Update: Added 'Change your PSP's MAC address'.

I started writing this guide a while ago, but never got round to finishing it. This tutorial will tell you how to:

• How to use PSPfiler (Used in losts of tutorials)
• Customise your PSP's opening sound (1.50 only)
• Changing the game intro movie (Gameboot)
• Change the horizontal XMB icons
• Make the XMB sounds really cool & Change the icon that appears for a second or two while the icon for your homebrew loads. This also changes the default icon for a game without a predefined one.
• Change the version number to anything (includes letters; up to 9 characters; 3.02 OE only)
• Free some space on your flash0 for other stuff
• Making backgrounds suitable for firmware 3.00+
• Changing your PSP's visible MAC address
  

Right, shall we start?

---------------------

How to Use PSPfiler (Thank Syphon for writing this)

You can find PSPfiler's latest version here:
http://www.geocities.jp/mediumgauge/filer2.4.zip
1. Setting up the program:
1. Run PSPFiler
2. Press "SELECT" to bring up the program options.
3. Press "CIRCLE" to change the language into English. (or if you understand and prefer the original language, don't bother change it into English)
4. Press "SQUARE" to save the changes
5. Press "X" close the options menu.

2. Searching through directories/folders & selecting files:

1. Press "START" to scroll through the different directories. There 5 directories. You can see which one you are in by looking at the top left corner of the screen. The directories are:
* ms0:/
* disk0:/
* flash0:/
* flash1:/
* RAMDISK:/

To open & close a folder, press "CIRCLE" when highlighting them.

To select a file, press "SQUARE" when highlighting it.

Folders end with a SLASH ( / ) & files end with an extension (.bin, .pgf, .mp3, etc).

Folders will expand if items are in them.

Files will have an asterisk ( * ) when selected.

3. Enabling "Hacker Mode":

Hacker mode needs to be enabled in order to make any changes to the system. You will not be able to make changes such as renaming, copying, overwriting, etc. if hacker mode is not enabled.

1. To enable, press LEFT TRIGGER + RIGHT TRIGGER + LEFT D-PAD
2. The words "Hacker Mode" will be shown in red to let you know it is enabled.

4. Deleting Files:

1. With Hacker mode enabled, go into the directory that contains the file you wish to delete.
2. Press "Square" to select it.
3. Press "X" to bring up the file options
4. Press "SQUARE" (remove all marked files)
5. A confirmation box will ask if you are sure about your actions.
6. Press "CIRCLE" (OK) to delete.
7. A box will show "# file(s) removed". Press "CIRCLE" to remove this box.

5. Copying TO RAMDISK

1. With Hacker mode enabled, go into the directory that contains the file you wish to copy.
2. Press "Square" to select it.
3. Press "X" to bring up the file options
4. Press "CIRCLE" to copy the marked file to RAMDISK
5. A box will show "# file(s) copied". Press "CIRCLE" to remove this box.

6. Copying file FROM RAMDISK
If you have a file you copied to the RAMDISK & have edited it, this is what you do to transfer said file to another directory.

1. Press "START" until you are in the directory you want the file to be copied to
2. Press "X" to bring up the options menu
3. Press "TRIANGLE" to copy all files in RAMDISK here

7. Rename Files

1. With Hacker mode enabled, go into the directory that contains the file you wish to copy.
2. Press "Square" to select it.
3. Press "X" to bring up the file options
4. Press "RIGHT TRIGGER" to bring up the text entry options.
5. Very similar to the default PSP text entry input. I don't really need to explain how to use this.
6. Once you're done renaming, press "ENTER" on the center top of that menu screen.

--------------

Customise your PSP's opening sound
What you will need:
- EitherX-flash (latest version), or PSPFiler (v1.6 or later).
- The opening_plugic.rco file from a 1.50 PSP. You can obtain it from your own PSP, or you can get one in the file you'll be downloading later. I don't really care which.
- THIS file.

This is moderately easy. You will need to be using firmware 1.50 for this hack. Of course, there is one easy and way to do this, and one that is a little more dangerous and thrilling. If you got your PSP for christmas, or you don't want to take the risk of ending up with just another useless household ornament for your dog to pee on because the unit is broken, (IE, you have a brick), or even don't know how to use PSPfiler, then skip step 3.

1. Finding your sound:
You will need a .wav (wave) audio file for this, no longer than 4 or 5 seconds. Make sure it is an uncompressed wave audio file! (If it isn't uncompressed, go [HERE])You will also need the file in the 'What you will need' section, "ThemePSP Creator Pack.rar". Now, extract the folder "bootsound" from the archive to your desktop. Place the .wav file with it.

2. Converting your boot sound
Open up MFAUDIO.exe from the folder we extracted. In the top section, press 'open' and select your audio file. Press 'play' to hear it. (If you got an error about the file being compressed, go [HERE]).
In the bottom section, press 'Save as' and find the place to save, naming it coldboot.vag. Select the output format as a PSX .VAG file. Press 'Process!' and it should output a coldboot.vag file to the selected place.
Also, did you know that if you reverse the procedures, and load the .vag file, selecting the WAV format for output, you can convert them back? Pretty useless, but I felt like saying it.

3. Injecting the sound into the firmware file
Since the folder we extracted already has the file we need, you don't need to dump anything from the flash on your PSP. So, open up PSPmenuedit.exe, and look at the right hand side of the window, which is the startup sound option. Click on the three dots next to the file selection box, and locate the RCO file in the extracted folder. Press the button to insert new audio, and locate your VAG file.
It should now inject the sound and pad the remaining bytes; it will then adjust the header, and you're done with the main part!
By the way, if you wanted, you could extract the existing vag file from the file with the extract audio button, just for the novelty of having the original Sony sound, or to see if you've already injected a custom sound into the file. You can then play it with MFaudio.

4. Flashing the sound
Depending on whether you've chosen to use X-flash, or are going to do it manually with PSPfiler, you need to follow these instructions carefully.

For X-flash (You skipped step 3): Install X-flash, and place the coldboot.vag in X:/PSP/GAME/xflash (OR __SCE__XFLASH)/xflash/modified/.
Open up X-flash in the XMB (not from iRshell or anything like that), and scroll down to the 'APPLY ALTERNATE SOUND EFFECT' option (usually option 2), and then press [>] or [<] until you find the option about applying an external opening sound. (There is also one to apply it with echo at the end). Press [X] to confirm, and it will flash.
To exit, hold the Home button, and you will get yellow X's flying accross the screen. Keep doing it until red ones start to go across, finish, and you get the 'Turn off' message. Your PSP will shut down, so start it back up and listen to your new coldboot!

To do it manually (You modified the RCO file):
Put the Opening_Plugin.rco file into the root of your memory stick. Open up PSPfiler and use the first tutorial on this page to flash the file to Flash0:/vsh/resource/. Done!

-----------------

Changing the game intro movie

This is easy. Download a cool gameboot.pmf file that you like (no bigger than 500kb if you're on a custom 2.71 or 3.02 firmware). Place it in "X:/PSP/GAME/xflash (OR __SCE__XFLASH)/xflash/modified/".
Open up X-flash, find the changing game intro movie option, and press [/\] to flash a custom one. I think it's [X] to apply a blank one, and [O] to restore it.

------------------

Changing the main XMB icons

There is a really tedious way to do this, and a new fairly simple way. I'm not going to bother with the tedious way, most of you lot won't understand it. It invloves scripts and hex-editors and encoding and backward-engineering of all kinds!

Download [THIS] file. When you have, you'll need your icons. They MUST be 64x64 pixels, 8-bit, bmp format images.

It's unlikely that a bad one will brick your PSP, as the program wouldn't successfully insert them, but it's best to have 3.02 OE or the 1.50 custom firmware installed to be safe.
When you have them all, open the program, select your firmware, and open all your icons.
Press the create button, and if all goes well, you should end up with a topmenu_plugin.rco file with your custom icons.

Also, you can download my topmenu file with already hacked icons. (You can find a screenshot here). You can find the file [HERE].

Now, you're going to need to flash it, and all I'm going to say is that you'll have to find a way to do it. PSPFiler will do it, and there's a tutorial at the top of the page to use it, but also D-viant flash and other programs can flash the topmenu, I believe; so if you that lying around, you could use that.


-------------

Pimping the XMB sounds and game icons

You will need:
- The EBOOT.PBP of the bogus 1.00 update HERE. (Or a dump of it)
- PBP unpacker. (Google it; Not needed if you have a dump)
- PSAR dumper (This version should work)

This is an odd hack; it involves flashing two files from the 'bogus 1.00 firmware update'. When I say bogus, I mean it's real, but the firmware update isn't complete, so flashing it will brick. According to the original file source, it was leaked by Sony. This doesn't mean to say that the file isnt useful. The XMB sounds are different, as are some of the XMB icons, and the default icon for a game has the word 'Game' printed across it in big letters. This automatically makes your PSP very cool!

Now, you're going to need to download the firmware update OR the dump. The dump is illegal to distribute, as with other firmwares, but I can link you to the EBOOT. The place where I usually get the file is constantly down, so I gave you a MegaUpload link at the top of this section.
When you download, make sure you do not open it on the PSP. Open PBP unpacker, and open the EBOOT.PBP file. Extract all the files to a folder somewhere. Now, find the DATA.PSAR in the folder you extracted everything to, and put it in the root of your PSP's memory stick.
Run PSAR dumper 2B from the game menu, and choose to decrypt all. Wait, and it will then dump a F0 folder to the root of your memory stick.

Go onto USB and go to F0\VSH\RESOURCE from Windows, or whatever, and save the files game_plugin.rco and system_plugin.rco. Delete the original F0 folder, making sure you keep the two files in a safe place. If you downloaded a dump, just copy the two files to the root of your memory stick.

Put the files into the root of your memory stick, make sure you have enough space in Flash0, and flash them to VSH/Resource in Flash0 with PSPfiler. A tutorial for using it is at the top of the page.

Reboot and take a look at your XMB! Go into the game menu, scroll down really fast. You should see a cool picture when a game is loading.

--------------

Changing your version number in 3.02 OE

This hack is really cool. So far, I've had my version on the PSP as 'PSP3D CFW', 'Sex Bomb', and '0.9f BETA'! Of course, we're really not updating the PSP's firmware.

You see, in 3.02 OE and 2.71 SE, Dark_AleX decided to use an external file to display the custom '3.02 OE-X' version in the system information screen. The file 'systemctrl.prx' attacks when the user opens system information, so instead of showing 3.02 which it should be, it's displaying the custom one. The version number is actually still 3.02, which is why games work.

To edit it, dump the systemctrl.prx file from flash0:\KN to the 'Reflash' folder in the root of your memory stick. Now, make a copy and in the 'Reflash' folder, and name it systemctrl.prx.bak.
Open the original up in a hex editor (I use XVI32, it's free!). Go to decimal address 42108 (hexadecimal A47C) and locate the text '3 . 0 2 O E - B' (If you're in OE-B).

Note that these characters are seperated with the '00' character', so whatever you do, only overwrite existing characters. Make sure
So, mine is "33 00 2E 00 30 00 32 00 20 00 6F 00 45 00 2D 00 62" since I'm on 3.02 OE-B.
Note that the '20' is actually a space, so make sure that it goes 00 20 00 when writing a space.
So, if I'm calling the 00 'xx', then version '3.50 ME-A' would be
'3xx.xx5xx0xx xxMxxExx-xxA'
or
33 00 2E 00 35 00 30 00 20 00 4D 00 45 00 2D 00 41".

Get it? If not, then please PM me and I'll do one for you.

Then, save the file to X:\Reflash (where it, and it's backup should be already. Boot the PSP into recovery mode, open the 'Advanced' menu, and press [X] on 'Flash systemctrl.prx(3.02). Do not flash the 1.50 version!

Now, reboot and wait for the XMB to load. If it doesn't boot, you get a red screen or it freezes, then keep reading.
If it didn't, go to system information; did it freeze? If the answer is no, then the custom version probably showed.
If didn't boot properly or it froze just as you opened system info, then reboot, and hold [R] to go into recovery.
Now, plug your PSP into your PC and enable USB from the PSP. On the PC, go into the recovery folder, delete the 'systemctrl.prx' file, and rename 'systemctrl.prx.bak' to 'systemctrl.prx'. Now, disengage USB, and flash the 3.02 version of systemctrl.prx from 'Advanced' again, and the PSP should be back to normal. If you were stupid and didn't make a backup, or it didn't work, then you'll need to run your recovery program.

-------------------

Free some space on your flash0 for other stuff (by |-Anubis-|)

This is quite useful, but you must be careful with what you delete. Get it wrong, and BOOM, brick!

Here are some things to delete:[*] gb3s1518.bwfon (1,000 KB) located in flash0:/font can be replaced with a ltn0.pgf, with no problems cauased. Saves loads of space.
[*] jpn0.pgf (1,545 KB) also located in flash0:/font can also be replace with a ltn0.pgf however the following will be missing:
o arrows at the bottom of xmb "agreement" screens are blank
o some "tm" signs are blank
o DNAS icon while authenticating is blank.
o Arrow to the right of the On Screen Keyboard is missing.

For smaller things to delete that make the XMB lose certain functionality, go HERE.

---------------

Getting your backgrounds ready for 3.00+ (Manually)

I know there's a tool for this, but hey-ho. In 3.00 and over, Sony added a really stupid and pathetic protection to stop us from customising our PSPs... All they have done is joined them, one after the other, into one file. Before you start, make sure you have 12 bitmap files. They must be:
* 24-bit Bitmap (BMP) files
* <= 150KB in size
* <= 300x170 resolution
To combine the files yourself, do the following:
- Create a new folder
- Place all 12 background files, preferably named 01.bmp, 02.bmp, etc (until 12.bmp). That's not necessary, but preferable. Make sure they are the only BMP files in there!
- Create a new plain text (txt) file, and paste the following into it:
Save and rename the text file to 'something.bat' or 'something.cmd'. Double click it to run it, and a new BMP file named 01-12 should have joined the party. Open it, and it should look extactly the same as the first bitmap file. It has the the others after it.
Note: If you havn't got the command line associated with either of these extensions, open up the windows command line (Press Start>Run and type cmd.exe), navigate your way to the folder containing the BMPs into it by using the cd command, right click and paste copy /b "*.bmp" 01-12.bmp (No quotes). Press enter

Now you can flash 01-12.bmp to flash0:\VSH\resource!

------------

Changing your PSP's visible MAC address

This hack doesn't really change your MAC address (that's hard-coded), but it changes what the PSP says it is in system information. Before we start, I would advise you to think seriously about the consequesnces of writing to the IdStorage, a critical area on the PSP's NAND. This isn't the flash, this is much more independant, and isn't ever supposed to be touched. Your PSP will not function properly if your IdStorage is incorrect. This has only so far been tested on 3.03 OE-A.

If you would like to know more about IdStorage, please read some of what HarleyG, a fantastic hacker and one of the biggest players in the entire TA-082 fiasco, has written about it. HERE is the in-depth documentation and HERE is some-more information.

Right, now that I've warned you, let's get cracking. First, download THIS file. Extract the folder inside to the PSP/GAME150 folder on your PSP. On your PSP, open the program from the XMB, and press [X] to dump the code from 0x044, macid.bin. Quit with home, and go into USB. Open the macid.bin file from the root of your memory stick with a hex editor (not notepad), and take a look at the first 6 bytes.

It should say XX.XX.XX.XX.XX.XX (Consisting of the letters A, B, C, D, E, and F; as well as the numbers 0-9). Edit the hex characters (in XVI32 it's the left panel), do not edit the text version! Edit the first 6 bytes (consisting of 2 characters each), and save the file. Do not edit past the first 6 bytes (12 characters)!

Open the program from the XMB again, and press [L]+[O]. It should flash the file. Exit to the XMB, and if all goes well, the visible MAC address should have changed!

That's all folks! Check back later for more!

__________________