Donate
01
September
September
As an ongoing project, me and some1 have been enhancing this downgrader from birth on the 6.31/6.35 firmwares. This multi-firmware downgrader allows you to install a lower (or higher) firmware without any fuss. No complex flash0 sharing, just running the firmware update.
However, there comes restriction with PSP models and compatible firmware. For example, a PSPgo cannot run 1.50 as there are no drivers for the system and the IPL format is incompatible. Much like this, the PSP 3000 09g is unable to install firmwares < 6.30 which removes it’s ability to appreciate the flexibility of permanent custom firmware.
This is no longer the case.
It started off with rumours of 09g systems being “converted” to 04g systems with some sort of Sony equipment. I explored the firmware comparing 04g and 09g and there is little difference between the modules, so I looked into what makes a 04g and 09g different. I got various testers (named below) to give me information on their IDStorage and internal system data (baryon/tachyon). From this I can conclude that the only (effective) difference between a 04g and 09g is:
- Idstorage Certificates
- Baryon Version
Nothing more.
Now, it was time to see what it did with these values. I looked up the Idstorage certificates, it’s used in Chkreg and used internally to generate a model number. I found out that 6.20 and 6.39 sets the model of 09g to 04g, lovely.
The big game was the value that is returned from sceKernelGetModel(). Where is this taken from? Well, rooting back from the IPL, there is some code used to determine the model. This code used some strange code which turned out to be syscon code to obtain the Baryon version! The model number is determined from the Baryon.
Here is a little explanation of the Baryon version. When shifted 16 bits to the left, the least significant byte is the data used to determine a model number. the most significant nybble contains the SKU (PHAT, SLIM/3000, GO) and the lower specifies the model of that SKU. However, it got me thinking… Sony don’t know how many revision they will produce in the future. Checking 6.39 firmware, Sony does this: [0x2C -> 0x2E] = 04g, [0x2E -> 0x30] = 09g. Rightfully so, the Baryon version from the 04g’s I had was 0x2C and the 09g had 0x2E. Then i though, if they didn’t know the future, then what does 6.20 IPL do? After analysing I found this: [0x2C -> 0x30] = 04g.
So, if for some reason you find your 09g on 6.20, the IPL is gonna think it is a 04g. Ok, we can work with that, Chkreg sets the certificate based model to 04g and the IPL sets Baryon based model to 04g. Now, lets get some 04g firmware in there!
After a bit of thought, I was sitting at the Downgrader source thinking “how can I install 6.20 on a 09g”. Obviously, run the update and spoof the model. However, changing sceKernelGetModel() did nothing. The model must be determined by some other way. So, 123 and I find Baryon code, yay. Once again, the 6.20 updater has the 09g Baryon as a 04g so if it could run on it’s own, it will flash 04g modules. But why did it error?
IDXFFFFFFFF. That’s the error, it’s to do with error opening INDEX.dat. Wait, a second, why is this happening? Oh wait, it thinks it’s a 04g, so it’s looking for index_04g.dat, doh!
Now, we got a new error. This is weird, it originates from a module called “sceChkuppkg”. Heh, cool. After a brief look at the internals a wild idstorage certificate check appeared. It checked a PSAR block against a list of data composing a PSCode. Easy fix, now the 6.20 could run. Once it had run, it rebooted.
Then it bricked.
Yes i fucked up. By only hooking the usermode version of “sceChkuppkg” caused the updater to validate the blocks until it started to do something important… like read the rest of the firmware after wiping flash clean. Everybody, thank “Gamefreeak100″ for the first brave and bold steps into a 09g permanent patch world, he sacrificed his PSP for it.
A lot of reading later, I identified the problem, fixed it and handed it to another brave tester. This time, it worked! 09g was running firmware 6.20 and for the last 12-ish hours it has been running fine. It retains the ability to update to >= 6.30 and seems very stable!
A word of advice though, this is still experimental. The idstorage certificates do NOT belong to a 04g PSP and upgrading and downgrading from
This would not be possible without the combined efforts of:
- some1
- Gamefreeak100
- Chris10Lyn
- snailface
- XxGodOfWar2xX
- mint
- ponso21
- Ryone
- ROE-UR-BOAT
- diggory
- Yoti
Give them all thanks! Leave a comment if you think you should be here!
499 Responses
Stay in touch with the conversation, subscribe to the RSS feed for comments on this post.
-
-
my initial firmware as you can see was 6.39..I´ve update to ofw 6.60 and i,ve been playing with 660PRO and 660FastRecovery..then I uninstalled this low cfw,I had been tryng several times with downgrader v.5 with the error IDXFFFFFFFF, but, at last,I run the Davee downgrader version 5f and all works fine.thanks from Spain
Fri 27th January, 2012 at 10:25 BST -
“at last,I run the Davee downgrader version 5f and all works fine.thanks from Spain”
without suspend bug????
Fri 27th January, 2012 at 10:39 BST
ur psp is like mine
http://imageshack.us/photo/my-images/202/dscn3857s.jpg/ -
NO, No, My psp works fine after downgrading, but WITH the suspend bug, Of Course..
Fri 27th January, 2012 at 12:13 BST -
Does anybody have a 07g model? I’m pretty sure it is unsupported, but hey, ill take another look
Fri 27th January, 2012 at 12:48 BST -
!!!!!!!!!!!!!!!!ATTENTION!!!!!!!!!!!!!!!!!!!!! (Even for Devee)
Sun 29th January, 2012 at 08:48 BST
!!!!!!!!!!!!!!!!ATTENTION!!!!!!!!!!!!!!!!!!!!! (Even for Devee)
Hey Guy! I discovered a method to put in suspension from the PSP XMB…. It is currently the only one I found ….From the “XMB”, start the “VSH” menu by pressing “select” and set the CPU frequency to “20/10″, then wait a few seconds and raise the power levers …. and the PSP will get suspended … Just as we put the frequency in “20/10″, the next time the PSP gets lag …..
!!!!!!!!!!!!!!!!ATTENTION!!!!!!!!!!!!!!!!!!!!! (Even for Devee)
!!!!!!!!!!!!!!!!ATTENTION!!!!!!!!!!!!!!!!!!!!! (Even for Devee)
Maybe can be useful …. -
Ok, so for me it’s clear now.
My PSP is 3004 TA-095v2 09g OFW 6.60I need to understand something about the 5f downgrader.
Where do I find the 6.60 04g OFW?! So that I can downgrade from 6.60 09g to 6.60 04g.
Is it ok to use the 6.60 LME so that I can run the 5f Downgrader?
After downgrading to 6.60 04g I have to attempt to downgrade to 6.20 OFW and afterwards to use the permapatch, correct?Tell me if I missed anything.
Thanks!
Tue 31st January, 2012 at 12:22 BST
K -
!!!!!!!!!!!!!!!!ATTENTION!!!!!!!!!!!!!!!!!!!!! (Even for Devee)
Tue 31st January, 2012 at 16:40 BST
!!!!!!!!!!!!!!!!ATTENTION!!!!!!!!!!!!!!!!!!!!! (Even for Devee)
Hey Guy! I discovered a method to put in suspension from the PSP XMB…. It is currently the only one I found ….From the “XMB”, start the “VSH” menu by pressing “select” and set the CPU frequency to “20/10″, then wait a few seconds and raise the power levers …. and the PSP will get suspended … Just as we put the frequency in “20/10″, the next time the PSP gets lag …..
!!!!!!!!!!!!!!!!ATTENTION!!!!!!!!!!!!!!!!!!!!! (Even for Devee)
!!!!!!!!!!!!!!!!ATTENTION!!!!!!!!!!!!!!!!!!!!! (Even for Devee)
Maybe can be useful …. -
Frostegater has released a pre-downgrader!
Wed 1st February, 2012 at 11:36 BST
Now no error at all!
And a fix for the sleep mode.
http://psdev.ru/ -
-
Oh dear.
Well done to Frostegater, but I do not recommend running the “Pre-Downgrader”. It involves manipulating IDStorage key 0×51, which contains the factory firmware. This key is “signed” to each PSP individually and this code does not resign your key.
This means a future update can render your PSP inoperable by Sony enforcing a simple check on the signature at boottime.
I am not sure if we can regenerate this key at all, but if we cannot, and you lose it. It is gone forever. So either backup your Idstorage keys before running this program or don’t run it.
Wed 1st February, 2012 at 16:40 BST -
I should clarify that the chance Sony does that is low, but better safe than sorry. Just backup idstorage and you’ll be ok.
Wed 1st February, 2012 at 16:55 BST -
Sleep-Fix does not work …. : \
Wed 1st February, 2012 at 17:18 BST
Works in the XMB while in games and PS1 games do not …..
My rate is 222/111, and even if I put the Defolt does not work ….
My FuseCFG is 0x00002A00 …..
But noting the frequency with a plug-in game 333/XXX I do (I do not remember xD)
Solutions? -
I successfully downgraded my PSP 3006 09g from 6.35 OFW to 6.20 OFW and it’s currently running on 6.20 PRO-B10 Permanent CFW. It’s been 24 hours since the downgrade and I still can’t find any bugs or any problems. I can’t even find the suspend/sleep bug. I think my PSP is perfect.
Changelog:
Generation: It went from 09g to 04g. I checked this through PSP Everest v2.0 by Frostegater
Photos
Before Downgrade:
http://www.mediafire.com/i/?xo8kuhrsc8yu5qoAfter Downgrade:
http://www.mediafire.com/i/?c96bc2h9gx2j396Hope I helped!
Fri 3rd February, 2012 at 08:20 BST
-
Davee, I not erase and write new 0×51 key. I only edit first 4 bytes of 0×51 key. Also I see some PSP’s without 0×51 key. For it PSP’s I create new key.. Sorry for my bad English.
Fri 3rd February, 2012 at 12:43 BST -
I would like to report a bug in “camera”. The application crashes after about 30 seconds.
Sat 4th February, 2012 at 08:48 BST -
Hi all last time i have the same bug IDxFFFFFFFF , next i use downgrader from Dave version 5.0F and my psp succesifoul downgrade 660-620 now i have 660 pro b10 perm
THANX DAVE FOR U TIME
3004 09g data code 1C now is —-> 6.20
Sry for my English im from Poland
Sat 4th February, 2012 at 12:35 BST -
Does anyone know how to combine pro cfw with sleep-fix plugin???
Wed 8th February, 2012 at 12:01 BST -
Hello, wonderful work out there! The downgrader v5 worked successfully for me without the IDXFFFFFFFF error (6.60 > 6.20). However, it didn’t go so smoothly afterwards, I cannot update to 6.20 PRO b5/b9/b10.fix, they run but then it’s the black screen of death. I also tried to use Frostegater’s upgrader to go back to 6.60, on hitting the button I get “This game cannot be started. The data is corrupted.” I tried several 6.20 CFW and TA-095 09g upgraders (same version, but different download sites) no success at all. Since I depend on ISOs,I cannot play any games now. This problem is out of ordinary and of course I take full responsibility for trying, but please HELP (PSP 3001 09g)
Wed 8th February, 2012 at 17:02 BST -
Ok for those concerned about my case, I was successful in installing 6.20 TN-B (HEN). I’m going to try reading an ISO using OpenIdea ISO loader.
Thu 9th February, 2012 at 13:26 BST -
For those concerned about my case, I was successful in installing 6.20 TN-B (HEN). I’ll try to read an ISO soon using OpenIdea ISO loader. “Crossing fingers!”
Thu 9th February, 2012 at 13:30 BST -
Okay people hear me out!
OpenIdea loader didn’t work so I tried Prometheus and it worked. I was able to play ISOs again.
Then my hands pained to try 6.20 PRO b10 (I was on 6.20 TN-B, try me on that), and that worked!
I switched off, went for fast recovery, it worked like no glitches at all. So no need to use any ISO loaders!
I would also like to mention Frostegater 095 09g upagrader also works (I was on 6.20 TN-B)
So people with similar trouble like me, no need to say twice!!!
Epilogue: I downgraded because of “random encounter crashes” in Dissidia 012 Duo (USA Fix) 6.35/39/60 even with sony#### iso mode, it could still crash with any enemy. But with 6.20 (TN-B or PRO [inferno iso mode] CFW) no crashing!!!!!!
It was an old CFW way less flexible than PRO-B that helped. Nice day!
Thu 9th February, 2012 at 14:47 BST -
-
thank you davee for your hard work
Wed 22nd February, 2012 at 18:40 BST
finaly my psp 3004 slim 09g model get downgraded to 6.20FW -
hey just asking if any one has a way to upgrade from 6.10 on my 3000 after i downgraded with a wrong firmware a sit had posted as 6.20
Thu 23rd February, 2012 at 02:02 BST -
-
davee right now im in 6.20 when i want to update to 6.60 it say
Fri 24th February, 2012 at 11:51 BST
(psp update cannot be started data corrupted IDXFFFFFFFF)
help -
-
@rashid u need to have installed cfw on ur psp first ( 6.20 B10 should be fine), then try to use TA095 upgrader by frostgater before u start to upgrade ur psp (work on mine).
back to 6.60 for now cant hold with the suspended bug..
my hardware information
http://imageshack.us/photo/my-images/853/pspident000c.png/@jammer i feel sorry for you 3000 with 6.10 aww too bad, 3000 isn’t fully hackable yet, to downgrade from 6.10 u need pandora,as far i know that just for psp 1000 or 2000 at this moment. well i think u need to be more patient, hope 5.1 can resolve ur prob
sorry for my bad english
Sun 26th February, 2012 at 12:21 BST -
@immortalityking i hope 5.1 can help me does any one know a release date
Sun 26th February, 2012 at 18:47 BST -
-
Hey my PSP is just collecting dust so can 5.1 be released soon don’t want my PSP to be a dust bunny farm any more
Wed 9th May, 2012 at 01:53 BST -
hmm…i still have this guy’s problem :
http://www.youtube.com/watch?v=hrXFvCZzYuk
should i just sit back and wait for the new version…or is there a way around this problem ?
Tue 21st August, 2012 at 03:35 BST -
hello,
i have psp 3006 (slim) 09g
Sun 26th August, 2012 at 04:44 BST
when using the downgrader..it says IDXFFFFFFFF error file corrupted
first i think maybe because it 6.20 (i really want the permanent patch) after that i give up and try 6.35 just for experiment..and than it says no need to update…pls help me -
i use the chronoswitch downgrader v5.0f (but when use it, it says v5.0b)
if u know the answer plssss contact me at http://www.youtube.com/user/crackerzWave
Sun 26th August, 2012 at 04:47 BST -
I’m hacking my PSP and this would never happen without you guys. Thanks
Thu 1st November, 2012 at 00:58 BST -
-
Hi..
I’m hoping that the version 5.1 be released..
itching to have permanent patch with my psp3000 9g
Sun 16th December, 2012 at 17:12 BST -
Trying to downgrade a PSP-3001 (TA-093 04g mobo) with OFW 6.60 to OFW 6.20
Sun 13th January, 2013 at 15:13 BST
I’m getting a (CAAFFFFFCF7) error while using Chronoswitch Downgrader v5. -
PSP won’t update from 6.20 to 6.60 ever since I used Chronoswitch Downgrader to downgrade to 6.20?
Fri 15th February, 2013 at 11:11 BST
So I figured it would be neat to hack my 2 PSP 3000s so I used Chronoswitch Downgrader to downgrade from 6.60 to 6.20 after that I installed the PRO B10 hack to the PSP then I installed the permanent boot loader patch for PRO B10 then I decided I wanted to take it off and so on my first PSP I first uninstalled the permanent patch then I uninstalled the PRO B10 and it worked perfectly and I was able to update my firmware back to 6.60 but on the second PSP I uninstalled the PRO B10 hack first instead of uninstalling the permanent patch first like I did on the other PSP and ever since then I’ve tried downloading the 6.60 firmware from the internet then downloading it to my PSP and booting it from the game section and that didnt work I got this The update cannot be started. The data is corrupted. (IDXFFFFFFFF) SO after that I tried using the built it System Update Feature and i tried Update via Internet and I got connected to the internet but then I got Connection to the server could not be established. (20000006) So if someone could please give me a solution to how to get back to 6.60 that would be GREAT! Because I sold this on eBay and need to get it shipped out soon! Thanks! -
whoah this weblog is magnificent i love reading
Sun 17th February, 2013 at 19:38 BST
your articles. Keep up the great work! You already know,
a lot of people are searching round for this information, you
can help them greatly. -
After looking into a number of the blog posts on your web page, I honestly like your technique of blogging.
Sun 31st March, 2013 at 13:27 BST
I bookmarked it to my bookmark website list and will be checking back in the near future.
Please check out my website as well and let me know how you feel. -
Thank you for sharing your info. I really appreciate
Fri 5th April, 2013 at 02:50 BST
your efforts and I am waiting for your further write
ups thanks once again. -
Oh my goodness! Impressive article dude! Many thanks, However I am experiencing
Wed 10th April, 2013 at 05:10 BST
troubles with your RSS. I don’t understand the reason why I cannot subscribe to it. Is there anyone else getting identical RSS issues? Anyone who knows the solution will you kindly respond? Thanks!! -
hello! i have psp 3004 with 6.60 9g, want to downgrade it, every time i try to run chronoswitch downgrader it works ok but before start the downgrading it comes up with error.
Fri 19th April, 2013 at 12:26 BST
(A later version of the system software is already installed. There is no need to update (CAAFFFFFCF7)).
please help me………! -
-
why giving idfxxxx error?
Wed 22nd May, 2013 at 11:17 BST
i dont understand
using
psp 3001
09g
ta95v2 -
I’ll right away grab your rss feed as I can’t in finding your email subscription link or newsletter service.
Thu 30th May, 2013 at 22:28 BST
Do you’ve any? Please allow me recognise so that I may subscribe. Thanks. -
Excellent post however , I was wanting to know if
you could write a litte more on this topic?I’d be very thankful if you could elaborate a little bit further. Appreciate it!
Mon 3rd June, 2013 at 03:41 BST
Sorry aain..I think that the information you need is not from system information..her you have the hardware information:
Fri 27th January, 2012 at 10:18 BSThttp://imageshack.us/photo/my-images/202/dscn3857s.jpg/