I think I know, how to fake the updater in order to flash older firmware:
Updater obtains the firmware segments versions from Pronto and compares those (versions) with ones stored on the end of tspupd.exe.

1. Run Update_Pronto_NG.exe from TSU3000__v2.3.9.zip or RU950__v2.3.9.zip and don't touch it.
2. Go to "C:\Documents and Settings\###current user###\Local Settings\Temp\IXP000.TMP\"
3. Copy both files (tspcom.dll and tspupd.dll) to stable place, say "My Documents\NG recovery"
4. Carefully, byte-to-byte, change both strings at the end of tspupd.exe "2.3.9.0" to "3.2.0.0"
5. Close Update_Pronto_NG.exe, use tspupd.exe.

After the updating, Pronto become actually 2.3.9.0, de-facto and for updaters.

If it is actually, I can write the masquerader. But I hope for discretion at all: Pronto IR/RF capacities can’t become worse permanently, once they will be cured :)

Why do these repeating codes may not work now? Let’s try to increase the last byte 0DF5.