Information on the PSP-1000, PSP-2000, PSP-3000,

and the PSP Go!

Created: Sunday, March 29, 2009

Version: 6.3 Updated: Monday, February 15, 2010
Basic Info For This PowerPoint
 If you see one of these * , please read the note at the bottom, most of them are very
important*
 Internal flash refers to the NAND/LFlash, where the firmware is stored. This is not the
same as the RAM.
 Hackable refers to the ability to unbrick and/or install custom firmware using
Pandora/Despertar del Cementerio
 If you are not in slideshow mode and want to open a link, right-click and select “Open
Hyperlink”
 Homebrew are games and apps that aren’t officially supported/signed by Sony, this is
why CFW was created.
 Original Firmware = OFW, Custom Firmware = CFW, Custom Firmware Enabler =
CFWe
 HEN = Homebrew ENabler – temporary CFW that goes away with a full shutdown and
restart, used with an exploit that has kernel access to allow most (if not all) homebrew
to run on OFW, can sometimes enable other CFW features
 Most apps talked about have a download link on the “Downloads” page
 This PowerPoint is best viewed in Slide Show mode

* This is an important note… are you reading this?

 The Reason For Custom Firmware
Everybody new to the PSP scene needs to know this, so
read it.
If you are only getting CFW so you can go download
official games for free, then you shouldn’t use CFW*.
The only reason CFW even has an ISO loader in it is so
people can use their LEGAL BACKUP COPIES OF UMDS
THEY ALREADY OWN!!!, not so people can pirate
games**.
The real reason CFW was created was to completely open
the PSP so people can play homebrew games or use
applications that are otherwise blocked by OFW, and use
the hardware to it’s full potential.
*This is my opinion, what you do with CFW is your own business. Just know that dark-alex.org and upsp.ws does NOT support piracy.
**This is a known fact and is NOT my opinion.
 Table of Contents
 Basic Info For This PowerPoint  About the PSP-3000
 The Reason For Custom Firmware  PSP-3000/TA-088v3/Go Compatible Exploits
 Table Of Contents  PSP Go! Series Comparison
 Regions And Model Numbers  PSP Go! Motherboards
 Fake CFW Warning  Downgrading Without Pandora
 Exploits and How To Find Them  Deciphering “Date Codes”
 User And Kernel Mode  Battery Info And Pandora Battery Creation
 PSP-1000 Series Comparison  Now What? (Hackable)
 PSP-1000 Motherboards  Now What? (Unhackable)
 PSP-2000 Series Comparison  ISO to EBOOT Explanation
 PSP-2000 Motherboards  Downloads
 About The TA-088v3  OFW Changelogs
 How To Tell If It’s A TA-088v3  CFW Version Information
 PSP-3000 Series Comparison  PowerPoint Change Log
 PSP-3000 Motherboards  Credits

The “Table of Contents” page uses a Hyperlink system.

If you are not using slide show mode, to go to a page right-click and select “Open Hyperlink”
Go to Table of Contents

Regions And Model Numbers

 It doesn’t matter if you have a PSP-3004 or a PSP-3001, it’s still a PSP-3000 in relation to
what model it is. The only difference between a PSP-3001 and a PSP-3004 is where it was
meant to be sold, so in other words the last 1 or 2 numbers designates region. Here is a
list of all the different model numbers and the region they belong to:
 PSP-1000/2000/3000/N1000 – Japan
 PSP-1001/2001/3001/N1001 – North America
 PSP-1002/2002/3002/N1002 – Australia/New Zealand
 PSP-1003/2003/3003/N1003 – UK
 PSP-1004/2004/3004/N1004 – Europe
 PSP-1005/2005/3005/N1005 – Korea
 PSP-1006/2006/3006/N1006 – Hong Kong/Singapore/Vietnam
 PSP-1007/2007/3007/N1007 – Taiwan
 PSP-1008/2008/3008/N1008 – Russia
 PSP-1009/2009/3009/N1009 – China
 PSP-1010/2010/3010/N1010 – Mexico
Go to Table of Contents

Fake CFW Warning

 Lately, there have been a lot of fake Custom Firmwares popping up on
YouTube, mostly 5.55 and 6.00 (these are the easiest to fake), these are usually
just people looking for their 5 minutes of fame.
 There are a few ways to tell if someone is faking or not:
 1. Know the OFW they are trying to customize, if one thing seems off, it’s
probably fake.
 2. Do a Google search on their username, if nothing good turns up, there’s a
chance they’re faking
 3. If they make multiple excuses/postpone the release multiple times, it’s
probably a fake
 I have made a fake CFW myself just to show people how easy it is to make a
fake 6.00 CFW without any coding experience, I only used 7 files from 6.10
and 2 plugins and it looks exactly like 6.00 to the untrained eye, see it here.
 Beware of Beta and untested CFW, those files could do anything: from
nothing at all to Perma-bricking your PSP, wait for a trusted person to test
them before doing anything.
Go to Table of Contents

Exploits and How To Find Them

 What is an exploit?
 To put it into simpler words, an exploit is basically a piece of software, or code
that takes advantage of a bug or vulnerability in a piece of software or
hardware.
 If a user-mode exploit is found on the PSP, it will enable a good amount of
homebrew to run. Possibly allowing an eLoader to be coded.
 If the user-mode exploit is supplied with a kernel-mode one, you will be able
to make a HEN.
 For more info on User and Kernel-Mode, refer to the next slide.
 Please refer to slide 24 for more info regarding current exploits that work with
the TA-088v3 and the 3000, and slide 29 for info on past exploits used on the
Phat.
 Here are some tutorials about exploits:
 Finding gamesaves exploits on the PSP
 Looking for vulnerabilities in the PSP Firmware
 PSP Exploits – finding crashes with Fuzzing
 Tiff crashes: a breakpoint is NOT exploitable!
Go to Table of Contents

User And Kernel Mode

 Kernel-mode is much like administrator rights on a PC. It has more
access over the computer than a normal user would have.
 A "Kernel" is actually the interface between software and hardware. The
kernel tells the hardware what to do, and it receives data from the
software/firmware.
 With a Kernel-mode exploit you can access program functions that are
normally only available to Sony-signed code, or Sony technicians.
The kernel-mode would have more access to functions that would
allow the control of the Hardware and firmware.
 User-mode is simply the normal mode that a software (a game) would
be able to access. In a way, it only allows access to what a game or a
typical user has access to.
 Basically, a kernel-mode exploit would allow access to hardware and
firmware functions, while the user-mode exploits would deny access to
those things.
 Kernel-mode exploits are harder to find in-game than in-XMB
 Both a user-mode and a kernel-mode exploit are needed to make a
HEN.
Go to Table of Contents

PSP-1000 Series
This PSP is also known as the Phat
How To Tell If It’s A Phat:
•Speaker holes are at the bottom
of this PSP
•The WLan switch is on the left
side
•The UMD drive is opened by a
latch on the top
•The back of the Phat has humps
on both sides
Go to Table of Contents

PSP-1000 Series Pros

All versions of the 1000 are hackable
Is compatible with the 1.50 kernel, which is used in
older homebrew
Is built strong with an internal metal frame
Has a built-in IR port
Go to Table of Contents

PSP-1000 Series Cons

Small internal flash (33MB)
Low amount of RAM (32MB)
Heavy
No TV-Out
Not compatible with Skype
Go to Table of Contents

PSP-1000 Motherboards
Motherboard Tachyon Baryon Pommel CFW-able Pandora Creation
TA-079v1 0x00140000 0x00030600 0x00000103 Yes Yes
TA-079v2 0x00200000 0x00030600 0x00000103 Yes Yes
TA-079v3 0x00200000 0x00040600 0x00000103 Yes Yes
TA-081 0x00300000 0x00040600 0x00000103 Yes Yes
TA-082 0x00400000 0x00114000 0x00000112 Yes Yes
TA-086 0x00400000 0x00121000 0x00000112 Yes Yes

To find out which motherboard you have,

use PSPIdent v0.4
Go to Table of Contents

PSP-2000 Series
This PSP is also known as the Slim
How To Tell If It’s A Slim:
•The speaker holes are at the top
•The WLan switch is on top
•The UMD drive is opened
manually
•The back of the Slim is flat with
a slight curve at each end
Go to Table of Contents

PSP-2000 Series Pros

Large internal flash space (66MB)
Large amount of RAM (64MB)
Lighter than 1000 Series
Has a TV-Out feature for HDTVs
Certain homebrew is designed to use the Slim’s extra
RAM, this type of homebrew only works on the Slim
or higher
As of OFW 3.90, the Slim has the ability to use Skype
Go to Table of Contents

PSP-2000 Series Cons

Not all Slims are hackable, Slims with the
motherboard TA-088v3 cannot be hacked yet
The only way to run homebrew on a TA-088v3 is to
use exploits/HEN/CFWe
Uses a plastic frame, easier to break
No IR port
Easily shows fingerprints
PSP games can’t be played using TV-Out on
standard TVs, only HDTVs
Go to Table of Contents

PSP-2000 Motherboards
Motherboard Tachyon Baryon Pommel CFW-able Pandora Creation
TA-085v1 0x00500000 0x0022B200 0x00000123 Yes Yes
TA-085v2 0x00500000 0x00234000 0x00000123 Yes No
TA-088v1 0x00500000 0x00243000 0x00000123 Yes No
TA-088v2 0x00500000 0x00243000 0x00000123 Yes No
TA-088v3 0x00600000 0x00243000 0x00000123 CFWe only No
TA-090v1 0x00500000 0x00263100 0x00000132 Yes No

To find out which motherboard you have,

use PSPIdent v0.4
For TA-088v3 detection, see this slide
Go to Table of Contents

About The TA-088v3

This motherboard has a new CPU, this CPU holds a
new Pre-IPL, the new Pre-IPL blocks all current
custom IPLs used for custom firmware, this is the
reason the TA-088v3 cannot be hacked yet.
For more info, visit this page
Go to Table of Contents

How To Tell If It’s A TA-088v3

Fig. B Fig. A  If you purchased a PSP-2000, how can you tell if it’s
hackable? Well there are many ways to tell!
 Look for your box letter, if it’s a “G” or higher, it’s most
likely a TA-088v3* (Fig. A)
 Check to see which firmware it came with, if it came
with “Version 4.01” or higher, it’s most likely a TA-
088v3*
 If it was used and has firmware 5.03 or under , the
easiest way to tell if it’s a TA-088v3 is to run PSPIdent
v0.4 thru ChickHEN, this also works on new PSP-2000s
Fig. C as well (Fig. B)
 Look under your battery for a “DATE CODE” (Fig. C)
(some PSPs don’t have one), if you have one that says
“8B” or lower, it’s hackable, if it says “8C” or higher, it’s a
TA-088v3
 Open the UMD door and look at the USB (Fig. D), you
should see 5 letters/numbers printed on it, the first 2
letters/numbers should be the same as the date code
referenced above
Fig. D
 The only other way is to try to use a Pandora Kit on it, if
* Thisitmethod
bootsonly
into theonmenu,
works thenif you
NEW PSPs, it’s purchased
hackableit used, it probably
didn’t come with the original box/the original owner could have updated
the firmware
Go to Table of Contents

PSP-3000 Series
This PSP is also known as the Brite
How To Tell If It’s A Brite:
• The Home button is now a PS
button
• The PS, Select, and Start buttons
are oval instead of half-circles
• The metal ring on the UMD drive is
thinner
• The D-Pad and Action buttons now
sit in a small crater
• The edges are rounded
• There is a mic hole next to the PSP
logo under the screen
Go to Table of Contents

PSP-3000 Series Pros

Large internal flash space (66MB)
Large amount of RAM (64MB)
Lighter than 1000 Series
Has a new screen with better color
Has a built-in microphone
TV-Out is enhanced, PSP games can be played on any
TV
Can use Skype
Some colors use a matte surface which is more
resistant to fingerprints
Go to Table of Contents

PSP-3000 Series Cons

None of the PSP-3000 Series systems can be hacked
yet
Some people can see interlacing lines on the new
screen
The only way to currently run homebrew is to use
exploits/HEN/CFW Enabler
Uses a plastic frame, easier to break
No IR port
Some colors feel cheaper than the 2000
Go to Table of Contents

PSP-3000 Motherboards
Motherboard Tachyon Baryon Pommel CFW-able Pandora Creation
TA-090v2 0x00600000 0x00263100 0x00000132 CFWe only No
???* 0x00600000 0x00285000 0x00000133 CFWe only No

To find out which motherboard you have,

use PSPIdent v0.4

*This motherboard was discovered on this page, it is unknown if it is a TA-090v3 or something

else (it definitely isn’t a TA-090v1)
Go to Table of Contents

About the PSP-3000

This motherboard has a new CPU, this CPU holds a
new Pre-IPL, the new Pre-IPL blocks all current
custom IPLs used for custom firmware, this is the
reason the PSP-3000 cannot be hacked yet.
For more info, visit this page
Also, the PSP-3000 has no reaction to current
jigkick (also known as Pandora) batteries, it can’t
even turn on with one, making it even harder to
hack.
Go to Table of Contents

PSP-3000/TA-088v3/Go Compatible Exploits

 Lately, the PSP-3000 has started a search for exploits that allow unsigned code to be run on
Official firmware, this is a list of known user mode exploits for the PSP-3000/ TA-088v3/Go:
 Format: Exploit Name – firmware supported: info
 Gripshift Exploit –1.52-5.02: This exploit uses the UMD game Gripshift to launch homebrew
using a hacked savegame, the homebrew this exploit launches must be coded specifically
for this exploit, this exploit was patched in 5.03
 “Easter Eggsploit” (Also known as the “Laughing Man TIFF Exploit”) – 5.00-5.05: This
exploit was found by MaTiAz, it uses a bug in the way Sony implemented libtiff to run
unsigned code. A HEN (named ChickHEN) was created for 5.03 by Davee, who found the
kernel exploit needed for a HEN. Using the ChickHEN, PSP Slims with the TA-088v3
Motherboard and the PSP-3000 are able to use most homebrew. Using a homebrew called
CFW Enabler, the TA-088v3 and the PSP-3000 can run 5.03 MHU/GEN on top of the HEN*.
This exploit was patched in 5.50
 MOHH Exploit – 3.03-5.55: This exploit uses the UMD game Metal of Honor: Heroes to
launch homebrew using a hacked savegame, the exploit happens when you kill yourself in
an adhoc multiplayer mode. Currently, the homebrew this exploit launches must be coded
specifically for this exploit, but an eLoader is currently being coded for it, this exploit was
patched in 6.00
 Mercury Exploit - ?.??-6.10: This exploit uses the game Archer Maclean’s Mercury to launch
homebrew using a hacked savegame. The homebrew this exploit launches must be coded
specifically for this exploit .See this page for more info. This exploit was patched in 6.20

*This does not mean you can now install CFW on an unhackable motherboard, it just makes the HEN more CFW-
like, DO NOT TRY TO INSTALL CFW ON TA-088v3 OR PSP-3000, YOU WILL GET A BRICK!!!
Go to Table of Contents

PSP Go! Series

 This PSP’s model number is “PSP-N1000”

How To Tell If It’s A Go!:

• The PS button is located on the left side of the
screen
•This system has no UMD Drive
• This system can slide up and down to hide/reveal
buttons
• The speaker holes are four dots in a diamond
pattern beside the screen
•This system has a Bluetooth indicator light on the
right of the screen, and a Wi-Fi indicator light on
the left
• There is a mic hole between the analog stick and
the start/select buttons
Go to Table of Contents

PSP Go! Pros

Has 16 GB Internal Flash Memory
Smaller and lighter than PSP-2000/3000
“Game Sleep Function” (Save State)
Bluetooth Compatibility:
- Can be paired with a PS3 controller*
- Can connect to a cell phone and use it to connect to
the internet
- Can use a Bluetooth headset

*A PS3 is required to pair a PS3 controller with the PSP Go!

Go to Table of Contents

PSP Go! Cons

No UMD Drive
Smaller Screen (3.8 inch)
Uses a custom USB/AV Out/Charge port, AV Out
cable for 2000/3000 will not work, chargers for
1000/2000/3000 will not work, special USB cable
needed
Uses M2 memory cards, so MS Pro Duo will not work
with the PSP Go!
There is currently no public way to run homebrew on
the Go!
Go to Table of Contents

PSP Go! Motherboards

Motherboard Tachyon Baryon Pommel CFW-able
TA-091 ? ? ? No
TA-094 ? ? ? No
Go to Table of Contents

Downgrading Without Pandora

 Before Pandora existed, installing CFW involved downgrading to 1.50 thru exploits then
upgrading to CFW, exploits can still be used to install CFW with the help of Hellcat’s Recovery
Flasher*, this is a list of all user mode exploits that have the ability to downgrade/install CFW (a
kernel mode exploit is needed for HEN):
 Format: Exploit Name (Game Used) [Type] – firmware supported: info
 TIFF Exploit [eLoader] – 2.00: Used a bug in libtiff to run unsigned code, this exploit was
patched in 2.01
 GTA:LCS Exploit (GTA:LCS) [eLoader] – 2.00 to 2.60: Used a modified savegame to run unsigned
code, can be used to downgrade in 2.50, 2.60, save slots 1-7 were patched to prevent this exploit
in 2.70
 TIFF Exploit [eLoader/HEN] – 2.01 to 2.80: Used a bug in libtiff to run unsigned code, can be
used to downgrade in 2.01, 2.71, 2.80, this exploit was patched in 2.81
 “Goofy” Exploit (GTA:LCS) [HEN] – 2.00 to 3.03: Used a modified savegame to run unsigned
code, this exploit is different than the one for firmwares 2.00 to 2.60 as it uses save slot 8 instead
of slots1-7, Sony patched slots 1-7 but not slot 8, can be used to downgrade in 3.03, this exploit
was completely patched in 3.10
 Illuminati Exploit (Lumines) [HEN] – 1.50 to 3.50: Used a modified savegame to run unsigned
code, can be used to downgrade in 3.11,3.50, this exploit was patched in 3.51
 Easter Eggsploit [HEN] – 5.00 to 5.05: Also called the “Laughing Man Exploit”, uses a bug in the
way Sony implemented libtiff to run unsigned code, can be used to install CFW on 5.03*, this
exploit was patched in 5.50

* Do not try this on a PSP-2000 with the TA-088v3 motherboard or on a PSP-3000, you will
end up with an unrecoverable brick!! You have been warned!
Go to Table of Contents

Deciphering “Date Codes” Date Code Months

 On some PSPs, there is a “Date Code” in the battery
compartment, this code can tell you the quarter and A Jan-Mar
year that your PSP was manufactured, it is useful in B Apr-June
TA-088v3 detection C July-Sept
 For the PSP-2000 and PSP-3000, the “Date Code” is D Oct-Dec
also printed on the USB inside the UMD compartment,
it’s the first two parts of a five part code (See Fig. D on
this slide)
 The first part is always a number and it designates the
year
 The second part is always a letter (A, B, C, D), it
designates the quarter of the year (See chart to the
right)
 Examples: 8C = July-Sept 2008, 0A = Jan-Mar 2010, 5B =
Apr-June 2005

If somebody finds this information to be incorrect, please contact me (see Credits for how)
Go to Table of Contents

Battery Info And Pandora Battery Creation

 There are three types of official Sony batteries for the Phat, Slim, and Brite: 1200 mAh
(PSP-S110), 1800 mAh (PSP-110), and 2200 mAh (PSP-280)
 Phat compatible: 1800 mAh, 2200mAh
 Slim compatible: 1200 mAh, 1800 mAh*, 2200 mAh*
 Brite compatible: 1200 mAh, 1800 mAh*, 2200 mAh*
 Only certain PSPs have the ability to create Jigkick (also known as Pandora) batteries, if
you get a PSP that doesn’t have this ability, you will have to ask someone to make one
for you, hardmod one, or buy a pre-made one
 All PSP Phat’s can make Pandora Batteries
 The only Slims that are capable of making Pandoras are ones with a TA-085v1
motherboard, these Slims were found in early Daxter Entertainment Packs and are silver
 Later versions of the Daxter pack PSP have TA-085v2 motherboards and are also silver,
all PSP Slims with a TA-085v2 motherboard and up cannot create Pandora batteries
 Newer 1200 mAh batteries cannot be changed into jigkick/Pandora batteries at all
 The PSP-3000 can not create Pandora batteries
 OSPBT 0.52 is a good program to make Softmodded Pandora Batteries

*The Slim and Brite require a special battery cover to use these batteries
Go to Table of Contents

Now What? (Hackable)

So you found the PSP you wanted and it’s hackable, now
what do you do to get it hacked? Here is a list of helpful
tutorials to get you started:
How to make Jigkick Battery (Softmod): Here
How to make Jigkick Battery (Hardmod): Here
Using The Universal Unbricker To Unbrick/Downgrade:
Here
Installing CFW via OFW 5.03 on 100x & 200x: Here

NOTE: DO NOT USE HELLCAT’S RECOVERY FLASHER ON TA-088V3 OR PSP-3000, YOU WILL BRICK IT AND
THERE IS NO WAY TO UNBRICK IT AT THIS POINT!!! You have been warned!
Go to Table of Contents

Now What? (Unhackable)

 So you found the PSP you wanted and it’s unhackable, now what do
you do to get homebrew on it?
 If you have firmware 5.03 or below, your best bet is to upgrade to
5.03 and use ChickHEN. If you really want CFW, there is a
homebrew called CFW Enabler (CFWe) that makes HEN act like
CFW*, there is also 5.03 GEN which is the same as CFWe except it
is made by Team GEN and has a few different features*. You still
have to run it every time you hard reset your PSP, though.
 If you have firmware above 5.03, then there currently isn’t a way to
run homebrew on your PSP, if you have firmware 5.55 or below,
your best bet is to wait for the MOHH eLoader, if you have a
firmware between 5.55-6.10, you’ll have to wait and see if the
Mercury Exploit will be turned into anything, if you have 6.20+,
you’ll have to wait for a new exploit.
 Step by Step tutorial – Installing ChickHEN + CFWEnabler: Here
*This does not mean you can now install CFW on an unhackable motherboard, it just makes the HEN more CFW-
like, DO NOT TRY TO INSTALL CFW ON TA-088v3 OR PSP-3000, YOU WILL GET A BRICK!!!
Go to Table of Contents

ISO to EBOOT Explanation

 It is possible to take a PS1 ISO file that was ripped from a disc you own and convert it
into an EBOOT.PBP file so you can play it on a CFW-Enabled PSP, it is NOT possible to
convert a PSP ISO/CSO into an EBOOT.PBP
 “Why can’t I convert a PSP ISO into an EBOOT?” This is a common question that gets
asked all the time, why can you convert PSX ISOs to eboots, and not PSP ISOs to
eboots?
 The simple answer is: PSP ISOs are encrypted, PSX ones are not. So how can I convert
PSX ISOs to eboots?
 There are tons of guides available, as well as easy-to-use tools that make converting PS1
games a snap
 The best tools out there* are PSX2PSP for Windows and iPoPS for Mac
 Here are a few guides to get you started:
 Tutorial: Quickly Convert PSX to EBOOT (Uses AutoPopstation 4)
 PS1 2 PSP (PSX) TUTORIAL (Uses PSX2PSP)

*In my opinion
Go to Table of Contents

Downloads
ChickHEN R2 (m0skit0 Mod): Here
CFW Enabler (3.70): Here
5.03 GEN-A/B: Here
5.03 GEN-C: Here
PSPIdent v0.4: Here
Recovery Flasher v1.60: Here
OSPBT 0.52: Here
PS1 to PSP: Windows Mac

Note: If you are having problems opening the links, right-click them and select “Open Hyperlink”
 Go to Table of Contents

OFW Changelogs Part 1

Version Date Released Download Changelog
Original release
1.00 12/12/2004 N/A No content authorization system.
Japanese only.
Support for content authorization
1.50 03/24/2005 Here Support for new video codecs
Support for multiple languages
Security update to patch KXploit exploit
1.51 05/18/2005 Here
Revisions to strengthen security have been added
1.52 06/15/2005 Here Support for UMD music
Internet browser added under [network]
2.00 09/01/2005 Here 4:3 Screen Mode has been added under [video] (for video saved on Memory Stick Duo™ media).
Go To feature has been added (for UMD™VIDEO and UMD™MUSIC).
A-B Repeat feature has been added under [music] (for UMD™VIDEO, UMD™MUSIC and video saved on Memory
Stick)
Audio options have been added (for video saved on Memory Stick Duo™ media).
MP4 (AVC) has been added as a playable file format under [video] (for video saved on Memory Stick Duo™)
The combination of SonicStage™ version 3.2 supports Attrac3 plus files
WAV have been added as playable files under [video]
Wallpaper feature has been added.
Image transfer feature has been added.
TIFF, GIF, PNG and BMP have been added as viewable file formats under [picture]
Korean has been added as a system language in [System Settings].
[Character Set] has been added in [System Settings].
[Theme Settings] has been added.
[Internet Browser Start Control] has been added as a security mode in [Security Settings].
WPA-PSK (TKIP) has been added as a security mode in [Network Settings].
Web address shortcut feature has been added as an input mode for the on-screen keyboard.
Security update to patch TIFF exploit
2.01 10/03/2005 Here
 Go to Table of Contents

OFW Changelogs Part 2

Version Date Released Download Changelog
[LocationFree™ Player] added.
2.50 10/13/2005 Here [Auto-Select] and [Unicode (UTF-8)] added to the browser.
Settings for [Text Size] and [Display Mode] and the history is saved.
Copyright-protected video can now be played.
[Set via Internet] has been added to [Date and Time] in [Date & Time Settings].
[WPA-PSK (AES)] has been added as a security method under [Network Settings].
Korean input mode has been added to the on-screen keyboard.
Support for Audio RSS feeds under [network/RSS]
2.60 11/29/2005 Here
Support for Adobe Flash player
2.70 04/25/2006 Here
Support to download Demos from the Web Browser
2.71 05/30/2006 Here
Support for Video RSS feeds.
2.80 07/27/2006 Here Update for LocationFree Player to support AVC video codec.
Secret patching of sceKernelLoadExec bug, but opening sceRegOpenRegistry exploit.
Support for memory sticks with a capacity of greater than 4GB.
2.81 09/07/2006 Here Security update to fix libtiff exploit.

Revisions to strengthen security have been added.

2.82 10/26/2006 Here
PlayStation 3 Remote Play.
3.00 11/21/2006 Here Classic PSone games.
Added a music visualizer.
Support for PlayStation Network titles expanded.
3.01 11/22/2006 Here
Support for PlayStation Network titles expanded
3.02 12/06/2006 Here
Support for PlayStation Network titles expanded.
3.03 12/20/2006 Here Support for taking photos and videos using the camera.
 Go to Table of Contents

Version
OFW Changelogs Part 3
Date Released Download Changelog
Dynamic normalizer.
3.10 01/30/2007 Here Conserve memory option.
"PlayStation®Spot" menu under "Network". [Japanese version only]
Secret patching of sceRegOpenRegistry and GTA exploit.
Reset option for PlayStation Network titles.
3.11 02/08/2007 Here "Portable TV™" menu under "Network". [Japanese version only]

Support for thumbnail images within RSS channel and in video folder.
3.30 03/28/2007 Here MPEG-4/H.264 support for 720×480, 352×480, and 480×272 (native resolution).
"Wireless Hotspot" added
Support for PlayStation Network titles expanded.
3.40 04/20/2007 Here "Certificate Utility" option erased.
Saved data from PlayStation format software can be used on both PSP and PS3 systems.
Allows Remote Play to be used via an internet connection.
3.50 05/31/2007 Here "RSS Channel Guide" has been added as a feature under "RSS Channel".
CPU speed limit removed, allowing CPU to run at 333MHz rather than 266MHz.
2007 Illuminati exploit has been patched
3.51 06/29/2007 Here
Support for PlayStation Network titles expanded.
3.52 07/24/2007 Here
TV output added
3.60 09/10/2007 N/A Support for the 1-Seg Tuner [Japanese version only]
UMD cache support
USB Charge option
Additional color themes for XMB
Custom themes
3.70 09/11/2007 Here Support has been added for assigning buttons in [Remote Play]
A scene search feature has been added under [Video]
Sequential playback is now supported under [Video]
Simultaneous playback of content under [Music] and [Photo] is now supported
PlayStation Spot icon added under [Network] for regions other than Japan
Video bitrate limit raised to 2Mbps from 768kbps
 Go to Table of Contents

OFW Changelogs Part 4

Version Date Released Download Changelog
Revisions to strengthen security have been added.
3.71 09/13/2007 Here Support for PlayStation Network titles expanded.
A correction has been made to the settings for some regions
Support for PlayStation Network titles expanded.
3.72 10/30/2007 Here Remote Start now available under Remote Play. Remote Start requires a Playstation 3 system

Improved system stability by fixing problems where the UMD drive would occasionally suspend
3.73 11/29/2007 Here
Streaming internet radio player
3.80 12/17/2007 Here Added new music visualization effect
Video scene search
RSS now supports OPML and pictures
PlayStation Spot now available at BB Mobile Point (Japanese version only)
Added ability to play PlayStation games from disc or hard drive via Remote Play
PSP Slim only features:
One-segment broadcasting recordings (Japanese version only)
Support for PlayStation Network titles has been expanded.
3.90 01/29/2008 Here Download icon for Go!Messenger has been added under [Network] (European version only)

Support for PlayStation Network titles has been expanded.

3.93 03/18/2008 Here 20 new Internet Radio players has been added.

Support for PlayStation Network titles has been expanded

3.95 04/08/2008 Here While playing PSone games on your PSP, you can now customize how the buttons are assigned by going to
[Controller Settings] > [Assign Buttons] and select [Custom].
You can now quit Remote Play and choose to turn off your PS3 or leave it on after quitting. This is useful if you are
performing a download and want to quit Remote Play, but still want your download to continue on the PS3. Select
[Quit and Turn Off the PS3 System] or [Quit Without Turning Off the PS3 System] from [Quit Remote Play] when
you press the HOME button on the PSP system.
Adds support for Playstation Network Titles.
3.96 06/04/2008 UMD Only Fixes some bug issues.
This update is required to use Hot Shot Golf 2, for PSP. Allows game to be played.
 Go to Table of Contents

Version
OFW Changelogs Part 5
Date Released Download Changelog
Google Search has been added as an icon under "Network".
4.00 06/18/2008 Here Pressing up or down while viewing videos slows down and speeds up videos
Added Subtitle support for UMD Movies under Video
Display of search results under Internet Search has been improved for certain languages.
4.01 06/25/2008 Here Playback of video content under Video has been improved for certain file types

Added new visualization effect under [Music].

4.05 07/13/2008 Here Added support for viewing rentals and purchased videos downloaded from the Playstation Store (temporarily US
version only)
PSP Slim only features:
Up to 8 programs may now be scheduled for record using the One-segment TV Tuner (Japanese version only)
You may now set up a whole series of programs to record using the One-segment TV Tuner (Japanese version only)
You may now record TV using the One-segment TV Tuner without having to also watch it (Japanese version only)

[USB Auto-Connect] feature in [System Settings] under [Settings]

4.20 10/14/2008 N/A PSP 3000 only features:
[Flicker Reduction] under the [Connected Display] menu in [Settings]
[Noise Reduction] under the [Connected Display] menu in [Settings]
[Color Space] under the [System Settings] menu in [Settings]
Patched a bug in libtiff.
4.21 10/14/2008 N/A
[PlayStation Network] has been added as a category on the XMB
5.00 10/15/2008 Here [PlayStation Store] has been added under [PlayStation Network] menu
[Account Management] has been added under [PlayStation Network] menu
Sleep Timer Function for [Music]
[USB Auto-Connect] Feature added for PSP-1000 and PSP-2000
A new full-screen keyboard; press [Select] when the On-Screen Keyboard is displayed.
A new optional redesigned XMB Background
A new video format is supported (MPEG-4 AVC (H.264) Video Main Profile (AVC CABAC) in 640 x 480 pixels)
[Title Display] feature under [Settings]
[Backlight Auto-Adjust] has been added as an option under [Power Save Settings]
Screen capture has been added as a feature within games and the internet browser (this is up to the game developer
or the web site developer to support though).
PSP Slim and PSP 3000 only features:
Full screen and/or interlaced TV-out option for PSX games
 Go to Table of Contents

OFW Changelogs Part 6

Version Date Released Download Changelog
Fixed a bug where PSP owners using 8GB or 16GB Memory Stick PRO Duos get a message saying there is insufficient
5.01 10/22/2008 Here memory space on their Memory Sticks while downloading stuff from the PlayStation Store even when there is
enough space.
System software stability during use of some features, including PlayStation(R)Store, has been improved.
5.02 11/20/2008 Here PSP Slim only features:
One-segment channel list updated, now Niigata Prefecture - Shiga Prefecture and Takada - Koka local channels can
be received properly. (Japanese version only)
System software stability during use of some features, including PlayStation(R)Store, has been improved.
5.03 01/20/2009 Here Patches Gripshift exploit.

Compatibility update for Idolm@ster SP and a few other games.

5.05 02/19/2009 UMD Only
[Information Board] has been added
5.50 04/21/2009 Here Memory Stick improvements
Sub-folder support has been added for music, videos, and photos
Space required to download a file from PlayStation Store to your Memory Stick has been reduced significantly.
[Internet Search] for games directly from the XMB has been added
Trend Micro trial has been added for the Web Browser.
Trend Micro Web Security
Trend Micro Kids’ Safety
Exploit via libTIFF bug patched
System software stability during use of some features has been improved.
5.51 06/11/2009 Here Patches kernel exploit used in ChickHEN
Compatibility update for certain UMD games. For a list of those games, see Official Firmware 5.55 on the PSP Wiki
5.55 07/06/2009 UMD Only
Games can now be grouped and displayed in folders based on their expire date under [Game].
6.00 09/10/2009 Here Under [Settings], [Network Update] has been changed to [System Update]. Under [System Update], you can now
choose how to update the system software.
The number of colors that can be selected under [Settings] > [Theme Settings] has been increased.
Revisions to strengthen security have been added.
Screen mode "Custom" has been added in pops with PSOne Classics for perfect zooming.
 Go to Table of Contents

OFW Changelogs Part 7

Version Date Released Download Changelog
The importing of playlists from the Media Go application is now supported under [Music]
6.10 09/30/2009 Here (SensMe™ channels) has been added as a new feature.
In [Display Panel Close Options] under (System Settings), the design for the [Standard] theme has been changed.
(N1000 only)
[Update] has been added to the options menu for games.
[Memory Stick™] has been added as a save destination for content that is downloaded from PlayStation®Store.
(N1000 only)
The Dial-up Networking (DUN) profile has been added as one of the supported Bluetooth® profiles. (N1000 only)
The importing of playlists from the Media Go application is now supported under [Video].
6.20 11/19/2009 Here The importing of playlists from the PlayStation 3 system or the Media Go application is now supported under
[Photo].
The [TV] category has been integrated into the new [Extras] category in the XMB (XrossMediaBar) menu.
Compatible Models: PSP-2000, PSP-2005, PSP-3000, PSP-3005, PSP-N1000, PSP-N1005
Go to Table of Contents

CFW Version Information

For a list of many different CFW versions, info, and
downloads, see this page on the PSPWiki
That list contains info on OE, M33, GEN, and many
other CFWs from other people
The most current CFW is 5.50 GEN-D3 for hackable
motherboards, and 5.03 GEN-C for unhackable
motherboards
I bet you’re wondering “Why isn’t there a 6.20
CFW?”, the answer lies on this page and this page.
Go to Table of Contents

PowerPoint Change Log

 For earlier changelogs, see this page on my website.
 6.2 – Edited “Regions And Model Numbers”, Edited “CFW Version
Information”, Added a Hyperlink system to find pages quicker thru the
“Table of Contents” page, Edited “Basic Info For This PowerPoint”,
Edited “Credits”, Edited “How To Tell If It’s A TA-088v3”, Edited
“Exploits and How To Find Them”
 6.3 – Edited “Exploits and How To Find Them”, Edited “How To Tell If
It’s A TA-088v3”, Added “Deciphering “Date Codes”” page, Edited “Fake
CFW Warning”, Edited “PSP-1000 Motherboards”, Edited “PSP-2000
Motherboards”, Edited “PSP-3000 Series Pros”, Edited “PSP-3000 Series
Cons”, Edited “PSP-3000 Motherboards”, Fixed the theme of multiple
charts

Note: Minor changes made to “Table of Contents” will not be logged

Go to Table of Contents

Credits
Author: Ruyor
Contributors: mortalinstincts, wololo, leq,
DarkestVoid, Rolen47, raing3, SifJar, n00b81,
cypriotbro, Hellcat
Sources: dark-alex.org, PSP Wiki, Google, Many
websites I don’t remember, My Brain ☺
Thanks: Jonatan10, jeerum

If you have any suggestions or find any errors please go to upsp.ws, a site
with a dedicated section to this PowerPoint
For updates, follow me on Twitter: @ruyor, also check my site:
ruyor.upsp.ws