the update process. We have dumps of these firmwares as they are written. That is part of the puzzle.

The second part would be to retrace these steps, using what we do know about the PSP's devices(flash0: for example). And see how we can write our own 'updates'. No doubt Sony has got us beat at the moment.

But hope isn't lost. It might be possible to use the Swaploit or Kxploit to 'downgrade' but we cannot downgrade from 1.5 to 1.0 without bricking our PSPs. At least for the time being.

[johnequickiii]

Since the PSP looks for an updated or more recent version of the firmware when you try to load it, Why don't you rename everything about the 1.5 firmware file to something like 1.53 or something? Since it looks for a newer version, you can give it one.

Not sure if it'd work or not, just putting it out on the airwaves.

Also, something to think about. How come no one's began an online petition yet to petition Sony to rethink their position on Homebrewers? Maybe with enough of a voice, (signatures and comments...), the Homebrewing community could go about their duties without all this opposition from Sony.

[PompeySteve]

I think the proliferance of UMD loaders / ISO launchers has killed any prospect of Sony softening their stance on homebrew.

[Èl Nächó]

Since the PSP looks for an updated or more recent version of the firmware when you try to load it, Why don't you rename everything about the 1.5 firmware file to something like 1.53 or something? Since it looks for a newer version, you can give it one.

Not sure if it'd work or not, just putting it out on the airwaves.

This idea has been "out on the airwaves" since before 1.51 was even released when people were trying to downgrade 1.5s to 1.0s. If it were that simple, don't you think someone would have done it by now?

Also, something to think about. How come no one's began an online petition yet to petition Sony to rethink their position on Homebrewers? Maybe with enough of a voice, (signatures and comments...), the Homebrewing community could go about their duties without all this opposition from Sony.

There's already one. There's even a thread about it here.