Sponsored Links

Sponsored Links

Page 1 of 2 12 LastLast
Results 1 to 10 of 16



  1. #1
    Forum Moderator PS3 News's Avatar
    Join Date
    Apr 2005
    Posts
    27,702
    Sponsored Links

    PS3 MFW XMB InGame ScreenShot Feature Allows Saving ScreenShots

    Sponsored Links
    Following up on the recent PS3 MFW Builder updates, today PlayStation 3 developer Mysis (via tiefputin2) has been working on an XMB InGame ScreenShot feature which allows PS3 MFW (Modified Firmware) users to take and save screenshots in every PS3, PSP and PS Minis game except for PS2.

    PlayStation 3 developer haz367 has also coded a [Register or Login to view links] script ([4.46] in-game screenshot feature) for use with [Register or Login to view links] followed by a fixed Rebug 4.46.1 CEX Lite [Register or Login to view links] file and a [Register or Login to view links], a [Register or Login to view links] and a [Register or Login to view links] by RazorX for those interested.

    Additionally, lex3a shared some [Register or Login to view links] stating: InGame Screenshot + Remote Play with PlayStation 3 (Windows Software) patches for 4.50 CEX. Tested only vsh.self, working OK. Nicolas17 also compiled an XMB InGame ScreenShot.rar PKG for those interested in testing it out.

    From flynhigh09 also comes Rebug Rex 4.46 with permaphoto patch only ([Register or Login to view links] - MD5: B8CCD05DE7C1E1CD2039E8F0AD65A411) which must be installed from 3.55 due to the image version and some [Register or Login to view links] SPRX and VSH mods as well alongside a Rogero 4.46 v1.01 [Register or Login to view links] (RAR Password: console-hax.com) patch.

    Below are the XMB InGame ScreenShot Feature updates and some Remote Play with PlayStation 3 (Windows Software) details, as follows:

    XMB InGame ScreenShot Feature

    Allow: taking screenshots in every game (ps3,psp,minis,... - except ps2)

    4.21 retail: Export: vshmain_981D7E9F is retrieving enabled(1)/disabled(0) Screenshot feature-flag from dword_720A4C+4
    Code:
    seg001:0000000000193498
    seg001:0000000000193498 _Export_vshmain_981D7E9F:               # DATA XREF: OPD:_Export_vshmain_981D7E9F_opd�o
    seg001:0000000000193498                 lis       r9, dword_720A4C@h
    seg001:000000000019349C                 lwz       r9, dword_720A4C@l(r9)
    seg001:00000000001934A0                 addi      r9, r9, 4
    seg001:00000000001934A4                 lwarx     r0, r0, r9                                ->  li    r0, 1
    seg001:00000000001934A8                 srawi     r9, r0, 0x1F
    seg001:00000000001934AC                 xor       r3, r9, r0
    seg001:00000000001934B0                 subf      r3, r3, r9
    seg001:00000000001934B4                 srwi      r3, r3, 31
    seg001:00000000001934B8                 extsw     r3, r3
    seg001:00000000001934BC                 blr
    seg001:00000000001934BC # End of function _Export_vshmain_981D7E9F
    This fix will make xmb enabling screenshot save button, but it will error out when trying. it requires another patch inside vsh.self:
    Code:
    sub_195084:  (4.21 retail as well)
    ...
    seg001:00000000001950A0                 lwz       r9, dword_720A4C@l(r9)
    seg001:00000000001950A4                 stfd      f31, 0x190+var_8(r1)
    seg001:00000000001950A8                 std       r22, 0x190+var_68(r1)
    seg001:00000000001950AC                 std       r23, 0x190+var_60(r1)
    seg001:00000000001950B0                 std       r24, 0x190+var_58(r1)
    seg001:00000000001950B4                 std       r25, 0x190+var_50(r1)
    seg001:00000000001950B8                 std       r26, 0x190+var_48(r1)
    seg001:00000000001950BC                 std       r27, 0x190+var_40(r1)
    seg001:00000000001950C0                 std       r28, 0x190+var_38(r1)
    seg001:00000000001950C4                 std       r29, 0x190+var_30(r1)
    seg001:00000000001950C8                 std       r31, 0x190+var_20(r1)
    seg001:00000000001950CC                 addi      r9, r9, 4
    seg001:00000000001950D0                 lwarx     r0, r0, r9                                ->  li    r0, 1
    seg001:00000000001950D4                 cmpwi     cr7, r0, 0
    seg001:00000000001950D8                 li        r3, -0x270D
    seg001:00000000001950DC                 beq       cr7, return
    vsh.elf (CEX, 4.50)
    Code:
    < 00184278  7C 00 48 28
    ---
    > 00184278  38 00 00 01
    
    < 00185EB0  7C 00 48 28
    ---
    > 00185EB0  38 00 00 01
    Thats it! Enables Screenshot-Feature working fine. Have fun, i do !

    From haz367: For rebug 446 lite cex it's 99% these 2 offsets ?! replace and sign.. these offsets/values are the originals, the bold ones needs replacing:
    Code:
    rebug 446lite cex - vsh.elf
    
    offset 184070
    
    29 00 04 7C 00 48 28 7C 09 FE 70
    
    offset 185ca8
    
    29 00 04 7C 00 48 28 2F 80 00 00
    How to decrypt the self: Use updated SCETool.. it's included in reddot's ps3mfw 0.3.1. Just use:
    Code:
    scetool -d vsh.self vsh.elf
    or use SCETool GUI and replace old scetool with new. For re-encrypt:
    Code:
    scetool.exe -v --sce-type=SELF --compress-data=TRUE --skip-sections=TRUE --key-revision=1C --self-auth-id=10700005ff000001 --self-vendor-id=01000002 --self-type=APP --self-fw-version=0004004600000000 --self-app-version=0004004000000000 --decrypt vsh.self vsh.elf
    scetool -- 335kb
    MD5: 3604e5f07a8b3bb119196b6cb35be643
    gitorious.ps3dev.net/mfw-tasks-custom/mfw-tasks-custom/commits/master

    After fix use this vsh command:
    Code:
    -0 SELF -1 TRUE -s FALSE -2 1C -3 10700005FF000001 -4 01000002 -5 APP -A 00040046
    From RedDot-3ND7355: Hey guys! Here's the changes that happened from 446 to 450!!!

    [Register or Login to view links] <-- It has lv1 peek&poke <-- credits to habib!
    Code:
    Patches done to 4.50 CFW ;) (Verified habib's CFW by RedDot!)
    ===============================================================
    lv1 peek&poke -0x1299C4-
    original
    64 00 FF FF 60 00 FF EC F8 03 00 C0 4E 80 00 20 38 00 00 00 64 00 FF FF 60 00 FF EC F8 03 00 C0
    replace
    E8 83 00 18 E8 84 00 00 F8 83 00 C8 4E 80 00 20 38 00 00 00 E8 A3 00 20 E8 83 00 18 F8 A4 00 00
    ===============================================================
    lv1 remove lv2 protection  -0x23AA9C-
    original
    48 00 E0 81 2F 83 00 00 38 60 00 01 41 9E
    replace
    60 00 00 00 2F 83 00 00 38 60 00 01 48 00
    ===============================================================
    lv2 peek&poke (part 2) -0x36F105-
    original
    33 AE 48 80 00 00 00 00 33 AE 48 80 00 00 00 00 33 AE 48 80 00 00 00 00 33 AE 48 80 00 00 00 00 33 AE 48 80
    replace
    00 17 78 80 00 00 00 00 00 17 80 80 00 00 00 00 00 17 88 80 00 00 00 00 00 17 90 80 00 00 00 00 00 17 98 80
    And if cobra usb works for OFW for 450 or 446 then man... BTW i updated the [Register or Login to view links]

    From sandungas: Enabling screenshot icon on XMB photo column permanently (is supposed to work OUTSIDE of games to take screencaptures of main XMB)

    In dev_flash\vsh\resource\explore\xmb\category_photo. xml
    In line 45:
    Code:
    src="sel://localhost/screenshot?category_photo.xml#seg_screenshot"
    Replace by:
    Code:
    src="#seg_screenshot"
    Explanation: The "sel" functions in XMB are used as "conditionals"... in this case in the original .xml the condition is "screenshot?"

    If the condition is satisfied then the icon is visible, and when clicking in it the code "jumps" to the tag "seg_screenshot" that is in the same .xml at bottom (in line 265)

    The problem: The condition can only be satisfied by the code inside games eboots (actually one of the mysis patches in vsh.self enables it permanently, but "main XMB" is built with the .xml's)... but to take screenshots of the main XMB we dont have any eboot loaded, so it will never be satisfyed (so is needed to unlock the icon in the xml's)

    The "trick" I made is simply to remove the condition... the tag reference still is there because is needed to make the "jump" to line 265 that does the real magic.

    The "jump" doesn't contains the full path to the xml file/segment because is pointing to a tag in the same xml file (in this case you can jump from one tag to other by simply pointing to the other tag name)

    This has not been tested yet, please report if it works. All lines positions i said are for 4.50 firmware... but is the same idea for any other firmware versions

    Is an icon in XMB photo column. It works in the same way than the "quit game" icon in XMB game column... but for "quit game" the condition is "sel://localhost/ingame?" (so "quit game" icon appears for all apps when you are inside them)

    Mysis patches for vsh.self are for 4.21, then flatz added patches for 4.50... so by now only works in these 2 firmwares. My .xml edit works on all firmwares, but without the vsh.self patches i don't think it will work ingame.

    And about the "loading" icon instead of the screenshot icon in main XMB... I think is because is trying to display the TITLE of the game under the icon in a smaller font (and there is no TITLE loaded in main XMB)

    I think mysis patches includes what i explained (only working ingame, not in main XMB) but is patching more things, not only this

    Anyway... another alternative to enable the icon only ingame from the xml's: In dev_flash\vsh\resource\explore\xmb\category_photo. xml

    In line 45:
    Code:
    src="sel://localhost/screenshot?category_photo.xml#seg_screenshot"
    Replace by:
    Code:
    src="sel://localhost/ingame?category_photo.xml#seg_screenshot"
    Replaced the condition "screenshot" by "ingame" so is supposed to work in all games, and not visible in main XMB. Like I said I don't think this is an alternative to mysis patches (only replaces one of them)... but maybe simplifies them a bit because is more convenient to patch an .xml than a .self.

    The first .xml patch i posted enables screenshot in "XMB ingame" and in "main XMB" (i was trying to enable in both but we crashed with the problem of the requirement of the TITLE of an eboot that doesn't exist)

    The last .xml patch only makes the icon to appear in "XMB ingame" is what we have working by now (the second vsh patch is enabling it in "main XMB" also but we cant use it because the problem with the icon text and the filename based on TITLE)... maybe patching the .sprx there is some way to fix this problem, but this is a different history.

    Now I realize what i was trying is more complicated than i imagined, but the second .xml patch is usable. For the .tlc patch i think is better to use one patch in vsh.self and other in the category_photo.xml... mostly because it will be easier to mantain and port in long term

    But for the people that wants to test now and don't want to wait for rebug or MFW is better to use the vsh.self with the 2 patches, just because is better to overwrite 1 file than 2 (less risky, and less room for mistakes)

    I guess is a question of "personal tastes". Also, I don't know which of the 2 vsh patches is replaced by the .xml patch (I guess is the first one listed in wiki, but I'm not sure)

    Remote Play with PlayStation 3 (Windows Software)

    premo_plugin.prx

    for 4.50
    Code:
    < 0xB7E4 38 60 00 00  li r3, 0
    ---
    > 0xB7E4  38 60 00 01 li r3, 1
    
    premo_game_plugin.prx
    for 4.50
    Code:
    < 0xC9E4 38 60 00 00  li r3, 0
    ---
    > 0xC9E4 38 60 00 01  li r3, 1
    Enables playing Remote Play enabled games (via SFO) to be played via sonys official remote play pc software.

    lv1.self

    graf chokolo patch

    lv1_undocumented_function_114 (mmap)
    Code:
    < 000f5a40  39 08 05 48 39 20 00 00  38 60 00 00 4b ff fc 45
    ---
    > 000f5a40  39 08 05 48 39 20 00 01  38 60 00 00 4b ff fc 45
    
       2d5a38:	7f 87 e3 78 	mr      r7,r28
       2d5a3c:	e8 89 00 00 	ld      r4,0(r9)
       2d5a40:	39 08 05 48 	addi    r8,r8,1352
    -  2d5a44:	39 20 00 00 	li      r9,0
    +  2d5a44:	39 20 00 01 	li      r9,1
       2d5a48:	38 60 00 00 	li      r3,0
       2d5a4c:	4b ff fc 45 	bl      0x2d5690
       2d5a50:	38 00 00 00 	li      r0,0
    wutangrza patch

    hash fixing
    Code:
    < 00136bc0  00 00 00 00 00 00 00 00  72 73 78 20 64 72 69 76  |........rsx driv|
    ---
    > 00136bc0  00 00 00 00 00 00 00 00  72 73 73 20 64 72 69 76  |........rss driv|
    
    < 00136be0  3a 20 63 6f 72 65 2f 63  6f 6e 74 65 78 74 2e 63  |: core/context.c|
    ---
    > 00136be0  3a 20 63 6f 72 65 20 63  6f 6e 74 65 78 74 2e 63  |: core context.c|
    lv2_kernel.self

    PL3 patch

    lv2 peek / poke
    Code:
    < 00029330  7c 63 07 b4 38 21 00 a0  4e 80 00 20 3c 60 80 01
    ---
    > 00029330  7c 63 07 b4 38 21 00 a0  4e 80 00 20 e8 63 00 00
    
    < 00029340  60 63 00 03 4e 80 00 20  3c 60 80 01 60 63 00 03
    ---
    > 00029340  60 00 00 00 4e 80 00 20  f8 83 00 00 60 00 00 00
    
     8000000000019330:	7c 63 07 b4 	extsw   r3,r3
     8000000000019334:	38 21 00 a0 	addi    r1,r1,160
     8000000000019338:	4e 80 00 20 	blr
    -800000000001933c:	3c 60 80 01 	lis     r3,-32767
    -8000000000019340:	60 63 00 03 	ori     r3,r3,3
    +800000000001933c:	e8 63 00 00 	ld      r3,0(r3)
    +8000000000019340:	60 00 00 00 	nop
     8000000000019344:	4e 80 00 20 	blr
    -8000000000019348:	3c 60 80 01 	lis     r3,-32767
    -800000000001934c:	60 63 00 03 	ori     r3,r3,3
    +8000000000019348:	f8 83 00 00 	std     r4,0(r3)
    +800000000001934c:	60 00 00 00 	nop
     8000000000019350:	4e 80 00 20 	blr
     8000000000019354:	3c 60 80 01 	lis     r3,-32767
     8000000000019358:	60 63 00 03 	ori     r3,r3,3
    wutangrza patch

    hash fixing
    Code:
    < 002d6e00  6f 75 6c 64 20 6e 6f 74  20 67 65 74 20 50 50 50  |ould not get PPP|
    ---
    > 002d6e00  6f 75 6c 64 20 6e 6f 74  20 6e 6f 74 20 6e 6f 74  |ould not not not|
    ---
    < 002d6e10  6f 45 20 68 65 61 64 65  72 0a 00 00 00 00 00 00  |oE header.......|
    ---
    > 002d6e10  20 6e 6f 74 20 6e 6f 74  20 6e 6f 74 20 6e 00 00  | not not not n..|
    
    < 00359380  a0 40 36 6b 2d 8a 50 99  1e b3 0c 53 e5 9b 5d 6e
    ---
    > 00359380  5e b8 a5 00 8c f3 bc 24  08 91 19 61 e6 db 19 cb
    ---
    < 00359390  61 2c ac b8 00 00 00 00  00 00 00 00 00 00 00 00
    ---
    > 00359390  0d ca fd 2f 00 00 00 00  00 00 00 00 00 00 00 00
    Finally, below are some more TCL updates from RazorX, as follows:
    Updated tcls and added new ones:

    All tested and now working.. created my own cfw from 4.50ofw and used all above except replace_vsh_file. Here's some info on the new ones:
    • customize_wave - allows you to replace the cfws xmb wave
    • patch_alpha_xml - lets you sort games in alphabetical order
    • replace_vsh_file - lets you replace the vsh.self in pup
    • replace_warning - lets you replace the startup warning and photosensitive epilepsy warning

    I just made this simple tcl file ([Register or Login to view links]) it just sets the build/image version but still doesn't fix the issue i will try to download yours again. sorry forgot to mention it has 3 options which sets the build/image version for either 3.55, 4.46 or 4.50.
    From RedDot-3ND7355: My way is different, and mine only applies for 4.50, so if there is other fw you want me to add to the list just tell me their build #'s & fw and i'll add them: [Register or Login to view links]

    PS3 MFW XMB InGame ScreenShot Feature Allows Saving ScreenShots

    PS3 MFW XMB InGame ScreenShot Feature Allows Saving ScreenShots

    PS3 MFW XMB InGame ScreenShot Feature Allows Saving ScreenShots

    More PlayStation 3 News...
    Attached Thumbnails<br><br> Attached Thumbnails

    2hki.png   83vu.png   g7mc.png  
    Attached Files Attached Files

  2. #2
    Senior Member StanSmith's Avatar
    Join Date
    Feb 2012
    Posts
    667
    Sponsored Links

    Red Face

    Sponsored Links
    Nice but I've RSOD before editing things manually so I'd prefer a patch.

    And as I use Rebug CFW I'll wait for them to release a patch or someone to release a patch for my CFW. Rebug 4.21.2

  3. #3
    Senior Member seeman's Avatar
    Join Date
    Mar 2011
    Posts
    97
    Sponsored Links
    Sponsored Links
    i'm using newest rogero... can smb edit the files for me and can upload them?

  4. #4
    Senior Member BlackDeath's Avatar
    Join Date
    Sep 2006
    Posts
    43
    Works like a charm with Rebug CFW 4.46. Thanks ^_^

  5. #5
    Member lordzxX's Avatar
    Join Date
    Sep 2009
    Posts
    26
    not work for re-encrypt self...
    Code:
    '.] Error: Unknown type 'SELF
    '.] Error: unknown SELF type 'APP[*] Loaded keysets.[*] Loaded loader curves.[*] Loaded vsh curves.[*] Error: Could not find keyset for SE[*] Error: Could not decrypt header.
    use sceetool in Our MFW 0.3.1/tools/scetool.exe
    Code:
    Command: scetool.exe -v --sce-type=SELF --compress-data=TRUE --skip-sections=TRUE --key-revision=1C --self-auth-id=10700005ff000001 --self-vendor-id=01000002 --self-type=APP --self-fw-version=0004004600000000 --self-app-version=0004004000000000 --decrypt vsh.self vsh.elf
    file: vsh.elf ( fw4.50 ) decrypt but no re-encrypt.... WHY!?!?

    I could not understand the error .. and was in command. In fact, on the thread, the commands are wrong.
    What exactly is:

    Code:
    scetool.exe -v --sce-type=SELF --compress-data=TRUE --skip-sections=TRUE --key-revision=1C --self-auth-id=10700005ff000001 --self-vendor-id=01000002 --self-type=APP --self-fw-version=0004004600000000 --self-app-version=0004004000000000 --encrypt vsh.elf vsh.self
    I just shows the following error.

    Code:
    [*] Loaded keysets.[*] Loaded loader curves.[*] Loaded vsh curves.[*] Skipped program header LOAD     @ 0x006F9720 (0x00000000)[*] Skipped program header LOAD     @ 0x006F9720 (0x00000000)[*] Skipped program header TLS      @ 0x006E1344 (0x00000000)[*] Skipped program header PARAMS   @ 0x006A9D00 (0x00000000)[*] Skipped program header PRX      @ 0x00000000 (0x00000000)[*] SELF built.[*] Skipped compression of section 002 (size is zero)[*] Data compressed.[*] Error: Could not find keyset for SELF.[*] Error: Data not encrypted.
    scetool of keys in the file, I have all the keys, including 4.46 and 4.50. I do not understand why it is not able to compile it.
    you have any ideas?

  6. #6
    Contributor swodniw's Avatar
    Join Date
    Oct 2013
    Posts
    10
    can i use the 450CEX_Patches.zip for HABIB 4.50?

  7. #7
    Contributor xr3b0rn's Avatar
    Join Date
    Feb 2012
    Posts
    8
    Everyone that cant use ps3mfw properly and gets error signing and stuff PLZ

    presize the fw you are trying to mod AND plz set the key folder to "data" folder in ps3mfw 0.3.1

  8. #8
    Contributor swodniw's Avatar
    Join Date
    Oct 2013
    Posts
    10
    I have no idea what i'm reading do i need the MFW 0.3.1 to get the "XMB InGame ScreenShot"? or is there a way to only get the Screenshot feature?

  9. #9
    Registered User NEO117's Avatar
    Join Date
    Dec 2010
    Posts
    2
    Working great on Rebug 4.46.1 REX

    This could really benefit from a shortcut though... Some games tend to open the pause menu when you press the PS button. Maybe a keyboard combo.

  10. #10
    Junior Member Nicolas17's Avatar
    Join Date
    Jan 2012
    Posts
    14
    I created a Package for Easy Installation.. Please Test.

    Installation
    • Enable /dev_blind write access to /dev_flash
    • Just double click it in multiMAN
    • Then reset your console

    Download XMB InGame ScreenShot ALL CFW: [Register or Login to view links] (Password: console-hax.com)

 

Sponsored Links
Page 1 of 2 12 LastLast
Affiliates - Contact Us - PS3 Downloads - Privacy Statement - Site Rules - Top - © 2014 PlayStation 3 News