OK actually i dont have read the whole post because after the first 3 sites i fealled that i have to answer a few things:
To Beginning:
I have taken some ps3 dev_flash files and gived a little look.First i looked for the category_game_tool2.xml and the provided information from SKFU to get a better understanding how the ps3 works, how the things works that we see and how the console handle this.
I recognized that we easy can have debug options on a retail ps3 only with the editing of a ID from "root_dex" to "root".
But this would be not my style....i want to really change things not only change a text from "root_dex" to "root".I than have first added the *Install PKG and *App_Home option to the normal "root" wich will be used from the retail ps3´s.How this work can you read in SKFU´s post.
Ok so far as good.First step was done and understanding of how this kind of xml works was learned.But this dont macigally lead to FULL and working debug option.This only would result in the same psydo-dev fw that CJ have mentioned where you can see the debug options greyed out and you wouldnt be able to select them.In first case this happens because as long the xRegisrty of your PS3 dont have set the flags for debug options you can not select them.This will be blocked from a other txt xml.In those xml´s you have this options marked with xml code that will not display text.Looks like that:
Code:
<![CDATA[*Install Package File]]>
The indicated "<![CDATA[]]>" is a xml code and used to not display text.
At this moment i cam to the result that when we edit every xml and delate this xml block we should be able to se the options and also should be able to select them.This would give free Debug options for normal retail ps3´s and aslong the xRegistry is edited and have debug flags it will work.
Because its the same like the JB works.The sticks add´s the:
Code:
<Query
class="type:x-xmb/folder-pixmap"
key="seg_gamedebug"
src="xmb://localhost/%flash/xmb/category_game_tool2.xml#seg_gamedebug"
/>
<Query
class="type:x-xmb/folder-pixmap"
key="seg_package_files"
src="xmb://localhost/%flash/xmb/category_game_tool2.xml#seg_package_files"
/>
to the "id root" of our "category_game.xml".The code "xmb://localhost/%falsh/xmb/category_game_tool2.xml" tells the ps3 where to look for the defination of #seg_gamedebug and #seg_package_files.
Let us give a peek how this code looks like:
Code:
<View id="seg_gamedebug">
<Attributes>
<Table key="game_debug">
<Pair key="icon_rsc"><String>tex_album_icon</String></Pair>
<Pair key="title_rsc"><String>msg_tool_app_home_ps3_game</String></Pair>
<Pair key="child"><String>segment</String></Pair>
</Table>
</Attributes>
<Items>
<Query class="type:x-xcb/game-debug" key="game_debug" attr="game_debug" />
</Items>
</View>
<View id="seg_package_files">
<Attributes>
<Table key="host_device">
<Pair key="icon_rsc"><String>tex_album_icon</String></Pair>
<Pair key="title_rsc"><String>msg_tool_install_file</String></Pair>
<Pair key="child"><String>segment</String></Pair>
<Pair key="ingame"><String>enable</String></Pair>
</Table>
</Attributes>
<Items>
<Query
class="type:x-xmb/xmlpackagefolder"
key="host_device" attr="host_device"
src="#seg_packages"
/>
</Items>
</View>
<View id="seg_packages">
<Items>
<Query class="type:x-xmb/xmlpackagefolder" key="host_provider_host" src="host://localhost/q?path=/app_home/&suffix=.pkg&subclass=x-host/package" />
<Query class="type:x-xmb/xmlpackagefolder" key="host_provider_bdvd" src="host://localhost/q?path=/dev_bdvd&suffix=.pkg&subclass=x-host/package" />
<Query class="type:x-xmb/xmlpackagefolder" key="host_provider_ms" src="host://localhost/q?path=/dev_ms&suffix=.pkg&subclass=x-host/package" />
<Query class="type:x-xmb/xmlpackagefolder" key="host_provider_usb0" src="host://localhost/q?path=/dev_usb000&suffix=.pkg&subclass=x-host/package" />
<Query class="type:x-xmb/xmlpackagefolder" key="host_provider_usb1" src="host://localhost/q?path=/dev_usb001&suffix=.pkg&subclass=x-host/package" />
<Query class="type:x-xmb/xmlpackagefolder" key="host_provider_usb2" src="host://localhost/q?path=/dev_usb002&suffix=.pkg&subclass=x-host/package" />
<Query class="type:x-xmb/xmlpackagefolder" key="host_provider_usb3" src="host://localhost/q?path=/dev_usb003&suffix=.pkg&subclass=x-host/package" />
<Query class="type:x-xmb/xmlpackagefolder" key="host_provider_usb4" src="host://localhost/q?path=/dev_usb004&suffix=.pkg&subclass=x-host/package" />
<Query class="type:x-xmb/xmlpackagefolder" key="host_provider_usb5" src="host://localhost/q?path=/dev_usb005&suffix=.pkg&subclass=x-host/package" />
<Query class="type:x-xmb/xmlpackagefolder" key="host_provider_usb6" src="host://localhost/q?path=/dev_usb006&suffix=.pkg&subclass=x-host/package" />
<Query class="type:x-xmb/xmlpackagefolder" key="host_provider_usb7" src="host://localhost/q?path=/dev_usb007&suffix=.pkg&subclass=x-host/package" />
</Items>
</View>
Give a good look and try to understand because with this information you will be able to completely change the experince of the xmb.But by the way i have also changed the "<Pair key="ingame"><String>disable</String></Pair>" to "enable" wich should enable the Install PKG option also ingame.
What does unlocked psp only mean?
In the xml wher is defined things like what to do for psp only games and what to do for other games i have added mor code.So for normal games you came to defination what let you download games to every drive and looks a little bit like the path defination for the install pkg option.But for psp only the defination does not contain any aditional drive.Just the psp not more. 
Yes i simply added more drive definations to the psp only section wich should leed into the possability to be able to download/save psp only games to any conected drive. And such things i have done to many files.
But this is the first test of it because i cant test in case of no psgroove.There are a few things they need to be tested but im sure if this is figuered out it will run !! 
We need to check if the xRegistry needs flags or values.But i will guess to time that SKFU will be wright when he sayes to use "flags".
I then would mean that maybe the uncompressed xmls and pngs files could be a reason for some of you why the ps3 dont boot correct.It was a test to try out if it works and maybe if the ps3 boots and loads a little bit faster.
But i will change all modded rco´s and repack them with compresion headers.Or for the first tests i dont convert the png´s and let them as they are.When we get the thing running and everything works like we want we then have enough time to spend to do a visual CXMB.
And yes i call it CFW in case that we change/modify the rco´s and this is the defination of CFW for me.To time we cant change the sprx´s but in case we change the experians and usage of the xmb and do things that sony dont whant us to do its a cfw.
By the way we can learn from the xml´s some commands we can use for other things.Like i have it done to add more download paths to "only" titles and so on.
Also i have changed the version.txt and the backup of the xRegistry to reflect everything the ps3 needs to indicate as a "3.50" version one.The xReg backup is located in dev_flash2/etc/backup/ folder.But since its the first test and i dont know if this files need to be placed on the ps3´s flash or it simply could also placed onto the usb stick i dont have told you to much of it.
The version.txt is located in dev_flash/vsh/etc/ and reflect a Dex (dev) console.Also for that i dont know if dex can be used or if dec will give mor compatiblity.
THX to Eikii and daxtsu for the input.I will repack all rco´s with compresion header and double check the xml´s for any error on maybe my site.
It also can be that we have to leav the xml block code and only activate the flags in the xreg.
For all others NO it isnt a install able cfw.Its more identicall to the CFW loader for the psp and the unhackable psp boards.With the USB Firm Loader you can load hacked/modifyed ps3 fw files into the ram in case it will rederict every flash related calling to the usb stick.You still need a JB and you still need to load the cfw with USB Firm Loader every time you boot your ps3.
But the goal is to activate options and gain mor controlle over retail ps3´s that even with a jailbreak wouldnt be possible.
If some one will provide a dump of his 3.41 FW i can start using that fw files insteed of the files from 3.15.As more dumps i can get (retail and debug) there mor i can figuer out.
And normally it should not be of interest wich fw you are.Remeber the files from usb will be redericted as files from the internal dev flash.
As long the ps3 dont use a external place for the fw version we should be able to use higher OR lower FW´s without any trouble.For now i think that the ps3 use the xRegistry.sys backup to verify if the fw would be up or downgraded.Beside the fact that on the xReg from a fesh dumped fw .pup hase a value (not a flag -value-) thats reflect a indication of the system.What "for me" tels the con after a upate to indicate the system and reset all values or flags from the xReg backup file except the fw version for sure.
PS3 downgrading problem help? - 23m ago 
Originally Posted by msr
