PSP 3.03 降级程序发布

月神侠

原创于NWBBS，未经原作者同意，严禁任何形式转载，违者将负法律责任！
; e7 G2 I( W( W0 S5 n3 \/ t■ 　■┅┅┅┅┅┅┅┅┅┅┅┅★
■● ■ 　 www.NewWise.com
  _# U' A1 D$ ^' {$ w9 T. R* x■ ●■　　 站友月神侠原创
' v# c3 r: `% y& U■ 　■┅┅┅┅┅┅┅┅┅┅┅┅★
3 s7 k- l# ~. \$ P
  b- _3 [1 A) Q8 a) z' M% u
PSP 3.03 降级程序发布！！

3 X! b8 R2 q- C+ i2 A: a刚才Team Noobz 发布了 3.03 降级程序，从此结束了3.03用户的噩梦，也昭示着 PSP 这部跨时代掌机全线破解！从2.71降级，到2.71SE,到 3.03OE-B, 到同期的TA-082/086降级程序，再到现在的3.03 Downgrader，破解的速度可谓 Sony 主机中最快的，而且破解的方法是最让用户省钱的（当然那些一点动手能力都没有的土鳖除外）

4 L% Y5 U/ B1 V总的来说，你需要原版的GTA: Liberty City Stories UMD. 3.03 降级程序，以及 1.50 的官方升级 EBOOT 文件。还有，目前你只能从 3.03降级到1.50，然后你可以选择是留在 1.50 用 Devhook；或者是刷成 3.03OE。不要做 “从 3.03 降到 1.50,然后又升级到 3.03，再使用这个降级程序”这种事情，因为目前你这么作的结果就是把你的PSP变砖。Noobz.eu 还在研究一个清除程序来改进这个降级程序产生的垃圾文件。所以，千万不要做傻事。

下载: * PSP 3.03 降级程序

+ X6 J9 V) r6 p+ P8 B0 _* 1.50 的官方升级 EBOOT 文件
/ s! m- s' M' s# Q' _
0 C$ |/ c5 g2 U- B% q6 p* 3.03 的官方升级 EBOOT 文件（如果你的PSP版本不是3.03,也可以尝试先更新到3.03再降级）
9 w" c, A4 b: _3 K6 f: I
/ _, j% F' J, J! r8 f! `* Homebrew Enabler for 3.03 FINAL
& ^$ O5 t. O5 ]9 x! c

0 P- S; k$ v) D8 A; W, B以下是操作步骤:
3 L5 L) }. ]& Z% h
1 - 如果你的版本是 3.03 那你可以跳到第六步
, {2 e$ z  f9 w" e5 o& O: M% a
2 - 下载 3.03 更新文件

. A! B. Q1 R- `0 c& V3 - 如果是压缩文件就解压缩一下，然后放到 MS0:/PSP/GAME/UPDATE

4 w5 l; f: E$ \9 O4 - 在 PSP 里，到 GAME 菜单下运行 3.03 UPDATE

5 - 完成后，删除 MS0:/PSP/GAME/UPDATE

6 - 把解压好的 3.03 降级程序压缩包内的 MS_ROOT 文件夹下的所有文件复制到记忆棒根目录
" e, T4 [0 {$ v* L" F, h( A- S
( U: ]) m  h# [1 t5 n8 F/ s7 - 把 1.50 升级文件（EBOOT.PBP）改名为 UPDATE.PBP 并复制到 MS0:/PSP/GAME/UPDATE/ 切记改名，不然会覆盖降级程序的文件。

8 - 运行 GTA LCS UMD
7 T3 b: \4 U9 g& c% ^. u
: ~7 E3 g: ^* p$ Y# \# Q3 d* _9 - 它将尝试载入游戏进度，然后屏幕会变黑接着会变浅绿色，然后 PSP 会自动重新启动 (如果没有，那么请往下看）

10 - 在 SYSTEM SETTINGS 里面，进入 “SYSTEM INFORMATION” 确认一下版本号，显示的应该是 3.03 HEN
/ V; p3 z5 p8 b% b$ m( ^2 l
11 - 如果版本号是 3.03 HEN，进入 Memory stick 菜单，运行 x.yz
1 ?. ?0 Q- \! [
) z: z, W$ o' c, j12 - 如果你的 PSP 的硬件版本是没有打过补丁的 TA-082 或更高的版本，那么降级程序将会提示你需要给你的主板打补丁而令这个降级操作更安全。你要选择允许，否则降级程序不会在没有在你允许它打补丁的情况下继续下面的操作。

13 - 降级程序会在对 PSP 进行任何危险操作的时候都会询问你的许可，如果你现在反悔了，那么你可以按 R 键退出。
% r. _- ^1 D3 h8 p2 x
14 - 一旦你同意进行降级操作了，千万不要做出拔掉电源或者重新启动之类的蠢事。

15 - 完成后，降级程序会要求你按下 X 键来重新启动 PSP。

5 [, N* `9 S. e* S& {/ Y! b16 - 如果启动后遇到12国语言蓝屏，按 X 继续。这意味着你要重新输入你的网络设置。如果没有出现蓝屏，那你可以跳到步骤 18.
/ {3 c! V$ H) H+ E- E
6 [) J4 p1 }! P2 ^! u6 U3 {: M17 - 完成第 16 步后进入 PSP 主界面，运行降级程序自带的 NetConfigBackup，并选择 Restore，它就会把在降级过程中读取到的网络设置信息写回到PSP里。
1 O; g, v% F  z- ^, D3 g
18 - 完成了 . 你现在已经有一台 1.50 PSP 了。好好享受吧。

以下为Noobz.eu的原文：
7 I8 q2 S' n4 w1 Z8 j5 JHomebrew Enabler for 3.03 FINAL  by Noobz / Dark_AleX
-------------------------------
. f1 [9 G+ u. B6 K
NOTE: This is the official final released version of 3.03 HEN.  An
      earlier testing version was leaked, and we do not recommend
      using that one.
; ?  U+ l, V$ _" `( y; T9 V, K* H
1 E% w( }' A% S* C9 qThis program enables homebrew and downgraders to be run on 3.03 using the original version of GTA.
" ]; m/ }- Y& u' OIt makes a patch that remains permanent until hardware reset. Sleep mode won't remove the patch.

This is based on the source for HEN 2.71 provided by Dark_Alex, thanks for the code and the help.

9 o# ~  K$ \  B$ M0 q( D) CNote: this program writes some small files in the flash, ONLY the first time is executed.
It does NOT rewrite any existing file in the system, it writes new files, so the probabilities of
* C; i9 y' d! F- L5 E' [bricking are practically null.


Instructions
( d8 p1 O- U& w# u' f------------
3 a( K+ s" h( j
- Copy all contents inside MS_ROOT to the root of your memory stick.
9 \# |2 Q% i7 Z$ W- Load GTA
3 y: L7 ]# [6 _0 k* k: G- q2 n- If the PSP freezes try again
- j' [' X1 r$ c9 O) G; r- When you run the program, you'll see a coloured screen that can be one of two colors:
8 T. ]2 G3 _. i- N, H1 g  * Red: the files couldn't be written to the flash (it happens a few times). Just keep trying.
; [  h0 e# O9 v6 W8 ~: F  w) S) J' Q  * Pale Blue: The files were written succesfully, and HEN is active. After that, the xmb will
( @" u1 [, f9 _- X3 i$ Q7 Q, z! }) |    be rebooted. Now you can run the homebrew in format prepared for 2.71. (see details below).
* W& S( @7 B7 _9 Y6 Z  l, Z    Note that a pale blue screen will appear again every time the PSP reboots with HEN active.
* o) C( Y( C# p1 T- w
: L8 e2 j3 e& T2 `+ O/ Q8 {- As mentioned before, the patch will remain resident in memory, and even entering sleep mode
" u2 l7 ~% D, a$ f6 t9 v7 c- o, r5 Y  won't delete it. Only a hardware reset will remove the program from memory.
* m# ?% a- [- s$ J) n& s
- When you do a hardware reset, you'll have to run GTA again.
  This time there will just be the pale blue screen and xmb reboot, since this time there is
  no need to write to the flash.

Note: Ensure that you leave the PSP/HEN_303 and PSP/SAVEDATA directories that are used for HEN
as some of the files are used each time you enter HEN.
/ `* j  ~% I3 a0 `' e7 gNote2: Once the program is loaded, it is independant of the memory stick contents. So you can
6 ^# d, ]9 ]! @. z- E+ gfreely swap memory sticks.
) r1 @0 u! g3 _( A

" k& C. l# Q6 o! a$ m! QNotes about homebrew running
-----------------------------

" z+ G2 u( G6 D+ a# D- Current homebrews are not supported. Since current homebrews are in static elf format,  they
) m0 n& i2 Y+ |& w, T! @  won't run (they are rejected by the 3.03 kernel). Homebrews for 3.03 have to be in prx format.
$ x% h3 X: m4 Q8 f  Programmers see the programming notes.
  In future versions i may patch the kernel to allow it to accept static elf's.

3 s5 R4 P! J- l6 d8 n- You can try using the PatchSFO tool from www.noobz.eu to patch homebrew to HEN format.

- There are some samples in the "GAME" directory, all of them ported from the pspsdk samples,
  except the nanddumper written by Dark_AleX.

$ b) h' c8 u* P9 [* polyphonic, pspsdk sample (user mode).
4 U6 c8 [# d& m  S$ m3 M: t* cube, pspsdk sample (user mode). It shows a cube rotating.
( z8 r3 F$ ~9 w, S! `% i" b! _* kdumper, pspsdk sample (kernel mode). It dumps kernel memory to the memory stick.
5 R7 g6 E& e- t* ipldumper, pspsdk sample (kernel mode). It dumps the ipl to the memory stick.
4 `& Z1 V2 q0 @. E7 k3 t: ~* systemparam, pspsdk sample  (user mode). It displays info about the system
* nanddumper, by Dark_AleX. (kernel mode). It dumps the full nand content to the  file
   "nandimage.flash" in the memory stick. The format of the dump is compliant with u.p. chip.
3 g$ z$ ^1 y) ~- `   (It requires 33 MB of free space in the memory stick).


9 F0 M/ W5 X2 \
Programming notes for developers
--------------------------------
7 t0 y& |4 d/ H$ C9 [
( ~- I9 L7 C/ A& [7 ^- As mentioned before, homebrew has to be in prx format, at least atm. Furthermore, the main prx, the one in
  the pbp, has to be an user prx. However this user prx can load unsigned kernel modules from
  the memory stick, allowing kernel mode apps.
7 R! X7 M$ O' ]0 e
  e  S% q, S7 k7 L- There is no need for noplainmodule check patch or nodevicecheck patch, since those are done
) O% Y0 |- \/ D  by the homebrew enabler.

! P9 F& Y3 K3 Q- d- Try to use USE_KERNEL_LIBS = 1 in your kernel prx's. In 2.XX, the separation between user
9 R4 A3 G4 x: \) T  and kernel mode is higher than in 1.XX.
  Some functions in "*ForUser" are now totally separated (different address) from their
$ d0 A. X! Z' n4 E9 ~  "*ForKernel" equivalents. A good example is ModuleMgr. If you are in a kernel prx and
1 r: W4 N. {  _. o( r4 Z5 \9 I* k  you call the sceKernelLoadModule of ModuleMgrForUser, you will get a "ILLEGA_PERMANENT_CALL" error.

- See the source code of the samples to have a hint on how to program for 3.03.

Credits and thanks.
-------------------
- Noobz team for porting to 3.03
- Noobz team for porting to 2.80

% b1 E" ]- |' W. K0 qThanks to:
8 I- V8 }* U: A- Original code for 2.71 HEN supplied by Dark_AleX

- Booster for creating devhook. HEN reboot method is based on devhook one.

- Team C+D for the registry kernel exploit.

! }' r, P, i$ }$ e. A. D7 ~- Mathieulh for the help provided to Dark_AleX for the two months that he was without psp.
: s- A  q# p, q, b: a+ i

Anticredits: ps2nfo for impersonating Dark_AleX in their forums. We don't believe your circus.