As some of you know when emulating the 1.5 firmware on devhook or Pandoras Battery only eboots with the kxploit modification load successfully and due to the fact that the NO-Kxploit patcher writes to the RAM it fails to work. So, what follows is a solution to this annoying problem.

What you'll need-

PSP you will be using to run the emulated firmware
PSP with 1.5 FW (could be the same one if you plan on updating to homebrew enabled firmware afterwards)
Devhook 4.x with PSAR DUMPER
M33 Permanent Kxploit Patcher
Flash Agent for 1.5


1. Patch firmware 1.5 with permanent kxploit patcher from M33 upgrade

2. Use Flash Agent to dump flash0

3. Dump encrypted version of 1.5 using psar dumper for Devhook

4. Open pspbtcnf_game.txt from patched firmware dump with text editor and insert /kd/patcher.prx after /kd/uart4.prx

5. Then delete both the line /kd/modulemgr.prx and the file modulemgr.prx

6. Add /kd/modulemgrp.prx after /kd/memlmd.prx

7. Save pspbtcnf_game.txt and exit

8. Go to the folder were the flash0 dump from the patched firmware is and open the kd folder

9. Extract patcher.prx, modulemgrp.prx, loadcore.prx, and the modified pspbtcnf_game.txt

10. Move the files into your ms0:\dh\150\flash0\kd folder and click Replace All

11. You now have a 1.5 firmware that runs both 1.50 and 1.00 eboots


This has been tested both on Devhook and Pandora's battery.

__________________