btfree (ARK edition)

A VSH plugin for the PSP Go (N1000) that unlocks the Bluetooth "Register device" screen so it lists every discoverable Bluetooth device, instead of only the device classes Sony's firmware allows by default.

This is a continuation of btfree3 by JJS and yoti (2017), updated so it runs on 6.61 CFW (ARK‑4 / ARK‑5). The original 2017 build freezes and crashes the PSP Go the instant Bluetooth scanning finds a device on 6.60/6.61. This version fixes that.

Tested working on a PSP Go running 6.61 with ARK‑5. On these systems sceKernelDevkitVersion() reports 0x06060010.

---

What it does

The PSP Go hides Bluetooth devices whose Class of Device isn't on Sony's allow‑list (a PC won't appear, a phone will). btfree patches the in‑memory bluetooth_plugin_module so the class filter accepts everything, and it logs each device you register (name + class + BD_ADDR) to ef0:/btfree_log.txt.

It only affects the pairing/registration phase. Once a device is registered you can disable the plugin and the device stays paired.

⚠️ What it does NOT do — please read

btfree cannot fix Bluetooth pairing error 0x802F0130 (the "cannot register" error some modern headphones, e.g. AirPods, throw). That error is generated by a lower‑level Bluetooth module during the pairing handshake — not by the UI module this plugin patches. We verified this by disassembling the 6.60/6.61 bluetooth_plugin_module: it builds 0x802F0135 ("unsupported device", the class rejection btfree bypasses) and 0x802F0131 ("already registered"), but never 0x802F0130.

In other words: btfree gets a device past the class filter and into the list. Whether it then pairs is up to Sony's closed Bluetooth stack, which this plugin does not touch. If a device fails with 0x802F0130, btfree will not help — a Bluetooth audio transmitter on the headphone jack is the reliable workaround for getting PSP audio onto modern wireless headphones.

---

Install (PSP Go, ARK‑4 / ARK‑5)

1. Copy btfree.prx to ef0:/seplugins/ (create the folder if needed).
2. Add this line to ef0:/SEPLUGINS/PLUGINS.TXT:

   vsh, ef0:/seplugins/btfree.prx, on
   

3. Reboot. (Optional: confirm it's enabled in ARK's VSH plugin menu.)
4. Go to Settings → Bluetooth Device Settings → Register new device and scan.

A log is written to ef0:/btfree_log.txt recording each device you register (name, class, BD_ADDR).

Supported firmware

Firmware (devkit version)	Status
6.60 / 6.61 — 0x06060010 (ARK‑4 / ARK‑5)	Fixed & tested
6.20 — 0x06020010	Inherited from original btfree3 (unverified here)
6.31 / 6.35 — 0x06030x10	Inherited from original btfree3 (unverified here)

Only the PSP Go has built‑in Bluetooth, so this plugin is only meaningful there.

---

What was fixed vs. the 2017 btfree3

The 2017 build crashed on scan on 6.60/6.61 and its device log never worked. Both are fixed:

1. Crash on scan (wrong callback / no cache flush). The 66x support left the "call the original function" pointer hardcoded at text+0x9498, an unrelated dispatcher, so the class‑filter hook jumped into the wrong function and crashed the moment a device appeared. The class‑filter unlock is now done with two direct instruction patches (no fragile call‑redirect), followed by sceKernelDcacheWritebackInvalidateAll() + sceKernelIcacheInvalidateAll().
2. Device logging. The original tried to log by creating a brand‑new syscall for a hook inside the user‑mode UI module. On 6.61 ARK that cannot be done — sceKernelQuerySystemCall / sctrlKernelQuerySystemCall return -1 and sctrlHENMakeSyscallStub returns 0 (nothing imports the hook, so no syscall slot exists). Logging is now done by hijacking sceBSMan's register‑device function — an existing syscall — via sctrlHENFindFunction + HIJACK_FUNCTION, which needs no stub creation. It records the name, class and BD_ADDR of each device you register.

---

Build from source

You only need Docker — it uses the official pspdev/pspdev toolchain image, so no local PSP SDK setup is required:

./build.sh

The result is dist/btfree.prx.

To build manually with a local PSP SDK instead:

make        # produces btfree.prx

---

Credits

• JJS and yoti — original btfree / btfree3 (2017) and the reverse engineering of bluetooth_plugin_module.
• The PSPdev project — toolchain and pspsdk.
• The ARK‑4 / ARK‑5 developers — the CFW this build targets and its SystemCtrl SDK.
• 6.61 ARK‑5 fixes and packaging by this repository's maintainer.

Disclaimer

Homebrew software provided as‑is, without any warranty. Patching system modules in memory carries inherent risk. Use at your own risk.