[How To's] Do It the Manual Way

[bstronga]

i really would like people doing things the manual way since i think many stupid questions arise when using apps that sets your brain to off mode.
so here quick how to's, how to do the most common things - manually.

1.0 - Use PSP Filer
1.1 - Use 3.03OE-C USB flash access
1.2 - Getting Started

x.0 - Some Notes - Readme Please

2.0 - Debranding Gameboot
2.1 - Debranding Coldboot SCE Logo

3.0 - Redirecting Gameboot.pmf to Memorystick
3.1 - Load topmenu_plugin.rco from Memorystick - usable now - 2.5 topmenu_plugin.rco not supported by 3.10
3.2 - Load other XMB related stuff from Memorystick - usable now

4.0 - Change XMB Icon Names - 2.5 topmenu_plugin.rco not supported by 3.10
4.1 - Change Text under XMB -> Settings -> System Settings

5.0 - flash a Font
5.1 - flash a XMB Icon Theme - 2.5 topmenu_plugin.rco not supported by 3.10
5.2 - create/flash Background Theme

7.0 - CIntro Mod - !Recovery Menu has to be altered! -autoboot feature is broken on 3.03OE-C
7.1 - load CIntro from BOOT folder -autoboot feature is broken on 3.03OE-C

8.0 - Change System Version

9.0 - Goto Favorite Web page by a link on the XMB (by zmathue)

10.0 - Change Loading Icon & Corrupted Icon & Saved Data Games Icon
10.1 - Change Coldboot Sound
10.2 - Change XMB Click Sounds

11.0 - Having fully customized opening_plugin.rco with PSX working

Spoiler for Show Content!:

1.0 - PSP Filer

Spoiler for PSP Filer:

Get the latest version: http://www.geocities.jp/mediumgauge/
this little tool seem to looking plain or even ugly but its real beauty is its powerfulness.
most important features:
dump UMD
dump Flash0
dump Flash1
and the most important one:
ability to write to Flash0/1
since you have full access to flash0 so be sure NOT to touch the 1.5 bootstrap!
do _NOT_ touch anything in:

flash0:/kd
flash0:/vsh/module

3.03 OE-C: Dark_Alex has moved the criticial recovery menu files to flash0:/kd
Note:
Select to go to options, press O to select english and Square to save.
you have to be in Hacker-Mode in order to have write access in Flash0/1
Dpad Left + R Trigger + L Trigger - Toggle Hacker-Mode
Files you want flash have to go first to RAMDISK.
ms0 -> RAMDISK -> Flash0/1

There's a bug in filer, when flashing a file smaller in size of the one in flash, the filesize strangly doesn't get refreshed which also affects free space calculation. so just remove the file before flashing.

1.1 - Use 3.03OE-C USB flash access

Spoiler for USB Flash Access:

Since 3.03OE-C you can access flash0/1 with a usb connection. this makes flashing _very_ easy so always make sure you flashing the files to the right place!

1.2 Getting Started

Spoiler for Getting Started:

First dump your flash0 and flash1 with filer: press Triangle -> L Trigger
unpack the content with UltraISO.

Get PSARDumper: http://forums.maxconsole.net/showthr...highlight=3.03
and the official Sony 3.03 Update File
in PSARDumper press Square.

Get a Hexeditor:
just use one of your choice.
as example http://www.chmaas.handshake.de/delph...vi32/xvi32.htm
which i honestly don't like but it will suffice for our purpose.
i use http://winhex.com/winhex/index-m.html

Quicknote: Hexediting is basicly the only way to alternate a binary file.

x.0 - Some Notes - Readme Please

Spoiler for Notes:

Brick: even though we are going to mess around with flash0 there is almost no chance of bricking (i would like to say impossible but i don't dare to do so)
even if you delete/flash the wrong file, you can just flash back the original file since you doing it manually you should know what files you just flashed!
so no need to reflash the entire firmware .
free flash0 space: And before starting better free some flash0 space. use filer or use your pc, rename ltn9.pgf (/font) to jpn0.pgf (orginial ~1.5mb!) (the japanese font) and flash it.
Bug in Filer: and something you should know is that there's currently a bug in filer, when flashing a file smaller in size of the one in flash, the filesize strangly doesn't get refreshed which also affects free space calculation. so better remove the file before flashing.
3.03OE-C: Critical Recovery Menu files have moved to kd folder.
Semi-Brick: if you semibrick and can't fix it manually you don't need to go back to 1.5! just put the oeflasher eboot with the data.dxar in GAME/RECOVERY and reflash 3.03OE. if you lost your data.dxar than just put the eboot of the oeupdmaker plus the 1.5 update renamed to 150.pbp and the 3.03 update renamed to 303.pbp and generate the data.dxar. the oeflasher formats flash0 which means it will do a clean install, there is absolutly no point to go back to 1.5 just to flash 3.03OE...

2.0 - Debranding Gameboot

Spoiler for Debranding Gameboot:

open up opening_plugin.rco (vsh/resource)
go to address 0x3A14 it doesn't really matter whats written here (in 3.03 it should be "7D")
just replace it with "55"
Quicknote: x-flash changes the value to 55 but in fact anything except the original value will work.

2.1 Debranding Coldboot SCE Logo

Spoiler for Debranding Coldboot Logo:

open up opening_plugin.rco (vsh/resource)
go to address 0x31AC also it doesn't really matter whats written (in 3.03 it should be "9A"
just replace it with "55"
Quicknote: x-flash changes the value to 55 but in fact anything except the original value will work.

3.0 - Redirecting Gameboot.pmf to Memorystick

Spoiler for Gameboot.pmf to Memorystick:

open up the decrypted opening_plugin.prx (vsh/module but has to be flashed in vsh/nodule!)
go to 0x18D4 you will see flash0:/vsh/resource/gameboot.pmf
change it to ms0:/xxxxxxxxx.... whatever you like
you have to rewrite the whole line, and whats left over you can fill up with zero bytes
but remember you can't exceed the number of letters given in the original path!
Note: you can delete gameboot.pmf (vsh/ressource) in flash0 after doing this.

3.1 - Load topmenu_plugin.rco from Memorystick

Spoiler for load topmenu_plugin from memstick:

open up decrypted vshmain.prx go to address 0x33E7C (3.03), you will see flash0:/vsh/resource/topmenu_plugin just change it to lets say ms0:/xmb/topmenu_plugin.rco. save as vsh.prx and flash it to vsh/nodule. open up pspbtcnf.txt in flash0:/kn and and write

/vsh/module/vshmain.prx

_under_

/kd/vshctrl.prx

and change the last line

$%%/vsh/module/vshmain.prx

to

$%%/vsh/module/vsh.prx

you will have to do this because otherwise GAME150 / GAME303 won't be recognized
Note: you have to run Noobz PatchSFO originally made for xLoader for your 1.5 homebrew!
Tip: you can delete the file/s from flash if you going to use this permanently.
PatchSFO File: http://files.fanjita.org/psp/patchsfo.zip Patches eboots in GAME so better remove you psx eboots before.
PatchSFO v0.1 by splodger15 http://forums.qj.net/f-psp-developme...v01-94768.html patches eboots in GAME150.

3.2 - Load other XMB related stuff from Memorystick

Spoiler for XMB from MS:

open up decrypted vshmain.prx and look on it, you can redirect XMB .prx to memstick or 01-12.bmp background theme. save edited vshmain.prx as vsh.prx and flash it to vsh/nodule. open up pspbtcnf.txt in flash0:/kn and and write

/vsh/module/vshmain.prx

_under_

/kd/vshctrl.prx

and change the last line

$%%/vsh/module/vshmain.prx

to

$%%/vsh/module/vsh.prx

you will have to do this because otherwise GAME150 / GAME303 won't be recognized
Note: you have to run Noobz PatchSFO originally made for xLoader for your 1.5 homebrew. It patches the Eboots only in GAME.
Tip: you can delete the file/s from flash if you going to use this permanently.
PatchSFO File: http://files.fanjita.org/psp/patchsfo.zip

4.0 - Change XMB Icon Names

Spoiler for XMB Icon Names:

in order to do this you will have to use the xmb icon hack provided by kgsws
(http://forums.qj.net/f-psp-mods-medi...ons-86874.html for more information)
since it uses a 2.5 topmenu_plugin.rco which is not fully encrypted, unlike the 3.03 one, you can freely change the icon texts.
open up your topmenu_plugin.rco, hit CTRL+F, which will hopefully popup the search window ;o.
so since the icon texts are written in Unicode, and hexeditors default are looking for an ascii string
you have to enable unicode. after doing that you can basicly search the text you want to edit. i.e. Network Update
Note: you have to leave at least 3 blank bytes between each icon text, in case of Network Update you can even add one letter (UMD, Location Free Player also)
i'll try to explain with screenshots...

Spoiler for Screenshot - 5 zero bytes:

as you can see, there are 5 zero bytes between the Icon "Game" and "Network".
but only 3 are necessary

Spoiler for screenshot - adding one letter:

4.1 Change Text under XMB -> Settings -> System Settings

Spoiler for Change System Settings Text:

extract the data.psar of the 2.5 official sony update and decrypt with psardumper (press x or square, better press square if you want to do some research of yourself)
go to vsh/ressource and open sysconf_plugin.rco
so since the icon texts are written in Unicode, and hexeditors default are looking for an ascii string
you have to enable unicode. after doing that you can basicly search the text you want to edit. i.e. Nickname, System Version
Note: the add one letter "trick" doesn't work, well not properly.

Spoiler for Screenshot:

Note: since we are using a 2.5 file the features autostart umd and enable flash/wmv are blank. btw we have to use a <2.5 .rco file because they are not completly encrypted unlike 3.03 (>2.6) even the xmb icon hack is based on the 2.5 topmenu_plugin.rco.

5.0 - flash a font

Spoiler for Font:

a short one: flash ltn0.pgf with filer to flash0:/font.
5.1 flash a XMB Icon Theme

5.1 - flash XMB Icon Theme

Spoiler for XMB Icon Theme:

another short one.
flash your custom topmenu_plugin.rco to vsh/ressource.

5.2 - create/flash a background theme

Spoiler for background theme:

so 01-12.bmp is basicly just 12 bmp pictures bunched in one, if you open the file with a hexeditor you can see the headers of 12 bmp files.
create a .bat file and paste this (by RaiderX) :

copy /b 01.bmp+02.bmp+03.bmp+04.bmp+05.bmp+06.bmp+07.bmp+08.bmp+09.bmp+10.bmp+11.bmp+12.bmp 01-12.bmp
pause

just put your 12 bmps in the same folder.

since 3.00 the format has changed. its only one .bmp now (01-12.bmp).
but its still possible to have 12 different backgrounds.
the limitation is very strict, background has to be _EXACTLY_ 6.176 bytes big and have a resolution of 60x34!

if you only want flash one background but with a higher resolution.
up to 335x190 with no corrupted icons
or
352x199 but it corrupts the DNAS logo which comes up when setting time via internet and maybe even more
if you want it as i.e. October because you like yellow (;p) you will have to make use of the .bat file we just created
thus make sure 01.bmp - 09.bmp are _EXACTLY_ 6.176 bytes big and have a resolution of 60x34.
November and December won't be accessable after that.
an example 01-12.bmp is provided as attachment. 01.bmp - 08.bmp (6.176 bytes big) and 12.bmp (352x199) are changed.
Note: resolutions are only vaild if you use a custom topmenu_plugin.rco!

6.0 - Flashing VSH Plugins/Modules and activate them thru XMB Icons

Spoiler for VSH Plugins/Modules:

so you can basicly flash every available VSH plugin and active them through an XMB Icon. Some plugins you don't want to have activated all the time but the way through recovery menu is just too long (to fully unload the plugins after activated you will have to do a hard reboot, because plugins available aren't supposed to be started like that so they don't have a unload feature)
a few vsh plugins you can flash are i.e. svcapture, mp3, usbhost etc + vsh ftpd and vsh rebooter.
if you want to flash svcapture and want it to be replaced with i.e. Saved Data Utilitiy. just take the capture.prx and rename it to savedata_plugin.prx (vsh/nodule) and flash it. now when you click saved data utility it'll activate the plugin.
Icons you can replace with a custom .prx are such as :
Network Update: update_plugin.prx
Camera: camera_plugin.prx
Certificate Utility: license_plugin.prx
Saved Data Utility: savedata_plugin.prx
Remote Play: premo_plugin.prx
Location Free Player: lftv_plugin.prx
Online Manual and Internet Browser are sharing the same prx: htmlviewer_plugin.prx

7.0 - CIntro Mod - !Recovery Menu has to be altered!

Spoiler for CIntro Mod - !Warning!:

ok this one is a bit dangerous since we have to alter a recovery menu file!
get the vshmain.prx file of your own firmware dump! its located in vsh/module. and has a size of 30,742bytes (3.03OE-B).
first disable autoboot if enabled, ok we have to change the autoboot path from (@address 0x5B0) ms0:/PSP/GAME/BOOT/EBOOT.PBP to somewhere in flash1. lets say: flash1:/cintro/EBOOT.PBP
the letters left you have to fill with blank zero bytes. i really don't want people mess this up so here 2 screenshots:
original:
changed:
now flash it to vsh/module. hard reboot your psp and hope that it start ups normally. if its and most likely will anyway ;p we have to change the paths of the cintro files. get cintro 0.2 i.e. from
open up the EBOOT.PBP and change the path at 0x6294 to "flash1:/cintro/intro.pmf" and the path at 0x62D8 to "flash1:/cintro/introcfg.ini" save. and than open pmfPlayer.prx change the path at 0x7EA8 to flash1:/cintro/introcfg.ini save. make a quick check on your introcfg.ini should look like this

bootup=xmb;

nocancel=yes;

cancelbutton=start;

now copy over the files (eboot.pbp, pmfplayer.prx, intro.pmf and introcfg.ini) to your memstick, start filer, select the files (with square you can mark them) copy to ramdisk, go flash1, enable hacker mode, create a new folder called cintro and paste your ramdisk content. restart enable autoboot from recovery menu. done.

7.1 - load CIntro from BOOT folder

Spoiler for CIntro from BOOT folder:

if you don't want to flash and want cintro to start from BOOT folder.
open up the EBOOT.PBP and change the path at 0x6294 to "ms0:/PSP/GAME/BOOT/intro.pmf" and the path at 0x62D8 to "ms0:/PSP/GAME/BOOT/introcfg.ini" save. after that open pmfPlayer.prx change the path at 0x7EA8 to ms0:/PSP/GAME/BOOT/introcfg.ini save. make a quick check on your introcfg.ini should look like this

bootup=xmb;

nocancel=yes;

cancelbutton=start;

enable autoboot from recovery menu. done.

8.0 - Change System Version

Spoiler for Change System Version:

since 3.03OE-B Dark_Alex has splitted systemctrl.prx in into systemctrl.prx and vshctrl.prx and therefore the System Version information is now in vshctrl.prx. open it (/kn) and look at 0x3BF0 you will see 3.03 OE-B written in unicode. write anything you like but don't exceed the letters given.
QuickNote: on 3.03OE-C the offset is 0x3D70.
3.10OE-A offset: 0x3D90

Spoiler for Screenshot:

Note: You can't spoof Firmware Number with this.

Originally Posted by Dark_AleX

The change to the text displayed in version is just that: only a hack to the text displayed, when the module sysconf_plugin is about to write the info in the screen.

I added a function in the se/hen sdk to fake the devkit version (stored simply in ram, it doesn't use index.dat), but the vsh uses another functions to check the version, vvvGetVersion and another one that calls internally vvvGetVersion, those get the version from index.dat.

It really has not much sense to fake the version anyways.

which basicly means changes done here are only visual

9.0 - Goto Favorite Web page by a link on the XMB (by zmathue)

Spoiler for web page link on xmb:

Originally Posted by zmathue

I found it myself when I was board...

Have you ever wanted to go to your favorite web page by a link on your xmb?

This mod allows you to do so by clicking on the online manual link on the xmb and it will take you to your favorite web page

1. If you do not know how to use psp filer find out then download it
2. dump htmlviewer_plugin from flash0/vsh/nodule in OE or flash0/vsh/module in devhook
3. Open it in a hex editor and search for "http://manuals.playstation.net/document/pspindex.htm"
4. replace "http://manuals.playstation.net/document/pspindex.htm" with you favorite website
5. hex out remaining byte

Note: dont use a website with more then 52 characters
Note: remove the quotes when you search

Original Thread: Launching A Website From The XMB

10.0 Change Loading Icon & Corrupted Icon

Spoiler for Corrupted/Loading Icon & Save Data Games Icon:

this is one seems out of place ;>

you have to use a 2.5 game_plugin.rco as they aren't encrypted.

The loading icon beginns at 0x6FD8 and ends at 0x7273.
the icon (with kgsws tools compressed .dat) to replaced can be maximal 668bytes big.

Spoiler for Screenshot:

The corrupted icon (yes i know pointless...)
beginns at 0x85EC and ends at 0x8C87. the maximum size is 1.692bytes.

Spoiler for Screenshot:

Also as you can see many texts are in there, like Corrupted Data and such, look in 4.0/4.1 for more information.
Note: you also have to "remove" the shadow and glow effect
Corrupted Icon: shadow: 0x6BFC glow: 0x6C10
Loading Icon: shadow: 0x6BC4 glow: 0x6BD8

Update: Use a game_plugin.rco of 1.00.
this game_plugin.rco allows to have a bigger loading icon! 960bytes maximum.
Loading Icon: 0x813C-0x84FB size: 960bytes shadow: 0x31CC
Corrupted Icon: 0xB744-0xBDDF size: 1.692bytes shadow: 0x322C glow: 0x3240

Spoiler for Screenshot:

Change the Saved Data Games Icon:
savedata_plugin.rco 1.00
Icon is located at 0x4CDC-0x509B size: 960bytes
didn't found the pointer to the shadow/glow so you have to break the icons itself.
shadow icon: 0x5E90
glow icon: 0x509C

Spoiler for Screenshot:

as you can see the glow is actually quite cool ;>

10.1 - Change Coldboot Sound

Spoiler for Coldboot.vag:

get the opening_plugin.rco of your firmware, don't use one of a previous firmware as this will mess up the psx emu.
inside the opening_plugin.rco are 2 .vag files, because of stereo.
the first vag sound file (left channel) appears at 0x3B58, ends at 0x1C559.
the second vag sound file (right channel) appears at 0x1C568 and ends at 0x34F69.
replace both with your favourite coldboot sound vag file.

10.2 - Change XMB Click Sounds

Spoiler for XMB sounds:

3.03 system_plugin.rco are 8 .vag files
1. 0xC4F0-0xC93F (1104bytes)
scroll through xmb sound. (aka cursor ;p)

2. 0xC940-0xCD8F (1104bytes)
NormalOK sound.

3. 0xCD90-0xD1DF (1104bytes)
is the "back" click sound

4. 0xD1E0-0xD62F (1104bytes)
Enter click sound.

5. 0xD630-0xDA7F (1104bytes)
Options sound.

6. 0xDA80-0xDAEF (112bytes)
seems to be a dummy sound

7. 0xDAF0-0xF8FF (7696bytes)
System ok sound

8. 0xF900-0x1482F (20272bytes)
System Error sound

1.00 system_plugin.rco also 8 .vag files, but they allow to put in sound files with a much higher size.

1. 0x100D8-0x15007 (20272bytes)
scroll through xmb sound. (aka cursor ;p)

2. 0x15008-0x1BCE7 (27872bytes)
NormalOK. (didn't heard it yet in the xmb)

3. 0x1BCE8-0x24C37 (36688bytes)
Back sound. (didn't heard it yet in the xmb)

4. 0x24C38-0x2D6E7 (35504bytes)
Enter click sound.

5. 0x2D6E8-0x36157 (35440bytes)
Options sound.

6. 0x36158-0x38807 (9904bytes)
error sound.

7. 0x38808-0x44717 (48912bytes)
System Ok sound.

8. 0x44718-0x4A707 (24560bytes)
System Error.

Note: unlike changing the coldboot sound you have to keep the original fileheader this time.

Attachment: ok here just a quick "proof of concept" ... lol
you have to provide the system_plugin.rco of 1.00 bogus,
run the "patcher", it replaces the cursor xmb sound with WinXP Ballon sound. yes its an exe you can trust me ... or not. the .vag file is also included.


11.0 - Having fully customized opening_plugin.rco with PSX working

Spoiler for coldboot:

so have a fully customized opening_plugin.rco, bootwave, custom coldboot text + psx emu fully working.

get yourself a decrypted game_plugin.prx of your _current_ firmware.
open it with hexeditor make a search for opening_plugin.rco and look for
flash0:/vsh/resource/opening_plugin.rco

change it to lets say:
flash0:/vsh/resource/0pening_plugin.rco
save.

rename the original 3.03/3.10 opening_plugin.rco to 0pening_plugin.rco

flash game_plugin.prx to vsh/nodule and 0pening_plugin.rco to vsh/ressource.

to be continued...

yes i know this how to is a terrible mess, ugly and far from beeing complete (not to mention the typos + grammatical errors which probably have burned your eyes by now)
so sorry for that but i think it still has some valuable information inside. (please correct if wrong/misleading instructions found!)
anyway i'll spend more on this if people are even interessted in this ;>

see original thread at maxconsole
http://forums.maxconsole.net/showthread.php?t=45330
very many people cared

;p

[ItsaSpoon]

wow very big guide

[Spirit Hawk Leon]

Ah, I did many of these things anyway. about this.

4.1 Change Text under XMB -> Settings -> System Settings - coming soon
Can't this be done with only a 2.5 file, so wouldn't the new stuff like "UMD Auto-Start" disappear, and cause the psp to crash when selected? I know i've heard of this somewhere....

[bstronga]

Originally Posted by Spirit Hawk Leon

Ah, I did many of these things anyway. about this.

4.1 Change Text under XMB -> Settings -> System Settings - coming soon
Can't this be done with only a 2.5 file, so wouldn't the new stuff like "UMD Auto-Start" disappear, and cause the psp to crash when selected? I know i've heard of this somewhere....

yep, exactly. enable flash/wmv are also affected when doing this, doesn't crash though when clicked.
not very useful, yes, still i think it's something some people can live with ;o

[Spirit Hawk Leon]

Originally Posted by bstronga

yep, exactly. enable flash/wmv are also affected when doing this, doesn't crash though when clicked.
not very useful, yes, still i think it's something some people can live with ;o

Ah so it doesn't crash, though blank spaces are still a little annoying. Who know's maybe someone will make a hack with the text in it, somewhat like the topmenu_plugin.....